@wix/himalaya-cli 0.855.0 → 0.857.0

package/dist/cli.mjs

@@ -832,19 +832,120 @@ var init_source_deny = __esm({
 });
 
 // src/mobile-ux-contract.ts
-function mobileUxMarkerFindings(mobile) {
+function mobileUxDocumentBody(mobile) {
+  const comments = /<!--[\s\S]*?(?:-->|$)/g;
+  let out = "";
+  let last = 0;
+  let blankBefore = true;
+  for (const match of mobile.matchAll(comments)) {
+    const offset = match.index ?? 0;
+    const between = mobile.slice(last, offset);
+    const newline = between.lastIndexOf("\n");
+    if (newline >= 0) blankBefore = between.slice(newline + 1).trim() === "";
+    else blankBefore = blankBefore && between.trim() === "";
+    out += between;
+    const ownsTheLine = offset === 0 || mobile[offset - 1] === "\n";
+    const precedesHeading = blankBefore && mobile.startsWith("#", offset + match[0].length);
+    out += ownsTheLine || precedesHeading ? "\n" : " ";
+    last = offset + match[0].length;
+  }
+  return out + mobile.slice(last);
+}
+function mobileUxSection(text2, heading) {
+  const match = new RegExp(`(?:^|\\n)##[ \\t]+${heading}\\b[^\\n]*([\\s\\S]*?)(?=\\n##[ \\t]|$)`, "i").exec(text2);
+  return match ? match[1] : null;
+}
+function sectionTables(markdown) {
+  const lines = markdown.split("\n").map((line) => line.trim());
+  const tables = [];
+  for (let i = 1; i < lines.length; i++) {
+    if (!DELIMITER_ROW.test(lines[i])) continue;
+    const header = lines[i - 1];
+    if (!header.includes("|")) continue;
+    const table = { header: splitCells(header), data: [] };
+    let j = i + 1;
+    for (; j < lines.length; j++) {
+      const line = lines[j];
+      if (!line.includes("|")) break;
+      if (DELIMITER_ROW.test(line)) continue;
+      const cells = splitCells(line);
+      if (cells.every((cell) => cell === "")) continue;
+      table.data.push(cells);
+    }
+    tables.push(table);
+    i = j;
+  }
+  return tables;
+}
+function namesOneCta(cell) {
+  if (!cell) return false;
+  return !/[,;]|\s\/\s/.test(cell);
+}
+function declaredStates(text2) {
+  const contract = section(text2, "Screen contract");
+  if (!contract) return [];
+  const states = [];
+  for (const bullet of contract.matchAll(/^[ \t]*[-*][ \t]*[^:\n]*\bstates?[ \t]*:[ \t]*(\S.*)$/gim)) {
+    const items = bullet[1].split(/[,;/]/).map((item) => item.trim().replace(/[.:]+$/, "")).filter(Boolean);
+    if (!items.length || items.some((item) => !/^[\w][\w.\-+]*$/.test(item))) continue;
+    states.push(...items);
+  }
+  return [...new Set(states.map((state) => state.toLowerCase()))];
+}
+function primaryCtaStructureGap(text2) {
+  const acceptance = section(text2, "Implementation acceptance");
+  if (acceptance === null) return "There is no `## Implementation acceptance` section to read it from.";
+  const tables = sectionTables(acceptance).filter((table) => table.data.length > 0);
+  if (!tables.length) return "Its acceptance table has no rows.";
+  const ctaTables = tables.map((table) => ({ table, cta: table.header.findIndex((cell) => /primary\s*(?:cta|call[- ]?to[- ]?action|action)/i.test(cell)) })).filter((entry) => entry.cta >= 0);
+  if (!ctaTables.length) return "Its acceptance table has no `Primary CTA` column.";
+  const unanswered = ctaTables.flatMap(({ table, cta }) => table.data.filter((row) => !namesOneCta(row[cta] ?? "")));
+  if (unanswered.length) {
+    return `${unanswered.length} acceptance row(s) do not name exactly one primary CTA (first: ${JSON.stringify(unanswered[0][0] ?? "")}).`;
+  }
+  const data = ctaTables.flatMap(({ table }) => table.data);
+  const flat = (value) => value.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
+  const rowText = data.map((row) => flat(row.join(" ")));
+  const missing = declaredStates(text2).filter((state) => !rowText.some((row) => row.includes(flat(state))));
+  if (missing.length) return `The acceptance table has no row for the declared state(s): ${missing.join(", ")}.`;
+  return null;
+}
+function hasUnterminatedComment(mobile) {
+  let i = 0;
+  for (; ; ) {
+    const open = mobile.indexOf("<!--", i);
+    if (open < 0) return false;
+    const close = mobile.indexOf("-->", open + 4);
+    if (close < 0) return true;
+    i = close + 3;
+  }
+}
+function mobileUxMarkerFindings(mobile, renderedWidths = []) {
+  const text2 = mobileUxDocumentBody(mobile);
   const findings = [];
-  if (!/^## Implementation acceptance\b/im.test(mobile)) {
-    findings.push({ code: "missing-acceptance-matrix", message: "MOBILE-UX.md must contain the exact heading `## Implementation acceptance`." });
+  if (!/^## Implementation acceptance\b/im.test(text2)) {
+    findings.push({ code: "missing-acceptance-matrix", message: "MOBILE-UX.md must contain the heading `## Implementation acceptance` at the start of a line. Case is not checked, but use this spelling: other tooling addresses the document by it." });
   }
-  if (!/^## Evidence\b/im.test(mobile)) {
-    findings.push({ code: "missing-evidence-section", message: "MOBILE-UX.md must contain the exact heading `## Evidence`." });
+  if (!/^## Evidence\b/im.test(text2)) {
+    findings.push({ code: "missing-evidence-section", message: "MOBILE-UX.md must contain the heading `## Evidence` at the start of a line. Case is not checked, but use this spelling: other tooling addresses the document by it." });
   }
-  if (!/one primary CTA per state/i.test(mobile)) {
-    findings.push({ code: "missing-primary-cta-rule", message: "MOBILE-UX.md must include the exact phrase `one primary CTA per state`." });
+  if (!/one primary CTA per state/i.test(text2)) {
+    const gap = primaryCtaStructureGap(text2);
+    if (gap) {
+      findings.push({
+        code: "missing-primary-cta-rule",
+        message: "MOBILE-UX.md must establish one primary CTA per state: give `## Implementation acceptance` a `Primary CTA` column with a row per declared state and exactly one CTA in each cell, or keep the phrase `one primary CTA per state`. " + gap
+      });
+    }
   }
-  if (!hasWidthEvidence(mobile)) {
-    findings.push({ code: "missing-width-evidence", message: widthEvidenceMessage(mobile) });
+  if (!hasWidthEvidence(text2, renderedWidths)) {
+    findings.push({ code: "missing-width-evidence", message: widthEvidenceMessage(text2, renderedWidths) });
+  }
+  if (findings.length && hasUnterminatedComment(mobile)) {
+    return [{
+      code: "unterminated-html-comment",
+      message: "MOBILE-UX.md has an HTML comment opened with `<!--` and never closed with `-->`, so everything after it is commented out \u2014 in this check and in any renderer. Close the comment and re-run: the headings and phrases below it are not being read."
+    }];
   }
   return findings;
 }
@@ -886,13 +987,33 @@ function closestWidthPair(mentions) {
   }
   return best;
 }
-function hasWidthEvidence(mobile) {
+function recordedWidthSpan(widths) {
+  const compact = widths.find((width) => inRange(width) && width <= COMPACT_MAX);
+  const wider = widths.find((width) => inRange(width) && width >= WIDER_MIN);
+  return compact !== void 0 && wider !== void 0 ? { compact, wider } : null;
+}
+function hasWidthEvidence(mobile, renderedWidths) {
+  if (recordedWidthSpan(renderedWidths)) return true;
   if (WIDTH_LITERAL.test(mobile)) return true;
   const pair = closestWidthPair(widthMentions(mobile));
   return pair !== null && pair.gap <= WIDTH_WINDOW;
 }
-function widthEvidenceMessage(mobile) {
-  const base = `MOBILE-UX.md has no width evidence. Record the widths you actually rendered \u2014 one at most ${COMPACT_MAX}px (compact) and one at least ${WIDER_MIN}px (medium or expanded), within ~${WIDTH_WINDOW} characters of each other so they read as one statement. A number counts only where it is spelled as a width on itself: a unit (\`320px\`, \`320 pt\`, \`320 dp\`, \`320 pixels\`, \`320 wide\`) or a screenshot filename (\`home-320.png\`). For example: \`Rendered 320px and 834px (home-320.png, home-834.png)\`. The scaffold's \`compact (320/360) \u2026 expanded\` sentence is still accepted as-is.`;
+function recordedRenderNote(renderedWidths) {
+  if (renderedWidths.length === 0) return "";
+  const list = (values) => {
+    const unique = [...new Set(values)].sort((a, b) => a - b);
+    const shown2 = unique.slice(0, 6).map((width) => `${width}px`).join(", ");
+    return unique.length > 6 ? `${shown2}, \u2026` : shown2;
+  };
+  const plausible = renderedWidths.filter(inRange);
+  const held = `The render record in \`${UX_EVIDENCE_PATH}\` holds`;
+  if (plausible.length === 0) {
+    return ` ${held} ${list(renderedWidths)}, and none of those is a plausible viewport (${PLAUSIBLE_WIDTH.min}-${PLAUSIBLE_WIDTH.max}px), so the record proves nothing about a size class.`;
+  }
+  return ` ${held} ${list(plausible)} \u2014 ` + (plausible.some((width) => width <= COMPACT_MAX) ? `compact only. Render the same screen again at ${WIDER_MIN}px or wider \u2014 \`himi render <screenId> --device ipad\`.` : `wider than compact only. Render the same screen again at ${COMPACT_MAX}px or less \u2014 \`himi render <screenId> --device iphone\`.`);
+}
+function widthEvidenceMessage(mobile, renderedWidths) {
+  const base = `MOBILE-UX.md has no width evidence. The shortest way to supply it is to RENDER: \`himi render <screenId> --content <dir> --device iphone\` and again \`--device ipad\` (or any two \`--width\`s spanning the bands below) write the widths they rendered into \`${UX_EVIDENCE_PATH}\`, and a recorded compact render plus a wider one satisfy this marker with no prose at all. Otherwise write the widths you actually rendered into this document \u2014 one at most ${COMPACT_MAX}px (compact) and one at least ${WIDER_MIN}px (medium or expanded), within ~${WIDTH_WINDOW} characters of each other so they read as one statement. A number counts only where it is spelled as a width on itself: a unit (\`320px\`, \`320 pt\`, \`320 dp\`, \`320 pixels\`, \`320 wide\`) or a screenshot filename (\`home-320.png\`). For example: \`Rendered 320px and 834px (home-320.png, home-834.png)\`. The scaffold's \`compact (320/360) \u2026 expanded\` sentence is still accepted as-is.` + recordedRenderNote(renderedWidths);
   if (/compact \(320\/360\)/i.test(mobile)) {
     return base + " `compact (320/360)` is present, but no `expanded` follows it within ~400 characters \u2014 keep them in the same sentence.";
   }
@@ -911,9 +1032,10 @@ function widthEvidenceMessage(mobile) {
   }
   return base;
 }
-var SPEC_TEMPLATE, MOBILE_UX_TEMPLATE, WIDTH_LITERAL, COMPACT_MAX, WIDER_MIN, PLAUSIBLE_WIDTH, YEAR, inRange, looksLikeYear, UNIT_ATTACHED, UNIT_WORD_ATTACHED, WIDTH_WINDOW, EDGE_WINDOW, FILENAME_AFTER, ANTI_CUE_BEFORE, PAIR_HEIGHT_BEFORE, ANTI_CUE_AFTER, isCompact, isWider;
+var UX_EVIDENCE_PATH, SPEC_TEMPLATE, MOBILE_UX_MARKER_NOTE, MOBILE_UX_TEMPLATE, section, DELIMITER_ROW, splitCells, WIDTH_LITERAL, COMPACT_MAX, WIDER_MIN, PLAUSIBLE_WIDTH, YEAR, inRange, looksLikeYear, UNIT_ATTACHED, UNIT_WORD_ATTACHED, WIDTH_WINDOW, EDGE_WINDOW, FILENAME_AFTER, ANTI_CUE_BEFORE, PAIR_HEIGHT_BEFORE, ANTI_CUE_AFTER, isCompact, isWider;
 var init_mobile_ux_contract = __esm({
   "src/mobile-ux-contract.ts"() {
+    UX_EVIDENCE_PATH = ".himi/ux-audit.json";
     SPEC_TEMPLATE = `# App specification
 
 ## User and outcome
@@ -938,8 +1060,37 @@ var init_mobile_ux_contract = __esm({
 - Required: iOS, Android
 - Optional: web, desktop, watch, widgets
 `;
+    MOBILE_UX_MARKER_NOTE = `<!-- LOAD-BEARING \u2014 read this before you rewrite the file.
+
+     \`himi validate\` warns, and \`himi validate --strict\` / \`himi ux audit --strict\` REFUSE, a
+     MOBILE-UX.md that satisfies none of the forms below. Everything else here is yours to
+     replace freely. This comment is not itself an answer: HTML comments are stripped before the
+     check runs, so keeping it satisfies nothing.
+
+       1. The headings \`## Implementation acceptance\` and \`## Evidence\`, each at the start of
+          a line. Case is not checked; use these spellings anyway, because other tooling
+          addresses this document by them.
+       2. One primary CTA per state \u2014 EITHER the phrase \`one primary CTA per state\`, OR a
+          \`Primary CTA\` column in the acceptance table below, with a row for every state you
+          declare under \`## Screen contract\` and exactly one CTA named in each row's cell.
+       3. Width evidence \u2014 EITHER a RECORDED RENDER, which is the shortest way and needs no prose
+          at all: \`himi render <screenId> --device iphone\` and again \`--device ipad\` each append
+          the width they rendered to \`.himi/ux-audit.json\`, and one below 600px plus one at 600px
+          or wider satisfies this on their own. OR the scaffold's own sentence,
+          \`compact (320/360)\` followed by
+          \`expanded\`, OR two widths you actually rendered, EACH SPELLED AS A WIDTH ON ITSELF:
+          one below 600px and one at 600px or wider, within about 400 characters of each other.
+          A number is spelled as a width when it carries a unit (\`320px\`, \`834 pt\`,
+          \`320 pixels\`, \`320 wide\`) or sits in a screenshot filename (\`home-320.png\`,
+          \`home-390x844.png\`). Nothing is read from the words around the number, so a BARE
+          figure never counts however you label it \u2014 \`Widths: 320, 390, 834\` and
+          \`compact (320) and expanded (834)\` both name no width. One unit per number fixes it.
+
+     Full contract: \`himi docs mobile-ux\` -> "Strict audit contract". -->`;
     MOBILE_UX_TEMPLATE = `# Mobile UX
 
+${MOBILE_UX_MARKER_NOTE}
+
 ## Flows
 ### <Task>
 1. Entry:
@@ -982,6 +1133,9 @@ in preview fixtures or labelled, capability-limited fallback states\u2014not ord
 > Keep this document safe to publish with a release: do not include credentials, personal data,
 > internal URLs, private research, or unreviewed notes. Read \`himi docs mobile-ux\` before filling it in.
 `;
+    section = mobileUxSection;
+    DELIMITER_ROW = /^\|?\s*:?-+:?\s*(?:\|\s*:?-+:?\s*)+\|?$/;
+    splitCells = (line) => line.replace(/^\|/, "").replace(/\|\s*$/, "").split("|").map((cell) => cell.trim());
     WIDTH_LITERAL = /compact \(320\/360\)[\s\S]{0,400}?expanded/i;
     COMPACT_MAX = 599;
     WIDER_MIN = 600;
@@ -2083,7 +2237,7 @@ async function mintToken(args, label2, cacheKey, spawnImpl) {
     tokenCache.set(cacheKey, fromEnv);
     return fromEnv;
   }
-  const token = await new Promise((resolve41, reject) => {
+  const token = await new Promise((resolve42, reject) => {
     let child;
     try {
       child = spawnImpl("wix", [...args]);
@@ -2112,12 +2266,12 @@ async function mintToken(args, label2, cacheKey, spawnImpl) {
     child.stdout?.on("data", (d) => {
       out += String(d);
       const m = out.match(TOKEN_RE);
-      if (m) done(() => resolve41(m[0]));
+      if (m) done(() => resolve42(m[0]));
     });
     child.stderr?.on("data", (d) => {
       out += String(d);
       const m = out.match(TOKEN_RE);
-      if (m) done(() => resolve41(m[0]));
+      if (m) done(() => resolve42(m[0]));
     });
     child.on("error", (e) => done(() => reject(new Error(mintHelp(label2, e.message)))));
     child.on("exit", (code) => done(() => reject(new Error(
@@ -2298,8 +2452,8 @@ function committedProvisioningPath(name) {
 function committedShellFor(path) {
   const normalized = path.replace(/\\/g, "/");
   return SHELL_NAMES2.find((name) => {
-    const relative7 = committedProvisioningPath(name);
-    return normalized === relative7 || normalized.endsWith(`/${relative7}`);
+    const relative8 = committedProvisioningPath(name);
+    return normalized === relative8 || normalized.endsWith(`/${relative8}`);
   });
 }
 function isBrandable(repoRoot2, name) {
@@ -4729,7 +4883,6 @@ function resolveTranslation(value, catalog, sourceCatalog) {
 var BINDING_SIGILS, BINDING_SIGIL_RE, TRANSLATION_PREFIX, TRANSLATION_KEY_RE;
 var init_bindings = __esm({
   "../../core/ts/src/bindings.ts"() {
-    "use strict";
     BINDING_SIGILS = ["service", "flag", "item", "t"];
     BINDING_SIGIL_RE = new RegExp(
       `^\\$(?:${BINDING_SIGILS.filter((s) => s !== "t").join("|")})\\b|^\\$t:`
@@ -6606,7 +6759,7 @@ function validateWorkerAction(action, context) {
     }
   }
   if (context.actionCatalogWithheld) {
-    return actionIssue(action, "warning", `worker actionId "${action.actionId}" was not cross-checked: this surface has precomputed service state but no precomputed action catalog`);
+    return actionIssue(action, "warning", `worker actionId "${action.actionId}" was not cross-checked: this surface has precomputed service state but no precomputed action catalog. This is a property of the surface doing the checking, not of your app \u2014 there is nothing to fix in the content package; re-run the check where the bundle can be inspected (\`himi validate\` / \`himi test\` locally) to have it cross-checked`);
   }
   const reason = context.bundleInspectionError ? `the bound bundle could not be inspected: ${context.bundleInspectionError}` : "no inspectable logic bundle is bound";
   return actionIssue(action, "error", `worker actionId "${action.actionId}" cannot resolve because ${reason}`);
@@ -9003,8 +9156,8 @@ Lifetime used`) : new QuickJSUseAfterFree("Lifetime not alive");
         this.dispose = () => {
           this.handle.alive && this.handle.dispose(), this.disposeResolvers();
         };
-        this.context = args.context, this.owner = args.context.runtime, this.handle = args.promiseHandle, this.settled = new Promise((resolve41) => {
-          this.onSettled = resolve41;
+        this.context = args.context, this.owner = args.context.runtime, this.handle = args.promiseHandle, this.settled = new Promise((resolve42) => {
+          this.onSettled = resolve42;
         }), this.resolveHandle = args.resolveHandle, this.rejectHandle = args.rejectHandle;
       }
       get alive() {
@@ -9368,12 +9521,12 @@ Lifetime used`) : new QuickJSUseAfterFree("Lifetime not alive");
           let vmPromise = scope.manage(this.getProp(this.global, "Promise")), vmPromiseResolve = scope.manage(this.getProp(vmPromise, "resolve"));
           return this.callFunction(vmPromiseResolve, vmPromise, promiseLikeHandle);
         });
-        return vmResolveResult.error ? Promise.resolve(vmResolveResult) : new Promise((resolve41) => {
+        return vmResolveResult.error ? Promise.resolve(vmResolveResult) : new Promise((resolve42) => {
           Scope.withScope((scope) => {
             let resolveHandle = scope.manage(this.newFunction("resolve", (value) => {
-              resolve41(this.success(value && value.dup()));
+              resolve42(this.success(value && value.dup()));
             })), rejectHandle = scope.manage(this.newFunction("reject", (error) => {
-              resolve41(this.fail(error && error.dup()));
+              resolve42(this.fail(error && error.dup()));
             })), promiseHandle = scope.manage(vmResolveResult.value), promiseThenHandle = scope.manage(this.getProp(promiseHandle, "then"));
             this.callFunction(promiseThenHandle, promiseHandle, resolveHandle, rejectHandle).unwrap().dispose();
           });
@@ -10219,13 +10372,13 @@ async function QuickJSRaw(moduleArg = {}) {
       }
       readAsync = async (url) => {
         if (isFileURI(url)) {
-          return new Promise((resolve41, reject) => {
+          return new Promise((resolve42, reject) => {
             var xhr = new XMLHttpRequest();
             xhr.open("GET", url, true);
             xhr.responseType = "arraybuffer";
             xhr.onload = () => {
               if (xhr.status == 200 || xhr.status == 0 && xhr.response) {
-                resolve41(xhr.response);
+                resolve42(xhr.response);
                 return;
               }
               reject(xhr.status);
@@ -10513,10 +10666,10 @@ async function QuickJSRaw(moduleArg = {}) {
     }
     var info = getWasmImports();
     if (Module["instantiateWasm"]) {
-      return new Promise((resolve41, reject) => {
+      return new Promise((resolve42, reject) => {
         try {
           Module["instantiateWasm"](info, (inst, mod) => {
-            resolve41(receiveInstance(inst, mod));
+            resolve42(receiveInstance(inst, mod));
           });
         } catch (e) {
           err(`Module.instantiateWasm callback failed with error: ${e}`);
@@ -10689,15 +10842,15 @@ async function QuickJSRaw(moduleArg = {}) {
       return parts;
     },
     normalize: (path) => {
-      var isAbsolute4 = PATH.isAbs(path), trailingSlash = path.slice(-1) === "/";
-      path = PATH.normalizeArray(path.split("/").filter((p) => !!p), !isAbsolute4).join("/");
-      if (!path && !isAbsolute4) {
+      var isAbsolute5 = PATH.isAbs(path), trailingSlash = path.slice(-1) === "/";
+      path = PATH.normalizeArray(path.split("/").filter((p) => !!p), !isAbsolute5).join("/");
+      if (!path && !isAbsolute5) {
         path = ".";
       }
       if (path && trailingSlash) {
         path += "/";
       }
-      return (isAbsolute4 ? "/" : "") + path;
+      return (isAbsolute5 ? "/" : "") + path;
     },
     dirname: (path) => {
       var result = PATH.splitPath(path), root = result[0], dir = result[1];
@@ -12163,12 +12316,12 @@ async function QuickJSRaw(moduleArg = {}) {
         throw new FS.ErrnoError(75);
       }
       var old_node = FS.lookupNode(old_dir, old_name);
-      var relative7 = PATH_FS.relative(old_path, new_dirname);
-      if (relative7.charAt(0) !== ".") {
+      var relative8 = PATH_FS.relative(old_path, new_dirname);
+      if (relative8.charAt(0) !== ".") {
         throw new FS.ErrnoError(28);
       }
-      relative7 = PATH_FS.relative(new_path, old_dirname);
-      if (relative7.charAt(0) !== ".") {
+      relative8 = PATH_FS.relative(new_path, old_dirname);
+      if (relative8.charAt(0) !== ".") {
         throw new FS.ErrnoError(55);
       }
       var new_node;
@@ -14577,8 +14730,8 @@ async function QuickJSRaw(moduleArg = {}) {
   if (runtimeInitialized) {
     moduleRtn = Module;
   } else {
-    moduleRtn = new Promise((resolve41, reject) => {
-      readyPromiseResolve = resolve41;
+    moduleRtn = new Promise((resolve42, reject) => {
+      readyPromiseResolve = resolve42;
       readyPromiseReject = reject;
     });
   }
@@ -15442,13 +15595,13 @@ async function QuickJSRaw3(moduleArg = {}) {
       }
       readAsync = async (url) => {
         if (isFileURI(url)) {
-          return new Promise((resolve41, reject) => {
+          return new Promise((resolve42, reject) => {
             var xhr = new XMLHttpRequest();
             xhr.open("GET", url, true);
             xhr.responseType = "arraybuffer";
             xhr.onload = () => {
               if (xhr.status == 200 || xhr.status == 0 && xhr.response) {
-                resolve41(xhr.response);
+                resolve42(xhr.response);
                 return;
               }
               reject(xhr.status);
@@ -15715,10 +15868,10 @@ async function QuickJSRaw3(moduleArg = {}) {
     }
     var info = getWasmImports();
     if (Module["instantiateWasm"]) {
-      return new Promise((resolve41, reject) => {
+      return new Promise((resolve42, reject) => {
         try {
           Module["instantiateWasm"](info, (inst, mod) => {
-            resolve41(receiveInstance(inst, mod));
+            resolve42(receiveInstance(inst, mod));
           });
         } catch (e) {
           err(`Module.instantiateWasm callback failed with error: ${e}`);
@@ -16146,8 +16299,8 @@ async function QuickJSRaw3(moduleArg = {}) {
   }, whenDone() {
     assert(Asyncify.currData, "Tried to wait for an async operation when none is in progress.");
     assert(!Asyncify.asyncPromiseHandlers, "Cannot have multiple async operations in flight at once");
-    return new Promise((resolve41, reject) => {
-      Asyncify.asyncPromiseHandlers = { resolve: resolve41, reject };
+    return new Promise((resolve42, reject) => {
+      Asyncify.asyncPromiseHandlers = { resolve: resolve42, reject };
     });
   }, allocateData() {
     var ptr = _malloc(12 + Asyncify.StackSize);
@@ -16775,8 +16928,8 @@ async function QuickJSRaw3(moduleArg = {}) {
   if (runtimeInitialized) {
     moduleRtn = Module;
   } else {
-    moduleRtn = new Promise((resolve41, reject) => {
-      readyPromiseResolve = resolve41;
+    moduleRtn = new Promise((resolve42, reject) => {
+      readyPromiseResolve = resolve42;
       readyPromiseReject = reject;
     });
   }
@@ -20469,6 +20622,101 @@ var init_wix_gateway_rules = __esm({
   }
 });
 
+// src/ux-evidence.ts
+import { existsSync as existsSync21, mkdirSync as mkdirSync10, readFileSync as readFileSync23, writeFileSync as writeFileSync9 } from "node:fs";
+import { dirname as dirname15, isAbsolute as isAbsolute2, join as join25, relative as relative3, resolve as resolve15 } from "node:path";
+function readText(path) {
+  try {
+    return existsSync21(path) ? readFileSync23(path, "utf8") : null;
+  } catch {
+    return null;
+  }
+}
+function parseEvidence(path) {
+  const raw = readText(path);
+  if (raw === null) return { evidence: null };
+  try {
+    const value = JSON.parse(raw);
+    if (value.version !== 1 || !value.platforms || typeof value.platforms !== "object") {
+      return { evidence: null, error: "must be an object with version: 1 and a platforms object" };
+    }
+    return { evidence: value };
+  } catch (error) {
+    return { evidence: null, error: `is not valid JSON: ${error.message}` };
+  }
+}
+function uxEvidencePath(content) {
+  return join25(resolve15(content), UX_EVIDENCE_PATH);
+}
+function isRenderEntry(value) {
+  if (!value || typeof value !== "object") return false;
+  const entry = value;
+  return typeof entry.screenId === "string" && entry.screenId.length > 0 && typeof entry.width === "number" && Number.isFinite(entry.width) && entry.width > 0 && typeof entry.recordedAt === "string" && entry.recordedAt.length > 0;
+}
+function renderEvidenceEntries(evidence) {
+  const raw = evidence?.renders;
+  return Array.isArray(raw) ? raw.filter(isRenderEntry) : [];
+}
+function recordedRenderWidths(content) {
+  const { evidence } = parseEvidence(uxEvidencePath(content));
+  return renderEvidenceEntries(evidence).map((entry) => entry.width);
+}
+function writeEvidence(path, evidence) {
+  mkdirSync10(dirname15(path), { recursive: true });
+  writeFileSync9(path, JSON.stringify(evidence, null, 2) + "\n");
+}
+function recordedFilePath(dir, file) {
+  const rel = relative3(dir, resolve15(file));
+  return rel && !rel.startsWith("..") && !isAbsolute2(rel) ? rel : file;
+}
+function recordRenderWidth(content, entry) {
+  try {
+    if (!entry.screenId || !Number.isFinite(entry.width) || entry.width <= 0) return null;
+    const dir = resolve15(content);
+    const path = join25(dir, UX_EVIDENCE_PATH);
+    const parsed = parseEvidence(path);
+    if (parsed.error) return null;
+    const evidence = parsed.evidence ?? { version: 1, platforms: {} };
+    const width = entry.width;
+    const written = {
+      screenId: entry.screenId,
+      width,
+      ...entry.device ? { device: entry.device } : {},
+      ...entry.file ? { file: recordedFilePath(dir, entry.file) } : {},
+      recordedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    const renders = renderEvidenceEntries(evidence);
+    const at = renders.findIndex((existing) => existing.screenId === written.screenId && existing.width === width);
+    if (at >= 0) renders[at] = written;
+    else renders.push(written);
+    evidence.renders = renders;
+    writeEvidence(path, evidence);
+    return written;
+  } catch {
+    return null;
+  }
+}
+function recordNativeAudit(content, platform, status, checks, reason) {
+  const normalizedChecks = status === "unavailable" ? [] : [...new Set(checks.map((check) => check.trim()).filter(Boolean))];
+  if (status !== "unavailable" && !normalizedChecks.length) {
+    throw new Error("--checks needs at least one comma-separated check (for example: back,keyboard,voiceover)");
+  }
+  if (status === "unavailable" && !reason?.trim()) throw new Error("--reason is required when --status unavailable");
+  const dir = resolve15(content);
+  const path = join25(dir, UX_EVIDENCE_PATH);
+  const parsed = parseEvidence(path);
+  if (parsed.error) throw new Error(`${UX_EVIDENCE_PATH} ${parsed.error}`);
+  const evidence = parsed.evidence ?? { version: 1, platforms: {} };
+  evidence.platforms[platform] = { status, checks: normalizedChecks, ...reason?.trim() ? { reason: reason.trim() } : {}, recordedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  writeEvidence(path, evidence);
+  return evidence;
+}
+var init_ux_evidence = __esm({
+  "src/ux-evidence.ts"() {
+    init_mobile_ux_contract();
+  }
+});
+
 // ../../core/sdk/capability-catalog/src/types.ts
 var init_types = __esm({
   "../../core/sdk/capability-catalog/src/types.ts"() {
@@ -21195,9 +21443,9 @@ var init_src2 = __esm({
 });
 
 // ../app-icons/plan.ts
-import { existsSync as existsSync23, readFileSync as readFileSync25, readdirSync as readdirSync12 } from "node:fs";
+import { existsSync as existsSync24, readFileSync as readFileSync26, readdirSync as readdirSync12 } from "node:fs";
 import { createHash as createHash7 } from "node:crypto";
-import { dirname as dirname16, join as join27, resolve as resolve17 } from "node:path";
+import { dirname as dirname17, join as join28, resolve as resolve18 } from "node:path";
 function stripComments(src) {
   let out = "";
   let i = 0;
@@ -21326,15 +21574,15 @@ function rotateHue(hex2, deg) {
 }
 function resolveTokensPath(app, configTs) {
   const literal = /^ {2}designTokensPath\s*:\s*["']([^"']+)["']/m.exec(stripComments(configTs))?.[1];
-  if (literal) return { path: resolve17(appDir(app), literal), source: "declared" };
-  return { path: join27(appDir(app), "tokens.json"), source: "assumed" };
+  if (literal) return { path: resolve18(appDir(app), literal), source: "declared" };
+  return { path: join28(appDir(app), "tokens.json"), source: "assumed" };
 }
 function resolveToken(app, token, tokensPathOverride) {
-  const tokensPath = tokensPathOverride ?? join27(appDir(app), "tokens.json");
-  if (!existsSync23(tokensPath)) {
+  const tokensPath = tokensPathOverride ?? join28(appDir(app), "tokens.json");
+  if (!existsSync24(tokensPath)) {
     throw new Error(`app-icons: ${app} has no tokens.json at ${tokensPath} (needed to resolve "${token}").`);
   }
-  const tokens = JSON.parse(readFileSync25(tokensPath, "utf8"));
+  const tokens = JSON.parse(readFileSync26(tokensPath, "utf8"));
   const value = tokens.colors?.[token];
   if (value === void 0) {
     throw new Error(`app-icons: ${app} references icon colour token "${token}" but tokens.json has no such color.`);
@@ -21375,8 +21623,8 @@ function iconSpec(app, configTs, id, tokensPathOverride) {
   assertIconContract(app, cfg);
   const tokens = tokensPathOverride ?? resolveTokensPath(app, configTs).path;
   if (cfg.source) {
-    const abs = resolve17(appDir(app), cfg.source);
-    if (!existsSync23(abs)) {
+    const abs = resolve18(appDir(app), cfg.source);
+    if (!existsSync24(abs)) {
       throw new Error(`app-icons: ${app} declares icon.source "${cfg.source}" but ${abs} does not exist.`);
     }
     return {
@@ -21413,17 +21661,17 @@ function iconSpec(app, configTs, id, tokensPathOverride) {
   };
 }
 function iosAssetCatalog2(app) {
-  return assetCatalogIn(join27(appDir(app), "ios"));
+  return assetCatalogIn(join28(appDir(app), "ios"));
 }
 function assetCatalogIn(platformDir) {
-  if (!existsSync23(platformDir)) return void 0;
+  if (!existsSync24(platformDir)) return void 0;
   const children = readdirSync12(platformDir).filter((c) => !c.startsWith("build")).sort();
-  const catalogs = children.map((c) => join27(platformDir, c, "Assets.xcassets")).filter(existsSync23);
+  const catalogs = children.map((c) => join28(platformDir, c, "Assets.xcassets")).filter(existsSync24);
   if (catalogs.length === 1) return catalogs[0];
   if (catalogs.length > 1) return void 0;
   const targets = [];
   for (const child of children) {
-    const dir = join27(platformDir, child);
+    const dir = join28(platformDir, child);
     let entries;
     try {
       entries = readdirSync12(dir);
@@ -21431,29 +21679,29 @@ function assetCatalogIn(platformDir) {
       continue;
     }
     if (entries.includes("Info.plist") || entries.some((e) => e.endsWith(".swift"))) {
-      targets.push(join27(dir, "Assets.xcassets"));
+      targets.push(join28(dir, "Assets.xcassets"));
     }
   }
   return targets.length === 1 ? targets[0] : void 0;
 }
 function androidResDir2(manifestPath) {
-  return join27(dirname16(manifestPath), "res");
+  return join28(dirname17(manifestPath), "res");
 }
 function androidManifestPath(app) {
-  const androidDir = join27(appDir(app), "android");
-  if (!existsSync23(androidDir)) return void 0;
-  const preferred = join27(androidDir, `${app}-app`, "src", "main", "AndroidManifest.xml");
-  if (existsSync23(preferred)) return preferred;
-  const candidates = readdirSync12(androidDir, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name.endsWith("-app")).map((d) => join27(androidDir, d.name, "src", "main", "AndroidManifest.xml")).filter(existsSync23);
+  const androidDir = join28(appDir(app), "android");
+  if (!existsSync24(androidDir)) return void 0;
+  const preferred = join28(androidDir, `${app}-app`, "src", "main", "AndroidManifest.xml");
+  if (existsSync24(preferred)) return preferred;
+  const candidates = readdirSync12(androidDir, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name.endsWith("-app")).map((d) => join28(androidDir, d.name, "src", "main", "AndroidManifest.xml")).filter(existsSync24);
   return candidates.length === 1 ? candidates[0] : void 0;
 }
 function androidOptedIn2(manifestPath) {
-  if (!manifestPath || !existsSync23(manifestPath)) return false;
-  return readFileSync25(manifestPath, "utf8").includes("@mipmap/ic_launcher");
+  if (!manifestPath || !existsSync24(manifestPath)) return false;
+  return readFileSync26(manifestPath, "utf8").includes("@mipmap/ic_launcher");
 }
 function templateIconSha256() {
   const cat = iosAssetCatalog2("_template");
-  return cat ? fileSha256(join27(cat, "AppIcon.appiconset", "icon_1024.png")) : null;
+  return cat ? fileSha256(join28(cat, "AppIcon.appiconset", "icon_1024.png")) : null;
 }
 function placeholderHashes() {
   const current = templateIconSha256();
@@ -21461,7 +21709,7 @@ function placeholderHashes() {
 }
 function fileSha256(path) {
   try {
-    return createHash7("sha256").update(readFileSync25(path)).digest("hex");
+    return createHash7("sha256").update(readFileSync26(path)).digest("hex");
   } catch {
     return null;
   }
@@ -21472,8 +21720,8 @@ function generationAllowed(app, configTs, opts = {}) {
     return { allowed: true, reason: "declares an icon block" };
   }
   const iosCat = iosAssetCatalog2(app);
-  const iosIcon = iosCat ? join27(iosCat, "AppIcon.appiconset", "icon_1024.png") : void 0;
-  if (!iosIcon || !existsSync23(iosIcon)) return { allowed: true, reason: "no icon yet" };
+  const iosIcon = iosCat ? join28(iosCat, "AppIcon.appiconset", "icon_1024.png") : void 0;
+  if (!iosIcon || !existsSync24(iosIcon)) return { allowed: true, reason: "no icon yet" };
   const hash = fileSha256(iosIcon);
   const placeholders = opts.placeholderHashes ?? placeholderHashes();
   if (app === "_template") return { allowed: true, reason: "the template itself" };
@@ -21497,8 +21745,8 @@ var init_plan2 = __esm({
 });
 
 // ../native-config/icon.ts
-import { existsSync as existsSync24, readFileSync as readFileSync26 } from "node:fs";
-import { join as join28 } from "node:path";
+import { existsSync as existsSync25, readFileSync as readFileSync27 } from "node:fs";
+import { join as join29 } from "node:path";
 function androidAdaptiveIconXml() {
   return [
     '<?xml version="1.0" encoding="utf-8"?>',
@@ -21525,8 +21773,8 @@ function androidIconArtifacts(app, configTs) {
   if (!androidOptedIn2(manifest)) return [];
   if (!generationAllowed(app, configTs).allowed) return [];
   const res = androidResDir2(manifest);
-  const foreground = join28(res, "mipmap-mdpi", "ic_launcher_foreground.png");
-  if (!existsSync24(foreground)) {
+  const foreground = join29(res, "mipmap-mdpi", "ic_launcher_foreground.png");
+  if (!existsSync25(foreground)) {
     throw new Error(
       `native-config icon: ${app} opts into @mipmap/ic_launcher but has no mipmap-*/ic_launcher_foreground.png. Run \`npm run app-icons -- ${app}\` first \u2014 the XML emitted here points at those rasters.`
     );
@@ -21535,11 +21783,11 @@ function androidIconArtifacts(app, configTs) {
   const spec = iconSpec(app, configTs, id, resolveTokensPath(app, configTs).path);
   return [
     ...ANDROID_ADAPTIVE_FILES.map((name) => ({
-      path: join28(res, "mipmap-anydpi-v26", name),
+      path: join29(res, "mipmap-anydpi-v26", name),
       content: androidAdaptiveIconXml()
     })),
     {
-      path: join28(res, "values", ANDROID_ICON_BACKGROUND_FILE),
+      path: join29(res, "values", ANDROID_ICON_BACKGROUND_FILE),
       content: androidIconBackgroundXml(spec.background)
     }
   ];
@@ -21773,8 +22021,8 @@ __export(gen_native_config_exports, {
   tvInfoPlan: () => tvInfoPlan,
   watchInfoPlan: () => watchInfoPlan
 });
-import { existsSync as existsSync25, mkdirSync as mkdirSync12, readFileSync as readFileSync27, readdirSync as readdirSync13, rmSync as rmSync3, writeFileSync as writeFileSync11 } from "node:fs";
-import { dirname as dirname17, join as join29 } from "node:path";
+import { existsSync as existsSync26, mkdirSync as mkdirSync12, readFileSync as readFileSync28, readdirSync as readdirSync13, rmSync as rmSync3, writeFileSync as writeFileSync11 } from "node:fs";
+import { dirname as dirname18, join as join30 } from "node:path";
 function parseStringArray(configTs, field) {
   const m = new RegExp(`${field}:\\s*\\[([^\\]]*)\\]`).exec(configTs);
   if (!m) return [];
@@ -21846,9 +22094,9 @@ function buildSet(capabilities, envelope = []) {
   return [...new Set([...capabilities, ...envelope].map(catalogKey))].sort();
 }
 function loadOverrides(app) {
-  const p = join29(appDir(app), "native-config.overrides.json");
-  if (!existsSync25(p)) return {};
-  return JSON.parse(readFileSync27(p, "utf8"));
+  const p = join30(appDir(app), "native-config.overrides.json");
+  if (!existsSync26(p)) return {};
+  return JSON.parse(readFileSync28(p, "utf8"));
 }
 function needsQuote(s) {
   if (s === "") return true;
@@ -21903,19 +22151,19 @@ function endText(kind, label2, indent) {
   return kind === "yaml" ? `${indent}# <<< ${label2} <<<` : `${indent}<!-- <<< ${label2} <<< -->`;
 }
 function hostAppliesDeferredWidgetActions(app) {
-  const root = join29(appDir(app), "ios");
-  if (!existsSync25(root)) return false;
+  const root = join30(appDir(app), "ios");
+  if (!existsSync26(root)) return false;
   const stack = [root];
   while (stack.length) {
     const dir = stack.pop();
     for (const entry of readdirSync13(dir, { withFileTypes: true })) {
       if (entry.name.startsWith(".") || entry.name === "GeneratedLiveActivity") continue;
-      const path = join29(dir, entry.name);
+      const path = join30(dir, entry.name);
       if (entry.isDirectory()) {
         if (entry.name.endsWith(".xcodeproj") || entry.name === "build") continue;
         stack.push(path);
       } else if (entry.name.endsWith(".swift")) {
-        if (readFileSync27(path, "utf8").includes("WidgetActionRelay.drain(")) return true;
+        if (readFileSync28(path, "utf8").includes("WidgetActionRelay.drain(")) return true;
       }
     }
   }
@@ -21937,18 +22185,18 @@ function injectBlock(text2, kind, label2, render) {
   return [...lines.slice(0, beginIdx), ...block, ...lines.slice(endIdx + 1)].join("\n");
 }
 function androidManifestPath2(app) {
-  const androidDir = join29(appDir(app), "android");
-  const preferred = join29(androidDir, `${app}-app`, "src", "main", "AndroidManifest.xml");
-  if (existsSync25(preferred)) return preferred;
-  const candidates = existsSync25(androidDir) ? readdirSync13(androidDir, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name.endsWith("-app")).map((d) => join29(androidDir, d.name, "src", "main", "AndroidManifest.xml")).filter(existsSync25) : [];
+  const androidDir = join30(appDir(app), "android");
+  const preferred = join30(androidDir, `${app}-app`, "src", "main", "AndroidManifest.xml");
+  if (existsSync26(preferred)) return preferred;
+  const candidates = existsSync26(androidDir) ? readdirSync13(androidDir, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name.endsWith("-app")).map((d) => join30(androidDir, d.name, "src", "main", "AndroidManifest.xml")).filter(existsSync26) : [];
   return candidates.length === 1 ? candidates[0] : preferred;
 }
 function automotiveAppDescPath(app) {
-  return join29(dirname17(androidManifestPath2(app)), "res", "xml", "automotive_app_desc.xml");
+  return join30(dirname18(androidManifestPath2(app)), "res", "xml", "automotive_app_desc.xml");
 }
 function applyToFile(path, kind, label2, render, check) {
-  if (!existsSync25(path)) return { path, outcome: "skipped" };
-  const before = readFileSync27(path, "utf8");
+  if (!existsSync26(path)) return { path, outcome: "skipped" };
+  const before = readFileSync28(path, "utf8");
   if (!hasMarkers(before, kind, label2)) return { path, outcome: "skipped" };
   const after = injectBlock(before, kind, label2, render);
   if (after === before) return { path, outcome: "unchanged" };
@@ -21957,15 +22205,15 @@ function applyToFile(path, kind, label2, render, check) {
   return { path, outcome: "written" };
 }
 function applyWholeFile(path, content, check) {
-  const current = existsSync25(path) ? readFileSync27(path, "utf8") : null;
+  const current = existsSync26(path) ? readFileSync28(path, "utf8") : null;
   if (current === content) return { path, outcome: "unchanged" };
   if (check) return { path, outcome: "drift" };
-  mkdirSync12(dirname17(path), { recursive: true });
+  mkdirSync12(dirname18(path), { recursive: true });
   writeFileSync11(path, content);
   return { path, outcome: "written" };
 }
 function removeWholeFile(path, check) {
-  if (!existsSync25(path)) return { path, outcome: "skipped" };
+  if (!existsSync26(path)) return { path, outcome: "skipped" };
   if (check) return { path, outcome: "drift" };
   rmSync3(path);
   return { path, outcome: "removed" };
@@ -21973,7 +22221,7 @@ function removeWholeFile(path, check) {
 function genNativeConfig(app, opts = {}) {
   const check = opts.check ?? false;
   const configPath = appConfigTs(app);
-  const configTs = existsSync25(configPath) ? readFileSync27(configPath, "utf8") : "";
+  const configTs = existsSync26(configPath) ? readFileSync28(configPath, "utf8") : "";
   const capabilities = parseStringArray(configTs, "capabilities");
   const envelope = parseStringArray(configTs, "capabilityEnvelope");
   const ids = buildSet(capabilities, envelope);
@@ -21989,7 +22237,7 @@ function genNativeConfig(app, opts = {}) {
   const carBlock = applyToFile(carManifestPath, "xml", LABEL_CAR, (i) => renderCarManifestXml(carCategory, i), check);
   assertCarBlockLanded(app, carCategory, carManifestPath, carBlock.outcome, LABEL_CAR);
   const iosYml = iosProjectYml(app);
-  const project = existsSync25(iosYml) ? readFileSync27(iosYml, "utf8") : "";
+  const project = existsSync26(iosYml) ? readFileSync28(iosYml, "utf8") : "";
   const targetManaged = hasMarkers(project, "yaml", LABEL_LIVE_TARGET);
   const embedManaged = hasMarkers(project, "yaml", LABEL_LIVE_EMBED);
   if (targetManaged !== embedManaged) throw new Error(`${app}: Live Activity target and embedding markers must be installed together`);
@@ -22043,12 +22291,12 @@ function genNativeConfig(app, opts = {}) {
     const plan = live2;
     files.push(applyToFile(iosYml, "yaml", LABEL_LIVE_TARGET, (i) => plan.target.map((line) => i + line), check));
     files.push(applyToFile(iosYml, "yaml", LABEL_LIVE_EMBED, (i) => plan.embed.map((line) => i + line), check));
-    const source = join29(dirname17(iosYml), LIVE_SOURCE_PATH);
+    const source = join30(dirname18(iosYml), LIVE_SOURCE_PATH);
     files.push(plan.source ? applyWholeFile(source, plan.source, check) : removeWholeFile(source, check));
-    const entitlements = join29(dirname17(iosYml), LIVE_ENTITLEMENTS_PATH);
+    const entitlements = join30(dirname18(iosYml), LIVE_ENTITLEMENTS_PATH);
     files.push(plan.entitlements ? applyWholeFile(entitlements, plan.entitlements, check) : removeWholeFile(entitlements, check));
   }
-  const iosSplashManaged = existsSync25(iosYml) && hasMarkers(readFileSync27(iosYml, "utf8"), "yaml", LABEL_IOS_SPLASH);
+  const iosSplashManaged = existsSync26(iosYml) && hasMarkers(readFileSync28(iosYml, "utf8"), "yaml", LABEL_IOS_SPLASH);
   const manifest = androidManifestPath2(app);
   const splash = splashPlan(app, configTs, manifest, iosSplashManaged);
   for (const artifact of splash.artifacts) files.push(applyWholeFile(artifact.path, artifact.content, check));
@@ -22136,8 +22384,8 @@ var init_app_module = __esm({
 });
 
 // ../../core/dev-server/src/loader.ts
-import { resolve as resolve18, basename as basename7, dirname as dirname18 } from "node:path";
-import { existsSync as existsSync26, readdirSync as readdirSync14, readFileSync as readFileSync28, mkdirSync as mkdirSync13 } from "node:fs";
+import { resolve as resolve19, basename as basename7, dirname as dirname19 } from "node:path";
+import { existsSync as existsSync27, readdirSync as readdirSync14, readFileSync as readFileSync29, mkdirSync as mkdirSync13 } from "node:fs";
 import { pathToFileURL as pathToFileURL5, fileURLToPath as fileURLToPath11 } from "node:url";
 function resolveWixWebAuthConfig(app) {
   const auth = app?.meta.auth;
@@ -22166,17 +22414,17 @@ function resolveWixClientId(app) {
 }
 function resolveDevEntry(name) {
   for (const base of APP_ROOTS2) {
-    const dir = resolve18(ROOT2, base, name);
-    const entry = resolve18(dir, "dev/index.ts");
-    if (existsSync26(entry)) return { entry, dir };
+    const dir = resolve19(ROOT2, base, name);
+    const entry = resolve19(dir, "dev/index.ts");
+    if (existsSync27(entry)) return { entry, dir };
   }
   return null;
 }
 async function devModuleUrl(entry, dir) {
   const hasTypeScriptLoader = process.execArgv.some((arg) => arg.includes("tsx"));
   if (!isOffRepo() && hasTypeScriptLoader) return pathToFileURL5(entry).href;
-  const out = resolve18(dir, "dist/.himi/dev.mjs");
-  mkdirSync13(dirname18(out), { recursive: true });
+  const out = resolve19(dir, "dist/.himi/dev.mjs");
+  mkdirSync13(dirname19(out), { recursive: true });
   await buildAppEntry(entry, out, {
     // Plain Node must resolve the published-style umbrella entry points for
     // both standalone and in-repo CLI content. In-repo workspace packages
@@ -22198,7 +22446,7 @@ async function importDevModule(name, entry, dir) {
 }
 function readPlatformsJson(dir) {
   try {
-    const raw = JSON.parse(readFileSync28(resolve18(dir, "platforms.json"), "utf8"));
+    const raw = JSON.parse(readFileSync29(resolve19(dir, "platforms.json"), "utf8"));
     return Object.fromEntries(
       Object.entries(raw).filter(([k, v]) => VALID_PLATFORM_KEYS2.has(k) && typeof v === "boolean")
     );
@@ -22207,17 +22455,17 @@ function readPlatformsJson(dir) {
   }
 }
 async function loadContent(dir) {
-  const absDir = resolve18(dir);
-  const entry = resolve18(absDir, "dev/index.ts");
-  if (!existsSync26(entry)) {
+  const absDir = resolve19(dir);
+  const entry = resolve19(absDir, "dev/index.ts");
+  if (!existsSync27(entry)) {
     throw new Error(`No content package at "${absDir}": expected ${entry}.`);
   }
   let name = basename7(absDir);
-  const manifestPath = resolve18(absDir, "himalaya.content.json");
-  if (existsSync26(manifestPath)) {
+  const manifestPath = resolve19(absDir, "himalaya.content.json");
+  if (existsSync27(manifestPath)) {
     let manifest;
     try {
-      manifest = JSON.parse(readFileSync28(manifestPath, "utf8"));
+      manifest = JSON.parse(readFileSync29(manifestPath, "utf8"));
     } catch (e) {
       throw new Error(`Invalid himalaya.content.json at ${manifestPath}: ${e.message}`);
     }
@@ -22243,11 +22491,11 @@ function listAvailableApps() {
   const out = [];
   const seen = /* @__PURE__ */ new Set();
   for (const base of APP_ROOTS2) {
-    const baseDir = resolve18(ROOT2, base);
-    if (!existsSync26(baseDir)) continue;
+    const baseDir = resolve19(ROOT2, base);
+    if (!existsSync27(baseDir)) continue;
     for (const name of readdirSync14(baseDir)) {
       if (name.startsWith("_") || name.startsWith(".") || seen.has(name)) continue;
-      if (existsSync26(resolve18(baseDir, name, "dev/index.ts"))) {
+      if (existsSync27(resolve19(baseDir, name, "dev/index.ts"))) {
         seen.add(name);
         out.push({ name, root: base, kind: base === "test-apps" ? "test" : "app" });
       }
@@ -22261,7 +22509,7 @@ var init_loader = __esm({
     init_app_module();
     init_preview_surfaces();
     init_build_lib();
-    ROOT2 = resolve18(fileURLToPath11(new URL("../../..", import.meta.url)));
+    ROOT2 = resolve19(fileURLToPath11(new URL("../../..", import.meta.url)));
     APP_ROOTS2 = ["apps", "test-apps"];
     VALID_PLATFORM_KEYS2 = /* @__PURE__ */ new Set([
       ...PREVIEW_SURFACES.map((s) => s.platformKey).filter((k) => k !== null),
@@ -22306,8 +22554,8 @@ var init_build_sha = __esm({
 
 // ../../core/dev-server/src/app-assets.ts
 import { createHash as createHash8 } from "node:crypto";
-import { existsSync as existsSync27, lstatSync as lstatSync3, readFileSync as readFileSync29, readdirSync as readdirSync15, realpathSync as realpathSync3, statSync as statSync6 } from "node:fs";
-import { join as join30, resolve as resolve19, sep as sep5 } from "node:path";
+import { existsSync as existsSync28, lstatSync as lstatSync3, readFileSync as readFileSync30, readdirSync as readdirSync15, realpathSync as realpathSync3, statSync as statSync5 } from "node:fs";
+import { join as join31, resolve as resolve20, sep as sep5 } from "node:path";
 function contentTypeFor(name) {
   const ext = name.includes(".") ? name.slice(name.lastIndexOf(".") + 1).toLowerCase() : "";
   return CONTENT_TYPES[ext] ?? "application/octet-stream";
@@ -22321,19 +22569,19 @@ function assetSha256(bytes2) {
 function findAssetsDir(appDir2) {
   let declared;
   try {
-    declared = JSON.parse(readFileSync29(join30(appDir2, "himalaya.content.json"), "utf8")).assets;
+    declared = JSON.parse(readFileSync30(join31(appDir2, "himalaya.content.json"), "utf8")).assets;
   } catch {
     declared = void 0;
   }
   const rel = typeof declared === "string" && declared ? declared : "assets";
-  const abs = resolve19(appDir2, rel);
-  const base = resolve19(appDir2);
+  const abs = resolve20(appDir2, rel);
+  const base = resolve20(appDir2);
   if (abs !== base && !abs.startsWith(base + sep5)) return null;
-  return existsSync27(abs) && statSync6(abs).isDirectory() ? abs : null;
+  return existsSync28(abs) && statSync5(abs).isDirectory() ? abs : null;
 }
 function readOtaOnlyPatterns(appDir2) {
   try {
-    const raw = JSON.parse(readFileSync29(join30(appDir2, "assets.json"), "utf8"));
+    const raw = JSON.parse(readFileSync30(join31(appDir2, "assets.json"), "utf8"));
     return Array.isArray(raw.otaOnly) ? raw.otaOnly.filter((p) => typeof p === "string") : [];
   } catch {
     return [];
@@ -22351,7 +22599,7 @@ function collectAssets(appDir2) {
   const walk2 = (abs, prefix) => {
     for (const entry of readdirSync15(abs, { withFileTypes: true })) {
       if (entry.name.startsWith(".")) continue;
-      const child = join30(abs, entry.name);
+      const child = join31(abs, entry.name);
       const name = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         walk2(child, name);
@@ -22360,7 +22608,7 @@ function collectAssets(appDir2) {
       if (!entry.isFile()) continue;
       const ext = name.includes(".") ? name.slice(name.lastIndexOf(".") + 1).toLowerCase() : "";
       const baked = !OTA_ONLY_BY_DEFAULT.has(ext) && !otaOnly.some((p) => matchesPattern(name, p));
-      out.push({ name, path: child, bytes: statSync6(child).size, contentType: contentTypeFor(name), baked });
+      out.push({ name, path: child, bytes: statSync5(child).size, contentType: contentTypeFor(name), baked });
     }
   };
   walk2(dir, "");
@@ -22369,7 +22617,7 @@ function collectAssets(appDir2) {
 function collectBrandFonts(appDir2) {
   let faces;
   try {
-    faces = JSON.parse(readFileSync29(join30(appDir2, "media/fonts/faces.json"), "utf8"));
+    faces = JSON.parse(readFileSync30(join31(appDir2, "media/fonts/faces.json"), "utf8"));
   } catch {
     return [];
   }
@@ -22382,7 +22630,7 @@ function collectBrandFonts(appDir2) {
     const rel = typeof raw?.file === "string" ? raw.file : "";
     if (!family || !postscriptName || !rel) continue;
     if (rel.startsWith("/") || rel.split("/").includes("..")) continue;
-    const path = join30(appDir2, rel);
+    const path = join31(appDir2, rel);
     try {
       if (!lstatSync3(path).isFile()) continue;
       const root = realpathSync3(appDir2);
@@ -22418,7 +22666,7 @@ function resolveAssetForBuild(appDir2, name, serverBaseUrl, appId2) {
   if (!hit) return null;
   let bytes2;
   try {
-    bytes2 = readFileSync29(hit.path);
+    bytes2 = readFileSync30(hit.path);
   } catch {
     return null;
   }
@@ -22492,7 +22740,7 @@ async function injectRequest(listener, request) {
   req.headers.host ??= url.host;
   if (body && body.length > 0) req.push(body);
   req.push(null);
-  return await new Promise((resolve41, reject) => {
+  return await new Promise((resolve42, reject) => {
     const streamed = () => {
       queueMicrotask(() => {
         req.emit("close");
@@ -22508,7 +22756,7 @@ async function injectRequest(listener, request) {
         else headers2.set(name, value);
       }
       const bodyless = out.status === 204 || out.status === 304 || request.method === "HEAD";
-      resolve41(new Response(bodyless ? null : out.body, { status: out.status, headers: headers2 }));
+      resolve42(new Response(bodyless ? null : out.body, { status: out.status, headers: headers2 }));
     }, streamed);
     res.on("inject-error", reject);
     try {
@@ -22611,25 +22859,25 @@ var init_inject = __esm({
 
 // ../../core/dev-server/src/store.ts
 import { mkdirSync as mkdirSync14 } from "node:fs";
-import { dirname as dirname19, resolve as resolve20 } from "node:path";
+import { dirname as dirname20, resolve as resolve21 } from "node:path";
 import { fileURLToPath as fileURLToPath12 } from "node:url";
 import { createRequire } from "node:module";
 var nodeRequire, ROOT3, Store;
 var init_store2 = __esm({
   "../../core/dev-server/src/store.ts"() {
     nodeRequire = createRequire(import.meta.url);
-    ROOT3 = resolve20(fileURLToPath12(new URL("../../..", import.meta.url)));
+    ROOT3 = resolve21(fileURLToPath12(new URL("../../..", import.meta.url)));
     Store = class {
       _db;
       dbPath;
       constructor(appName) {
-        const dataRoot = process.env.HIMALAYA_DEV_STORE_DIR ? resolve20(process.env.HIMALAYA_DEV_STORE_DIR) : resolve20(ROOT3, "core/dev-server/data");
-        this.dbPath = resolve20(dataRoot, `${appName}.sqlite`);
+        const dataRoot = process.env.HIMALAYA_DEV_STORE_DIR ? resolve21(process.env.HIMALAYA_DEV_STORE_DIR) : resolve21(ROOT3, "core/dev-server/data");
+        this.dbPath = resolve21(dataRoot, `${appName}.sqlite`);
       }
       /** The node:sqlite handle — opened, bootstrapped, and seeded on first access. */
       get db() {
         if (this._db) return this._db;
-        mkdirSync14(dirname19(this.dbPath), { recursive: true });
+        mkdirSync14(dirname20(this.dbPath), { recursive: true });
         const { DatabaseSync } = nodeRequire("node:sqlite");
         this._db = new DatabaseSync(this.dbPath, { timeout: 5e3 });
         this.bootstrap();
@@ -22968,15 +23216,15 @@ var init_store2 = __esm({
 });
 
 // ../../core/dev-server/src/derive-transport-capability.ts
-import { readFileSync as readFileSync30 } from "node:fs";
-import { resolve as resolve21 } from "node:path";
+import { readFileSync as readFileSync31 } from "node:fs";
+import { resolve as resolve22 } from "node:path";
 function bundleRidesWixTransport(bundleJs) {
   return /himalaya\.wixApi|wixApi\.call/.test(bundleJs);
 }
 function readFirst(roots, file) {
   for (const root of typeof roots === "string" ? [roots] : roots) {
     try {
-      return readFileSync30(resolve21(root, file), "utf8");
+      return readFileSync31(resolve22(root, file), "utf8");
     } catch {
     }
   }
@@ -23144,7 +23392,7 @@ var init_wix_member_login = __esm({
 });
 
 // ../../core/dev-server/src/wix-gateway.ts
-import { readFileSync as readFileSync31, existsSync as existsSync28 } from "node:fs";
+import { readFileSync as readFileSync32, existsSync as existsSync29 } from "node:fs";
 function redactJsonValue(v) {
   if (Array.isArray(v)) return v.map(redactJsonValue);
   if (v && typeof v === "object") {
@@ -23183,8 +23431,8 @@ function resolveNetMocks(fileMocks, appDeclared) {
 }
 function readNetMocksFile(path) {
   try {
-    if (!existsSync28(path)) return null;
-    const raw = JSON.parse(readFileSync31(path, "utf-8"));
+    if (!existsSync29(path)) return null;
+    const raw = JSON.parse(readFileSync32(path, "utf-8"));
     if (Array.isArray(raw)) return wixMockRuleErrors(raw).length ? null : { rules: raw };
     if (raw && typeof raw === "object") {
       const o = raw;
@@ -23984,13 +24232,13 @@ var init_l10n_catalog = __esm({
 });
 
 // ../../core/dev-server/src/l10n.ts
-import { readFileSync as readFileSync32, existsSync as existsSync29 } from "node:fs";
-import { resolve as resolve22 } from "node:path";
+import { readFileSync as readFileSync33, existsSync as existsSync30 } from "node:fs";
+import { resolve as resolve23 } from "node:path";
 import { fileURLToPath as fileURLToPath13 } from "node:url";
 function loadCatalog2(tag) {
   if (catalogCache.has(tag)) return catalogCache.get(tag);
-  const path = resolve22(ROOT4, `tools/l10n/catalog.${tag}.json`);
-  const map = existsSync29(path) ? sourceMap(parseCatalog(readFileSync32(path, "utf8"))) : /* @__PURE__ */ new Map();
+  const path = resolve23(ROOT4, `tools/l10n/catalog.${tag}.json`);
+  const map = existsSync30(path) ? sourceMap(parseCatalog(readFileSync33(path, "utf8"))) : /* @__PURE__ */ new Map();
   catalogCache.set(tag, map);
   return map;
 }
@@ -23999,8 +24247,8 @@ function pickLocale(acceptLanguage) {
   const tags = acceptLanguage.split(",").map((s) => s.split(";")[0].trim().toLowerCase()).map((s) => s.split("-")[0]).filter((s) => s.length > 0);
   for (const tag of tags) {
     if (tag === "en") continue;
-    const path = resolve22(ROOT4, `tools/l10n/catalog.${tag}.json`);
-    if (existsSync29(path)) return tag;
+    const path = resolve23(ROOT4, `tools/l10n/catalog.${tag}.json`);
+    if (existsSync30(path)) return tag;
   }
   return null;
 }
@@ -24056,7 +24304,7 @@ var init_l10n = __esm({
   "../../core/dev-server/src/l10n.ts"() {
     init_l10n_strings();
     init_l10n_catalog();
-    ROOT4 = resolve22(fileURLToPath13(new URL("../../..", import.meta.url)));
+    ROOT4 = resolve23(fileURLToPath13(new URL("../../..", import.meta.url)));
     catalogCache = /* @__PURE__ */ new Map();
   }
 });
@@ -24120,13 +24368,13 @@ var init_stable_ids = __esm({
 // ../../core/dev-server/src/preview.ts
 import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash11 } from "node:crypto";
-import { existsSync as existsSync30, createReadStream, statSync as statSync7, readFileSync as readFileSync33, renameSync, unlinkSync as unlinkSync2 } from "node:fs";
+import { existsSync as existsSync31, createReadStream, statSync as statSync6, readFileSync as readFileSync34, renameSync, unlinkSync as unlinkSync2 } from "node:fs";
 import { homedir as homedir5, tmpdir as tmpdir2 } from "node:os";
-import { resolve as resolvePath, dirname as dirname20 } from "node:path";
+import { resolve as resolvePath, dirname as dirname21 } from "node:path";
 import { fileURLToPath as fileURLToPath14 } from "node:url";
 function firstExisting(paths) {
   for (const p of paths) {
-    if (p && existsSync30(p)) return p;
+    if (p && existsSync31(p)) return p;
   }
   return null;
 }
@@ -24135,7 +24383,7 @@ function macosWinlistBin() {
 }
 function macosWinlistSourceHash() {
   try {
-    return createHash11("sha1").update(readFileSync33(MACOS_WINLIST)).digest("hex").slice(0, 12);
+    return createHash11("sha1").update(readFileSync34(MACOS_WINLIST)).digest("hex").slice(0, 12);
   } catch {
     return "missing";
   }
@@ -24165,7 +24413,7 @@ function isHimalayaAppWindow(w) {
 }
 async function macosWinlistCommand() {
   const bin = macosWinlistBin();
-  if (existsSync30(bin)) return compiledWinlist(bin);
+  if (existsSync31(bin)) return compiledWinlist(bin);
   if (macosWinlistCompileFailed) return interpretWinlist();
   if (!macosWinlistInFlight) {
     macosWinlistInFlight = buildMacosWinlist(bin).finally(() => {
@@ -24193,7 +24441,7 @@ async function buildMacosWinlist(bin) {
       unlinkSync2(staging);
     } catch {
     }
-    return existsSync30(bin) ? compiledWinlist(bin) : interpretWinlist();
+    return existsSync31(bin) ? compiledWinlist(bin) : interpretWinlist();
   }
   return compiledWinlist(bin);
 }
@@ -24280,7 +24528,7 @@ async function captureFrame(params, format = "png") {
     const tmp = resolvePath(tmpdir2(), `himalaya-macos-preview-${windowId}-${process.pid}-${++macosCaptureSeq}.png`);
     try {
       await runner.capture(SCREENCAPTURE_BIN, ["-o", "-x", `-l${windowId}`, tmp]);
-      return { buf: readFileSync33(tmp), mime: "image/png" };
+      return { buf: readFileSync34(tmp), mime: "image/png" };
     } finally {
       try {
         unlinkSync2(tmp);
@@ -24793,12 +25041,12 @@ function finalizeRecording(key2, rec) {
   if (rec.finalize) return rec.finalize;
   rec.finalize = (async () => {
     clearTimeout(rec.autoStop);
-    await new Promise((resolve41) => {
+    await new Promise((resolve42) => {
       let done = false;
       const finish2 = () => {
         if (!done) {
           done = true;
-          resolve41();
+          resolve42();
         }
       };
       rec.child.once("close", finish2);
@@ -24818,7 +25066,7 @@ function finalizeRecording(key2, rec) {
       } catch {
       }
     }
-    const sizeBytes = existsSync30(rec.localPath) ? statSync7(rec.localPath).size : 0;
+    const sizeBytes = existsSync31(rec.localPath) ? statSync6(rec.localPath).size : 0;
     clips.set(rec.id, { path: rec.localPath, mime: rec.mime });
     recordings.delete(key2);
     return { sizeBytes };
@@ -24890,12 +25138,12 @@ async function handlePreviewClip(res, url) {
   const q = new URLSearchParams(url.split("?")[1] ?? "");
   const id = q.get("id") ?? "";
   const clip = clips.get(id);
-  if (!clip || !existsSync30(clip.path)) {
+  if (!clip || !existsSync31(clip.path)) {
     res.statusCode = 404;
     res.setHeader("content-type", "application/json");
     return void res.end(JSON.stringify({ error: "clip_not_found", id }));
   }
-  const size = statSync7(clip.path).size;
+  const size = statSync6(clip.path).size;
   res.statusCode = 200;
   res.setHeader("content-type", clip.mime);
   res.setHeader("content-length", String(size));
@@ -24909,7 +25157,7 @@ var init_preview = __esm({
     DEVICE_LIST_TIMEOUT_MS = 5e3;
     defaultRunner2 = {
       capture(cmd, args, timeoutMs = DEFAULT_CAPTURE_TIMEOUT_MS) {
-        return new Promise((resolve41, reject) => {
+        return new Promise((resolve42, reject) => {
           const child = spawn2(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
           const out = [];
           const err = [];
@@ -24931,7 +25179,7 @@ var init_preview = __esm({
           child.stderr.on("data", (b) => err.push(b));
           child.on("error", (e) => settle(reject, e));
           child.on("close", (code) => {
-            if (code === 0) settle(resolve41, Buffer.concat(out));
+            if (code === 0) settle(resolve42, Buffer.concat(out));
             else settle(reject, new Error(`${cmd} exited ${code}: ${Buffer.concat(err).toString("utf8")}`));
           });
         });
@@ -24951,7 +25199,7 @@ var init_preview = __esm({
     SWIFT_BIN = process.env.HIMALAYA_SWIFT_PATH ?? "swift";
     SWIFTC_BIN = process.env.HIMALAYA_SWIFTC_PATH ?? "swiftc";
     SCREENCAPTURE_BIN = process.env.HIMALAYA_SCREENCAPTURE_PATH ?? "screencapture";
-    MACOS_WINLIST = resolvePath(dirname20(fileURLToPath14(import.meta.url)), "../scripts/macos-winshot.swift");
+    MACOS_WINLIST = resolvePath(dirname21(fileURLToPath14(import.meta.url)), "../scripts/macos-winshot.swift");
     MACOS_WINLIST_BUILD_TIMEOUT_MS = 12e4;
     MACOS_WINLIST_INTERPRET_TIMEOUT_MS = 3e4;
     HIMALAYA_MAC_BUNDLE_ID = /^(com\.himalaya\.|com\.wix\.himi\.|dev\.himalaya\.)/i;
@@ -25008,8 +25256,8 @@ var init_tier4_integrity = __esm({
 });
 
 // ../../core/dev-server/src/tier4-verifier.ts
-import { readFileSync as readFileSync34, existsSync as existsSync31 } from "node:fs";
-import { resolve as resolve23 } from "node:path";
+import { readFileSync as readFileSync35, existsSync as existsSync32 } from "node:fs";
+import { resolve as resolve24 } from "node:path";
 var TierFourVerifier;
 var init_tier4_verifier = __esm({
   "../../core/dev-server/src/tier4-verifier.ts"() {
@@ -25025,8 +25273,8 @@ var init_tier4_verifier = __esm({
       async verifyServedFile(bundleId, relPath, providedBytes) {
         const expected = this.expectedSri(bundleId, relPath);
         if (!expected) return { ok: true };
-        const path = resolve23(this.tier4Root, bundleId, relPath);
-        const bytes2 = providedBytes ?? (existsSync31(path) ? readFileSync34(path) : null);
+        const path = resolve24(this.tier4Root, bundleId, relPath);
+        const bytes2 = providedBytes ?? (existsSync32(path) ? readFileSync35(path) : null);
         if (!bytes2) return { ok: false, reason: "file not found" };
         if (computeSri(bytes2) !== expected) return { ok: false, reason: "sri mismatch" };
         return { ok: true };
@@ -25034,9 +25282,9 @@ var init_tier4_verifier = __esm({
       bundle(bundleId) {
         let cached3 = this.cache.get(bundleId);
         if (cached3) return cached3;
-        const manifestPath = resolve23(this.tier4Root, bundleId, "manifest.json");
-        if (!existsSync31(manifestPath)) return void 0;
-        const manifest = JSON.parse(readFileSync34(manifestPath, "utf8"));
+        const manifestPath = resolve24(this.tier4Root, bundleId, "manifest.json");
+        if (!existsSync32(manifestPath)) return void 0;
+        const manifest = JSON.parse(readFileSync35(manifestPath, "utf8"));
         cached3 = { integrity: parseManifestIntegrity(manifest) };
         this.cache.set(bundleId, cached3);
         return cached3;
@@ -35616,7 +35864,7 @@ async function stabilizePngPage(page, scheme) {
     const browser = globalThis;
     browser.document.documentElement.style.colorScheme = selected;
     await browser.document.fonts?.ready;
-    await new Promise((resolve41) => browser.requestAnimationFrame(() => browser.requestAnimationFrame(() => resolve41())));
+    await new Promise((resolve42) => browser.requestAnimationFrame(() => browser.requestAnimationFrame(() => resolve42())));
   }, scheme);
 }
 async function renderPngBatch(items) {
@@ -36560,8 +36808,8 @@ var init_src5 = __esm({
 });
 
 // ../../core/dev-server/src/flags/index.ts
-import { readFileSync as readFileSync35 } from "node:fs";
-import { resolve as resolve24 } from "node:path";
+import { readFileSync as readFileSync36 } from "node:fs";
+import { resolve as resolve25 } from "node:path";
 function selectProvider(config, store) {
   const local = new LocalFlagProvider(store, () => config?.overrides);
   if (!config || config.provider === "local") return local;
@@ -36656,7 +36904,7 @@ var init_flags2 = __esm({
         if (now - this.lastFetch < this.ttlMs) return;
         this.lastFetch = now;
         try {
-          const defs = JSON.parse(readFileSync35(resolve24(appDir2, "flags.json"), "utf8"));
+          const defs = JSON.parse(readFileSync36(resolve25(appDir2, "flags.json"), "utf8"));
           if (Array.isArray(defs) && defs.length > 0) store.replaceAll(defs);
         } catch {
         }
@@ -36706,19 +36954,19 @@ var init_motion_flags = __esm({
 });
 
 // ../../core/dev-server/src/kits.ts
-import { readdirSync as readdirSync16, readFileSync as readFileSync36 } from "node:fs";
-import { resolve as resolve25, join as join31 } from "node:path";
+import { readdirSync as readdirSync16, readFileSync as readFileSync37 } from "node:fs";
+import { resolve as resolve26, join as join32 } from "node:path";
 import { fileURLToPath as fileURLToPath15 } from "node:url";
 function listKits() {
   return readdirSync16(CATALOG).filter((f) => f.endsWith(".json")).map((f) => {
-    const { tokens, ...meta } = JSON.parse(readFileSync36(join31(CATALOG, f), "utf8"));
+    const { tokens, ...meta } = JSON.parse(readFileSync37(join32(CATALOG, f), "utf8"));
     return meta;
   });
 }
 function readKit(id) {
   if (!/^[a-z0-9-]+$/.test(id)) return null;
   try {
-    return JSON.parse(readFileSync36(join31(CATALOG, `${id}.json`), "utf8"));
+    return JSON.parse(readFileSync37(join32(CATALOG, `${id}.json`), "utf8"));
   } catch {
     return null;
   }
@@ -36726,8 +36974,8 @@ function readKit(id) {
 var ROOT5, CATALOG;
 var init_kits = __esm({
   "../../core/dev-server/src/kits.ts"() {
-    ROOT5 = resolve25(fileURLToPath15(new URL("../../..", import.meta.url)));
-    CATALOG = join31(ROOT5, "stdlib/design-kits");
+    ROOT5 = resolve26(fileURLToPath15(new URL("../../..", import.meta.url)));
+    CATALOG = join32(ROOT5, "stdlib/design-kits");
   }
 });
 
@@ -37095,12 +37343,12 @@ __export(validate_descriptor_exports, {
   validateScreenDescriptor: () => validateScreenDescriptor,
   workerSubtreeAllowed: () => workerSubtreeAllowed
 });
-import { readFileSync as readFileSync37, existsSync as existsSync32, readdirSync as readdirSync17 } from "node:fs";
-import { resolve as resolve26 } from "node:path";
+import { readFileSync as readFileSync38, existsSync as existsSync33, readdirSync as readdirSync17 } from "node:fs";
+import { resolve as resolve27 } from "node:path";
 import { runInNewContext as runInNewContext2 } from "node:vm";
 async function loadAllowedComponents(appDir2) {
-  const modPath = resolve26(appDir2, "components.ts");
-  if (!existsSync32(modPath)) return void 0;
+  const modPath = resolve27(appDir2, "components.ts");
+  if (!existsSync33(modPath)) return void 0;
   try {
     const { pathToFileURL: pathToFileURL8 } = await import("node:url");
     const mod = await import(pathToFileURL8(modPath).href);
@@ -37112,8 +37360,8 @@ async function loadAllowedComponents(appDir2) {
   return void 0;
 }
 function readBuiltBundle(tier5Root, bundleName) {
-  const p = resolve26(tier5Root, `${bundleName}.bundle.js`);
-  return existsSync32(p) ? readFileSync37(p, "utf8") : void 0;
+  const p = resolve27(tier5Root, `${bundleName}.bundle.js`);
+  return existsSync33(p) ? readFileSync38(p, "utf8") : void 0;
 }
 function bundleNameFromUrl(url) {
   if (typeof url !== "string") return null;
@@ -37140,11 +37388,11 @@ function appWorkerActionsFor(config, tier5Root) {
   }
 }
 function readBuiltBundleMap(tier5Root, bundleName) {
-  const p = resolve26(tier5Root, `${bundleName}.bundle.js.map`);
-  return existsSync32(p) ? readFileSync37(p, "utf8") : void 0;
+  const p = resolve27(tier5Root, `${bundleName}.bundle.js.map`);
+  return existsSync33(p) ? readFileSync38(p, "utf8") : void 0;
 }
 function nativeSourceFiles(directory, extension, buildDirMaxDepth, depth = 1) {
-  if (!existsSync32(directory)) return [];
+  if (!existsSync33(directory)) return [];
   let entries;
   try {
     entries = readdirSync17(directory, { withFileTypes: true });
@@ -37155,7 +37403,7 @@ function nativeSourceFiles(directory, extension, buildDirMaxDepth, depth = 1) {
   return entries.flatMap((entry) => {
     if (NATIVE_SCRATCH_DIRS.has(entry.name)) return [];
     if (entry.name === BUILD_OUTPUT_DIR && depth <= buildDirMaxDepth) return [];
-    const path = resolve26(directory, entry.name);
+    const path = resolve27(directory, entry.name);
     if (entry.isDirectory()) return nativeSourceFiles(path, extension, buildDirMaxDepth, depth + 1);
     return entry.name.endsWith(extension) ? [path] : [];
   });
@@ -37164,12 +37412,12 @@ function registeredActions(source) {
   return [...source.matchAll(/ActionDispatcher(?:\.shared)?\s*\.\s*register\s*\(\s*"([A-Za-z0-9_.]+)"/g)].map((match) => match[1]);
 }
 function discoverNativeActions(appDir2) {
-  const roots = NATIVE_SOURCE_ROOTS.filter(({ directory }) => existsSync32(resolve26(appDir2, directory)));
-  const sources = roots.flatMap(({ directory, extension, buildDirMaxDepth }) => nativeSourceFiles(resolve26(appDir2, directory), extension, buildDirMaxDepth));
+  const roots = NATIVE_SOURCE_ROOTS.filter(({ directory }) => existsSync33(resolve27(appDir2, directory)));
+  const sources = roots.flatMap(({ directory, extension, buildDirMaxDepth }) => nativeSourceFiles(resolve27(appDir2, directory), extension, buildDirMaxDepth));
   const registered = sources.flatMap((source) => {
     let text2;
     try {
-      text2 = readFileSync37(source, "utf8");
+      text2 = readFileSync38(source, "utf8");
     } catch (err) {
       if (!vanished(err)) throw err;
       return [];
@@ -37285,8 +37533,8 @@ __export(config_exports, {
   serializeRolloutYaml: () => serializeRolloutYaml,
   validateOverlayPatch: () => validateOverlayPatch
 });
-import { mkdirSync as mkdirSync15, readFileSync as readFileSync38, writeFileSync as writeFileSync12 } from "node:fs";
-import { dirname as dirname21, join as join32, resolve as resolve27 } from "node:path";
+import { mkdirSync as mkdirSync15, readFileSync as readFileSync39, writeFileSync as writeFileSync12 } from "node:fs";
+import { dirname as dirname22, join as join33, resolve as resolve28 } from "node:path";
 import { fileURLToPath as fileURLToPath16 } from "node:url";
 function strip(line) {
   const h = line.indexOf("#");
@@ -37351,14 +37599,14 @@ function parseRevocationsYaml(text2) {
 function appConfigPath(app, file, root = REPO_ROOT6) {
   assertAppId(app, "appConfigPath");
   for (const base of ["apps", "test-apps"]) {
-    const p = join32(root, base, app, file);
+    const p = join33(root, base, app, file);
     try {
-      readFileSync38(p);
+      readFileSync39(p);
       return p;
     } catch {
     }
   }
-  return join32(root, "apps", app, file);
+  return join33(root, "apps", app, file);
 }
 function serializeRolloutYaml(cfg) {
   const lines = [`app: ${cfg.app}`, "rings:"];
@@ -37393,14 +37641,14 @@ function validateOverlayPatch(patch) {
 }
 function readJsonAt(app, file, root) {
   try {
-    return JSON.parse(readFileSync38(appConfigPath(app, file, root), "utf8"));
+    return JSON.parse(readFileSync39(appConfigPath(app, file, root), "utf8"));
   } catch {
     return null;
   }
 }
 function writeJsonAt(app, file, root, value) {
   const path = appConfigPath(app, file, root);
-  mkdirSync15(dirname21(path), { recursive: true });
+  mkdirSync15(dirname22(path), { recursive: true });
   writeFileSync12(path, JSON.stringify(value, null, 2) + "\n");
   return path;
 }
@@ -37423,14 +37671,14 @@ function saveLocalFlags(app, defs, root = REPO_ROOT6) {
 }
 function loadRollout(app) {
   try {
-    return parseRolloutYaml(readFileSync38(appConfigPath(app, "rollout.yaml"), "utf8"));
+    return parseRolloutYaml(readFileSync39(appConfigPath(app, "rollout.yaml"), "utf8"));
   } catch {
     return null;
   }
 }
 function loadRevocations(app) {
   try {
-    return parseRevocationsYaml(readFileSync38(appConfigPath(app, "revocations.yaml"), "utf8")).revoked;
+    return parseRevocationsYaml(readFileSync39(appConfigPath(app, "revocations.yaml"), "utf8")).revoked;
   } catch {
     return [];
   }
@@ -37440,7 +37688,7 @@ var init_config2 = __esm({
   "../../core/serve-control/src/config.ts"() {
     init_errors();
     init_contract();
-    REPO_ROOT6 = resolve27(dirname21(fileURLToPath16(import.meta.url)), "../../..");
+    REPO_ROOT6 = resolve28(dirname22(fileURLToPath16(import.meta.url)), "../../..");
     OPERATIONAL_OVERLAY_KEYS = /* @__PURE__ */ new Set([
       "wixCachePolicy",
       "telemetryConfig",
@@ -37501,8 +37749,8 @@ var init_config2 = __esm({
 // ../../core/dev-server/src/index.ts
 import { createServer as createServer2 } from "node:http";
 import { readFile as readFile2, stat } from "node:fs/promises";
-import { readFileSync as readFileSync39, existsSync as existsSync33, watch, mkdirSync as mkdirSync16, rmSync as rmSync4 } from "node:fs";
-import { extname, resolve as resolve28, normalize as normalize3, sep as sep6, join as join33 } from "node:path";
+import { readFileSync as readFileSync40, existsSync as existsSync34, watch, mkdirSync as mkdirSync16, rmSync as rmSync4 } from "node:fs";
+import { extname, resolve as resolve29, normalize as normalize3, sep as sep6, join as join34 } from "node:path";
 import { createHash as createHash15, randomUUID } from "node:crypto";
 import { fileURLToPath as fileURLToPath17, pathToFileURL as pathToFileURL6 } from "node:url";
 function deepMerge2(base, patch) {
@@ -37551,8 +37799,8 @@ function makeEtag(body) {
 function readAppTokens(state) {
   if (!state.app) return null;
   try {
-    const tokenPath = state.app.module.designTokensPath ?? resolve28(state.app.dir, state.app.module.config.designTokensPath ?? "tokens.json");
-    const parsed = JSON.parse(readFileSync39(tokenPath, "utf8"));
+    const tokenPath = state.app.module.designTokensPath ?? resolve29(state.app.dir, state.app.module.config.designTokensPath ?? "tokens.json");
+    const parsed = JSON.parse(readFileSync40(tokenPath, "utf8"));
     delete parsed._meta;
     return parsed;
   } catch {
@@ -37564,7 +37812,7 @@ function effectiveAppConfigOverride(state) {
   if (state.app) {
     try {
       gitOverlay = JSON.parse(
-        readFileSync39(resolve28(state.app.dir, "app-config.overlay.json"), "utf8")
+        readFileSync40(resolve29(state.app.dir, "app-config.overlay.json"), "utf8")
       );
     } catch {
     }
@@ -37620,8 +37868,8 @@ function handleL10nRequest(req, res, state) {
   if (!state.app || app !== state.app.name) {
     return sendJson(res, 404, { error: "unknown_app", app }, cors);
   }
-  const path = resolve28(state.app.dir, "l10n", `${tag}.json`);
-  if (!existsSync33(path)) {
+  const path = resolve29(state.app.dir, "l10n", `${tag}.json`);
+  if (!existsSync34(path)) {
     res.writeHead(204, cors);
     res.end();
     return;
@@ -37630,7 +37878,7 @@ function handleL10nRequest(req, res, state) {
   let messages;
   try {
     messages = Object.fromEntries(
-      keyMap(parseCatalog(readFileSync39(path, "utf8")), { sourceFallback: tag === sourceLocale })
+      keyMap(parseCatalog(readFileSync40(path, "utf8")), { sourceFallback: tag === sourceLocale })
     );
   } catch {
     return sendJson(res, 500, { error: "catalog_unreadable", app, tag }, cors);
@@ -37677,8 +37925,8 @@ async function runScreenDiagnostics(state, screenId, descriptor) {
 }
 function servedFontFaces(appDir2, tokens) {
   try {
-    const policyPath = join33(appDir2, "fonts.json");
-    const policy = existsSync33(policyPath) ? JSON.parse(readFileSync39(policyPath, "utf8")) : {};
+    const policyPath = join34(appDir2, "fonts.json");
+    const policy = existsSync34(policyPath) ? JSON.parse(readFileSync40(policyPath, "utf8")) : {};
     const plan = planFonts(tokens, policy);
     if (plan.families.length === 0) return void 0;
     return servedProjection(plan);
@@ -37693,7 +37941,7 @@ function fontFaceBytesBySha(_appDir, sha) {
       for (const face of family.faces) {
         if (face.sha256 !== sha) continue;
         const src = faceSource(face.file, face.sha256);
-        if (src) return readFileSync39(src);
+        if (src) return readFileSync40(src);
       }
     }
   } catch {
@@ -38040,7 +38288,7 @@ async function buildDescriptorForScreenId(state, screenId, query = new URLSearch
 function bundleIntegritySync(name, dir) {
   for (const root of dir ? [dir, TIER5_ROOT] : [TIER5_ROOT]) {
     try {
-      const bytes2 = readFileSync39(resolve28(root, `${name}.bundle.js`));
+      const bytes2 = readFileSync40(resolve29(root, `${name}.bundle.js`));
       return "sha256-" + createHash15("sha256").update(bytes2).digest("base64");
     } catch {
     }
@@ -38290,7 +38538,7 @@ function startBundleArtifactWatcher(state) {
   }
 }
 async function rebuildBundleSource(name) {
-  const lib = await import(pathToFileURL6(resolve28(TIER5_SRC_ROOT, "build-lib.mjs")).href);
+  const lib = await import(pathToFileURL6(resolve29(TIER5_SRC_ROOT, "build-lib.mjs")).href);
   await lib.buildBundle(name);
 }
 function startBundleSourceWatcher(state) {
@@ -38345,11 +38593,11 @@ function applyTopBarDefault(descriptor, config) {
 async function reloadAppModule(state, opts) {
   const current = state.app;
   if (!current) return { ok: false, error: "no_app" };
-  const entry = resolve28(current.dir, "dev/index.ts");
+  const entry = resolve29(current.dir, "dev/index.ts");
   mkdirSync16(HMR_TMP_DIR, { recursive: true });
-  const outfile = resolve28(HMR_TMP_DIR, `${current.name}-${++appReloadSeq}.mjs`);
+  const outfile = resolve29(HMR_TMP_DIR, `${current.name}-${++appReloadSeq}.mjs`);
   try {
-    const lib = await import(pathToFileURL6(resolve28(TIER5_SRC_ROOT, "build-lib.mjs")).href);
+    const lib = await import(pathToFileURL6(resolve29(TIER5_SRC_ROOT, "build-lib.mjs")).href);
     await lib.buildAppEntry(entry, outfile, { confineTo: current.dir });
     const mod = await import(pathToFileURL6(outfile).href);
     const next = mod.default;
@@ -38622,7 +38870,7 @@ async function handleWebWix(req, res, state) {
     }
     if (match && (match.rule.kind ?? "mock") === "mock") {
       const mocked = match.rule.response;
-      if (mocked.delayMs) await new Promise((resolve41) => setTimeout(resolve41, mocked.delayMs));
+      if (mocked.delayMs) await new Promise((resolve42) => setTimeout(resolve42, mocked.delayMs));
       const responseBody = mocked.template ? renderTemplate(mocked.body, match.captures) : mocked.body;
       recordWixTraffic(state.wix, state.appName, state.adminUrl, {
         ts: started,
@@ -39113,7 +39361,7 @@ async function handleAdminPlayground(req, res, state) {
     const name = decodeURIComponent(sampleMatch[1]);
     if (!/^[a-zA-Z0-9._-]+$/.test(name)) return sendJson(res, 400, { error: "bad_name" });
     try {
-      const body = await readFile2(resolve28(SAMPLES_ROOT, name), "utf-8");
+      const body = await readFile2(resolve29(SAMPLES_ROOT, name), "utf-8");
       return sendJson(res, 200, JSON.parse(body));
     } catch {
       return sendJson(res, 404, { error: "sample_not_found", name });
@@ -39383,9 +39631,9 @@ async function readBundleFile(name, dir) {
   if (!/^[A-Za-z0-9_.\-]+$/.test(name)) return null;
   const roots = dir ? [dir, TIER5_ROOT] : [TIER5_ROOT];
   const candidates = roots.flatMap((root) => [
-    resolve28(root, `${name}.bundle.js`),
-    resolve28(root, `${name}.js`),
-    resolve28(root, name)
+    resolve29(root, `${name}.bundle.js`),
+    resolve29(root, `${name}.js`),
+    resolve29(root, name)
   ]);
   for (const path of candidates) {
     if (!roots.some((root) => path.startsWith(root))) continue;
@@ -39536,14 +39784,14 @@ async function handleWidgetClearPreview(res, state, widgetId) {
 }
 function readActionHandlerManifest(app) {
   if (!/^[A-Za-z0-9_.\-]+$/.test(app)) return { handlers: [] };
-  const manifestPath = resolve28(ACTION_HANDLERS_ROOT, `${app}.manifest.json`);
-  const bundlePath = resolve28(ACTION_HANDLERS_ROOT, `${app}.handlers.js`);
+  const manifestPath = resolve29(ACTION_HANDLERS_ROOT, `${app}.manifest.json`);
+  const bundlePath = resolve29(ACTION_HANDLERS_ROOT, `${app}.handlers.js`);
   if (!manifestPath.startsWith(ACTION_HANDLERS_ROOT) || !bundlePath.startsWith(ACTION_HANDLERS_ROOT)) return { handlers: [] };
   let decls;
   let bytes2;
   try {
-    decls = JSON.parse(readFileSync39(manifestPath, "utf8"));
-    bytes2 = readFileSync39(bundlePath);
+    decls = JSON.parse(readFileSync40(manifestPath, "utf8"));
+    bytes2 = readFileSync40(bundlePath);
   } catch {
     return { handlers: [] };
   }
@@ -39556,7 +39804,7 @@ function handleActionHandlersManifest(res, app) {
 }
 async function handleActionHandlerBundleGet(res, app) {
   if (!/^[A-Za-z0-9_.\-]+$/.test(app)) return sendJson(res, 404, { error: "not_found" });
-  const path = resolve28(ACTION_HANDLERS_ROOT, `${app}.handlers.js`);
+  const path = resolve29(ACTION_HANDLERS_ROOT, `${app}.handlers.js`);
   if (!path.startsWith(ACTION_HANDLERS_ROOT)) return sendJson(res, 404, { error: "not_found" });
   try {
     const bytes2 = await readFile2(path);
@@ -39573,9 +39821,9 @@ async function handleActionHandlerBundleGet(res, app) {
 }
 async function serveStatic(req, res, root, prefix) {
   const requested = decodeURIComponent((req.url ?? "").split("?")[0]);
-  const relative7 = requested.replace(prefix, "").replace(/^\//, "");
-  const safe = normalize3(relative7).replace(/^(\.\.[\/\\])+/, "");
-  const fullPath = resolve28(root, safe);
+  const relative8 = requested.replace(prefix, "").replace(/^\//, "");
+  const safe = normalize3(relative8).replace(/^(\.\.[\/\\])+/, "");
+  const fullPath = resolve29(root, safe);
   if (!fullPath.startsWith(root)) {
     return send(res, 403, "forbidden");
   }
@@ -39781,7 +40029,7 @@ function createDevServer(opts = {}) {
   };
   const netMocksDisabled = opts.netMocks === false;
   const explicitNetMocksPath = typeof opts.netMocks === "string" ? opts.netMocks : process.env.HIMALAYA_NET_MOCKS;
-  const netMocksPath = netMocksDisabled ? void 0 : explicitNetMocksPath ?? (state.app?.meta.devGateway?.enabled === false ? void 0 : state.app ? resolve28(state.app.dir, "dev/net-mocks.json") : void 0);
+  const netMocksPath = netMocksDisabled ? void 0 : explicitNetMocksPath ?? (state.app?.meta.devGateway?.enabled === false ? void 0 : state.app ? resolve29(state.app.dir, "dev/net-mocks.json") : void 0);
   const resolved2 = netMocksDisabled ? null : resolveNetMocks(
     netMocksPath ? readNetMocksFile(netMocksPath) : null,
     state.app?.meta.devGateway
@@ -39841,7 +40089,7 @@ function createDevServer(opts = {}) {
           const q = new URLSearchParams(url.split("?")[1] ?? "");
           const assetApp = q.get("app") ?? state.appName;
           const assetDir = state.app && assetApp === state.app.name ? state.app.dir : resolveAppDir(assetApp);
-          const hit = assetDir ? collectAssets(assetDir).find((a) => assetSha256(readFileSync39(a.path)) === sha) : void 0;
+          const hit = assetDir ? collectAssets(assetDir).find((a) => assetSha256(readFileSync40(a.path)) === sha) : void 0;
           if (!hit && assetDir) {
             const fontBytes = fontFaceBytesBySha(assetDir, sha);
             if (fontBytes) {
@@ -39864,7 +40112,7 @@ function createDevServer(opts = {}) {
             res.end(JSON.stringify({ error: "asset_not_found", app: assetApp, sha }));
             return;
           }
-          const bytes2 = readFileSync39(hit.path);
+          const bytes2 = readFileSync40(hit.path);
           res.writeHead(200, {
             "content-type": hit.contentType,
             "content-length": String(bytes2.length),
@@ -39950,8 +40198,8 @@ function createDevServer(opts = {}) {
         }
         if (url === "/v1/schema/screen-descriptor.json" && req.method === "GET") {
           try {
-            const schemaPath = resolve28(ROOT6, "core/schema/generated/screen-descriptor.schema.json");
-            const body = readFileSync39(schemaPath, "utf8");
+            const schemaPath = resolve29(ROOT6, "core/schema/generated/screen-descriptor.schema.json");
+            const body = readFileSync40(schemaPath, "utf8");
             return send(res, 200, body, {
               "content-type": "application/schema+json; charset=utf-8",
               "cache-control": "no-store",
@@ -39985,7 +40233,7 @@ function createDevServer(opts = {}) {
             try {
               const { parseRevocationsYaml: parseRevocationsYaml2 } = await Promise.resolve().then(() => (init_config2(), config_exports));
               revoked = parseRevocationsYaml2(
-                readFileSync39(resolve28(state.app.dir, "revocations.yaml"), "utf8")
+                readFileSync40(resolve29(state.app.dir, "revocations.yaml"), "utf8")
               ).revoked;
             } catch {
             }
@@ -40217,18 +40465,18 @@ var init_src6 = __esm({
     init_src5();
     init_kits();
     init_widgets();
-    ROOT6 = resolve28(fileURLToPath17(new URL("../../..", import.meta.url)));
-    TIER3_ROOT = resolve28(ROOT6, "core/dev-server/web");
-    TIER4_ROOT = resolve28(ROOT6, "core/dev-server/tier4-bundles");
+    ROOT6 = resolve29(fileURLToPath17(new URL("../../..", import.meta.url)));
+    TIER3_ROOT = resolve29(ROOT6, "core/dev-server/web");
+    TIER4_ROOT = resolve29(ROOT6, "core/dev-server/tier4-bundles");
     tier4Verifier = new TierFourVerifier(TIER4_ROOT);
-    TIER5_ROOT = resolve28(ROOT6, "core/dev-server/tier5-bundles");
-    ACTION_HANDLERS_ROOT = resolve28(ROOT6, "core/dev-server/action-handlers");
-    SAMPLES_ROOT = resolve28(ROOT6, "core/dev-server/sdui-samples");
+    TIER5_ROOT = resolve29(ROOT6, "core/dev-server/tier5-bundles");
+    ACTION_HANDLERS_ROOT = resolve29(ROOT6, "core/dev-server/action-handlers");
+    SAMPLES_ROOT = resolve29(ROOT6, "core/dev-server/sdui-samples");
     TELEMETRY_BUFFER_CAP = 1e3;
     overrideHistorySeq = 0;
     CACHE_CONTROL = "max-age=600, stale-while-revalidate=86400";
-    TIER5_SRC_ROOT = resolve28(ROOT6, "core/dev-server/tier5-bundles-src");
-    HMR_TMP_DIR = resolve28(ROOT6, "node_modules/.cache/himalaya-hmr");
+    TIER5_SRC_ROOT = resolve29(ROOT6, "core/dev-server/tier5-bundles-src");
+    HMR_TMP_DIR = resolve29(ROOT6, "node_modules/.cache/himalaya-hmr");
     appReloadSeq = 0;
     WEBWIX_CLIENT_ID = process.env.DEMO_APP_WIX_CLIENT_ID ?? "4f58d461-c1f5-4a5d-a467-62cc2329e4dd";
     WEBWIX_REDIRECT = "himalaya-demo-app://oauth/callback";
@@ -40593,12 +40841,12 @@ var init_query = __esm({
 });
 
 // ../../core/dev-server/src/crawl-input.ts
-function resolved(v, resolve41) {
-  if (typeof v === "string") return v.startsWith("$service:") ? resolve41(v) : v;
+function resolved(v, resolve42) {
+  if (typeof v === "string") return v.startsWith("$service:") ? resolve42(v) : v;
   if (Array.isArray(v)) {
     const out = v.flatMap((el) => {
       if (typeof el !== "string" || !el.startsWith("$service:")) return [el];
-      const r = resolve41(el);
+      const r = resolve42(el);
       return Array.isArray(r) ? r : [r];
     });
     return out;
@@ -40612,9 +40860,9 @@ function hasRowBinding(props) {
     return itemToken(v) || Array.isArray(v) && v.some(itemToken);
   });
 }
-function declaredOptionIds(props, resolve41) {
+function declaredOptionIds(props, resolve42) {
   const literal = props.options ?? props.tabs ?? props.chips;
-  const bound = props.optionsPath !== void 0 ? resolved(props.optionsPath, resolve41) : void 0;
+  const bound = props.optionsPath !== void 0 ? resolved(props.optionsPath, resolve42) : void 0;
   const raw = Array.isArray(bound) ? bound : literal;
   if (!Array.isArray(raw)) return [];
   const out = [];
@@ -40657,24 +40905,24 @@ function seedTokens(state, limit = 48) {
   walk2(state, 0);
   return out;
 }
-function synthesizeInput(control, resolve41, tokens) {
+function synthesizeInput(control, resolve42, tokens) {
   const id = `${control.type}.${control.callback}`;
   const row = SYNTHESIZED_CONTROLS[id];
   if (!row) return null;
   const props = control.props;
   if (hasRowBinding(props)) return null;
   if (row.from === "declared-options") {
-    const ids = declaredOptionIds(props, resolve41);
+    const ids = declaredOptionIds(props, resolve42);
     if (!ids.length) return null;
     if (row.encoding === "string-array") {
-      const currentRaw2 = resolved(props.selectedIds, resolve41);
+      const currentRaw2 = resolved(props.selectedIds, resolve42);
       const current3 = (Array.isArray(currentRaw2) ? currentRaw2 : []).filter((x) => typeof x === "string");
       const pick4 = ids.find((o) => !current3.includes(o));
       if (pick4 === void 0) return null;
       const value = props.multiSelect === true ? [...current3, pick4] : [pick4];
       return { key: row.key, value, from: row.from, current: current3, control: id };
     }
-    const currentRaw = resolved(props.selectedId, resolve41);
+    const currentRaw = resolved(props.selectedId, resolve42);
     const current2 = typeof currentRaw === "string" ? currentRaw : void 0;
     const pick3 = ids.find((o) => o !== current2);
     if (pick3 === void 0) return null;
@@ -40682,7 +40930,7 @@ function synthesizeInput(control, resolve41, tokens) {
   }
   if (!acceptsWords(props) || !acceptsWords(control.wrapper ?? {})) return null;
   const binding2 = typeof props.valuePath === "string" ? props.valuePath : typeof props.value === "string" && props.value.startsWith("$service:") ? props.value : void 0;
-  const bound = binding2 === void 0 ? void 0 : resolve41(binding2);
+  const bound = binding2 === void 0 ? void 0 : resolve42(binding2);
   const literal = typeof props.value === "string" && !props.value.startsWith("$") ? props.value : void 0;
   const current = typeof bound === "string" ? bound : typeof bound === "number" ? String(bound) : literal ?? "";
   const max = typeof props.maxLength === "number" && props.maxLength > 0 ? props.maxLength : void 0;
@@ -42899,8 +43147,8 @@ __export(build_exports2, {
   withStoreNavBundle: () => withStoreNavBundle
 });
 import { createHash as createHash18 } from "node:crypto";
-import { readFileSync as readFileSync40, readdirSync as readdirSync18, existsSync as existsSync34 } from "node:fs";
-import { dirname as dirname22, join as join34, resolve as resolve29 } from "node:path";
+import { readFileSync as readFileSync41, readdirSync as readdirSync18, existsSync as existsSync35 } from "node:fs";
+import { dirname as dirname23, join as join35, resolve as resolve30 } from "node:path";
 import { fileURLToPath as fileURLToPath18 } from "node:url";
 import { createRequire as createRequire2 } from "node:module";
 import { execFileSync as execFileSync4 } from "node:child_process";
@@ -42922,7 +43170,7 @@ function bundleMapFor(tier5Dir, bundleName) {
   if (!bundleName) return { bundleMap: null };
   const built = readBuiltBundleMap(tier5Dir, bundleName);
   if (built) return { bundleMap: built };
-  if (resolve29(tier5Dir) !== TIER5_DIR) return { bundleMap: null };
+  if (resolve30(tier5Dir) !== TIER5_DIR) return { bundleMap: null };
   let r;
   try {
     const { sourcemapForCommittedBundleSync } = requireFromHere(SOURCEMAP_ON_DEMAND_PATH);
@@ -42938,10 +43186,10 @@ function l10nLintOptions(locale, appDir2) {
   const tags = (locale.translations ?? []).filter((t) => t !== locale.default);
   const catalog = /* @__PURE__ */ new Set();
   for (const tag of tags) {
-    const path = join34(appDir2, "l10n", `${tag}.json`);
-    if (!existsSync34(path)) continue;
+    const path = join35(appDir2, "l10n", `${tag}.json`);
+    if (!existsSync35(path)) continue;
     try {
-      const parsed = JSON.parse(readFileSync40(path, "utf8"));
+      const parsed = JSON.parse(readFileSync41(path, "utf8"));
       for (const m of Object.values(parsed.messages ?? {})) {
         if (typeof m?.source === "string" && typeof m.translation === "string" && m.translation.length > 0) {
           catalog.add(m.source);
@@ -43106,7 +43354,7 @@ function shellSha(root = REPO_ROOT7) {
 function isMonorepoCheckout(dir) {
   try {
     const top = execFileSync4("git", ["rev-parse", "--show-toplevel"], { cwd: dir, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
-    return top.length > 0 && existsSync34(join34(top, "core", "schema", "core.proto"));
+    return top.length > 0 && existsSync35(join35(top, "core", "schema", "core.proto"));
   } catch {
     return false;
   }
@@ -43239,8 +43487,8 @@ async function buildReleaseFromContent(contentDir2, dest, opts = {}) {
 }
 function readTokensForLint(preloaded) {
   try {
-    const tokenPath = preloaded.module.designTokensPath ?? resolve29(preloaded.dir, preloaded.module.config.designTokensPath ?? "tokens.json");
-    const parsed = JSON.parse(readFileSync40(tokenPath, "utf8"));
+    const tokenPath = preloaded.module.designTokensPath ?? resolve30(preloaded.dir, preloaded.module.config.designTokensPath ?? "tokens.json");
+    const parsed = JSON.parse(readFileSync41(tokenPath, "utf8"));
     delete parsed._meta;
     return parsed;
   } catch {
@@ -43377,7 +43625,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     if (addrCache.has(name)) return addrCache.get(name);
     let bytes2;
     try {
-      bytes2 = readFileSync40(join34(tier5Dir, `${name}.bundle.js`));
+      bytes2 = readFileSync41(join35(tier5Dir, `${name}.bundle.js`));
     } catch {
       return null;
     }
@@ -43398,9 +43646,9 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
   const MAX_AUTHORING_DOC_BYTES = 128 * 1024;
   if (store.putDoc) {
     for (const [name, file] of [["spec", "SPEC.md"], ["mobile-ux", "MOBILE-UX.md"]]) {
-      const path = join34(preloaded.dir, file);
-      if (!existsSync34(path)) continue;
-      const bytes2 = readFileSync40(path);
+      const path = join35(preloaded.dir, file);
+      if (!existsSync35(path)) continue;
+      const bytes2 = readFileSync41(path);
       if (bytes2.length === 0 || bytes2.length > MAX_AUTHORING_DOC_BYTES) {
         throw new Error(`${file} must be non-empty and at most ${MAX_AUTHORING_DOC_BYTES} bytes to ship with a release.`);
       }
@@ -43415,7 +43663,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     const iconPath = resolveAppDirIcon(preloaded.dir);
     if (iconPath) {
       try {
-        const bytes2 = readFileSync40(iconPath);
+        const bytes2 = readFileSync41(iconPath);
         await store.putIcon(app, bytes2);
         iconHash = sha2564(bytes2);
       } catch {
@@ -43437,7 +43685,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     }
     const seenAssetSha = /* @__PURE__ */ new Set();
     for (const a of collected) {
-      const bytes2 = readFileSync40(a.path);
+      const bytes2 = readFileSync41(a.path);
       const hash = sha2564(bytes2);
       if (!seenAssetSha.has(hash)) {
         await store.putAsset(app, hash, bytes2, a.contentType);
@@ -43458,7 +43706,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
   const canEmitFonts = hasVendoredFloor();
   try {
     const appTokens = readTokensForLint(preloaded) ?? {};
-    const policy = existsSync34(join34(preloaded.dir, "fonts.json")) ? JSON.parse(readFileSync40(join34(preloaded.dir, "fonts.json"), "utf8")) : {};
+    const policy = existsSync35(join35(preloaded.dir, "fonts.json")) ? JSON.parse(readFileSync41(join35(preloaded.dir, "fonts.json"), "utf8")) : {};
     fontPlan = planFonts(appTokens, policy);
   } catch (err) {
     throw new Error(
@@ -43474,7 +43722,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
             `[release-build] ${family.name} face ${face.postScriptName} has no local bytes (sha ${face.sha256.slice(0, 12)}\u2026), so the release would declare a face the asset route cannot serve. Run \`npm run fonts:catalog\` to warm the cache before publishing.`
           );
         }
-        const bytes2 = readFileSync40(src);
+        const bytes2 = readFileSync41(src);
         const hash = sha2564(bytes2);
         if (hash !== face.sha256) {
           throw new Error(
@@ -43498,7 +43746,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
   if (store.putAsset) {
     for (const face of collectBrandFonts(preloaded.dir)) {
       try {
-        const bytes2 = readFileSync40(face.path);
+        const bytes2 = readFileSync41(face.path);
         if (bytes2.length === 0) continue;
         const hash = sha2564(bytes2);
         await store.putAsset(app, hash, bytes2, "font/ttf");
@@ -43920,10 +44168,10 @@ async function buildFunctionsOnlyRelease(preloaded, dest) {
   await store.reset(app);
   const sources = {};
   for (const definition of config.functions.functions) {
-    const candidates = [".ts", ".js", ".mts", ".mjs"].map((extension) => join34(preloaded.dir, "functions", `${definition.name}${extension}`));
-    const source = candidates.find((candidate) => existsSync34(candidate));
+    const candidates = [".ts", ".js", ".mts", ".mjs"].map((extension) => join35(preloaded.dir, "functions", `${definition.name}${extension}`));
+    const source = candidates.find((candidate) => existsSync35(candidate));
     if (!source) throw new Error(`missing source for function ${definition.name}; expected functions/${definition.name}.ts`);
-    sources[definition.name] = readFileSync40(source, "utf8");
+    sources[definition.name] = readFileSync41(source, "utf8");
   }
   const built = await buildFunctions(config.functions.functions, sources);
   const bundles = {};
@@ -43951,7 +44199,7 @@ async function buildFunctionsOnlyRelease(preloaded, dest) {
   return { manifest, failedToBuild: [], missingBundles: [], auth: {} };
 }
 function listBuildableApps() {
-  const appsDir = join34(REPO_ROOT7, "apps");
+  const appsDir = join35(REPO_ROOT7, "apps");
   return readdirSync18(appsDir, { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith("_")).map((d) => d.name);
 }
 var BAKE_OFFLINE_BASE, KNOWN_ICON_NAMES, KNOWN_ICONS, REPO_ROOT7, TIER5_DIR, requireFromHere, SOURCEMAP_ON_DEMAND_PATH, BAKED_SERVER_BASE_URL;
@@ -43982,10 +44230,10 @@ var init_build3 = __esm({
     BAKE_OFFLINE_BASE = "http://himalaya-bake.invalid";
     KNOWN_ICON_NAMES = [...ICON_NAMES].sort();
     KNOWN_ICONS = new Set(KNOWN_ICON_NAMES);
-    REPO_ROOT7 = resolve29(dirname22(fileURLToPath18(import.meta.url)), "../..");
-    TIER5_DIR = join34(REPO_ROOT7, "core/dev-server/tier5-bundles");
+    REPO_ROOT7 = resolve30(dirname23(fileURLToPath18(import.meta.url)), "../..");
+    TIER5_DIR = join35(REPO_ROOT7, "core/dev-server/tier5-bundles");
     requireFromHere = createRequire2(import.meta.url);
-    SOURCEMAP_ON_DEMAND_PATH = join34(REPO_ROOT7, "core/dev-server/tier5-bundles-src/sourcemap-on-demand.mjs");
+    SOURCEMAP_ON_DEMAND_PATH = join35(REPO_ROOT7, "core/dev-server/tier5-bundles-src/sourcemap-on-demand.mjs");
     BAKED_SERVER_BASE_URL = "http://baked.himalaya.invalid";
   }
 });
@@ -44162,18 +44410,18 @@ __export(captcha_exports, {
   captchaContentInput: () => captchaContentInput,
   runCaptcha: () => runCaptcha
 });
-import { readFileSync as readFileSync41 } from "node:fs";
-import { resolve as resolve30 } from "node:path";
+import { readFileSync as readFileSync42 } from "node:fs";
+import { resolve as resolve31 } from "node:path";
 function readObject(path) {
   try {
-    return JSON.parse(readFileSync41(path, "utf8"));
+    return JSON.parse(readFileSync42(path, "utf8"));
   } catch {
     return {};
   }
 }
 function captchaContentInput(dir) {
-  const content = readObject(resolve30(dir, "himalaya.content.json"));
-  const provisioning = readObject(resolve30(dir, "provisioning.json"));
+  const content = readObject(resolve31(dir, "himalaya.content.json"));
+  const provisioning = readObject(resolve31(dir, "provisioning.json"));
   return {
     app: text(content.name),
     siteId: text(provisioning.siteId),
@@ -44825,8 +45073,8 @@ __export(pack_exports, {
 });
 import { createHash as createHash19 } from "node:crypto";
 import { deflateRawSync, inflateRawSync } from "node:zlib";
-import { existsSync as existsSync35, mkdirSync as mkdirSync17, readFileSync as readFileSync42, readdirSync as readdirSync19, rmSync as rmSync5, statSync as statSync8, writeFileSync as writeFileSync13 } from "node:fs";
-import { dirname as dirname23, join as join35, resolve as resolve31 } from "node:path";
+import { existsSync as existsSync36, mkdirSync as mkdirSync17, readFileSync as readFileSync43, readdirSync as readdirSync19, rmSync as rmSync5, statSync as statSync7, writeFileSync as writeFileSync13 } from "node:fs";
+import { dirname as dirname24, join as join36, resolve as resolve32 } from "node:path";
 function writeZip(entries) {
   const sorted = entries.slice().sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
   const total = sorted.reduce((n, e) => n + e.bytes.length, 0);
@@ -44920,13 +45168,13 @@ function inflateEntry(buf, entry) {
   return bytes2;
 }
 function readIf(path) {
-  return existsSync35(path) && statSync8(path).isFile() ? readFileSync42(path) : null;
+  return existsSync36(path) && statSync7(path).isFile() ? readFileSync43(path) : null;
 }
 function listDir(dir) {
-  return existsSync35(dir) ? readdirSync19(dir).filter((f) => statSync8(join35(dir, f)).isFile()) : [];
+  return existsSync36(dir) ? readdirSync19(dir).filter((f) => statSync7(join36(dir, f)).isFile()) : [];
 }
 function gatherReleaseEntries(appDir2) {
-  const manifestPath = join35(appDir2, HIMI_PACKAGE_MANIFEST_PATH);
+  const manifestPath = join36(appDir2, HIMI_PACKAGE_MANIFEST_PATH);
   const manifestBytes = readIf(manifestPath);
   if (!manifestBytes) throw new Error(`no ${HIMI_PACKAGE_MANIFEST_PATH} in ${appDir2} \u2014 build a release there first`);
   const manifest = JSON.parse(manifestBytes.toString("utf8"));
@@ -44950,7 +45198,7 @@ function gatherReleaseEntries(appDir2) {
   }
   const missing = [];
   for (const rel of wanted) {
-    const bytes2 = readIf(join35(appDir2, rel));
+    const bytes2 = readIf(join36(appDir2, rel));
     if (bytes2) entries.push({ path: rel, bytes: bytes2 });
     else missing.push(rel);
   }
@@ -44961,12 +45209,12 @@ function gatherReleaseEntries(appDir2) {
     );
   }
   for (const name of SINGLETONS) {
-    const bytes2 = readIf(join35(appDir2, name));
+    const bytes2 = readIf(join36(appDir2, name));
     if (bytes2) entries.push({ path: name, bytes: bytes2 });
   }
   const skipped = [];
   for (const sub of ["screens", "bundles", "assets", "widgets"]) {
-    for (const f of listDir(join35(appDir2, sub))) {
+    for (const f of listDir(join36(appDir2, sub))) {
       if (!wanted.has(`${sub}/${f}`)) skipped.push(`${sub}/${f}`);
     }
   }
@@ -44999,18 +45247,18 @@ function buildEntries(appDir2, app, opts) {
   return { all, header, manifest, skipped };
 }
 function packRelease(releaseRoot, app, out, opts = {}) {
-  const appDir2 = join35(resolve31(releaseRoot), app);
+  const appDir2 = join36(resolve32(releaseRoot), app);
   const { all, header, skipped } = buildEntries(appDir2, app, opts);
   const buf = writeZip(all);
-  const isDir = existsSync35(out) && statSync8(out).isDirectory();
-  const outFile = isDir ? join35(resolve31(out), packageFileName(app, header.releaseId)) : resolve31(out);
-  mkdirSync17(dirname23(outFile), { recursive: true });
+  const isDir = existsSync36(out) && statSync7(out).isDirectory();
+  const outFile = isDir ? join36(resolve32(out), packageFileName(app, header.releaseId)) : resolve32(out);
+  mkdirSync17(dirname24(outFile), { recursive: true });
   writeFileSync13(outFile, buf);
   return { app, releaseId: header.releaseId, header, out: outFile, bytes: buf.length, entryCount: all.length, skipped };
 }
 function resolvePackageDirDest(outDir, app, releaseId) {
   const packagedApp = (dir) => {
-    const bytes2 = readIf(join35(dir, HIMI_PACKAGE_HEADER_PATH));
+    const bytes2 = readIf(join36(dir, HIMI_PACKAGE_HEADER_PATH));
     if (!bytes2) return void 0;
     try {
       return JSON.parse(bytes2.toString("utf8")).app;
@@ -45019,15 +45267,15 @@ function resolvePackageDirDest(outDir, app, releaseId) {
     }
   };
   const replaceable = (dir) => {
-    if (!existsSync35(dir)) return true;
-    if (!statSync8(dir).isDirectory()) return false;
+    if (!existsSync36(dir)) return true;
+    if (!statSync7(dir).isDirectory()) return false;
     return readdirSync19(dir).length === 0 || packagedApp(dir) === app;
   };
-  if (existsSync35(outDir) && !statSync8(outDir).isDirectory()) {
+  if (existsSync36(outDir) && !statSync7(outDir).isDirectory()) {
     throw new Error(`refusing to write a package tree over ${outDir} \u2014 it is a file, not a directory`);
   }
   if (replaceable(outDir)) return outDir;
-  const child = join35(outDir, packageDirName(app, releaseId));
+  const child = join36(outDir, packageDirName(app, releaseId));
   if (!replaceable(child)) {
     throw new Error(
       `refusing to replace ${child}: it is not empty and is not a ${app} package (no ${HIMI_PACKAGE_HEADER_PATH}). Pass --out to a new or empty directory.`
@@ -45041,14 +45289,14 @@ function packReleaseToDir(releaseRoot, app, outDir, opts = {}) {
       "a package carrying the app's source has no --format dir form: readers that predate the source entry drop it before hashing a directory and refuse the package as tampered. Pack it as a .himi archive."
     );
   }
-  const appDir2 = join35(resolve31(releaseRoot), app);
+  const appDir2 = join36(resolve32(releaseRoot), app);
   const { all, header, skipped } = buildEntries(appDir2, app, opts);
-  const dest = resolvePackageDirDest(resolve31(outDir), app, header.releaseId);
+  const dest = resolvePackageDirDest(resolve32(outDir), app, header.releaseId);
   rmSync5(dest, { recursive: true, force: true });
   let bytes2 = 0;
   for (const entry of all) {
-    const target = join35(dest, entry.path);
-    mkdirSync17(dirname23(target), { recursive: true });
+    const target = join36(dest, entry.path);
+    mkdirSync17(dirname24(target), { recursive: true });
     writeFileSync13(target, entry.bytes);
     bytes2 += entry.bytes.length;
   }
@@ -45070,21 +45318,21 @@ function openPackageBuffer(buf) {
   return openFromEntries(readZip(buf), { requireHeader: true });
 }
 function openPackageFile(file) {
-  return openPackageBuffer(readFileSync42(file));
+  return openPackageBuffer(readFileSync43(file));
 }
 function openPackageDir(dir) {
-  const root = resolve31(dir);
+  const root = resolve32(dir);
   const entries = /* @__PURE__ */ new Map();
   const walk2 = (rel) => {
-    const abs = rel ? join35(root, rel) : root;
+    const abs = rel ? join36(root, rel) : root;
     for (const name of readdirSync19(abs)) {
       const childRel = rel ? `${rel}/${name}` : name;
-      const childAbs = join35(abs, name);
-      if (statSync8(childAbs).isDirectory()) walk2(childRel);
-      else if (isSafeEntryName(childRel)) entries.set(childRel, readFileSync42(childAbs));
+      const childAbs = join36(abs, name);
+      if (statSync7(childAbs).isDirectory()) walk2(childRel);
+      else if (isSafeEntryName(childRel)) entries.set(childRel, readFileSync43(childAbs));
     }
   };
-  if (!existsSync35(root)) throw new Error(`no such package directory: ${root}`);
+  if (!existsSync36(root)) throw new Error(`no such package directory: ${root}`);
   walk2("");
   const manifestBytes = entries.get(HIMI_PACKAGE_MANIFEST_PATH);
   if (manifestBytes) {
@@ -45125,12 +45373,12 @@ function unpackTo(buf, dest, appFallback) {
   const app = header.app ?? manifest?.app ?? appFallback;
   if (!app) throw new Error("package declares no app id (no himi-package.json and no manifest.app)");
   if (!isSafeAppId(app)) throw new Error(`package declares an unsafe app id ${JSON.stringify(app)} \u2014 refusing to unpack it`);
-  const root = resolve31(dest);
-  const appDir2 = join35(root, app);
+  const root = resolve32(dest);
+  const appDir2 = join36(root, app);
   rmSync5(appDir2, { recursive: true, force: true });
   for (const [rel, bytes2] of entries) {
-    const target = join35(appDir2, rel);
-    mkdirSync17(dirname23(target), { recursive: true });
+    const target = join36(appDir2, rel);
+    mkdirSync17(dirname24(target), { recursive: true });
     writeFileSync13(target, bytes2);
   }
   return { root, appDir: appDir2, app };
@@ -45164,19 +45412,19 @@ __export(app_source_exports, {
   writeConflicts: () => writeConflicts,
   zipAppSource: () => zipAppSource
 });
-import { readdirSync as readdirSync20, lstatSync as lstatSync4, readFileSync as readFileSync43, mkdirSync as mkdirSync18, writeFileSync as writeFileSync14, existsSync as existsSync36, rmSync as rmSync6, rmdirSync, unlinkSync as unlinkSync3 } from "node:fs";
-import { join as join36, resolve as resolve32, sep as sep7 } from "node:path";
+import { readdirSync as readdirSync20, lstatSync as lstatSync4, readFileSync as readFileSync44, mkdirSync as mkdirSync18, writeFileSync as writeFileSync14, existsSync as existsSync37, rmSync as rmSync6, rmdirSync, unlinkSync as unlinkSync3 } from "node:fs";
+import { join as join37, resolve as resolve33, sep as sep7 } from "node:path";
 function walkSourceTree(dir, file, skip) {
   const walk2 = (relDir) => {
-    for (const name of readdirSync20(join36(dir, relDir))) {
-      const rel = relDir ? join36(relDir, name) : name;
-      const st = lstatSync4(join36(dir, rel));
+    for (const name of readdirSync20(join37(dir, relDir))) {
+      const rel = relDir ? join37(relDir, name) : name;
+      const st = lstatSync4(join37(dir, rel));
       if (st.isSymbolicLink()) {
         skip(rel);
         continue;
       }
       if (st.isDirectory()) {
-        if (isDeniedSourceDir(name) || existsSync36(join36(dir, rel, PACKAGE_DIR_MARKER))) skip(rel);
+        if (isDeniedSourceDir(name) || existsSync37(join37(dir, rel, PACKAGE_DIR_MARKER))) skip(rel);
         else walk2(rel);
         continue;
       }
@@ -45194,7 +45442,7 @@ function collectAppSource(dir) {
   const skipped = [];
   walkSourceTree(
     dir,
-    (archivePath, hostRel) => entries.push({ path: archivePath, bytes: readFileSync43(join36(dir, hostRel)) }),
+    (archivePath, hostRel) => entries.push({ path: archivePath, bytes: readFileSync44(join37(dir, hostRel)) }),
     (hostRel) => skipped.push(hostRel)
   );
   entries.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
@@ -45224,7 +45472,7 @@ function pathKind(p) {
   }
 }
 function writeAppSource(entries, destDir) {
-  const root = resolve32(destDir);
+  const root = resolve33(destDir);
   if (pathKind(root)?.isSymbolicLink()) {
     throw new Error(
       `refusing to restore into ${root}: the destination itself is a symlink, so every file would be written outside it. Remove it, or pass --out/--name somewhere else.`
@@ -45237,13 +45485,13 @@ function writeAppSource(entries, destDir) {
     const segments = entry.path.split("/");
     let dir = root;
     for (const segment of segments.slice(0, -1)) {
-      dir = join36(dir, segment);
+      dir = join37(dir, segment);
       const kind = pathKind(dir);
       if (kind?.isSymbolicLink()) unlinkSync3(dir);
       else if (kind) continue;
       mkdirSync18(dir);
     }
-    const target = join36(root, ...segments);
+    const target = join37(root, ...segments);
     if (pathKind(target)?.isSymbolicLink()) unlinkSync3(target);
     writeFileSync14(target, entry.bytes);
     written.push(entry.path);
@@ -45251,7 +45499,7 @@ function writeAppSource(entries, destDir) {
   return written;
 }
 function staleSourcePaths(entries, destDir) {
-  if (!existsSync36(destDir)) return [];
+  if (!existsSync37(destDir)) return [];
   const archived = new Set(entries.map((e) => e.path));
   const stale = [];
   walkSourceTree(destDir, (archivePath) => {
@@ -45264,7 +45512,7 @@ function deniedArchivePaths(entries) {
   return entries.filter((e) => isDeniedSourcePath(e.path)).map((e) => e.path).sort();
 }
 function writeConflicts(entries, destDir) {
-  const root = resolve32(destDir);
+  const root = resolve33(destDir);
   const conflicts = [];
   const seen = /* @__PURE__ */ new Set();
   const say = (rel, what) => {
@@ -45278,7 +45526,7 @@ function writeConflicts(entries, destDir) {
     let dir = root;
     let stop = false;
     for (const [i, segment] of segments.slice(0, -1).entries()) {
-      dir = join36(dir, segment);
+      dir = join37(dir, segment);
       const kind2 = pathKind(dir);
       if (!kind2 || kind2.isSymbolicLink()) {
         stop = true;
@@ -45290,7 +45538,7 @@ function writeConflicts(entries, destDir) {
       break;
     }
     if (stop) continue;
-    const kind = pathKind(join36(root, ...segments));
+    const kind = pathKind(join37(root, ...segments));
     if (kind && !kind.isSymbolicLink() && kind.isDirectory()) {
       say(entry.path, "is a directory here, but the release has a file at that path");
     }
@@ -45298,24 +45546,24 @@ function writeConflicts(entries, destDir) {
   return conflicts;
 }
 function removeStaleSource(entries, destDir) {
-  const root = resolve32(destDir);
+  const root = resolve33(destDir);
   const removed = staleSourcePaths(entries, root);
-  for (const rel of removed) rmSync6(join36(root, ...rel.split("/")), { force: true });
+  for (const rel of removed) rmSync6(join37(root, ...rel.split("/")), { force: true });
   const needed = /* @__PURE__ */ new Set();
   for (const entry of entries) {
     if (isDeniedSourcePath(entry.path)) continue;
     const segments = entry.path.split("/");
     for (let i = 1; i < segments.length; i++) needed.add(segments.slice(0, i).join("/"));
   }
-  if (existsSync36(root)) pruneEmptyDirs(root, "", needed, removed);
+  if (existsSync37(root)) pruneEmptyDirs(root, "", needed, removed);
   return removed.sort();
 }
 function pruneEmptyDirs(root, rel, needed, removed) {
   let empty = true;
-  for (const name of readdirSync20(rel ? join36(root, rel) : root)) {
-    const childRel = rel ? join36(rel, name) : name;
+  for (const name of readdirSync20(rel ? join37(root, rel) : root)) {
+    const childRel = rel ? join37(rel, name) : name;
     const posix3 = childRel.split(sep7).join("/");
-    const kind = lstatSync4(join36(root, childRel));
+    const kind = lstatSync4(join37(root, childRel));
     if (kind.isSymbolicLink() || !kind.isDirectory() || isDeniedSourceDir(name)) {
       empty = false;
       continue;
@@ -45325,7 +45573,7 @@ function pruneEmptyDirs(root, rel, needed, removed) {
       empty = false;
       continue;
     }
-    rmdirSync(join36(root, childRel));
+    rmdirSync(join37(root, childRel));
     removed.push(`${posix3}/`);
   }
   return empty;
@@ -45353,13 +45601,13 @@ __export(eject_exports, {
   EJECTABLE: () => EJECTABLE,
   ejectModule: () => ejectModule
 });
-import { existsSync as existsSync37, mkdirSync as mkdirSync19, readFileSync as readFileSync44, writeFileSync as writeFileSync15 } from "node:fs";
-import { dirname as dirname24, join as join37, relative as relative4, resolve as resolve33, sep as sep8 } from "node:path";
+import { existsSync as existsSync38, mkdirSync as mkdirSync19, readFileSync as readFileSync45, writeFileSync as writeFileSync15 } from "node:fs";
+import { dirname as dirname25, join as join38, relative as relative5, resolve as resolve34, sep as sep8 } from "node:path";
 function locate(repoRootOrCwd, mod) {
-  const inRepo = resolve33(repoRootOrCwd, `stdlib/flows/${mod}/src/index.ts`);
-  if (existsSync37(inRepo)) return { path: inRepo, form: "source" };
-  const dist = resolve33(repoRootOrCwd, `node_modules/@wix/himalaya/dist/${mod}.mjs`);
-  if (existsSync37(dist)) return { path: dist, form: "bundle" };
+  const inRepo = resolve34(repoRootOrCwd, `stdlib/flows/${mod}/src/index.ts`);
+  if (existsSync38(inRepo)) return { path: inRepo, form: "source" };
+  const dist = resolve34(repoRootOrCwd, `node_modules/@wix/himalaya/dist/${mod}.mjs`);
+  if (existsSync38(dist)) return { path: dist, form: "bundle" };
   return null;
 }
 function specifiersFor(mod) {
@@ -45383,8 +45631,8 @@ function ejectModule(opts) {
     };
   }
   const ext = found.form === "source" ? "ts" : "mjs";
-  const target = join37(contentDir2, "tier5-src", "_ejected", `${mod}.${ext}`);
-  mkdirSync19(dirname24(target), { recursive: true });
+  const target = join38(contentDir2, "tier5-src", "_ejected", `${mod}.${ext}`);
+  mkdirSync19(dirname25(target), { recursive: true });
   const banner = `// EJECTED from @wix/himalaya/${mod}. This app owns this file now.
 //
 // Central fixes to @wix/himalaya/${mod} NO LONGER REACH THIS APP \u2014 including any
@@ -45397,17 +45645,17 @@ function ejectModule(opts) {
 // gate still applies. Ejecting buys layout and flow, never the floor.
 
 `;
-  const normalized = readFileSync44(found.path, "utf8").replace(
+  const normalized = readFileSync45(found.path, "utf8").replace(
     /(["'])@himalaya\/([a-z0-9-]+(?:\/[a-z0-9-]+)?)\1/g,
     (_m, q, sub) => `${q}@wix/himalaya/${sub}${q}`
   );
   writeFileSync15(target, banner + normalized);
   const rewired = [];
   for (const f of files) {
-    if (!existsSync37(f)) continue;
-    const before = readFileSync44(f, "utf8");
+    if (!existsSync38(f)) continue;
+    const before = readFileSync45(f, "utf8");
     let after = before;
-    let rel = relative4(dirname24(f), target).split(sep8).join("/").replace(/\.tsx?$/, ".js");
+    let rel = relative5(dirname25(f), target).split(sep8).join("/").replace(/\.tsx?$/, ".js");
     if (!rel.startsWith(".")) rel = `./${rel}`;
     for (const spec of specifiersFor(mod)) {
       const q = spec.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -45453,14 +45701,14 @@ __export(test_exports, {
   scopeDescriptors: () => scopeDescriptors,
   writeRecordedMocks: () => writeRecordedMocks
 });
-import { existsSync as existsSync38, mkdirSync as mkdirSync20, readFileSync as readFileSync45, writeFileSync as writeFileSync16 } from "node:fs";
-import { join as join38, resolve as resolve34 } from "node:path";
+import { existsSync as existsSync39, mkdirSync as mkdirSync20, readFileSync as readFileSync46, writeFileSync as writeFileSync16 } from "node:fs";
+import { join as join39, resolve as resolve35 } from "node:path";
 function readTestConfig(dir) {
-  const p = resolve34(dir, TEST_CONFIG_FILE);
-  if (!existsSync38(p)) return {};
+  const p = resolve35(dir, TEST_CONFIG_FILE);
+  if (!existsSync39(p)) return {};
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync45(p, "utf8"));
+    parsed = JSON.parse(readFileSync46(p, "utf8"));
   } catch (e) {
     throw new Error(`${TEST_CONFIG_FILE} is not valid JSON \u2014 ${e.message}`);
   }
@@ -45503,7 +45751,7 @@ function readTestConfig(dir) {
 function readNetRules(path) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync45(path, "utf8"));
+    parsed = JSON.parse(readFileSync46(path, "utf8"));
   } catch (e) {
     throw new Error(`--net ${path} could not be read as JSON \u2014 ${e.message}`);
   }
@@ -45523,8 +45771,8 @@ function readNetRules(path) {
 }
 function defaultNetRules(dir) {
   for (const rel of ["dev/net-mocks.json", "tests/net-mocks.json"]) {
-    const p = resolve34(dir, rel);
-    if (existsSync38(p)) {
+    const p = resolve35(dir, rel);
+    if (existsSync39(p)) {
       const rules = readNetRules(p);
       if (rules.length) return { rules, from: rel };
     }
@@ -45540,7 +45788,7 @@ function readCannedResponses() {
   ];
   for (const url of candidates) {
     try {
-      const parsed = JSON.parse(readFileSync45(url, "utf8"));
+      const parsed = JSON.parse(readFileSync46(url, "utf8"));
       const byKey = {};
       for (const [k, v] of Object.entries(parsed)) {
         if (!k.startsWith("//")) byKey[k] = v;
@@ -45632,8 +45880,8 @@ function writeRecordedMocks(opts) {
     mkdir: (p) => mkdirSync20(p, { recursive: true }),
     write: (p, s) => writeFileSync16(p, s)
   };
-  fs.mkdir(join38(opts.dir, "dev"));
-  fs.write(join38(opts.dir, "dev", "net-mocks.json"), JSON.stringify(opts.mocks, null, 2) + "\n");
+  fs.mkdir(join39(opts.dir, "dev"));
+  fs.write(join39(opts.dir, "dev", "net-mocks.json"), JSON.stringify(opts.mocks, null, 2) + "\n");
   return { ok: true, rules, to: "dev/net-mocks.json" };
 }
 function scopeDescriptors(descriptors, requestedIds, invalidScreens) {
@@ -45696,7 +45944,7 @@ async function runCrawl(opts) {
       if (list.length > 1) collapsed.push({ representative: rep.screenId, instances: list.length });
     }
   }
-  const net = opts.offline ? null : opts.netPath ? { rules: readNetRules(resolve34(opts.netPath)), from: opts.netPath } : defaultNetRules(opts.dir);
+  const net = opts.offline ? null : opts.netPath ? { rules: readNetRules(resolve35(opts.netPath)), from: opts.netPath } : defaultNetRules(opts.dir);
   const suppressions = opts.config?.skip ?? [];
   const suppressed = [];
   const matchSuppression = (screen, actionId, componentId, invariant) => suppressions.find((s) => (s.screen === void 0 || s.screen === screen) && (s.action === void 0 || s.action === actionId) && (s.component === void 0 || s.component === componentId) && (s.invariant === void 0 || s.invariant === invariant));
@@ -46090,19 +46338,19 @@ var mobile_ux_lint_exports = {};
 __export(mobile_ux_lint_exports, {
   mobileUxIssues: () => mobileUxIssues
 });
-import { existsSync as existsSync39, readFileSync as readFileSync46 } from "node:fs";
-import { join as join39 } from "node:path";
+import { existsSync as existsSync40, readFileSync as readFileSync47 } from "node:fs";
+import { join as join40 } from "node:path";
 function mobileUxIssues(dir, strict) {
-  const file = join39(dir, "MOBILE-UX.md");
-  if (!existsSync39(file)) return [];
+  const file = join40(dir, "MOBILE-UX.md");
+  if (!existsSync40(file)) return [];
   let text2;
   try {
-    text2 = readFileSync46(file, "utf8");
+    text2 = readFileSync47(file, "utf8");
   } catch {
     return [];
   }
   if (!text2) return [];
-  return mobileUxMarkerFindings(text2).map((finding) => ({
+  return mobileUxMarkerFindings(text2, recordedRenderWidths(dir)).map((finding) => ({
     screen: null,
     pass: "mobile-ux",
     ruleCode: finding.code,
@@ -46118,6 +46366,7 @@ function mobileUxIssues(dir, strict) {
 var init_mobile_ux_lint = __esm({
   "src/mobile-ux-lint.ts"() {
     init_mobile_ux_contract();
+    init_ux_evidence();
   }
 });
 
@@ -46300,9 +46549,9 @@ function ipv6Private(address) {
   const value = address.toLowerCase().replace(/^\[|\]$/g, "");
   const sections = value.split("::");
   if (sections.length > 2) return true;
-  const parse = (section) => {
-    if (!section) return [];
-    const parts = section.split(":");
+  const parse = (section2) => {
+    if (!section2) return [];
+    const parts = section2.split(":");
     const last = parts.at(-1) ?? "";
     if (!last.includes(".")) return parts.map((part) => Number.parseInt(part, 16));
     parts.pop();
@@ -46376,7 +46625,7 @@ async function pinnedFetch(url, init, addresses, maxResponseBytes) {
   const headers2 = Object.fromEntries(new Headers(init.headers).entries());
   const request = url.protocol === "https:" ? httpsRequest : httpRequest;
   const hostname = url.hostname.replace(/^\[|\]$/g, "");
-  return await new Promise((resolve41, reject) => {
+  return await new Promise((resolve42, reject) => {
     let settled = false;
     const finish2 = (fn) => {
       if (settled) return;
@@ -46413,7 +46662,7 @@ async function pinnedFetch(url, init, addresses, maxResponseBytes) {
         }
         const responseHeaders = new Headers();
         for (const [key2, value] of Object.entries(response.headers)) if (value !== void 0) responseHeaders.set(key2, Array.isArray(value) ? value.join(", ") : value);
-        resolve41(new Response(bytes2, { status: response.statusCode, statusText: response.statusMessage, headers: responseHeaders }));
+        resolve42(new Response(bytes2, { status: response.statusCode, statusText: response.statusMessage, headers: responseHeaders }));
       }));
     });
     req.once("error", (error) => finish2(() => reject(error)));
@@ -46713,7 +46962,7 @@ function createLocalTestSandbox() {
           }
         })();
       `;
-      return await new Promise((resolve41, reject) => {
+      return await new Promise((resolve42, reject) => {
         const { port1, port2 } = new MessageChannel();
         const serializableContext = {
           auth: context.auth,
@@ -46789,7 +47038,7 @@ function createLocalTestSandbox() {
             timer = setTimeout(() => finish2(() => reject(new SandboxError("timeout", `execution exceeded ${limits.timeoutMs}ms`))), Math.max(1, limits.timeoutMs));
             return;
           }
-          if (message.ok) finish2(() => resolve41({ value: message.value, durationMs: Date.now() - started }));
+          if (message.ok) finish2(() => resolve42({ value: message.value, durationMs: Date.now() - started }));
           else finish2(() => reject(new SandboxError("execution_failed", message.message ?? "handler failed")));
         });
         worker.once("error", (error) => finish2(() => reject(new SandboxError("execution_failed", error.message))));
@@ -47756,8 +48005,8 @@ __export(functions_exports, {
   resolveFunctionsTarget: () => resolveFunctionsTarget,
   runRemoteFunctionOperation: () => runRemoteFunctionOperation
 });
-import { readFileSync as readFileSync47, existsSync as existsSync40 } from "node:fs";
-import { join as join40, resolve as resolve35 } from "node:path";
+import { readFileSync as readFileSync48, existsSync as existsSync41 } from "node:fs";
+import { join as join41, resolve as resolve36 } from "node:path";
 function resolveFunctionsTarget(input) {
   const explicitUrl = input.functionsUrl?.trim();
   if (explicitUrl) return { mode: "remote", baseUrl: explicitUrl };
@@ -47769,16 +48018,16 @@ function resolveFunctionsTarget(input) {
   return { mode: "local" };
 }
 async function loadFunctionsApp(dir) {
-  const loaded = await loadContent(resolve35(dir));
+  const loaded = await loadContent(resolve36(dir));
   const config = loaded.module.config;
   if (config.kind !== "functions" || !Array.isArray(config.functions?.functions)) {
     throw new Error(`content package "${dir}" is not a functions-only app`);
   }
   const sources = {};
   for (const definition of config.functions.functions) {
-    const source = [".ts", ".js", ".mts", ".mjs"].map((extension) => join40(loaded.dir, "functions", `${definition.name}${extension}`)).find(existsSync40);
+    const source = [".ts", ".js", ".mts", ".mjs"].map((extension) => join41(loaded.dir, "functions", `${definition.name}${extension}`)).find(existsSync41);
     if (!source) throw new Error(`missing source for function ${definition.name}; expected functions/${definition.name}.ts`);
-    sources[definition.name] = readFileSync47(source, "utf8");
+    sources[definition.name] = readFileSync48(source, "utf8");
   }
   const data = config.cms || config.data ? mergeDataResources(config) : void 0;
   const dataErrors = validateDataResources(data, loaded.name).filter((issue2) => issue2.severity === "error");
@@ -47927,14 +48176,15 @@ __export(native_decode_exports, {
   nativeDecodeAndroidHarnessDir: () => nativeDecodeAndroidHarnessDir,
   nativeDecodePackageDir: () => nativeDecodePackageDir,
   nativeDecodePlatforms: () => nativeDecodePlatforms,
+  nativeOracleShipped: () => nativeOracleShipped,
   parseNativeDecodeOutput: () => parseNativeDecodeOutput,
   runAndroidNativeDecode: () => runAndroidNativeDecode,
   runNativeDecode: () => runNativeDecode
 });
 import { execFileSync as execFileSync5, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync41, mkdtempSync as mkdtempSync2, readFileSync as readFileSync48, rmSync as rmSync7, writeFileSync as writeFileSync17 } from "node:fs";
+import { existsSync as existsSync42, mkdtempSync as mkdtempSync2, readFileSync as readFileSync49, rmSync as rmSync7, writeFileSync as writeFileSync17 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join41 } from "node:path";
+import { join as join42 } from "node:path";
 import { fileURLToPath as fileURLToPath19 } from "node:url";
 function nativeDecodePackageDir() {
   return fileURLToPath19(new URL("../../../core/runtime/ios/HimalayaCore/", import.meta.url));
@@ -47942,6 +48192,12 @@ function nativeDecodePackageDir() {
 function nativeDecodeAndroidHarnessDir() {
   return fileURLToPath19(new URL("../../../tools/wix-sdk-android-tests/", import.meta.url));
 }
+function nativeOracleShipped() {
+  return {
+    ios: existsSync42(join42(nativeDecodePackageDir(), "Package.swift")),
+    android: existsSync42(join42(nativeDecodeAndroidHarnessDir(), "gradlew"))
+  };
+}
 function detectNativeDecode(options = {}) {
   const hostPlatform = options.hostPlatform ?? process.platform;
   const packageDir = options.packageDir ?? nativeDecodePackageDir();
@@ -47950,7 +48206,7 @@ function detectNativeDecode(options = {}) {
     return { platform: "ios", available: false, reason: `the iOS decoder oracle requires macOS (darwin); this host is ${hostPlatform}` };
   }
   if (!swiftAvailable) return { platform: "ios", available: false, reason: "swift is not on PATH" };
-  const packageAvailable = options.packageAvailable ?? existsSync41(join41(packageDir, "Package.swift"));
+  const packageAvailable = options.packageAvailable ?? existsSync42(join42(packageDir, "Package.swift"));
   if (!packageAvailable) {
     return {
       platform: "ios",
@@ -47962,7 +48218,7 @@ function detectNativeDecode(options = {}) {
 }
 function localPropertiesSdk(harnessDir) {
   try {
-    const match = readFileSync48(join41(harnessDir, "local.properties"), "utf8").match(/^sdk\.dir\s*=\s*(.+)$/m);
+    const match = readFileSync49(join42(harnessDir, "local.properties"), "utf8").match(/^sdk\.dir\s*=\s*(.+)$/m);
     return match?.[1]?.trim().replace(/\\([ :\\])/g, "$1") ?? null;
   } catch {
     return null;
@@ -47970,8 +48226,8 @@ function localPropertiesSdk(harnessDir) {
 }
 function detectAndroidNativeDecode(options = {}) {
   const harnessDir = options.harnessDir ?? nativeDecodeAndroidHarnessDir();
-  const gradlew = join41(harnessDir, "gradlew");
-  const gradlewAvailable = options.gradlewAvailable ?? existsSync41(gradlew);
+  const gradlew = join42(harnessDir, "gradlew");
+  const gradlewAvailable = options.gradlewAvailable ?? existsSync42(gradlew);
   if (!gradlewAvailable) {
     return {
       platform: "android",
@@ -47981,7 +48237,7 @@ function detectAndroidNativeDecode(options = {}) {
   }
   const androidHome = options.androidHome ?? process.env.ANDROID_HOME ?? "";
   const sdk = androidHome.trim() || (options.localPropertiesSdk !== void 0 ? options.localPropertiesSdk : localPropertiesSdk(harnessDir));
-  const sdkAvailable = options.sdkAvailable ?? (typeof sdk === "string" && sdk.length > 0 && existsSync41(sdk));
+  const sdkAvailable = options.sdkAvailable ?? (typeof sdk === "string" && sdk.length > 0 && existsSync42(sdk));
   if (!sdkAvailable) {
     return {
       platform: "android",
@@ -48053,14 +48309,14 @@ function parseNativeDecodeOutput(stdout, expectedScreenIds, platform = "ios") {
   return verdicts;
 }
 function runNativeDecode(options) {
-  const descriptorDir = mkdtempSync2(join41(tmpdir3(), "himi-native-decode-"));
+  const descriptorDir = mkdtempSync2(join42(tmpdir3(), "himi-native-decode-"));
   const startedAt = Date.now();
   try {
     for (const descriptor of options.descriptors) {
       if (typeof descriptor.descriptorJson !== "string") {
         throw new Error(`native decode cannot judge ${descriptor.screenId}: the release builder did not return its exact baked JSON bytes`);
       }
-      writeFileSync17(join41(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
+      writeFileSync17(join42(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
     }
     options.progress?.("building cached Swift oracle");
     execFileSync5("swift", ["build", "--package-path", options.packageDir, "--product", "himi-decode-oracle"], {
@@ -48072,7 +48328,7 @@ function runNativeDecode(options) {
       encoding: "utf8"
     }).trim();
     options.progress?.(`running real Swift decoder over ${options.descriptors.length} screen${options.descriptors.length === 1 ? "" : "s"}`);
-    const stdout = execFileSync5(join41(binPath, "himi-decode-oracle"), ["--dir", descriptorDir], {
+    const stdout = execFileSync5(join42(binPath, "himi-decode-oracle"), ["--dir", descriptorDir], {
       stdio: ["ignore", "pipe", "pipe"],
       encoding: "utf8"
     });
@@ -48090,15 +48346,15 @@ function runNativeDecode(options) {
   }
 }
 function runAndroidNativeDecode(options) {
-  const descriptorDir = mkdtempSync2(join41(tmpdir3(), "himi-native-decode-android-"));
-  const outputPath = join41(descriptorDir, "verdicts.ndjson");
+  const descriptorDir = mkdtempSync2(join42(tmpdir3(), "himi-native-decode-android-"));
+  const outputPath = join42(descriptorDir, "verdicts.ndjson");
   const startedAt = Date.now();
   try {
     for (const descriptor of options.descriptors) {
       if (typeof descriptor.descriptorJson !== "string") {
         throw new Error(`native decode cannot judge ${descriptor.screenId}: the release builder did not return its exact baked JSON bytes`);
       }
-      writeFileSync17(join41(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
+      writeFileSync17(join42(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
     }
     options.progress?.(`running real Kotlin decoder over ${options.descriptors.length} screen${options.descriptors.length === 1 ? "" : "s"}`);
     execFileSync5(options.gradlew, [
@@ -48113,7 +48369,7 @@ function runAndroidNativeDecode(options) {
       stdio: ["ignore", "ignore", "pipe"],
       encoding: "utf8"
     });
-    const stdout = readFileSync48(outputPath, "utf8");
+    const stdout = readFileSync49(outputPath, "utf8");
     return {
       platform: "android",
       verdicts: parseNativeDecodeOutput(stdout, options.descriptors.map((descriptor) => descriptor.screenId), "android"),
@@ -48184,13 +48440,13 @@ __export(browser_authoring_exports, {
 import { createServer as createServer3 } from "node:http";
 import { createHash as createHash22, randomBytes as randomBytes5 } from "node:crypto";
 import { execFile as execFile2 } from "node:child_process";
-import { existsSync as existsSync42, readdirSync as readdirSync21, readFileSync as readFileSync49, realpathSync as realpathSync4, statSync as statSync9 } from "node:fs";
-import { join as join42, posix, relative as relative5, sep as sep9 } from "node:path";
+import { existsSync as existsSync43, readdirSync as readdirSync21, readFileSync as readFileSync50, realpathSync as realpathSync4, statSync as statSync8 } from "node:fs";
+import { join as join43, posix, relative as relative6, sep as sep9 } from "node:path";
 function humanMs(ms) {
   return ms < 1e3 ? `${ms}ms` : `${Math.round(ms / 1e3)}s`;
 }
 function collectWorkerSources(tier5SrcDir, bundleName) {
-  const root = join42(tier5SrcDir, bundleName);
+  const root = join43(tier5SrcDir, bundleName);
   const files = {};
   const visitedDirs = /* @__PURE__ */ new Set();
   const walk2 = (abs, rel) => {
@@ -48198,16 +48454,16 @@ function collectWorkerSources(tier5SrcDir, bundleName) {
     if (visitedDirs.has(real)) return;
     visitedDirs.add(real);
     for (const name of readdirSync21(abs).sort()) {
-      const childAbs = join42(abs, name);
+      const childAbs = join43(abs, name);
       const childRel = posix.join(rel, name);
-      if (statSync9(childAbs).isDirectory()) {
+      if (statSync8(childAbs).isDirectory()) {
         walk2(childAbs, childRel);
       } else if (/\.(ts|tsx|js|mjs|json)$/.test(name)) {
-        files[childRel] = readFileSync49(childAbs, "utf8");
+        files[childRel] = readFileSync50(childAbs, "utf8");
       }
     }
   };
-  if (!existsSync42(root)) return null;
+  if (!existsSync43(root)) return null;
   walk2(root, `/tier5-src/${bundleName}`);
   const entry = [`/tier5-src/${bundleName}/index.ts`, `/tier5-src/${bundleName}/index.js`].find((p) => p in files);
   if (!entry) return null;
@@ -48224,20 +48480,20 @@ function collectRelativeSiblings(files, tier5SrcDir) {
       const spec = m[1];
       const virtual = posix.normalize(posix.join(dir, spec));
       if (!virtual.startsWith("/tier5-src/")) continue;
-      const onDisk = join42(tier5SrcDir, virtual.slice("/tier5-src/".length));
+      const onDisk = join43(tier5SrcDir, virtual.slice("/tier5-src/".length));
       const candidates = [
         onDisk,
         `${onDisk}.ts`,
         `${onDisk}.js`,
         onDisk.replace(/\.js$/, ".ts"),
-        join42(onDisk, "index.ts"),
-        join42(onDisk, "index.js")
+        join43(onDisk, "index.ts"),
+        join43(onDisk, "index.js")
       ];
       for (const abs of candidates) {
-        if (!existsSync42(abs) || statSync9(abs).isDirectory()) continue;
-        const key2 = `/tier5-src/${relative5(tier5SrcDir, abs).split(sep9).join(posix.sep)}`;
+        if (!existsSync43(abs) || statSync8(abs).isDirectory()) continue;
+        const key2 = `/tier5-src/${relative6(tier5SrcDir, abs).split(sep9).join(posix.sep)}`;
         if (key2 in files) break;
-        files[key2] = readFileSync49(abs, "utf8");
+        files[key2] = readFileSync50(abs, "utf8");
         queue.push(key2);
         break;
       }
@@ -48269,10 +48525,10 @@ function collectSdkModules(files, resolveSubpath) {
   for (const source of Object.values(files)) visit(source);
   return { modules, unsupported };
 }
-function sdkSubpathReader(resolve41) {
+function sdkSubpathReader(resolve42) {
   return (sub) => {
     try {
-      return readFileSync49(resolve41(`@wix/himalaya/${sub}`), "utf8");
+      return readFileSync50(resolve42(`@wix/himalaya/${sub}`), "utf8");
     } catch {
       return null;
     }
@@ -48353,7 +48609,7 @@ async function runBrowserAuthoring(opts) {
   const token = mintToken2(payload);
   const unusable = await probeAuthoringPage(opts.authoringBase, opts.fetchImpl, opts.probeTimeoutMs);
   if (unusable) throw new Error(unusable);
-  return await new Promise((resolve41, reject) => {
+  return await new Promise((resolve42, reject) => {
     let settled = false;
     let url = "";
     const server = createServer3();
@@ -48405,7 +48661,7 @@ async function runBrowserAuthoring(opts) {
         }
         res.writeHead(200, { "content-type": "text/plain" }).end("ok");
         const report = body.result;
-        finish2(() => resolve41({ report, url }));
+        finish2(() => resolve42({ report, url }));
       })();
     });
     server.on("error", (e) => finish2(() => reject(e)));
@@ -48443,11 +48699,15 @@ __export(coverage_exports, {
   diffAndStoreObservations: () => diffAndStoreObservations,
   formatDelta: () => formatDelta,
   formatLedger: () => formatLedger,
+  suppressedNativeKeys: () => suppressedNativeKeys,
   trendAndStore: () => trendAndStore
 });
-import { existsSync as existsSync43, mkdirSync as mkdirSync21, readFileSync as readFileSync50, writeFileSync as writeFileSync18 } from "node:fs";
-import { dirname as dirname25, join as join43 } from "node:path";
-function assembleLedger(r) {
+import { existsSync as existsSync44, mkdirSync as mkdirSync21, readFileSync as readFileSync51, writeFileSync as writeFileSync18 } from "node:fs";
+import { dirname as dirname26, join as join44 } from "node:path";
+function suppressedNativeKeys(oracle) {
+  return [...oracle.ios ? [] : ["native-decode|ios"], ...oracle.android ? [] : ["native-decode|android"]];
+}
+function assembleLedger(r, options = {}) {
   const out = [];
   for (const c of r.crawled ?? []) {
     const noRow = (c.actionsSkipped ?? []).filter((s) => s.why === "no-row-value");
@@ -48569,8 +48829,9 @@ function assembleLedger(r) {
       remedy: "npx playwright install chromium (~170MB, one time) \u2014 then every himi test writes a PNG per screen to .himi/shots/"
     });
   }
+  const oracle = options.nativeOracle ?? nativeOracleShipped();
   const nativeIos = r.nativeDecode?.ios;
-  if (!nativeIos || "unavailable" in nativeIos) {
+  if (oracle.ios && (!nativeIos || "unavailable" in nativeIos)) {
     const reason = nativeIos && "unavailable" in nativeIos ? ` (${nativeIos.reason})` : "";
     out.push({
       key: "native-decode|ios",
@@ -48581,7 +48842,7 @@ function assembleLedger(r) {
     });
   }
   const nativeAndroid = r.nativeDecode?.android;
-  if (!nativeAndroid || "unavailable" in nativeAndroid) {
+  if (oracle.android && (!nativeAndroid || "unavailable" in nativeAndroid)) {
     const reason = nativeAndroid && "unavailable" in nativeAndroid ? ` (${nativeAndroid.reason})` : "";
     out.push({
       key: "native-decode|android",
@@ -48611,30 +48872,32 @@ function assembleLedger(r) {
   }
   return out;
 }
-function trendAndStore(dir, entries) {
-  const p = join43(dir, LEDGER_FILE);
+function trendAndStore(dir, entries, suppressed) {
+  const p = join44(dir, LEDGER_FILE);
   let previous = null;
   try {
-    if (existsSync43(p)) {
-      const parsed = JSON.parse(readFileSync50(p, "utf8"));
+    if (existsSync44(p)) {
+      const parsed = JSON.parse(readFileSync51(p, "utf8"));
       if (Array.isArray(parsed.keys)) previous = parsed.keys.filter((k) => typeof k === "string");
     }
   } catch {
   }
   const current = entries.map((e) => e.key);
+  const stored = [.../* @__PURE__ */ new Set([...current, ...(previous ?? []).filter((key2) => (suppressed ?? []).includes(key2))])];
   try {
-    mkdirSync21(dirname25(p), { recursive: true });
-    writeFileSync18(p, JSON.stringify({ keys: current, ts: (/* @__PURE__ */ new Date()).toISOString() }, null, 2));
+    mkdirSync21(dirname26(p), { recursive: true });
+    writeFileSync18(p, JSON.stringify({ keys: stored, ts: (/* @__PURE__ */ new Date()).toISOString() }, null, 2));
   } catch {
     return null;
   }
   if (previous === null) return { opened: 0, closed: 0 };
-  const prev = new Set(previous);
+  const baseline = previous.filter((key2) => !(suppressed ?? []).includes(key2));
+  const prev = new Set(baseline);
   const cur = new Set(current);
   return {
     opened: current.filter((k) => !prev.has(k)).length,
-    closed: previous.filter((k) => !cur.has(k)).length,
-    previousTotal: previous.length
+    closed: baseline.filter((k) => !cur.has(k)).length,
+    previousTotal: baseline.length
   };
 }
 function formatLedger(entries, trend) {
@@ -48653,11 +48916,11 @@ function formatLedger(entries, trend) {
   return out.join("\n");
 }
 function diffAndStoreObservations(dir, current) {
-  const p = join43(dir, OBS_FILE);
+  const p = join44(dir, OBS_FILE);
   let previous = null;
   try {
-    if (existsSync43(p)) {
-      const parsed = JSON.parse(readFileSync50(p, "utf8"));
+    if (existsSync44(p)) {
+      const parsed = JSON.parse(readFileSync51(p, "utf8"));
       if (parsed.screens && typeof parsed.screens === "object" && !Array.isArray(parsed.screens) && Object.values(parsed.screens).every(
         (v) => Array.isArray(v) && v.every((l) => typeof l === "string")
       )) {
@@ -48667,7 +48930,7 @@ function diffAndStoreObservations(dir, current) {
   } catch {
   }
   try {
-    mkdirSync21(dirname25(p), { recursive: true });
+    mkdirSync21(dirname26(p), { recursive: true });
     writeFileSync18(p, JSON.stringify({ screens: current, ts: (/* @__PURE__ */ new Date()).toISOString() }, null, 2));
   } catch {
     return null;
@@ -48705,8 +48968,9 @@ function formatDelta(delta) {
 var LEDGER_FILE, OBS_FILE;
 var init_coverage = __esm({
   "src/coverage.ts"() {
-    LEDGER_FILE = join43(".himi", "test-ledger.json");
-    OBS_FILE = join43(".himi", "test-observations.json");
+    init_native_decode();
+    LEDGER_FILE = join44(".himi", "test-ledger.json");
+    OBS_FILE = join44(".himi", "test-observations.json");
   }
 });
 
@@ -48719,11 +48983,11 @@ __export(assets_exports, {
   removeAssetPayload: () => removeAssetPayload,
   verifyReport: () => verifyReport
 });
-import { readFileSync as readFileSync51 } from "node:fs";
+import { readFileSync as readFileSync52 } from "node:fs";
 import { basename as basename8 } from "node:path";
 function declaredAssets(dir) {
   return collectAssets(dir).map((a) => {
-    const bytes2 = readFileSync51(a.path);
+    const bytes2 = readFileSync52(a.path);
     return {
       name: a.name,
       sha256: assetSha256(bytes2),
@@ -48799,7 +49063,7 @@ function verifyReport(dir, app, manifest) {
   };
 }
 function addAssetPayload(manifest, filePath, opts) {
-  const bytes2 = readFileSync51(filePath);
+  const bytes2 = readFileSync52(filePath);
   const name = opts.name ?? basename8(filePath);
   const sha2565 = assetSha256(bytes2);
   const record2 = {
@@ -50213,9 +50477,9 @@ __export(run_exports, {
   runPackage: () => runPackage,
   withoutProdServe: () => withoutProdServe
 });
-import { cpSync, existsSync as existsSync44, mkdirSync as mkdirSync22, mkdtempSync as mkdtempSync3, readFileSync as readFileSync52, rmSync as rmSync8, statSync as statSync10 } from "node:fs";
+import { cpSync, existsSync as existsSync45, mkdirSync as mkdirSync22, mkdtempSync as mkdtempSync3, readFileSync as readFileSync53, rmSync as rmSync8, statSync as statSync9 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { join as join44 } from "node:path";
+import { join as join45 } from "node:path";
 import { spawn as spawn3 } from "node:child_process";
 function makePackageRunHandler(opts) {
   return makeRunHandler({
@@ -50233,9 +50497,9 @@ async function fetchBytes(url) {
 }
 async function resolvePackage(source, workDir) {
   const isUrl2 = /^https?:\/\//i.test(source);
-  if (!isUrl2 && existsSync44(source) && statSync10(source).isDirectory()) {
-    const appDirManifest = join44(source, "release-manifest.json");
-    if (existsSync44(appDirManifest)) {
+  if (!isUrl2 && existsSync45(source) && statSync9(source).isDirectory()) {
+    const appDirManifest = join45(source, "release-manifest.json");
+    if (existsSync45(appDirManifest)) {
       const opened2 = openPackageDir(source);
       if (!opened2.validation.ok) {
         throw new Error(`package is not valid:
@@ -50244,9 +50508,9 @@ async function resolvePackage(source, workDir) {
       const app2 = opened2.header?.app ?? opened2.manifest?.app;
       if (!app2) throw new Error(`${source} has no app id (no himi-package.json and no manifest.app)`);
       if (!isSafeAppId(app2)) throw new Error(`${source} declares an unsafe app id ${JSON.stringify(app2)} \u2014 refusing to open it`);
-      const root2 = workDir ?? mkdtempSync3(join44(tmpdir4(), "himi-run-"));
-      const target = join44(root2, app2);
-      if (join44(source) !== target) {
+      const root2 = workDir ?? mkdtempSync3(join45(tmpdir4(), "himi-run-"));
+      const target = join45(root2, app2);
+      if (join45(source) !== target) {
         mkdirSync22(root2, { recursive: true });
         rmSync8(target, { recursive: true, force: true });
         cpSync(source, target, { recursive: true });
@@ -50263,8 +50527,8 @@ async function resolvePackage(source, workDir) {
     }
     throw new Error(`${source} is a directory but has no release-manifest.json \u2014 is it a package?`);
   }
-  const bytes2 = isUrl2 ? await fetchBytes(source) : readFileSync52(source);
-  const root = workDir ?? mkdtempSync3(join44(tmpdir4(), "himi-run-"));
+  const bytes2 = isUrl2 ? await fetchBytes(source) : readFileSync53(source);
+  const root = workDir ?? mkdtempSync3(join45(tmpdir4(), "himi-run-"));
   const { app, appDir: appDir2 } = unpackTo(bytes2, root);
   const opened = openPackageDir(appDir2);
   if (!opened.validation.ok) {
@@ -50364,19 +50628,19 @@ __export(run_browser_exports, {
   runInBrowser: () => runInBrowser
 });
 import { createServer as createServer5 } from "node:http";
-import { existsSync as existsSync45, readFileSync as readFileSync53 } from "node:fs";
+import { existsSync as existsSync46, readFileSync as readFileSync54 } from "node:fs";
 import { spawnSync as spawnSync3, execFile as execFile3 } from "node:child_process";
-import { dirname as dirname26, resolve as resolve36 } from "node:path";
+import { dirname as dirname27, resolve as resolve37 } from "node:path";
 import { fileURLToPath as fileURLToPath20 } from "node:url";
 function stagedDir() {
-  return process.env.HIMI_BROWSER_PLANE_OUT ? resolve36(process.env.HIMI_BROWSER_PLANE_OUT) : resolve36(REPO, "packages", "serve", "dist", "browser-plane");
+  return process.env.HIMI_BROWSER_PLANE_OUT ? resolve37(process.env.HIMI_BROWSER_PLANE_OUT) : resolve37(REPO, "packages", "serve", "dist", "browser-plane");
 }
 function missingStaged() {
-  return [...SERVED].filter((f) => !existsSync45(resolve36(stagedDir(), f))).sort();
+  return [...SERVED].filter((f) => !existsSync46(resolve37(stagedDir(), f))).sort();
 }
 function ensureBrowserPlaneStaged() {
   if (missingStaged().length === 0) return { ok: true, detail: "already staged" };
-  const r = spawnSync3(process.execPath, [resolve36(REPO, "core/serve/scripts/stage-browser-plane.mjs")], {
+  const r = spawnSync3(process.execPath, [resolve37(REPO, "core/serve/scripts/stage-browser-plane.mjs")], {
     cwd: REPO,
     encoding: "utf8"
   });
@@ -50462,7 +50726,7 @@ async function runInBrowser(releaseRoot, app, header, opts = {}) {
     }
     const name = path === "/" || path === "/index.html" ? "host.html" : path.slice(1);
     if (SERVED.has(name)) {
-      if (!existsSync45(resolve36(stagedDir(), name))) {
+      if (!existsSync46(resolve37(stagedDir(), name))) {
         const restaged = ensureBrowserPlaneStaged();
         if (!restaged.ok) {
           res.writeHead(503, { "content-type": "application/json" });
@@ -50472,7 +50736,7 @@ async function runInBrowser(releaseRoot, app, header, opts = {}) {
       }
       let bytes2;
       try {
-        bytes2 = readFileSync53(resolve36(stagedDir(), name));
+        bytes2 = readFileSync54(resolve37(stagedDir(), name));
       } catch (e) {
         res.writeHead(503, { "content-type": "application/json" });
         res.end(JSON.stringify({ error: "browser_plane_unstaged", file: name, detail: String(e) }));
@@ -50515,8 +50779,8 @@ var HERE, REPO, SERVED;
 var init_run_browser = __esm({
   "src/run-browser.ts"() {
     init_file_store();
-    HERE = dirname26(fileURLToPath20(import.meta.url));
-    REPO = resolve36(HERE, "..", "..", "..");
+    HERE = dirname27(fileURLToPath20(import.meta.url));
+    REPO = resolve37(HERE, "..", "..", "..");
     SERVED = /* @__PURE__ */ new Set(["host.html", "sw.js", "package-reader.js"]);
   }
 });
@@ -50890,11 +51154,11 @@ __export(preflight_exports, {
   parseStoreConfig: () => parseStoreConfig,
   requireEnv: () => requireEnv
 });
-import { existsSync as existsSync46, readFileSync as readFileSync54 } from "node:fs";
-import { isAbsolute as isAbsolute2, relative as relative6, resolve as resolve37 } from "node:path";
+import { existsSync as existsSync47, readFileSync as readFileSync55 } from "node:fs";
+import { isAbsolute as isAbsolute3, relative as relative7, resolve as resolve38 } from "node:path";
 function isInsideRepo(p) {
-  const rel = relative6(REPO_ROOT3, resolve37(p));
-  return rel !== "" && !rel.startsWith("..") && !isAbsolute2(rel);
+  const rel = relative7(REPO_ROOT3, resolve38(p));
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute3(rel);
 }
 function assertCredentialOutsideRepo(label2, p) {
   if (isInsideRepo(p)) {
@@ -50923,7 +51187,7 @@ function scalar2(v) {
 }
 function parseStoreConfig(text2) {
   const cfg = {};
-  let section = null;
+  let section2 = null;
   for (const raw of text2.split("\n")) {
     const line = strip2(raw);
     if (!line.trim()) continue;
@@ -50933,24 +51197,24 @@ function parseStoreConfig(text2) {
     const [, key2, rest] = kv;
     if (!indented) {
       if (rest.trim() === "") {
-        section = {};
-        cfg[key2] = section;
+        section2 = {};
+        cfg[key2] = section2;
       } else {
-        section = null;
+        section2 = null;
         cfg[key2] = scalar2(rest);
       }
-    } else if (section) {
-      section[key2] = scalar2(rest);
+    } else if (section2) {
+      section2[key2] = scalar2(rest);
     }
   }
   return cfg;
 }
 function loadStoreConfig(app) {
   const p = storeConfigPath(app);
-  if (!existsSync46(p)) {
+  if (!existsSync47(p)) {
     throw new Error(`No store config at ${p}. Create apps/${app}/store/store.config.yaml first (see /setup-store-signing).`);
   }
-  return parseStoreConfig(readFileSync54(p, "utf8"));
+  return parseStoreConfig(readFileSync55(p, "utf8"));
 }
 var init_preflight = __esm({
   "../store-release/preflight.ts"() {
@@ -50973,9 +51237,9 @@ __export(preflight_app_exports, {
   pngSize: () => pngSize,
   preflightApp: () => preflightApp
 });
-import { readFileSync as readFileSync55, existsSync as existsSync47, readdirSync as readdirSync22, statSync as statSync11 } from "node:fs";
+import { readFileSync as readFileSync56, existsSync as existsSync48, readdirSync as readdirSync22, statSync as statSync10 } from "node:fs";
 import { createHash as createHash23 } from "node:crypto";
-import { join as join45 } from "node:path";
+import { join as join46 } from "node:path";
 function analyze(projectYml, storeConfig, icon) {
   const f = [];
   const has = (re, s) => re.test(s);
@@ -51023,10 +51287,10 @@ function analyze(projectYml, storeConfig, icon) {
   return f;
 }
 async function preflightApp(app) {
-  const projectYml = existsSync47(iosProjectYml(app)) ? readFileSync55(iosProjectYml(app), "utf8") : "";
-  const storeConfig = existsSync47(storeConfigPath(app)) ? readFileSync55(storeConfigPath(app), "utf8") : "";
+  const projectYml = existsSync48(iosProjectYml(app)) ? readFileSync56(iosProjectYml(app), "utf8") : "";
+  const storeConfig = existsSync48(storeConfigPath(app)) ? readFileSync56(storeConfigPath(app), "utf8") : "";
   if (!storeConfig) return [{ level: "error", message: `no apps/${app}/store/store.config.yaml \u2014 run /setup-store-signing first.` }];
-  const findings = analyze(projectYml, storeConfig, await appIconState(join45(appDir(app), "ios")));
+  const findings = analyze(projectYml, storeConfig, await appIconState(join46(appDir(app), "ios")));
   findings.push(...analyzeListing(metadataFilesPresent(app), listScreenshots(app)));
   findings.push(
     ...analyzePlayListing(playListingAssets(app)).map((finding) => ({ ...finding, level: "warn" }))
@@ -51053,17 +51317,17 @@ function analyzeSubmissionRecord(appLevel, review, opts) {
   return f;
 }
 function appLevelMetadataFiles(app, locale = "en-US") {
-  const root = join45(storeDir(app), "metadata");
+  const root = join46(storeDir(app), "metadata");
   const out = /* @__PURE__ */ new Set();
-  if (existsSync47(root)) {
+  if (existsSync48(root)) {
     for (const n of readdirSync22(root)) if (n.endsWith(".txt")) out.add(n);
   }
-  if (existsSync47(join45(root, locale, "privacy_url.txt"))) out.add("privacy_url.txt");
+  if (existsSync48(join46(root, locale, "privacy_url.txt"))) out.add("privacy_url.txt");
   return out;
 }
 function reviewInfoFiles(app) {
-  const dir = join45(storeDir(app), "review_information");
-  if (!existsSync47(dir)) return /* @__PURE__ */ new Set();
+  const dir = join46(storeDir(app), "review_information");
+  if (!existsSync48(dir)) return /* @__PURE__ */ new Set();
   return new Set(readdirSync22(dir).filter((n) => n.endsWith(".txt")));
 }
 function isValidAppStoreSize(w, h) {
@@ -51173,12 +51437,12 @@ function analyzePlayListing(assets) {
   return f;
 }
 function playListingAssets(app, locale = "en-US") {
-  const dir = join45(storeDir(app), "play", locale, "images");
+  const dir = join46(storeDir(app), "play", locale, "images");
   const read = (names) => {
     for (const name of names) {
-      const p = join45(dir, name);
+      const p = join46(dir, name);
       try {
-        if (statSync11(p).isFile()) return { name, bytes: readFileSync55(p) };
+        if (statSync10(p).isFile()) return { name, bytes: readFileSync56(p) };
       } catch {
       }
     }
@@ -51209,26 +51473,26 @@ function analyzeListing(metaFiles, shots) {
   return f;
 }
 function metadataFilesPresent(app, locale = "en-US") {
-  const dir = join45(storeDir(app), "metadata", locale);
-  if (!existsSync47(dir)) return /* @__PURE__ */ new Set();
+  const dir = join46(storeDir(app), "metadata", locale);
+  if (!existsSync48(dir)) return /* @__PURE__ */ new Set();
   return new Set(readdirSync22(dir).filter((n) => n.endsWith(".txt")));
 }
 function listScreenshots(app, locale = "en-US") {
   const out = [];
-  const flat = join45(storeDir(app), "screenshots", locale);
-  if (existsSync47(flat)) {
+  const flat = join46(storeDir(app), "screenshots", locale);
+  if (existsSync48(flat)) {
     for (const png of readdirSync22(flat).filter((n) => n.endsWith(".png"))) {
-      const sz = pngSize(readFileSync55(join45(flat, png)));
+      const sz = pngSize(readFileSync56(join46(flat, png)));
       if (sz) out.push({ name: png, w: sz.w, h: sz.h });
     }
   }
-  const legacy = join45(storeDir(app), "metadata", locale, "screenshots");
-  if (existsSync47(legacy)) {
+  const legacy = join46(storeDir(app), "metadata", locale, "screenshots");
+  if (existsSync48(legacy)) {
     for (const deviceDir of readdirSync22(legacy)) {
-      const d = join45(legacy, deviceDir);
-      if (!statSync11(d).isDirectory()) continue;
+      const d = join46(legacy, deviceDir);
+      if (!statSync10(d).isDirectory()) continue;
       for (const png of readdirSync22(d).filter((n) => n.endsWith(".png"))) {
-        const sz = pngSize(readFileSync55(join45(d, png)));
+        const sz = pngSize(readFileSync56(join46(d, png)));
         if (sz) out.push({ name: `${deviceDir}/${png}`, w: sz.w, h: sz.h });
       }
     }
@@ -51236,13 +51500,13 @@ function listScreenshots(app, locale = "en-US") {
   return out;
 }
 function placeholderHashes2() {
-  const templateIos = join45(appDir("_template"), "ios");
-  if (!existsSync47(templateIos)) return [LEGACY_PLACEHOLDER_SHA2562];
+  const templateIos = join46(appDir("_template"), "ios");
+  if (!existsSync48(templateIos)) return [LEGACY_PLACEHOLDER_SHA2562];
   for (const target of readdirSync22(templateIos)) {
-    const p = join45(templateIos, target, "Assets.xcassets", "AppIcon.appiconset", "icon_1024.png");
+    const p = join46(templateIos, target, "Assets.xcassets", "AppIcon.appiconset", "icon_1024.png");
     try {
-      if (!statSync11(p).isFile()) continue;
-      return [LEGACY_PLACEHOLDER_SHA2562, createHash23("sha256").update(readFileSync55(p)).digest("hex")];
+      if (!statSync10(p).isFile()) continue;
+      return [LEGACY_PLACEHOLDER_SHA2562, createHash23("sha256").update(readFileSync56(p)).digest("hex")];
     } catch {
     }
   }
@@ -51273,12 +51537,12 @@ async function pixelIssues(bytes2) {
   }
 }
 async function appIconState(iosDir) {
-  if (!existsSync47(iosDir)) return { exists: false, isPlaceholder: false, storeIssues: [] };
+  if (!existsSync48(iosDir)) return { exists: false, isPlaceholder: false, storeIssues: [] };
   for (const target of readdirSync22(iosDir)) {
-    const p = join45(iosDir, target, "Assets.xcassets", "AppIcon.appiconset", "icon_1024.png");
+    const p = join46(iosDir, target, "Assets.xcassets", "AppIcon.appiconset", "icon_1024.png");
     try {
-      if (!statSync11(p).isFile()) continue;
-      const bytes2 = readFileSync55(p);
+      if (!statSync10(p).isFile()) continue;
+      const bytes2 = readFileSync56(p);
       const hash = createHash23("sha256").update(bytes2).digest("hex");
       const pixels = await pixelIssues(bytes2);
       return {
@@ -51348,14 +51612,14 @@ __export(credential_profile_exports, {
   profilePath: () => profilePath,
   resolveStoreCredentials: () => resolveStoreCredentials
 });
-import { existsSync as existsSync48, readFileSync as readFileSync56 } from "node:fs";
+import { existsSync as existsSync49, readFileSync as readFileSync57 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join46 } from "node:path";
+import { join as join47 } from "node:path";
 function credentialsDir(home = homedir6()) {
-  return join46(home, ".himalaya", "store-credentials");
+  return join47(home, ".himalaya", "store-credentials");
 }
 function profilePath(name, home = homedir6()) {
-  return join46(credentialsDir(home), `${name}.json`);
+  return join47(credentialsDir(home), `${name}.json`);
 }
 function parseProfile(text2, label2) {
   let doc;
@@ -51382,8 +51646,8 @@ function resolveStoreCredentials(opts) {
   const { app, cfg } = opts;
   const env = opts.env ?? process.env;
   const home = opts.home ?? homedir6();
-  const read = opts.readProfile ?? ((p) => readFileSync56(p, "utf8"));
-  const exists = opts.profileExists ?? existsSync48;
+  const read = opts.readProfile ?? ((p) => readFileSync57(p, "utf8"));
+  const exists = opts.profileExists ?? existsSync49;
   const ios = cfg.ios ?? {};
   const flagName = opts.profileFlag?.trim();
   const named = flagName || ios.credentialProfile?.trim();
@@ -51457,7 +51721,7 @@ __export(version_exports, {
   setAndroidVersion: () => setAndroidVersion,
   setIosVersion: () => setIosVersion
 });
-import { readFileSync as readFileSync57, writeFileSync as writeFileSync19 } from "node:fs";
+import { readFileSync as readFileSync58, writeFileSync as writeFileSync19 } from "node:fs";
 function readIosVersion(projectYml) {
   const marketing = matchScalar(projectYml, "CFBundleShortVersionString");
   const build2 = matchScalar(projectYml, "CFBundleVersion");
@@ -51515,8 +51779,8 @@ function setAndroidVersion(gradle, v) {
 function bumpVersion(app, opts) {
   const iosPath = iosProjectYml(app);
   const gradlePath = androidGradle(app);
-  const iosYml = readFileSync57(iosPath, "utf8");
-  const gradle = readFileSync57(gradlePath, "utf8");
+  const iosYml = readFileSync58(iosPath, "utf8");
+  const gradle = readFileSync58(gradlePath, "utf8");
   const current = readIosVersion(iosYml);
   const next = {
     marketing: opts.marketing ?? current.marketing,
@@ -51533,7 +51797,7 @@ var init_version = __esm({
 });
 
 // ../store-release/register-bundle.ts
-import { readFileSync as readFileSync58 } from "node:fs";
+import { readFileSync as readFileSync59 } from "node:fs";
 import { createPrivateKey, sign } from "node:crypto";
 function b64url2(b) {
   return Buffer.from(b).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
@@ -51551,7 +51815,7 @@ function bundleIdBody(identifier, name, platform = "IOS") {
 async function registerBundleId(opts) {
   const env = requireEnv(["ASC_KEY_ID", "ASC_ISSUER_ID", "ASC_KEY_PATH"]);
   assertCredentialOutsideRepo("ASC_KEY_PATH", env.ASC_KEY_PATH);
-  const jwt = ascJwt(env.ASC_KEY_ID, env.ASC_ISSUER_ID, readFileSync58(env.ASC_KEY_PATH, "utf8"), Math.floor(Date.now() / 1e3));
+  const jwt = ascJwt(env.ASC_KEY_ID, env.ASC_ISSUER_ID, readFileSync59(env.ASC_KEY_PATH, "utf8"), Math.floor(Date.now() / 1e3));
   const res = await fetch(`${ASC_API}/v1/bundleIds`, {
     method: "POST",
     headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
@@ -51605,7 +51869,7 @@ __export(asc_status_exports, {
   ascStatus: () => ascStatus,
   buildVerdict: () => buildVerdict
 });
-import { readFileSync as readFileSync59 } from "node:fs";
+import { readFileSync as readFileSync60 } from "node:fs";
 function buildVerdict(builds) {
   if (!builds.length) {
     return "NO builds registered \u2014 if you uploaded recently and it's been >15 min, the binary was REJECTED IN PROCESSING (reason is email-only; run validate-binary.ts / scan-purpose-strings.ts to reproduce it).";
@@ -51619,7 +51883,7 @@ function buildVerdict(builds) {
 function client2(creds) {
   const env = creds ?? requireEnv(["ASC_KEY_ID", "ASC_ISSUER_ID", "ASC_KEY_PATH"]);
   assertCredentialOutsideRepo("ASC_KEY_PATH", env.ASC_KEY_PATH);
-  const jwt = ascJwt(env.ASC_KEY_ID, env.ASC_ISSUER_ID, readFileSync59(env.ASC_KEY_PATH, "utf8"), Math.floor(Date.now() / 1e3));
+  const jwt = ascJwt(env.ASC_KEY_ID, env.ASC_ISSUER_ID, readFileSync60(env.ASC_KEY_PATH, "utf8"), Math.floor(Date.now() / 1e3));
   return async (path) => {
     const r = await fetch(`${ASC}${path}`, { headers: { Authorization: `Bearer ${jwt}` } });
     return { status: r.status, json: await r.json().catch(() => ({})) };
@@ -53635,11 +53899,11 @@ function suggestKeys(args) {
       if (rule.tab && allowed2(rule) && rule.re.test(label2)) set(rule.tab, label2);
     }
   }
-  for (const section of sections) {
+  for (const section2 of sections) {
     for (const rule of KEY_RULES) {
-      if (!allowed2(rule) || !rule.re.test(section.heading)) continue;
-      set(rule.title, section.heading);
-      if (section.body) set(rule.subtitle, section.body);
+      if (!allowed2(rule) || !rule.re.test(section2.heading)) continue;
+      set(rule.title, section2.heading);
+      if (section2.body) set(rule.subtitle, section2.body);
     }
   }
   if (tagline) set("home.onboardingBody", tagline.text);
@@ -53672,12 +53936,12 @@ function buildCopyChapter(args) {
         pageUrl: page.url
       }))
     );
-    for (const section of candidates) {
+    for (const section2 of candidates) {
       if (faq.length >= CAP.faq) break;
-      if (!section.heading || !section.body || !/\?\s*$/.test(section.heading)) continue;
-      if (about && section.body === about) continue;
-      if (faq.some((f) => f.q.toLowerCase() === section.heading.toLowerCase())) continue;
-      faq.push({ q: section.heading, a: section.body, pageUrl: section.pageUrl });
+      if (!section2.heading || !section2.body || !/\?\s*$/.test(section2.heading)) continue;
+      if (about && section2.body === about) continue;
+      if (faq.some((f) => f.q.toLowerCase() === section2.heading.toLowerCase())) continue;
+      faq.push({ q: section2.heading, a: section2.body, pageUrl: section2.pageUrl });
     }
   }
   const testimonials = dedupe2(pages.flatMap((p) => p.testimonials ?? []), CAP.testimonials);
@@ -54709,10 +54973,10 @@ function isFetchableFontUrl(raw) {
   return true;
 }
 function resolveAll(hostname) {
-  return new Promise((resolve41, reject) => {
+  return new Promise((resolve42, reject) => {
     dnsLookup(hostname, { all: true, verbatim: true }, (err, addresses) => {
       if (err) reject(err);
-      else resolve41(addresses);
+      else resolve42(addresses);
     });
   });
 }
@@ -54720,13 +54984,13 @@ function withAbort(start, signal, what) {
   if (signal?.aborted) return Promise.reject(new Error(`${what} aborted`));
   const work = start();
   if (!signal) return work;
-  return new Promise((resolve41, reject) => {
+  return new Promise((resolve42, reject) => {
     const onAbort = () => reject(new Error(`${what} aborted`));
     signal.addEventListener("abort", onAbort, { once: true });
-    work.then(resolve41, reject).finally(() => signal.removeEventListener("abort", onAbort));
+    work.then(resolve42, reject).finally(() => signal.removeEventListener("abort", onAbort));
   });
 }
-async function pinAddress(url, resolve41 = resolveAll, signal) {
+async function pinAddress(url, resolve42 = resolveAll, signal) {
   const host = url.hostname.replace(/^\[|\]$/g, "");
   if (ipv4Octets(host)) {
     if (isBlockedAddress(host)) throw new Error(`${host} is a blocked address`);
@@ -54736,7 +55000,7 @@ async function pinAddress(url, resolve41 = resolveAll, signal) {
     if (isBlockedAddress(host)) throw new Error(`${host} is a blocked address`);
     return { address: host, family: 6 };
   }
-  const addresses = await withAbort(() => resolve41(host), signal, `${host} lookup`);
+  const addresses = await withAbort(() => resolve42(host), signal, `${host} lookup`);
   if (!addresses.length) throw new Error(`${host} resolved to no address`);
   const blocked = addresses.filter((a) => isBlockedAddress(a.address)).map((a) => a.address);
   if (blocked.length) throw new Error(`${host} resolves to a blocked address (${blocked.join(", ")})`);
@@ -54759,7 +55023,7 @@ function decodedBody(res, hasBody) {
   return out;
 }
 function requestOnce(url, pinned, init) {
-  return new Promise((resolve41, reject) => {
+  return new Promise((resolve42, reject) => {
     const headers2 = { host: url.host, "accept-encoding": "identity" };
     new Headers(init.headers ?? {}).forEach((value, key2) => {
       if (key2.toLowerCase() !== "host") headers2[key2] = value;
@@ -54793,7 +55057,7 @@ function requestOnce(url, pinned, init) {
           reject(err);
           return;
         }
-        resolve41(new Response(body, { status, statusText: res.statusMessage ?? "", headers: out }));
+        resolve42(new Response(body, { status, statusText: res.statusMessage ?? "", headers: out }));
       }
     );
     req.on("error", reject);
@@ -54902,7 +55166,7 @@ var init_brand_font = __esm({
 
 // src/site-analyze/write-artifacts.ts
 import { mkdirSync as mkdirSync23, writeFileSync as writeFileSync20 } from "node:fs";
-import { join as join47 } from "node:path";
+import { join as join48 } from "node:path";
 function attachVeloSources(book, sources, put) {
   const byPath = new Map((sources ?? []).map((s) => [s.path, s.text]));
   for (const f of book.velo.files) {
@@ -55057,12 +55321,12 @@ async function downloadMedia(book, fetchImpl, put) {
 }
 async function writeBusinessBook(result, opts) {
   const out = opts.outDir;
-  mkdirSync23(join47(out, "evidence/pages"), { recursive: true });
-  mkdirSync23(join47(out, "media/catalog"), { recursive: true });
+  mkdirSync23(join48(out, "evidence/pages"), { recursive: true });
+  mkdirSync23(join48(out, "media/catalog"), { recursive: true });
   const files = [];
   const put = (rel, body) => {
-    const p = join47(out, rel);
-    mkdirSync23(join47(p, ".."), { recursive: true });
+    const p = join48(out, rel);
+    mkdirSync23(join48(p, ".."), { recursive: true });
     writeFileSync20(p, body);
     files.push(rel);
   };
@@ -55393,15 +55657,15 @@ var init_home_descriptor = __esm({
 });
 
 // src/site-analyze/apply.ts
-import { existsSync as existsSync49, readFileSync as readFileSync60, writeFileSync as writeFileSync21, copyFileSync as copyFileSync3, mkdirSync as mkdirSync24, realpathSync as realpathSync5, statSync as statSync12 } from "node:fs";
-import { dirname as dirname27, isAbsolute as isAbsolute3, join as join48, resolve as resolve38, sep as sep10 } from "node:path";
+import { existsSync as existsSync50, readFileSync as readFileSync61, writeFileSync as writeFileSync21, copyFileSync as copyFileSync3, mkdirSync as mkdirSync24, realpathSync as realpathSync5, statSync as statSync11 } from "node:fs";
+import { dirname as dirname28, isAbsolute as isAbsolute4, join as join49, resolve as resolve39, sep as sep10 } from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
 function unpairedRedirectNote(overlay) {
   if (!overlay.wix?.clientId || overlay.wix.redirectUri) return void 0;
   return `no OAuth redirect paired with client ${overlay.wix.clientId} \u2014 the app (and prepare:customer) will refuse to start until one is set. Register it with \`himi site client ensure --site ${overlay.siteId?.trim() || "<msid>"} --redirect-uri <uri> --yes\`, then re-run analyze with \`--redirect-uri <uri>\` (or export HIMI_BRANDED_LITE_WIX_REDIRECT_URI)`;
 }
 function posix2(p) {
-  return resolve38(p).replace(/\\/g, "/");
+  return resolve39(p).replace(/\\/g, "/");
 }
 function committedShellProvisioning(path) {
   return committedShellFor(posix2(path));
@@ -55409,8 +55673,8 @@ function committedShellProvisioning(path) {
 function findRepoRoot(cwd) {
   let dir = cwd;
   for (let i = 0; i < 8; i++) {
-    if (SHELL_NAMES2.some((name) => existsSync49(join48(dir, shellAppDir(name), "package.json")))) return dir;
-    const next = dirname27(dir);
+    if (SHELL_NAMES2.some((name) => existsSync50(join49(dir, shellAppDir(name), "package.json")))) return dir;
+    const next = dirname28(dir);
     if (next === dir) break;
     dir = next;
   }
@@ -55435,7 +55699,7 @@ function assertNotCommitted(path, forbidden) {
       `refusing to overwrite committed ${committedProvisioningPath(committed)} \u2014 use prepare:customer --contract`
     );
   }
-  if (forbidden && resolve38(path) === resolve38(forbidden)) {
+  if (forbidden && resolve39(path) === resolve39(forbidden)) {
     const named = committedShellProvisioning(forbidden);
     throw new Error(
       `refusing to overwrite committed ${named ? committedProvisioningPath(named) : forbidden} \u2014 pass a content-package provisioning.json or use prepare:customer --contract`
@@ -55477,24 +55741,24 @@ function mergeCustomerOwned(committed, overlay) {
 }
 function buildMergedContract(options) {
   const { appDir: appDir2, packageDir, overlay } = options;
-  const committedPath = join48(appDir2, "provisioning.json");
-  if (!existsSync49(committedPath)) {
+  const committedPath = join49(appDir2, "provisioning.json");
+  if (!existsSync50(committedPath)) {
     throw new Error(`shell has no committed provisioning.json at ${committedPath} to build a contract from`);
   }
-  const committed = JSON.parse(readFileSync60(committedPath, "utf8"));
+  const committed = JSON.parse(readFileSync61(committedPath, "utf8"));
   const merged = mergeCustomerOwned(committed, overlay);
   const overlayFontFamily = (overlay.branding ?? {}).fontFamily;
   const branding = merged.branding ?? {};
   const staged = [];
   const contained = (root, rel) => {
-    if (isAbsolute3(rel)) return void 0;
-    const full = resolve38(root, rel);
-    return full.startsWith(resolve38(root) + sep10) ? full : void 0;
+    if (isAbsolute4(rel)) return void 0;
+    const full = resolve39(root, rel);
+    return full.startsWith(resolve39(root) + sep10) ? full : void 0;
   };
   const stage = (fromRel, toRel) => {
     const from = contained(packageDir, fromRel);
-    const to = contained(join48(appDir2, STAGED), toRel.slice(STAGED.length + 1));
-    if (!from || !to || !existsSync49(from)) return void 0;
+    const to = contained(join49(appDir2, STAGED), toRel.slice(STAGED.length + 1));
+    if (!from || !to || !existsSync50(from)) return void 0;
     let real;
     let realRoot;
     try {
@@ -55505,8 +55769,8 @@ function buildMergedContract(options) {
     }
     if (!real.startsWith(realRoot + sep10)) return void 0;
     try {
-      if (!statSync12(real).isFile()) return void 0;
-      mkdirSync24(dirname27(to), { recursive: true });
+      if (!statSync11(real).isFile()) return void 0;
+      mkdirSync24(dirname28(to), { recursive: true });
       copyFileSync3(real, to);
     } catch {
       return void 0;
@@ -55516,11 +55780,11 @@ function buildMergedContract(options) {
   };
   const icon = stage("media/icon.png", `${STAGED}/icon.png`);
   if (icon) branding.appIconPath = icon;
-  const facesPath = join48(packageDir, "media/fonts/faces.json");
-  if (existsSync49(facesPath)) {
+  const facesPath = join49(packageDir, "media/fonts/faces.json");
+  if (existsSync50(facesPath)) {
     let faces = [];
     try {
-      const parsed = JSON.parse(readFileSync60(facesPath, "utf8"));
+      const parsed = JSON.parse(readFileSync61(facesPath, "utf8"));
       faces = Array.isArray(parsed) ? parsed : [];
     } catch {
       faces = [];
@@ -55541,20 +55805,20 @@ function buildMergedContract(options) {
   merged.branding = branding;
   const body = `${JSON.stringify(merged, null, 2)}
 `;
-  const path = join48(packageDir, "provisioning.contract.json");
+  const path = join49(packageDir, "provisioning.contract.json");
   writeFileSync21(path, body);
-  const localPath = join48(appDir2, LOCAL_CONTRACT_REL);
-  mkdirSync24(dirname27(localPath), { recursive: true });
+  const localPath = join49(appDir2, LOCAL_CONTRACT_REL);
+  mkdirSync24(dirname28(localPath), { recursive: true });
   writeFileSync21(localPath, body);
   staged.push(localPath);
   return { path, staged };
 }
 async function applyOverlays(input) {
-  const cwd = resolve38(input.cwd);
+  const cwd = resolve39(input.cwd);
   const shell = input.shell ?? DEFAULT_BRANDABLE_SHELL;
   assertKnownShell(shell);
-  const overlay = JSON.parse(readFileSync60(input.overlayPath, "utf8"));
-  const tokens = JSON.parse(readFileSync60(input.tokensPath, "utf8"));
+  const overlay = JSON.parse(readFileSync61(input.overlayPath, "utf8"));
+  const tokens = JSON.parse(readFileSync61(input.tokensPath, "utf8"));
   const wrote = [];
   const notes = [];
   const repoRoot2 = findRepoRoot(cwd);
@@ -55564,8 +55828,8 @@ async function applyOverlays(input) {
         `shell "${shell}" cannot bake a customer brand \u2014 it ships no prepare:customer script`
       );
     }
-    const appDir2 = join48(repoRoot2, shellAppDir(shell));
-    const packageDir = dirname27(resolve38(input.overlayPath));
+    const appDir2 = join49(repoRoot2, shellAppDir(shell));
+    const packageDir = dirname28(resolve39(input.overlayPath));
     const { path: contract, staged } = buildMergedContract({ appDir: appDir2, packageDir, overlay });
     wrote.push(...staged);
     const r = spawnSync4("npm", ["run", "prepare:customer", "--", "--contract", contract], {
@@ -55586,10 +55850,10 @@ async function applyOverlays(input) {
       note: `prepare:customer --contract with a merged contract (committed provisioning.json untouched)${unpairedInRepo ? ` \xB7 ${unpairedInRepo}` : ""}`
     };
   }
-  const pkgProv = join48(cwd, "provisioning.json");
+  const pkgProv = join49(cwd, "provisioning.json");
   assertNotCommitted(pkgProv, input.forbiddenProvisioning);
-  if (existsSync49(pkgProv)) {
-    const cur = JSON.parse(readFileSync60(pkgProv, "utf8"));
+  if (existsSync50(pkgProv)) {
+    const cur = JSON.parse(readFileSync61(pkgProv, "utf8"));
     const merged = deepMerge3(cur, overlay);
     writeFileSync21(pkgProv, JSON.stringify(merged, null, 2) + "\n");
     wrote.push(pkgProv);
@@ -55597,17 +55861,17 @@ async function applyOverlays(input) {
     writeFileSync21(pkgProv, JSON.stringify(overlay, null, 2) + "\n");
     wrote.push(pkgProv);
   }
-  const pkgTokens = join48(cwd, "tokens.json");
-  if (existsSync49(pkgTokens) && (tokens.colors || tokens.typography)) {
-    const cur = JSON.parse(readFileSync60(pkgTokens, "utf8"));
+  const pkgTokens = join49(cwd, "tokens.json");
+  if (existsSync50(pkgTokens) && (tokens.colors || tokens.typography)) {
+    const cur = JSON.parse(readFileSync61(pkgTokens, "utf8"));
     const merged = deepMerge3(cur, tokens);
     writeFileSync21(pkgTokens, JSON.stringify(merged, null, 2) + "\n");
     wrote.push(pkgTokens);
   }
   const homeAction = homeRefreshActionId(shell);
-  const homeSrc = join48(cwd, "dev/index.ts");
-  if (homeAction && existsSync49(homeSrc)) {
-    const prev = readFileSync60(homeSrc, "utf8");
+  const homeSrc = join49(cwd, "dev/index.ts");
+  if (homeAction && existsSync50(homeSrc)) {
+    const prev = readFileSync61(homeSrc, "utf8");
     const patched = patchBrandParams(prev, overlay, homeAction);
     let next = patched.src;
     if (!patched.foreign && overlay.installedVerticals?.length) {
@@ -55627,13 +55891,13 @@ async function applyOverlays(input) {
       notes.push(`${patched.unparsed} onAppear params block(s) in ${homeSrc} could not be read \u2014 any brand values inside them were not applied`);
     }
   }
-  if (!input.iconPath || !existsSync49(input.iconPath)) {
-    const book = input.iconPath ? dirname27(dirname27(resolve38(input.iconPath))) : void 0;
+  if (!input.iconPath || !existsSync50(input.iconPath)) {
+    const book = input.iconPath ? dirname28(dirname28(resolve39(input.iconPath))) : void 0;
     notes.push(
       book ? `no icon installed \u2014 ${siteLogoAbsence(book).hint}` : "no icon installed and no business book to say why \u2014 `himi icon generate` draws one from the accent, or `himi icon set <file.png>` installs the customer's own mark"
     );
   }
-  if (input.iconPath && existsSync49(input.iconPath)) {
+  if (input.iconPath && existsSync50(input.iconPath)) {
     try {
       const installed = await installIcon(cwd, input.iconPath, { derivePlay: true });
       wrote.push(...installed.wrote);
@@ -56767,13 +57031,13 @@ __export(cli_exports, {
   runSiteAnalyze: () => runSiteAnalyze,
   runSiteFunctionCli: () => runSiteFunctionCli
 });
-import { readFileSync as readFileSync61 } from "node:fs";
-import { resolve as resolve39 } from "node:path";
+import { readFileSync as readFileSync62 } from "node:fs";
+import { resolve as resolve40 } from "node:path";
 async function runSiteAnalyze(opts) {
   const fetchImpl = opts.fetchImpl ?? fetch;
   const assetFetch = opts.fetchImpl ?? pinnedFetch2;
   const cwd = opts.cwd ?? process.cwd();
-  const outDir = resolve39(cwd, opts.outDir ?? ".himi/business-book");
+  const outDir = resolve40(cwd, opts.outDir ?? ".himi/business-book");
   let ownerAuth;
   let msid;
   try {
@@ -56810,9 +57074,9 @@ async function runSiteAnalyze(opts) {
   if (opts.apply) {
     applied = await applyOverlays({
       cwd,
-      overlayPath: resolve39(outDir, "provisioning.overlay.json"),
-      tokensPath: resolve39(outDir, "tokens.overlay.json"),
-      iconPath: resolve39(outDir, "media/icon.png"),
+      overlayPath: resolve40(outDir, "provisioning.overlay.json"),
+      tokensPath: resolve40(outDir, "tokens.overlay.json"),
+      iconPath: resolve40(outDir, "media/icon.png"),
       shell: opts.shell
     });
     const note = noteWithWarnings(applied.note, warnings);
@@ -56848,8 +57112,8 @@ async function runSiteFunctionCli(opts) {
   const token = opts.token ?? await siteToken(msid);
   let source;
   if (opts.sourcePath) {
-    const p = resolve39(opts.cwd ?? process.cwd(), opts.sourcePath);
-    source = readFileSync61(p, "utf8");
+    const p = resolve40(opts.cwd ?? process.cwd(), opts.sourcePath);
+    source = readFileSync62(p, "utf8");
   }
   let body;
   if (opts.bodyRaw != null) {
@@ -56900,7 +57164,7 @@ async function accountToken2(spawnImpl = spawn4) {
     cached2 = fromEnv;
     return fromEnv;
   }
-  const token = await new Promise((resolve41, reject) => {
+  const token = await new Promise((resolve42, reject) => {
     let child;
     try {
       child = spawnImpl("wix", ["token"]);
@@ -56929,7 +57193,7 @@ async function accountToken2(spawnImpl = spawn4) {
     const scan = (d) => {
       out += String(d);
       const m = out.match(TOKEN_RE2);
-      if (m) done(() => resolve41(m[0]));
+      if (m) done(() => resolve42(m[0]));
     };
     child.stdout?.on("data", scan);
     child.stderr?.on("data", scan);
@@ -57106,7 +57370,7 @@ __export(site_create_exports, {
   runSiteList: () => runSiteList,
   writeProvisioningBinding: () => writeProvisioningBinding
 });
-import { existsSync as existsSync50, readFileSync as readFileSync62, writeFileSync as writeFileSync22 } from "node:fs";
+import { existsSync as existsSync51, readFileSync as readFileSync63, writeFileSync as writeFileSync22 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 function oauthClientName(projectName) {
   return `${projectName} client`;
@@ -57255,7 +57519,7 @@ async function runSiteCreate(opts) {
   if (!wantOauthApp) return { ...base, nextSteps: nextSteps(metaSiteId) };
   return { ...base, clientId, redirectUri, nextSteps: nextSteps(metaSiteId, clientId) };
 }
-function writeProvisioningBinding(target, binding2, fs = { existsSync: existsSync50, readFileSync: readFileSync62, writeFileSync: writeFileSync22 }) {
+function writeProvisioningBinding(target, binding2, fs = { existsSync: existsSync51, readFileSync: readFileSync63, writeFileSync: writeFileSync22 }) {
   const msid = binding2.siteId;
   const path = resolvePath2(target);
   const committed = committedShellProvisioning(path);
@@ -57589,11 +57853,11 @@ var init_site_oauth_client = __esm({
 });
 
 // src/cli.ts
-import { mkdtempSync as mkdtempSync4, readFileSync as readFileSync63, mkdirSync as mkdirSync25, writeFileSync as writeFileSync23, existsSync as existsSync51, rmSync as rmSync9, readdirSync as readdirSync23, statSync as statSync13, lstatSync as lstatSync5 } from "node:fs";
+import { mkdtempSync as mkdtempSync4, readFileSync as readFileSync64, mkdirSync as mkdirSync25, writeFileSync as writeFileSync23, existsSync as existsSync52, rmSync as rmSync9, readdirSync as readdirSync23, statSync as statSync12, lstatSync as lstatSync5 } from "node:fs";
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash24 } from "node:crypto";
 import { tmpdir as tmpdir5 } from "node:os";
-import { join as join49, resolve as resolve40, basename as basename9, dirname as dirname28 } from "node:path";
+import { join as join50, resolve as resolve41, basename as basename9, dirname as dirname29 } from "node:path";
 import { fileURLToPath as fileURLToPath21 } from "node:url";
 
 // ../serve-cli/src/client.ts
@@ -59109,7 +59373,7 @@ async function browserLogin(opts) {
   const log = opts.log ?? (() => {
   });
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  return await new Promise((resolve41, reject) => {
+  return await new Promise((resolve42, reject) => {
     let settled = false;
     let loginUrl = "";
     const server = createServer();
@@ -59173,7 +59437,7 @@ async function browserLogin(opts) {
           return;
         }
         res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", connection: "close" }).end(CLOSE_PAGE);
-        finish2(() => resolve41({ token, loginUrl }));
+        finish2(() => resolve42({ token, loginUrl }));
       });
     });
     server.on("error", (err) => finish2(() => reject(err)));
@@ -60583,17 +60847,18 @@ init_crawl_layers();
 // src/ux-audit.ts
 init_wix_gateway_rules();
 init_mobile_ux_contract();
-import { existsSync as existsSync21, mkdirSync as mkdirSync10, readFileSync as readFileSync23, readdirSync as readdirSync11, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join25, relative as relative3, resolve as resolve15 } from "node:path";
-var EVIDENCE_RELATIVE_PATH = ".himi/ux-audit.json";
+init_ux_evidence();
+init_ux_evidence();
+import { existsSync as existsSync22, readFileSync as readFileSync24, readdirSync as readdirSync11 } from "node:fs";
+import { join as join26, relative as relative4, resolve as resolve16 } from "node:path";
 var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".json"]);
 var IGNORED_DIRECTORIES = /* @__PURE__ */ new Set([".git", "node_modules", "dist", ".himi", "coverage"]);
 function issue(issues, strict, code, message, path) {
   issues.push({ code, message, ...path ? { path } : {}, severity: strict ? "error" : "warning" });
 }
-function readText(path) {
+function readText2(path) {
   try {
-    return existsSync21(path) ? readFileSync23(path, "utf8") : null;
+    return existsSync22(path) ? readFileSync24(path, "utf8") : null;
   } catch {
     return null;
   }
@@ -60602,32 +60867,19 @@ function walkSource(dir, root = dir) {
   const found = [];
   for (const entry of readdirSync11(dir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
-      if (!IGNORED_DIRECTORIES.has(entry.name)) found.push(...walkSource(join25(dir, entry.name), root));
+      if (!IGNORED_DIRECTORIES.has(entry.name)) found.push(...walkSource(join26(dir, entry.name), root));
       continue;
     }
     const ext = entry.name.slice(entry.name.lastIndexOf("."));
     if (!SOURCE_EXTENSIONS.has(ext)) continue;
-    const absolute = join25(dir, entry.name);
-    const text2 = readText(absolute);
-    if (text2 !== null) found.push({ path: relative3(root, absolute), text: text2 });
+    const absolute = join26(dir, entry.name);
+    const text2 = readText2(absolute);
+    if (text2 !== null) found.push({ path: relative4(root, absolute), text: text2 });
   }
   return found;
 }
-function parseEvidence(path) {
-  const raw = readText(path);
-  if (raw === null) return { evidence: null };
-  try {
-    const value = JSON.parse(raw);
-    if (value.version !== 1 || !value.platforms || typeof value.platforms !== "object") {
-      return { evidence: null, error: "must be an object with version: 1 and a platforms object" };
-    }
-    return { evidence: value };
-  } catch (error) {
-    return { evidence: null, error: `is not valid JSON: ${error.message}` };
-  }
-}
 function blankMatrixRows(text2) {
-  const acceptance = text2.match(/## Implementation acceptance\s*([\s\S]*?)(?=\n##\s|$)/i)?.[1] ?? "";
+  const acceptance = mobileUxSection(mobileUxDocumentBody(text2), "Implementation acceptance") ?? "";
   return /\|\s*(?:Ready|Empty|Add\s*\/\s*edit|Saved\s*\/\s*completed|Error\s*\/\s*recovery)\s*\|\s*\|\s*\|\s*\|\s*\|/i.test(acceptance);
 }
 function usesAppNetwork(source) {
@@ -60635,40 +60887,41 @@ function usesAppNetwork(source) {
   return source.some(({ text: text2 }) => /\bwixApi\b|(?:from|import)\s*["']@(?:himalaya|wix\/himalaya)\/wix-[^"']+["']/.test(code(text2)));
 }
 function auditUx(content, strict = false) {
-  const dir = resolve15(content);
+  const dir = resolve16(content);
   const issues = [];
-  const evidencePath = join25(dir, EVIDENCE_RELATIVE_PATH);
-  const spec = readText(join25(dir, "SPEC.md"));
-  const mobile = readText(join25(dir, "MOBILE-UX.md"));
+  const evidencePath = join26(dir, UX_EVIDENCE_PATH);
+  const parsed = parseEvidence(evidencePath);
+  const renderedWidths = renderEvidenceEntries(parsed.evidence).map((entry) => entry.width);
+  const spec = readText2(join26(dir, "SPEC.md"));
+  const mobile = readText2(join26(dir, "MOBILE-UX.md"));
   if (!spec) issue(issues, strict, "missing-spec", "SPEC.md is missing; define the customer task before calling this UX-ready.", "SPEC.md");
   if (!mobile) {
     issue(issues, strict, "missing-mobile-ux", "MOBILE-UX.md is missing; add the mobile state and platform contract.", "MOBILE-UX.md");
   } else {
-    for (const finding of mobileUxMarkerFindings(mobile)) issue(issues, strict, finding.code, finding.message, "MOBILE-UX.md");
+    for (const finding of mobileUxMarkerFindings(mobile, renderedWidths)) issue(issues, strict, finding.code, finding.message, "MOBILE-UX.md");
     if (blankMatrixRows(mobile)) issue(issues, strict, "blank-acceptance-matrix", "The seeded acceptance rows are still blank; replace them with this app's flows and visible results.", "MOBILE-UX.md");
   }
-  const parsed = parseEvidence(evidencePath);
   if (parsed.error) {
-    issues.push({ code: "invalid-native-evidence", message: `${EVIDENCE_RELATIVE_PATH} ${parsed.error}.`, path: EVIDENCE_RELATIVE_PATH, severity: "error" });
+    issues.push({ code: "invalid-native-evidence", message: `${UX_EVIDENCE_PATH} ${parsed.error}.`, path: UX_EVIDENCE_PATH, severity: "error" });
   }
   for (const platform of ["ios", "android"]) {
     const record2 = parsed.evidence?.platforms[platform];
     if (!record2) {
-      issue(issues, strict, `missing-${platform}-audit`, `No ${platform} native audit is recorded. Use \`himi ux record --platform ${platform} \u2026\` after driving the installed app.`, EVIDENCE_RELATIVE_PATH);
+      issue(issues, strict, `missing-${platform}-audit`, `No ${platform} native audit is recorded. Use \`himi ux record --platform ${platform} \u2026\` after driving the installed app.`, UX_EVIDENCE_PATH);
       continue;
     }
     if (!["passed", "failed", "unavailable"].includes(record2.status)) {
-      issues.push({ code: `invalid-${platform}-status`, message: `${platform} audit has an invalid status.`, path: EVIDENCE_RELATIVE_PATH, severity: "error" });
+      issues.push({ code: `invalid-${platform}-status`, message: `${platform} audit has an invalid status.`, path: UX_EVIDENCE_PATH, severity: "error" });
     } else if (record2.status === "failed") {
-      issues.push({ code: `${platform}-audit-failed`, message: `${platform} native audit is recorded as failed; fix it or record a justified unavailable platform.`, path: EVIDENCE_RELATIVE_PATH, severity: "error" });
+      issues.push({ code: `${platform}-audit-failed`, message: `${platform} native audit is recorded as failed; fix it or record a justified unavailable platform.`, path: UX_EVIDENCE_PATH, severity: "error" });
     }
     const malformedChecks = record2.checks !== void 0 && !Array.isArray(record2.checks);
     if (malformedChecks || record2.status !== "unavailable" && (record2.checks ?? []).length === 0) {
       const message = malformedChecks ? `${platform} audit has a malformed checks list; it must be an array.` : `${platform} audit needs the checks that were driven.`;
-      issues.push({ code: `missing-${platform}-checks`, message, path: EVIDENCE_RELATIVE_PATH, severity: "error" });
+      issues.push({ code: `missing-${platform}-checks`, message, path: UX_EVIDENCE_PATH, severity: "error" });
     }
     if (record2.status === "unavailable" && !record2.reason?.trim()) {
-      issues.push({ code: `missing-${platform}-reason`, message: `${platform} is unavailable but has no reason.`, path: EVIDENCE_RELATIVE_PATH, severity: "error" });
+      issues.push({ code: `missing-${platform}-reason`, message: `${platform} is unavailable but has no reason.`, path: UX_EVIDENCE_PATH, severity: "error" });
     }
   }
   const source = walkSource(dir);
@@ -60680,12 +60933,12 @@ function auditUx(content, strict = false) {
   const preview = matches(previewControl);
   if (preview) issue(issues, strict, "possible-preview-control", "Possible customer-visible test/demo state control found. Keep scenario controls out of shipping UI, or document a capability-limited fallback.", preview.path);
   if (usesAppNetwork(source)) {
-    const mocksPath = join25(dir, "dev", "net-mocks.json");
-    if (!existsSync21(mocksPath)) {
+    const mocksPath = join26(dir, "dev", "net-mocks.json");
+    if (!existsSync22(mocksPath)) {
       issue(issues, strict, "missing-app-mocks", "This package uses a Wix/network client but has no app-specific dev/net-mocks.json. Add fixtures for dynamic, entitlement, or recovery flows.", "dev/net-mocks.json");
     } else {
       try {
-        const parsed2 = JSON.parse(readFileSync23(mocksPath, "utf8"));
+        const parsed2 = JSON.parse(readFileSync24(mocksPath, "utf8"));
         const errors2 = Array.isArray(parsed2?.rules) ? wixMockRuleErrors(parsed2.rules) : ['missing top-level "rules" array'];
         if (errors2.length) issue(issues, strict, "invalid-app-mocks", `dev/net-mocks.json cannot serve the flows it claims to mock: ${errors2.join("; ")}`, "dev/net-mocks.json");
       } catch (error) {
@@ -60695,49 +60948,33 @@ function auditUx(content, strict = false) {
   }
   const errors = issues.filter((item) => item.severity === "error");
   const warnings = issues.filter((item) => item.severity === "warning");
-  return { ok: errors.length === 0, strict, content: dir, evidencePath: EVIDENCE_RELATIVE_PATH, errors, warnings, counts: { errors: errors.length, warnings: warnings.length } };
-}
-function recordNativeAudit(content, platform, status, checks, reason) {
-  const normalizedChecks = status === "unavailable" ? [] : [...new Set(checks.map((check) => check.trim()).filter(Boolean))];
-  if (status !== "unavailable" && !normalizedChecks.length) {
-    throw new Error("--checks needs at least one comma-separated check (for example: back,keyboard,voiceover)");
-  }
-  if (status === "unavailable" && !reason?.trim()) throw new Error("--reason is required when --status unavailable");
-  const dir = resolve15(content);
-  const path = join25(dir, EVIDENCE_RELATIVE_PATH);
-  const parsed = parseEvidence(path);
-  if (parsed.error) throw new Error(`${EVIDENCE_RELATIVE_PATH} ${parsed.error}`);
-  const evidence = parsed.evidence ?? { version: 1, platforms: {} };
-  evidence.platforms[platform] = { status, checks: normalizedChecks, ...reason?.trim() ? { reason: reason.trim() } : {}, recordedAt: (/* @__PURE__ */ new Date()).toISOString() };
-  mkdirSync10(join25(dir, ".himi"), { recursive: true });
-  writeFileSync9(path, JSON.stringify(evidence, null, 2) + "\n");
-  return evidence;
+  return { ok: errors.length === 0, strict, content: dir, evidencePath: UX_EVIDENCE_PATH, errors, warnings, counts: { errors: errors.length, warnings: warnings.length } };
 }
 
 // src/guides.ts
 init_mobile_ux_contract();
-import { readFileSync as readFileSync24, existsSync as existsSync22, mkdirSync as mkdirSync11, writeFileSync as writeFileSync10, copyFileSync as copyFileSync2 } from "node:fs";
+import { readFileSync as readFileSync25, existsSync as existsSync23, mkdirSync as mkdirSync11, writeFileSync as writeFileSync10, copyFileSync as copyFileSync2 } from "node:fs";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
-import { dirname as dirname15, join as join26, resolve as resolve16 } from "node:path";
-var GUIDES_DIR = resolve16(dirname15(fileURLToPath10(import.meta.url)), "../guides");
+import { dirname as dirname16, join as join27, resolve as resolve17 } from "node:path";
+var GUIDES_DIR = resolve17(dirname16(fileURLToPath10(import.meta.url)), "../guides");
 function guidesAvailable() {
-  return existsSync22(join26(GUIDES_DIR, "index.json"));
+  return existsSync23(join27(GUIDES_DIR, "index.json"));
 }
 function loadIndex() {
-  return JSON.parse(readFileSync24(join26(GUIDES_DIR, "index.json"), "utf8"));
+  return JSON.parse(readFileSync25(join27(GUIDES_DIR, "index.json"), "utf8"));
 }
 function readGuide(id) {
   const meta = loadIndex().guides.find((g) => g.id === id);
   if (!meta) return null;
-  return readFileSync24(join26(GUIDES_DIR, meta.file), "utf8");
+  return readFileSync25(join27(GUIDES_DIR, meta.file), "utf8");
 }
 function loadComponentReference() {
   const idx = loadIndex();
-  return JSON.parse(readFileSync24(join26(GUIDES_DIR, idx.componentReferenceFile), "utf8"));
+  return JSON.parse(readFileSync25(join27(GUIDES_DIR, idx.componentReferenceFile), "utf8"));
 }
 function loadSdkReference() {
   const idx = loadIndex();
-  return JSON.parse(readFileSync24(join26(GUIDES_DIR, idx.sdkReferenceFile), "utf8"));
+  return JSON.parse(readFileSync25(join27(GUIDES_DIR, idx.sdkReferenceFile), "utf8"));
 }
 function buildAgentPrimer() {
   const idx = loadIndex();
@@ -60846,19 +61083,19 @@ function writeAgentContext(targetDir) {
   const idx = loadIndex();
   const files = [];
   const write2 = (rel, body) => {
-    const p = join26(targetDir, rel);
-    mkdirSync11(dirname15(p), { recursive: true });
+    const p = join27(targetDir, rel);
+    mkdirSync11(dirname16(p), { recursive: true });
     writeFileSync10(p, body);
     files.push(rel);
   };
   const copy = (srcRel, destRel) => {
-    const p = join26(targetDir, destRel);
-    mkdirSync11(dirname15(p), { recursive: true });
-    copyFileSync2(join26(GUIDES_DIR, srcRel), p);
+    const p = join27(targetDir, destRel);
+    mkdirSync11(dirname16(p), { recursive: true });
+    copyFileSync2(join27(GUIDES_DIR, srcRel), p);
     files.push(destRel);
   };
   const writeIfMissing = (rel, body) => {
-    if (existsSync22(join26(targetDir, rel))) return;
+    if (existsSync23(join27(targetDir, rel))) return;
     write2(rel, body);
   };
   write2("HIMALAYA.md", buildAgentPrimer());
@@ -60919,8 +61156,8 @@ var str5 = (v) => typeof v === "string" ? v : void 0;
 var num = (v) => typeof v === "string" && v !== "" && Number.isFinite(Number(v)) ? Number(v) : void 0;
 function embeddedTemplateCatalog() {
   return availableTemplates().map((name) => {
-    const path = join49(templateSourceDir(name), TEMPLATE_META_FILE);
-    const meta = JSON.parse(readFileSync63(path, "utf8"));
+    const path = join50(templateSourceDir(name), TEMPLATE_META_FILE);
+    const meta = JSON.parse(readFileSync64(path, "utf8"));
     if (!meta || typeof meta.title !== "string" || typeof meta.description !== "string" || !Array.isArray(meta.tags)) {
       throw new Error(`${path} must be { title: string, description: string, tags: string[], category?: string }`);
     }
@@ -61377,7 +61614,7 @@ var COMMANDS = [
   { name: "functions", summary: "inspect/invoke server functions and operate durable jobs or schedules", required: "list|describe|openapi|invoke | jobs list|get|cancel|retry|dlq | schedule describe|invoke [--app <a>] [--environment preview|production] [--release <id>]" },
   { name: "eject", summary: "take ownership of a shared flow module (auth|checkout|screens): copies its source into tier5-src/_ejected/ and repoints this package's imports at the copy. The ladder's escape hatch \u2014 for when the factory options cannot express what you need. AFTER EJECTING, CENTRAL FIXES NO LONGER REACH THIS APP, including future corrections to the fail-closed entitlement and confirm-the-session rules. The floor is unaffected: credentials still go only through the native auth actions and money only through the cashier rail.", required: "<auth|checkout|screens> [--content <dir>]" },
   { name: "validate", summary: "lint the content package (no push): fixed-contract TypeScript checking for tier5-src workers + schema/proto + token refs + component allowlist + $service bindings + strict-enum foot-guns + capability decls + worker boot dry-run + build/compile failures. Type issues are advisory warnings normally; --strict promotes them and hygiene warnings to errors. Exit 1 on any error. Off-repo, the CLI supplies its compiler and SDK declarations.", required: "[--content <dir>] [--strict]" },
-  { name: "test", summary: "DERIVED behavioral crawl \u2014 no test files to write. Boots each screen's real worker, replays its onAppear, then dispatches every action site the descriptor already declares (each from a fresh boot) and checks a narrow set of unambiguous invariants: no uncaught throw, never stuck on `loading`, no `$service:` token or NaN/undefined/[object Object] reaching visible text, no binding aimed at state the worker never defines, no nav param silently dropped, no dead nav target. Catches what validate/render cannot \u2014 a WRONG REDUCER passes both with ok:true. Runs the worker in a DEVICE-PARITY sandbox (no setTimeout/setInterval, as on JSC/WebView) so a bundle that would die on device fails here. Crawls on HERMETIC DATA by default \u2014 zero network: the app's own dev/net-mocks.json first (--net <file> overrides), then the config's CMS `seed:` rows, then a canned fixture of frozen real vertical responses shipped with the CLI (exercises code paths, not API-contract truth) \u2014 so the success/mapping path runs, not just the failure UI. Two boot-only HOSTILE passes (every list empty; every request 500) then check the failure/empty day \u2014 corpus-proven, so their findings are errors. NAV EDGES are followed too: every himi.open site ($item params resolved against row 0 of its list, $service against worker state) and worker _nav directive is harvested, and each baked target is booted WITH the params the source sends \u2014 detail screens finally run their content arm; edge findings are errors tagged edge:<source>. --native runs both real native decoders over the exact baked JSON bytes; --native ios or --native android selects one. It is explicit and needs the selected local toolchain. Default runs name missing native verdicts in the coverage ledger. --offline strips all data layers (the old reject-all axis); --no-hostile skips the hostile passes. --record (EXPLICIT, never automatic) refreshes dev/net-mocks.json from live reads first: it boots each screen (load + root onAppear ONLY \u2014 nothing the app's own launch would not fire; the tap/action crawl never sees the live transport, and only proven reads \u2014 GET, or read-shaped POST (/query, /search, /list*, \u2026) \u2014 ever reach the wire), freezes the round-trips, then crawls hermetically on the fresh fixture; record against a QA site, not production. Nodes it cannot judge headless are named, never silently passed. Exit 1 on any error. The CLI carries the authoring runtime off-repo; no per-app SDK install is required. --browser runs the whole loop (build \u2192 extract \u2192 validate \u2192 render \u2192 test) in YOUR browser instead of here, so the source never reaches a pod: it opens one screen's worker + descriptor in a tab, blocks on a loopback callback, and prints the report it posts back. One screen per tab \u2014 name it. --no-open prints the URL rather than launching a browser (SSH); --timeout <ms> bounds the wait, which matters because the page has no execution deadline of its own and an infinite loop in the worker hangs the tab.", required: "[<screenId>\u2026] [--content <dir>] [--net <file>] [--budget <ms>] [--deep [n]] [--record] [--native [ios|android]] [--no-shots] [--offline] [--no-hostile] [--all-screens] [--browser] [--no-open] [--timeout <ms>] [--json]" },
+  { name: "test", summary: "DERIVED behavioral crawl \u2014 no test files to write. Boots each screen's real worker, replays its onAppear, then dispatches every action site the descriptor already declares (each from a fresh boot) and checks a narrow set of unambiguous invariants: no uncaught throw, never stuck on `loading`, no `$service:` token or NaN/undefined/[object Object] reaching visible text, no binding aimed at state the worker never defines, no nav param silently dropped, no dead nav target. Catches what validate/render cannot \u2014 a WRONG REDUCER passes both with ok:true. Runs the worker in a DEVICE-PARITY sandbox (no setTimeout/setInterval, as on JSC/WebView) so a bundle that would die on device fails here. Crawls on HERMETIC DATA by default \u2014 zero network: the app's own dev/net-mocks.json first (--net <file> overrides), then the config's CMS `seed:` rows, then a canned fixture of frozen real vertical responses shipped with the CLI (exercises code paths, not API-contract truth) \u2014 so the success/mapping path runs, not just the failure UI. Two boot-only HOSTILE passes (every list empty; every request 500) then check the failure/empty day \u2014 corpus-proven, so their findings are errors. NAV EDGES are followed too: every himi.open site ($item params resolved against row 0 of its list, $service against worker state) and worker _nav directive is harvested, and each baked target is booted WITH the params the source sends \u2014 detail screens finally run their content arm; edge findings are errors tagged edge:<source>. --native runs both real native decoders over the exact baked JSON bytes; --native ios or --native android selects one. It is explicit, runs only from a Himalaya SOURCE CHECKOUT (the decoder oracles are that tree's own HimalayaCore Swift package and Gradle harness, which a published install does not ship), and needs the selected local toolchain. From a source checkout, default runs name missing native verdicts in the coverage ledger; elsewhere the ledger stays silent about them rather than offering a remedy you cannot run. --offline strips all data layers (the old reject-all axis); --no-hostile skips the hostile passes. --record (EXPLICIT, never automatic) refreshes dev/net-mocks.json from live reads first: it boots each screen (load + root onAppear ONLY \u2014 nothing the app's own launch would not fire; the tap/action crawl never sees the live transport, and only proven reads \u2014 GET, or read-shaped POST (/query, /search, /list*, \u2026) \u2014 ever reach the wire), freezes the round-trips, then crawls hermetically on the fresh fixture; record against a QA site, not production. Nodes it cannot judge headless are named, never silently passed. Exit 1 on any error. The CLI carries the authoring runtime off-repo; no per-app SDK install is required. --browser runs the whole loop (build \u2192 extract \u2192 validate \u2192 render \u2192 test) in YOUR browser instead of here, so the source never reaches a pod: it opens one screen's worker + descriptor in a tab, blocks on a loopback callback, and prints the report it posts back. One screen per tab \u2014 name it. --no-open prints the URL rather than launching a browser (SSH); --timeout <ms> bounds the wait, which matters because the page has no execution deadline of its own and an infinite loop in the worker hangs the tab.", required: "[<screenId>\u2026] [--content <dir>] [--net <file>] [--budget <ms>] [--deep [n]] [--record] [--native [ios|android]] [--no-shots] [--offline] [--no-hostile] [--all-screens] [--browser] [--no-open] [--timeout <ms>] [--json]" },
   { name: "ux", summary: "audit or record mobile UX evidence. `audit` checks the public-safe contract, seeded blank acceptance rows, placeholder source copy, app-specific mocks, and iOS/Android audit records. It warns while existing templates migrate; `--strict` promotes missing evidence. `record` stores checks performed on an installed iOS/Android build: `--checks` is required for passed|failed and empty for unavailable, which drove nothing and needs a `--reason` instead.", required: "audit [--content <dir>] [--strict] [--json] | record --content <dir> --platform ios|android --status passed|failed|unavailable [--checks back,keyboard,...] [--reason <text>]" },
   { name: "render", summary: "headless-render a screen with the web renderer: render-tree + diagnostics, optional --png <file>, --scheme dark, --tree. Local by default (content dir). Pass --remote --app --release to hit GET /v1/preview/\u2026/render on the serve plane after a push. Boots the worker so $service bindings resolve; --static raw bindings; --live real Wix fetches; --state injects worker state; --input supplies pre-boot navigation params; --width/--device for PNG viewport; --rtl for dir=rtl + $env:isRTL.", required: "<screenId> [--content <dir>] [--scheme dark] [--png <file>] [--tree] [--static] [--live] [--state <json|file>] [--input <json|file>] [--width <px> | --device <name>] [--rtl] [--remote --app --release]" },
   { name: "cms", summary: "inspect, provision, and seed the app's CMS (Wix Data) collections, declared as a `cms` block in config.ts. `query` is READ-ONLY \u2014 by default it fetches ONLY the physical ids `config.ts` declares (item counts + schema drift) and reports `siteScanned: false`; it never lists the site, so an UNDECLARED `himi_<app>_` collection this app owns is not reached without `--all`. `--all` SCANS the site \u2014 every collection it lists is labeled `owned`/`adopted`/`foreign`, and it describes every foreign one \u2014 id, non-system field keys + types, and the site's read role \u2014 so an app with no `cms` block at all can DISCOVER a collection to adopt (`--all` is the one case where a missing `cms` block is not 'nothing to do'). Foreign collections are described up to a cap and are never item-counted (`itemCount: null`), because a row count is one query each; `foreign.count` is how many the scan LISTED \u2014 NOT a site census, since the list endpoint is paged and is not followed \u2014 and `foreign.truncated` says how many of those went undescribed, while `unlistedCollections` reports what the listing itself left out (from Wix's own paging total). The scan is OWNER-scoped \u2014 it needs --site <msid> (or WIX_SITE_ID) plus owner auth via `wix token`; a visitor token can read a public collection's ITEMS but can never enumerate collections, so there is no tokenless discovery path. `create` reconciles declared collections additively and idempotently, and REFUSES any id outside the app's `himi_<app>_` namespace, so it is safe against a production site. It reports declared-vs-site `permissionDrift` but never writes permissions unless asked with --apply-permissions, so a field reconcile can't silently revert access control changed in the dashboard. `seed` inserts the git-tracked `seed:` rows into EMPTY owned collections (--force to add to a non-empty one; --ai writes placeholder rows plus a refinement prompt for you to review). Adopted collections (declared by `wixId`) are read-only and never created, updated, or seeded. Site from --site <msid> or WIX_SITE_ID; owner auth via `wix token`.", required: "query|create|seed [--site <msid>] [--content <dir>] [--all] [--dry-run] [--force] [--allow-destructive] [--apply-permissions] [--only <id>] [--ai] [--count <n>]" },
@@ -61423,7 +61660,7 @@ var COMMANDS = [
 ];
 function cliVersion() {
   try {
-    return JSON.parse(readFileSync63(new URL("../package.json", import.meta.url), "utf8")).version ?? "unknown";
+    return JSON.parse(readFileSync64(new URL("../package.json", import.meta.url), "utf8")).version ?? "unknown";
   } catch {
     return "unknown";
   }
@@ -61439,18 +61676,18 @@ function compareVersions2(a, b) {
 }
 function packageVersion(path) {
   try {
-    const version = JSON.parse(readFileSync63(path, "utf8")).version;
+    const version = JSON.parse(readFileSync64(path, "utf8")).version;
     return typeof version === "string" && version ? version : void 0;
   } catch {
     return void 0;
   }
 }
 function resolvedSdkVersion(fromDir = process.cwd(), bundledManifest = new URL("./authoring-runtime/node_modules/@wix/himalaya/package.json", import.meta.url)) {
-  let dir = resolve40(fromDir);
+  let dir = resolve41(fromDir);
   for (; ; ) {
-    const version = packageVersion(join49(dir, "node_modules", "@wix", "himalaya", "package.json"));
+    const version = packageVersion(join50(dir, "node_modules", "@wix", "himalaya", "package.json"));
     if (version) return { version, source: "local" };
-    const parent = dirname28(dir);
+    const parent = dirname29(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -61458,7 +61695,7 @@ function resolvedSdkVersion(fromDir = process.cwd(), bundledManifest = new URL("
   if (bundled) return { version: bundled, source: "bundled" };
   try {
     const root = execFileSync6("npm", ["root", "-g"], { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
-    const version = root ? packageVersion(join49(root, "@wix", "himalaya", "package.json")) : void 0;
+    const version = root ? packageVersion(join50(root, "@wix", "himalaya", "package.json")) : void 0;
     return version ? { version, source: "global" } : {};
   } catch {
     return {};
@@ -61557,6 +61794,40 @@ function previewLogsUrl(serveBase, app, release) {
 function previewTelemetryUrl(serveBase, app, release) {
   return `${serveBase.replace(/\/$/, "")}/v1/telemetry/events?app=${encodeURIComponent(app)}&release=${encodeURIComponent(release)}`;
 }
+function diagnoseBody(body) {
+  const findings = body.findings;
+  if (!Array.isArray(findings)) return body;
+  const messageOf2 = (entry) => {
+    const message = entry && typeof entry === "object" ? entry.message : void 0;
+    return typeof message === "string" ? message : void 0;
+  };
+  const shown2 = new Set(findings.map(messageOf2).filter((message) => message !== void 0));
+  const folded = (value) => Array.isArray(value) && value.length > 0 && value.every((entry) => {
+    const message = messageOf2(entry);
+    return message !== void 0 && shown2.has(message);
+  });
+  const out = {};
+  const emptied = [];
+  for (const [key2, value] of Object.entries(body)) {
+    const fold = (key2 === "issues" || key2 === "failures" || key2 === "warnings") && folded(value);
+    if (fold) emptied.push(key2);
+    out[key2] = fold ? [] : value;
+  }
+  if (emptied.length) out.foldedIntoFindings = emptied;
+  return out;
+}
+var PREVIEW_TOKEN_NOTE = "the preview link carries a bearer with a limited lifetime, and this call has no usable expiry for it \u2014 the plane stated none, or the one it stated is unreadable, already past, or beyond the hour this CLI will reason about. Run the `previewRenew` command printed beside this note \u2014 from the same plane and credentials as this call (any `--serve-url`/`--control-url`/token flags you passed) \u2014 for a fresh one.";
+function previewTokenNote(expiresAt, now = Date.now()) {
+  const at = expiresAt ? Date.parse(expiresAt) : NaN;
+  if (!Number.isFinite(at)) return PREVIEW_TOKEN_NOTE;
+  const seconds = (at - now) / 1e3;
+  if (seconds <= 0 || seconds > 3600) return PREVIEW_TOKEN_NOTE;
+  const minutes = Math.max(1, Math.round(seconds / 60));
+  return `the preview link carries a bearer that expires at ${expiresAt} \u2014 about ${minutes} minute${minutes === 1 ? "" : "s"} from now; run the \`previewRenew\` command printed beside this note \u2014 from the same plane and credentials as this call (any \`--serve-url\`/\`--control-url\`/token flags you passed) \u2014 for a fresh one.`;
+}
+function previewRenewCommand(app, release, target, scope = {}) {
+  return `himi preview --app ${app} --release ${release}` + (scope.screen ? ` --screen ${scope.screen}` : "") + (scope.surface ? ` --surface ${scope.surface}` : "") + (target !== "local" ? ` --target ${target}` : "");
+}
 function previewPlayerLink(app, release, screenId) {
   return buildPlayerPreviewUrl({ app, releaseId: release, screenId, source: "cli" });
 }
@@ -61838,7 +62109,7 @@ async function nativeConfigAdvisories(app, configSource) {
     const { iosProjectYml: iosProjectYml2 } = await Promise.resolve().then(() => (init_paths(), paths_exports));
     const { androidOptedIn: androidOptedIn3, LABEL_IOS_SPLASH: LABEL_IOS_SPLASH2 } = await Promise.resolve().then(() => (init_splash(), splash_exports));
     const iosYmlPath = iosProjectYml2(app);
-    const iosYml = existsSync51(iosYmlPath) ? readFileSync63(iosYmlPath, "utf8") : "";
+    const iosYml = existsSync52(iosYmlPath) ? readFileSync64(iosYmlPath, "utf8") : "";
     let optedIn = iosYml.includes(LABEL_IOS_SPLASH2);
     if (!optedIn) {
       const { androidManifestPath: androidManifestPath3 } = await Promise.resolve().then(() => (init_gen_native_config(), gen_native_config_exports));
@@ -61852,19 +62123,19 @@ async function nativeConfigAdvisories(app, configSource) {
 }
 function readConfigSource(dir) {
   try {
-    return readFileSync63(join49(dir, "config.ts"), "utf8");
+    return readFileSync64(join50(dir, "config.ts"), "utf8");
   } catch {
     return null;
   }
 }
 function writePngFile(path, base64) {
-  mkdirSync25(dirname28(path), { recursive: true });
+  mkdirSync25(dirname29(path), { recursive: true });
   writeFileSync23(path, Buffer.from(base64, "base64"));
   return path;
 }
 async function initFromRemoteTemplate(name, parentDir, template, c) {
-  const dir = resolve40(parentDir, name);
-  if (existsSync51(join49(dir, "himalaya.content.json"))) {
+  const dir = resolve41(parentDir, name);
+  if (existsSync52(join50(dir, "himalaya.content.json"))) {
     throw new Error(`content package already exists at ${dir}`);
   }
   const r = await c.fetchTemplateSource(TEMPLATE_APP_PREFIX + template);
@@ -61876,7 +62147,7 @@ async function initFromRemoteTemplate(name, parentDir, template, c) {
   return finishScaffold(materializeSource(archive.files, name, dir), template);
 }
 function contentDir(flags) {
-  return resolve40(str5(flags.content) ?? process.cwd());
+  return resolve41(str5(flags.content) ?? process.cwd());
 }
 function renameRestoredSource(restored, declaredApp, renamed) {
   const text2 = {};
@@ -61907,8 +62178,8 @@ function symlinkDestinationIssue(dest) {
 function restoreDestinationIssue(dest, force) {
   const link = symlinkDestinationIssue(dest);
   if (link) return link;
-  if (!existsSync51(dest)) return null;
-  if (!statSync13(dest).isDirectory()) {
+  if (!existsSync52(dest)) return null;
+  if (!statSync12(dest).isDirectory()) {
     return { error: `${dest} exists and is not a directory`, hint: "pass --out/--name to land somewhere else, or remove the file" };
   }
   if (readdirSync23(dest).length > 0 && !force) {
@@ -61920,10 +62191,10 @@ function restoreDestinationIssue(dest, force) {
   return null;
 }
 function isHimalayaMonorepoCheckout(start) {
-  let dir = resolve40(start);
+  let dir = resolve41(start);
   for (; ; ) {
-    if (existsSync51(join49(dir, "tools", "himi-cli", "src", "cli.ts")) && existsSync51(join49(dir, "core", "serve", "src", "server.ts"))) return true;
-    const parent = dirname28(dir);
+    if (existsSync52(join50(dir, "tools", "himi-cli", "src", "cli.ts")) && existsSync52(join50(dir, "core", "serve", "src", "server.ts"))) return true;
+    const parent = dirname29(dir);
     if (parent === dir) return false;
     dir = parent;
   }
@@ -61953,8 +62224,8 @@ function materializeForPreview(appDir2, slug, displayName) {
   const forBuild = Object.fromEntries(
     Object.entries(files).map(([rel, body]) => [rel, rel === "himalaya.content.json" ? substituteIdentity(body, slug) : body])
   );
-  const repoRoot2 = resolve40(fileURLToPath21(new URL("../../..", import.meta.url)));
-  const dest = join49(repoRoot2, "node_modules", ".cache", "himi-template-preview", slug);
+  const repoRoot2 = resolve41(fileURLToPath21(new URL("../../..", import.meta.url)));
+  const dest = join50(repoRoot2, "node_modules", ".cache", "himi-template-preview", slug);
   rmSync9(dest, { recursive: true, force: true });
   mkdirSync25(dest, { recursive: true });
   materializeSource(forBuild, displayName, dest, slug);
@@ -61962,8 +62233,8 @@ function materializeForPreview(appDir2, slug, displayName) {
 }
 async function appId(dir) {
   try {
-    const { readFileSync: readFileSync64 } = await import("node:fs");
-    const m = JSON.parse(readFileSync64(join49(dir, "himalaya.content.json"), "utf8"));
+    const { readFileSync: readFileSync65 } = await import("node:fs");
+    const m = JSON.parse(readFileSync65(join50(dir, "himalaya.content.json"), "utf8"));
     if (m.name) return m.name;
   } catch {
   }
@@ -61971,8 +62242,8 @@ async function appId(dir) {
 }
 async function contentVisibility(dir) {
   try {
-    const { readFileSync: readFileSync64 } = await import("node:fs");
-    const m = JSON.parse(readFileSync64(join49(dir, "himalaya.content.json"), "utf8"));
+    const { readFileSync: readFileSync65 } = await import("node:fs");
+    const m = JSON.parse(readFileSync65(join50(dir, "himalaya.content.json"), "utf8"));
     if (m.visibility === "public" || m.visibility === "unlisted") return m.visibility;
   } catch {
   }
@@ -62173,7 +62444,7 @@ Seed your coding agent with \`himi agent-init\`. Portal: ${idx.portalUrl}`);
       return 0;
     }
     case "agent-init": {
-      const dir = resolve40(str5(flags.dir) ?? process.cwd());
+      const dir = resolve41(str5(flags.dir) ?? process.cwd());
       const res = writeAgentContext(dir);
       print({ ok: true, dir: res.dir, files: res.files, portalUrl: idx.portalUrl });
       return 0;
@@ -62259,7 +62530,7 @@ async function producedWidgetFamilies(dir) {
     let js;
     for (const candidate of [`${name}.bundle.js`, `${name}.js`, name]) {
       try {
-        js = readFileSync63(join49(outDir, candidate), "utf8");
+        js = readFileSync64(join50(outDir, candidate), "utf8");
         break;
       } catch {
       }
@@ -62349,7 +62620,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           return 2;
         }
         const template = str5(flags.template);
-        const parentDir = resolve40(str5(flags.dir) ?? process.cwd());
+        const parentDir = resolve41(str5(flags.dir) ?? process.cwd());
         if (template && flags.remote === true) {
           try {
             const res2 = await initFromRemoteTemplate(name, parentDir, template, client3());
@@ -62437,11 +62708,11 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           return 0;
         }
         if (sub === "publish") {
-          const appDir2 = resolve40(str5(flags.dir) ?? process.cwd());
-          const sourceDir = resolve40(str5(flags["source-dir"]) ?? appDir2);
+          const appDir2 = resolve41(str5(flags.dir) ?? process.cwd());
+          const sourceDir = resolve41(str5(flags["source-dir"]) ?? appDir2);
           let meta;
           try {
-            meta = JSON.parse(readFileSync63(join49(sourceDir, TEMPLATE_META_FILE), "utf8"));
+            meta = JSON.parse(readFileSync64(join50(sourceDir, TEMPLATE_META_FILE), "utf8"));
           } catch {
             io.error(JSON.stringify({ error: `no ${TEMPLATE_META_FILE} in ${sourceDir} \u2014 a template must declare { title, description, tags } to be published`, hint: `add ${TEMPLATE_META_FILE} next to himalaya.content.json (or pass --source-dir <dir>)` }));
             return 2;
@@ -62451,7 +62722,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
             return 2;
           }
           try {
-            const appearance = extractTemplateAppearance(JSON.parse(readFileSync63(join49(sourceDir, "tokens.json"), "utf8")));
+            const appearance = extractTemplateAppearance(JSON.parse(readFileSync64(join50(sourceDir, "tokens.json"), "utf8")));
             meta = { ...appearance, ...meta };
           } catch {
           }
@@ -62463,13 +62734,13 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           const force = flags.force === true;
           const { buildContentForValidation: buildContentForValidation2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
           const bres = await buildContentForValidation2(buildDir, { resolution: resolutionFlag(flags) });
-          const out = mkdtempSync4(join49(tmpdir5(), "himi-template-"));
+          const out = mkdtempSync4(join50(tmpdir5(), "himi-template-"));
           const hasWorkers = bres.built.length > 0 || bres.compileErrors.length > 0;
           const outcome = await buildReleaseFromContent2(buildDir, out, {
             ...hasWorkers ? { tier5Dir: bundleOutDir2(buildDir) } : {},
             collect: { lint: true, strict }
           });
-          const scaffoldSourceFindings = resolve40(sourceDir) === resolve40(appDir2) ? [] : [
+          const scaffoldSourceFindings = resolve41(sourceDir) === resolve41(appDir2) ? [] : [
             ...tokenColorIssues(sourceDir),
             ...surfaceIssues(sourceDir, void 0, strict),
             ...fontIssues(sourceDir, strict),
@@ -62512,11 +62783,11 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
             }));
             return 1;
           }
-          const iconPath = str5(flags.icon) ? resolve40(str5(flags.icon)) : templateIconPath(name);
+          const iconPath = str5(flags.icon) ? resolve41(str5(flags.icon)) : templateIconPath(name);
           let iconHash;
           if (iconPath) {
             try {
-              const bytes2 = readFileSync63(iconPath);
+              const bytes2 = readFileSync64(iconPath);
               payload.icon = bytes2.toString("base64");
               iconHash = createHash24("sha256").update(bytes2).digest("hex");
             } catch {
@@ -62715,7 +62986,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
         const { navIssues: navIssues2 } = await Promise.resolve().then(() => (init_nav_lint(), nav_lint_exports));
         const { buildContentForValidation: buildContentForValidation2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
         const bres = await buildContentForValidation2(dir, { resolution: resolutionFlag(flags) });
-        const out = mkdtempSync4(join49(tmpdir5(), "himi-validate-"));
+        const out = mkdtempSync4(join50(tmpdir5(), "himi-validate-"));
         const hasWorkers = bres.built.length > 0 || bres.compileErrors.length > 0;
         const outcome = await buildReleaseFromContent2(dir, out, {
           ...hasWorkers ? { tier5Dir: bundleOutDir2(dir) } : {},
@@ -62752,7 +63023,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           const path = dpxSessionTokenPath();
           let raw;
           try {
-            raw = readFileSync63(path, "utf8");
+            raw = readFileSync64(path, "utf8");
           } catch {
             throw new Error(`no DPX BO session at ${path}; run dpx auth login, write dpx auth token to that path, then himi login --dpx --target bo`);
           }
@@ -62904,7 +63175,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
       case "test": {
         const dir = contentDir(flags);
         const structuredOutput = flags.json === true || io.isTTY !== true;
-        if (existsSync51(join49(dir, "functions"))) {
+        if (existsSync52(join50(dir, "functions"))) {
           const { invokeLocalFunction: invokeLocalFunction2, loadFunctionsApp: loadFunctionsApp2 } = await Promise.resolve().then(() => (init_functions(), functions_exports));
           const loaded = await loadFunctionsApp2(dir);
           const results = [];
@@ -62991,7 +63262,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           }
         }
         const bres = await buildContentBundles2(dir, { resolution: resolutionFlag(flags) });
-        const out = mkdtempSync4(join49(tmpdir5(), "himi-test-"));
+        const out = mkdtempSync4(join50(tmpdir5(), "himi-test-"));
         const hasWorkers = bres.built.length > 0 || bres.compileErrors.length > 0;
         const outcome = await buildReleaseFromContent2(dir, out, {
           ...hasWorkers ? { tier5Dir: bundleOutDir2(dir) } : {},
@@ -63036,7 +63307,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
             io.error(JSON.stringify({ error: `screen "${screen.screenId}" has no Tier-5 worker, so there is nothing for the browser loop to build` }));
             return 2;
           }
-          const sources = collectWorkerSources2(join49(dir, "tier5-src"), screen.bundleName);
+          const sources = collectWorkerSources2(join50(dir, "tier5-src"), screen.bundleName);
           if (!sources) {
             io.error(JSON.stringify({ error: `no worker source found at tier5-src/${screen.bundleName} \u2014 the browser loop compiles SOURCE, not the built bundle` }));
             return 2;
@@ -63197,7 +63468,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
             const sp = await runShotsPass2({
               descriptors: scopeDescriptors2(outcome.descriptors ?? [], pos.slice(1), invalidScreens),
               tokens: outcome.tokens,
-              outDir: join49(dir, ".himi", "shots"),
+              outDir: join50(dir, ".himi", "shots"),
               width: 390,
               layers: { rules: shotRules, ...cmsSeed ? { cmsSeed } : {}, ...canned ? { canned: canned.byKey } : {} },
               ...budgetMs ? { budgetMs } : {},
@@ -63214,9 +63485,11 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
             result.shots = { ...sp.written.length ? { dir: sp.dir } : {}, written: sp.written.length, ...sp.unavailable ? { unavailable: true } : {} };
           }
         }
-        const { assembleLedger: assembleLedger2, trendAndStore: trendAndStore2, formatLedger: formatLedger2, diffAndStoreObservations: diffAndStoreObservations2, formatDelta: formatDelta2 } = await Promise.resolve().then(() => (init_coverage(), coverage_exports));
-        const ledger = assembleLedger2(result);
-        const trend = trendAndStore2(dir, ledger);
+        const { assembleLedger: assembleLedger2, trendAndStore: trendAndStore2, formatLedger: formatLedger2, diffAndStoreObservations: diffAndStoreObservations2, formatDelta: formatDelta2, suppressedNativeKeys: suppressedNativeKeys2 } = await Promise.resolve().then(() => (init_coverage(), coverage_exports));
+        const { nativeOracleShipped: nativeOracleShipped2 } = await Promise.resolve().then(() => (init_native_decode(), native_decode_exports));
+        const nativeOracle = nativeOracleShipped2();
+        const ledger = assembleLedger2(result, { nativeOracle });
+        const trend = trendAndStore2(dir, ledger, suppressedNativeKeys2(nativeOracle));
         const delta = diffAndStoreObservations2(dir, result.observations ?? {});
         const legacy = { ...result, ledger, ...trend ? { trend } : {}, ...delta ? { delta } : {}, ...recorded ? { recorded } : {} };
         const release = await loadReleaseFromDir(app, out);
@@ -63233,7 +63506,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           releaseId: result.releaseId,
           releasePayload: release,
           descriptors: attestedDescriptors,
-          screenshots: Object.fromEntries(writtenShots.filter((name) => crawledScreens.has(name.replace(/\.png$/, ""))).map((name) => [name.replace(/\.png$/, ""), join49(dir, ".himi", "shots", name)])),
+          screenshots: Object.fromEntries(writtenShots.filter((name) => crawledScreens.has(name.replace(/\.png$/, ""))).map((name) => [name.replace(/\.png$/, ""), join50(dir, ".himi", "shots", name)])),
           coverage: {
             screens: crawledScreens.size,
             actionsDispatched: result.actions.exercised,
@@ -63322,7 +63595,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
             return 2;
           }
           try {
-            const raw = stateArg.trim().startsWith("{") ? stateArg : readFileSync63(stateArg.replace(/^@/, ""), "utf8");
+            const raw = stateArg.trim().startsWith("{") ? stateArg : readFileSync64(stateArg.replace(/^@/, ""), "utf8");
             injectedState = JSON.parse(raw);
           } catch (e) {
             io.error(JSON.stringify({ error: `--state must be inline JSON or a path to a .json file \u2014 ${e.message}` }));
@@ -63337,7 +63610,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
             return 2;
           }
           try {
-            const raw = inputArg.trim().startsWith("{") ? inputArg : readFileSync63(inputArg.replace(/^@/, ""), "utf8");
+            const raw = inputArg.trim().startsWith("{") ? inputArg : readFileSync64(inputArg.replace(/^@/, ""), "utf8");
             const parsed = JSON.parse(raw);
             if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("must be a JSON object");
             injectedInput = parsed;
@@ -63370,7 +63643,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
             return 2;
           }
         } else if (typeof flags.width === "string" && flags.width) {
-          renderWidth = Number(flags.width);
+          renderWidth = Math.round(Number(flags.width));
           if (!Number.isFinite(renderWidth) || renderWidth <= 0) {
             io.error(JSON.stringify({ error: `--width must be a positive number of pixels (got "${str5(flags.width)}")` }));
             return 2;
@@ -63386,7 +63659,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
         }
         const { buildContentBundles: buildContentBundles2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
         const bres = await buildContentBundles2(dir, { resolution: resolutionFlag(flags) });
-        const out = mkdtempSync4(join49(tmpdir5(), "himi-render-"));
+        const out = mkdtempSync4(join50(tmpdir5(), "himi-render-"));
         const hasWorkers = bres.built.length > 0 || bres.compileErrors.length > 0;
         const outcome = await buildReleaseFromContent2(dir, out, {
           ...hasWorkers ? { tier5Dir: bundleOutDir2(dir) } : {},
@@ -63402,7 +63675,15 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
         let attestationPngFile;
         if (typeof flags.png === "string" && r.pngBase64) {
           pngFile = writePngFile(str5(flags.png), r.pngBase64);
-          attestationPngFile = writePngFile(join49(dir, ".himi", "shots", `${screenId}.png`), r.pngBase64);
+          attestationPngFile = writePngFile(join50(dir, ".himi", "shots", `${screenId}.png`), r.pngBase64);
+        }
+        if (renderWidth !== void 0 && r.renderable) {
+          recordRenderWidth(dir, {
+            screenId,
+            width: renderWidth,
+            ...deviceName ? { device: deviceName } : {},
+            ...pngFile ? { file: pngFile } : {}
+          });
         }
         const legacyRender = {
           ok: r.renderable,
@@ -63707,7 +63988,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           return 2;
         }
         const renamed = str5(flags.name);
-        const dest = resolve40(str5(flags.out) ?? process.cwd(), renamed ?? wanted);
+        const dest = resolve41(str5(flags.out) ?? process.cwd(), renamed ?? wanted);
         const replace = flags.replace === true;
         const force = replace || flags.force === true;
         const linked = symlinkDestinationIssue(dest);
@@ -63715,8 +63996,8 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           io.error(JSON.stringify(linked));
           return 1;
         }
-        if (existsSync51(dest)) {
-          if (!statSync13(dest).isDirectory()) {
+        if (existsSync52(dest)) {
+          if (!statSync12(dest).isDirectory()) {
             io.error(JSON.stringify({
               error: `${dest} exists and is not a directory`,
               hint: "pass --out/--name to land somewhere else, or remove the file"
@@ -63728,7 +64009,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             io.error(JSON.stringify({ error: `${dest} already exists and is not empty`, hint: "pass --force to write into it anyway (merging, and naming what it keeps), --replace to restore exactly what was archived, or --out/--name to land somewhere else" }));
             return 1;
           }
-          if (replace && occupied && !existsSync51(join49(dest, "himalaya.content.json"))) {
+          if (replace && occupied && !existsSync52(join50(dest, "himalaya.content.json"))) {
             io.error(JSON.stringify({
               error: `${dest} is not a content package \u2014 refusing to --replace it`,
               hint: "--replace only clears a directory that holds himalaya.content.json. Check --out/--name, or pass --force to merge into it instead."
@@ -63822,7 +64103,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
         const force = flags.force === true;
         const { buildContentForValidation: buildContentForValidation2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
         const bres = await buildContentForValidation2(dir, { resolution: resolutionFlag(flags) });
-        const out = mkdtempSync4(join49(tmpdir5(), "himi-push-"));
+        const out = mkdtempSync4(join50(tmpdir5(), "himi-push-"));
         const hasWorkers = bres.built.length > 0 || bres.compileErrors.length > 0;
         const outcome = await buildReleaseFromContent2(dir, out, {
           ...hasWorkers ? { tier5Dir: bundleOutDir2(dir) } : {},
@@ -64048,7 +64329,16 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           ...loopbackWarning ? { warning: loopbackWarning } : {},
           ...report.issues ? { issues: report.issues } : {},
           previewWeb: base ? previewWebUrl(base, app, release, void 0, void 0, previewToken) : null,
-          ...previewToken ? { previewTokenExpiresAt: previewTokenExpiresAt ?? null } : {},
+          // A timestamp alone leaves the reader to work out both how long they have and how to
+          // get another one. Print the duration and the re-mint command beside it (#2502 item 3).
+          // No `mintedHere` guard is needed here, unlike `himi preview`: this bearer can only
+          // have come from the publish response two hundred lines up, so THIS call minted it by
+          // construction. `push` has no `--preview-token` to paste one in with.
+          ...previewToken ? {
+            previewTokenExpiresAt: previewTokenExpiresAt ?? null,
+            previewRenew: previewRenewCommand(app, release, targetName()),
+            previewTokenNote: previewTokenNote(previewTokenExpiresAt)
+          } : {},
           // RFC 0051 — the surfaces THIS RELEASE targets, read from the manifest the
           // push just published (never a re-read of the local file: review found the
           // two can disagree — e.g. an older CLI whose local parser drops a key the
@@ -64132,7 +64422,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             return 2;
           }
           try {
-            const res = writePack(resolve40(releaseDir), only, resolve40(str5(flags.out) ?? process.cwd()));
+            const res = writePack(resolve41(releaseDir), only, resolve41(str5(flags.out) ?? process.cwd()));
             print({
               ok: true,
               app: res.app,
@@ -64181,7 +64471,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
         }
         const { buildContentForValidation: buildContentForValidation2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
         const bres = await buildContentForValidation2(dir, { resolution: resolutionFlag(flags) });
-        const built = mkdtempSync4(join49(tmpdir5(), "himi-pack-"));
+        const built = mkdtempSync4(join50(tmpdir5(), "himi-pack-"));
         const hasWorkers = bres.built.length > 0 || bres.compileErrors.length > 0;
         const outcome = await buildReleaseFromContent2(dir, built, {
           ...hasWorkers ? { tier5Dir: bundleOutDir2(dir) } : {},
@@ -64203,7 +64493,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           return 1;
         }
         try {
-          const res = writePack(built, app, resolve40(str5(flags.out) ?? dir), sourceArchive);
+          const res = writePack(built, app, resolve41(str5(flags.out) ?? dir), sourceArchive);
           print({
             ok: true,
             app: res.app,
@@ -64248,7 +64538,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
         const { HIMI_PACKAGE_SOURCE_PATH: HIMI_PACKAGE_SOURCE_PATH2, isSafeAppId: isSafeAppId2, packageContents: packageContents2 } = await Promise.resolve().then(() => (init_himi_package(), himi_package_exports));
         let opened;
         try {
-          opened = openPackageFile2(resolve40(file));
+          opened = openPackageFile2(resolve41(file));
         } catch (e) {
           io.error(JSON.stringify({ error: e.message }));
           return 1;
@@ -64261,7 +64551,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           io.error(JSON.stringify({
             ok: false,
             error: "app_source_not_in_package",
-            detail: `${resolve40(file)} is a release package: it carries built output (screens, bundles, tokens) and no source`,
+            detail: `${resolve41(file)} is a release package: it carries built output (screens, bundles, tokens) and no source`,
             hint: "re-pack it from the content package with `himi pack --dev`, or restore from the serve plane with `himi pull <app>`"
           }));
           return 1;
@@ -64284,7 +64574,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             return 1;
           }
         }
-        const dest = resolve40(str5(flags.out) ?? process.cwd(), renamed ?? opened.header.app);
+        const dest = resolve41(str5(flags.out) ?? process.cwd(), renamed ?? opened.header.app);
         const issue2 = restoreDestinationIssue(dest, flags.force === true);
         if (issue2) {
           io.error(JSON.stringify(issue2));
@@ -64369,7 +64659,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
         }
         try {
           const { openPackageFile: openPackageFile2 } = await Promise.resolve().then(() => (init_pack(), pack_exports));
-          const opened = openPackageFile2(resolve40(file));
+          const opened = openPackageFile2(resolve41(file));
           if (!opened.validation.ok || !opened.header) {
             io.error(JSON.stringify({ error: "refusing to share an invalid package", issues: opened.validation.errors }));
             return 1;
@@ -64379,12 +64669,12 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             io.error(JSON.stringify({
               ok: false,
               error: "refusing to share a package that carries the app's source",
-              detail: `${resolve40(file)} was packed with --dev, and a share link is public and unauthenticated \u2014 anyone with the URL could \`himi import\` your codebase`,
+              detail: `${resolve41(file)} was packed with --dev, and a share link is public and unauthenticated \u2014 anyone with the URL could \`himi import\` your codebase`,
               hint: "share a release package instead (`himi pack` with no --dev), or hand the dev package over directly"
             }));
             return 1;
           }
-          const archive = readFileSync63(resolve40(file));
+          const archive = readFileSync64(resolve41(file));
           const result = await client3().createPackageShare({
             app: opened.header.app,
             releaseId: opened.header.releaseId,
@@ -64421,10 +64711,10 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             const app = await appId(dir);
             const { buildContentBundles: buildContentBundles2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
             const bres = await buildContentBundles2(dir, { resolution: resolutionFlag(flags) });
-            temp = mkdtempSync4(join49(tmpdir5(), "himi-run-build-"));
+            temp = mkdtempSync4(join50(tmpdir5(), "himi-run-build-"));
             const hasWorkers = bres.built.length > 0 || bres.compileErrors.length > 0;
             await buildReleaseFromContent2(dir, temp, { ...hasWorkers ? { tier5Dir: bundleOutDir2(dir) } : {} });
-            source = join49(temp, app);
+            source = join50(temp, app);
           }
           const chromeArg = str5(flags.chrome) ?? "preview";
           if (chromeArg !== "preview" && chromeArg !== "app") {
@@ -64449,9 +64739,9 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
               open: flags["no-open"] !== true
             });
             print({ ok: true, app: run2.app, url: run2.url, port: run2.port, plane: "browser" });
-            await new Promise((resolve41) => {
+            await new Promise((resolve42) => {
               const stop = () => {
-                void run2.close().finally(() => resolve41());
+                void run2.close().finally(() => resolve42());
               };
               process.once("SIGINT", stop);
               process.once("SIGTERM", stop);
@@ -64509,6 +64799,8 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
         }
         let previewToken = str5(flags["preview-token"]);
         let previewTokenExpiresAt;
+        let mintedHere = false;
+        let mintFailure;
         if (!previewToken) {
           const target = resolveTarget({
             target: str5(flags.target),
@@ -64521,15 +64813,24 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             telemetryToken: str5(flags["telemetry-token"]),
             controlToken: str5(flags["control-token"])
           });
-          if (target.controlToken) {
+          if (!target.controlToken) {
+            mintFailure = `this target has no stored control credential, so none was requested \u2014 run \`himi login --target ${targetName()}\`, or pass --control-token`;
+          } else {
             try {
               const minted = await new ServeCliClient(target).previewToken(app, release);
-              if (minted.ok && minted.json && typeof minted.json === "object") {
+              if (!minted.ok) {
+                mintFailure = `the plane refused the mint request (HTTP ${minted.status}). Your credential reached it, so this is the plane's answer, not your session`;
+              } else if (!minted.json || typeof minted.json !== "object") {
+                mintFailure = "the plane accepted the mint request but its answer was not a JSON object, so no token could be read. Your credential is fine";
+              } else {
                 const body = minted.json;
                 previewToken = typeof body.previewToken === "string" ? body.previewToken : void 0;
                 previewTokenExpiresAt = typeof body.previewTokenExpiresAt === "string" ? body.previewTokenExpiresAt : void 0;
+                mintedHere = previewToken !== void 0;
+                if (!mintedHere) mintFailure = "the plane answered the mint request without a token \u2014 HIMALAYA_PREVIEW_TOKEN_SECRET may be unconfigured there. Your credential is fine";
               }
-            } catch {
+            } catch (e) {
+              mintFailure = `the mint request could not be sent: ${e.message}. Your credential was never judged`;
             }
           }
         }
@@ -64540,7 +64841,22 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           ...screen ? { screen } : {},
           ...surface ? { surface } : {},
           previewWeb: base ? previewWebUrl(base, app, release, screen, surface, previewToken) : null,
-          ...previewTokenExpiresAt ? { previewTokenExpiresAt } : {},
+          // Gated on the MINT, like the two fields below: a plane that returns an expiry but no
+          // token would otherwise print a lifetime for a bearer the same envelope says does not
+          // exist.
+          ...mintedHere && previewTokenExpiresAt ? { previewTokenExpiresAt } : {},
+          // Same as the push envelope: the expiry alone leaves the reader to work out both how
+          // long they have and how to get another link. `himi preview` re-mints, so the renew is
+          // this very command — say so rather than making them find it again (#2502 item 3).
+          //
+          // Gated on the MINT, not on the expiry: a plane that mints a bearer but returns no
+          // `previewTokenExpiresAt` would otherwise withhold the guidance in exactly the case
+          // where the reader has no timestamp to reason from — while a bearer the caller pasted
+          // in with `--preview-token` is one this command cannot promise to reissue.
+          ...mintedHere ? {
+            previewRenew: previewRenewCommand(app, release, targetName(), { screen, surface }),
+            previewTokenNote: previewTokenNote(previewTokenExpiresAt)
+          } : previewToken || !mintFailure ? {} : { previewTokenNote: `no preview bearer was minted \u2014 ${mintFailure}. The link above carries no \`pvt\`, so it opens a LIVE release and will not open a draft.` },
           previewPlayerDebug: previewPlayerDebugLink(app, release, screen, previewToken),
           context: base ? previewContextUrl(base, app, release, screen) : null,
           diagnose: base && screen ? previewDiagnoseUrl(base, app, release, screen) : null,
@@ -64718,8 +65034,16 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             if (!r.ok) throw Object.assign(new Error("crashes_read_failed"), { response: r });
             out.crashes = r.json?.crashes ?? [];
           }
-          if ((out.events?.length ?? 0) === 0 && (out.logs?.length ?? 0) === 0 && !includeSummary && !includeCrashes) {
-            out.note = "no telemetry yet \u2014 open the web preview or Himi Player link for this release, then retry or use --follow";
+          const eventCount = out.events?.length ?? 0;
+          const logCount = out.logs?.length ?? 0;
+          const narrowed = !!(level || str5(flags.screen) || str5(flags.screenId) || str5(flags.type) || str5(flags.event) || flags["crashes-only"] === true || flags.crashesOnly === true || num(flags.limit) !== void 0 || eventSince !== void 0 || logSince !== void 0);
+          const wholeChannels = includeEvents && includeLogs && !narrowed;
+          if (wholeChannels && eventCount === 0 && logCount === 0 && !includeSummary && !includeCrashes) {
+            out.note = "no events and no worker console output on this release \u2014 open the web preview or Himi Player link for it, then retry or use --follow";
+          } else if (wholeChannels && eventCount > 0 && logCount === 0) {
+            out.note = "events arrived but the worker console channel is empty \u2014 commonly because the worker never called `console.*`, though an empty channel can also mean the lines aged out or never made it through ingestion. What the CLI can say is that this channel returned nothing, not that the app was never opened";
+          } else if (narrowed && eventCount === 0 && logCount === 0 && !includeSummary && !includeCrashes) {
+            out.note = "nothing matched this query. Drop --screen/--type/--level/--since/--limit/--crashes-only to see the whole event and console channels for this release";
           }
           return out;
         };
@@ -64800,7 +65124,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           if (r.status !== 422) return printServeFailure(r);
         }
         const body = r.json ?? {};
-        print(body);
+        print(diagnoseBody(body));
         return body.ok === false ? 1 : 0;
       }
       case "deeplinks": {
@@ -64856,8 +65180,12 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             print({ ok: false, status: r.status, body: r.json ?? r.text });
             return 1;
           }
-          const logs = byLevel(r.json?.logs ?? []);
-          print({ ok: true, logs, ...logs.length === 0 ? { note: "no logs yet \u2014 a worker emits telemetry only once someone opens the app/preview on a device or web with a session. Boot-time console.log is visible via `himi validate` / `himi render`." } : {} });
+          const rawLogs = r.json?.logs ?? [];
+          const logs = byLevel(rawLogs);
+          const narrowed = !!(level || str5(flags.screen) || str5(flags.screenId) || num2(flags.since) !== void 0 || num2(flags.limit) !== void 0);
+          const scope = release ? "this release" : "this app";
+          const note = logs.length > 0 ? void 0 : narrowed ? `no worker \`console.*\` lines matched this query${level && rawLogs.length ? ` (${rawLogs.length} line(s) were hidden by --level ${level})` : ""}. Drop --level/--screen/--since/--limit to see the whole console channel for ${scope}; the telemetry EVENT stream is a separate channel, read with \`himi telemetry\`.` : `no worker \`console.*\` output on ${scope}. This is the console channel \u2014 distinct from the telemetry EVENT stream, which \`himi telemetry --app <app> --release <id>\` reads: ${scope} can carry many events and no console lines \u2014 commonly because the worker never logged any, though an empty channel can also mean the lines aged out or never made it through ingestion. Boot-time \`console.log\` is visible via \`himi validate\` / \`himi render\`.`;
+          print({ ok: true, logs, ...note ? { note } : {} });
           return 0;
         }
         const interval = num2(flags.interval) ?? 2e3;
@@ -65242,7 +65570,7 @@ ${label2}`);
         const platform = str5(flags.platform)?.split(",").map((p) => p.trim()).filter(Boolean);
         {
           const distDir = contentDir(flags);
-          if (existsSync51(join49(distDir, "himalaya.content.json"))) {
+          if (existsSync52(join50(distDir, "himalaya.content.json"))) {
             const issues = await iconIssues(distDir, flags.strict === true, { requireDeclared: true, requireVerified: true });
             const errors = issues.filter((i) => i.severity === "error");
             for (const i of issues.filter((i2) => i2.severity === "warning")) {
@@ -65512,7 +65840,7 @@ ${label2}`);
           const dpxPath = dpxSessionTokenPath();
           let dpx;
           try {
-            dpx = readFileSync63(dpxPath, "utf8").trim();
+            dpx = readFileSync64(dpxPath, "utf8").trim();
           } catch {
             io.error(JSON.stringify({ error: `no dpx session at ${dpxPath} \u2014 run \`dpx auth login\` then \`dpx auth token > ${dpxPath}\` (dpx 2.x keeps its own state in ~/.dpx/auth.json and does NOT write the legacy session file), or omit --dpx` }));
             return 1;
@@ -65799,7 +66127,7 @@ ${report.ok ? "OK \u2014 data + serve plane reachable." : typeof report.hint ===
           const path = dpxSessionTokenPath();
           let raw;
           try {
-            raw = readFileSync63(path, "utf8");
+            raw = readFileSync64(path, "utf8");
           } catch {
             io.error(JSON.stringify({ error: `no DPX BO session at ${path}` }));
             return 1;
@@ -66139,12 +66467,14 @@ export {
   ConfigLoadError,
   PLACEHOLDER_CLIENT_ID,
   PLACEHOLDER_SITE_URL,
+  PREVIEW_TOKEN_NOTE,
   PUBLIC_WIX_API_BASE,
   autoClaimSlug,
   buildDoctorReport,
   compareVersions2 as compareVersions,
   decodeControlTokenClaims,
   defaultTargetForCommand,
+  diagnoseBody,
   doctorVersionReport,
   foreignPlaneError,
   formatSdkVersionLine,
@@ -66167,8 +66497,10 @@ export {
   previewPlayerDebugLink,
   previewPlayerLink,
   previewRenderUrl,
+  previewRenewCommand,
   previewScreensUrl,
   previewTelemetryUrl,
+  previewTokenNote,
   previewWebUrl,
   probeControlToken,
   probeReachable,