@wix/himalaya-cli 0.980.0 → 0.982.0

package/dist/cli.mjs

@@ -1901,6 +1901,20 @@ var init_himi_report = __esm({
   }
 });
 
+// ../../core/serve-storage/src/widget-identity.ts
+function stableWidgets(widgets) {
+  if (!widgets || typeof widgets !== "object" || Array.isArray(widgets)) return widgets;
+  return Object.fromEntries(Object.entries(widgets).map(([id, value]) => {
+    if (!value || typeof value !== "object" || Array.isArray(value)) return [id, value];
+    const { contentEtag: _regenerated, ...stable } = value;
+    return [id, stable];
+  }));
+}
+var init_widget_identity = __esm({
+  "../../core/serve-storage/src/widget-identity.ts"() {
+  }
+});
+
 // ../../core/dev-server/src/wix-placeholders.ts
 var PLACEHOLDER_CLIENT_ID;
 var init_wix_placeholders = __esm({
@@ -5290,6 +5304,7 @@ function resolveTranslation(value, catalog, sourceCatalog) {
 var BINDING_SIGILS, BINDING_SIGIL_RE, TRANSLATION_PREFIX, TRANSLATION_KEY_RE;
 var init_bindings = __esm({
   "../../core/ts/src/bindings.ts"() {
+    "use strict";
     BINDING_SIGILS = ["service", "flag", "item", "t"];
     BINDING_SIGIL_RE = new RegExp(
       `^\\$(?:${BINDING_SIGILS.filter((s) => s !== "t").join("|")})\\b|^\\$t:`
@@ -7273,9 +7288,10 @@ function pathCrossesOpaqueAuthorJson(path) {
 function nativeRequiredFindings(descriptor) {
   const out = [];
   const shapeOf = (ref) => ref.startsWith("list:") ? "an array" : ref.startsWith("map:") ? "an object keyed by name" : "an object";
+  const kindOf = (value) => Array.isArray(value) ? "an array" : value === null ? "null" : typeof value === "object" ? "an object" : `a ${typeof value} (${JSON.stringify(value)})`;
   const reportKind = (ref, value, path, from) => {
     const cls = bareNestedClass(ref);
-    const got = Array.isArray(value) ? "an array" : value === null ? "null" : typeof value === "object" ? "an object" : `a ${typeof value} (${JSON.stringify(value)})`;
+    const got = kindOf(value);
     const expected = ref.startsWith("list:") ? "Expected JsonArray" : `Expected JsonObject for type with serial name 'io.himalaya.core.${cls}'`;
     out.push({
       path,
@@ -7321,6 +7337,25 @@ function nativeRequiredFindings(descriptor) {
       const inner = own(bag, name);
       if (inner !== void 0 && inner !== null) checkNested(inner, sub, `${path}.${name}`, from);
     }
+    if (cls === "Action") checkActionParams(own(bag, "params"), `${path}.params`, from);
+  };
+  const checkActionParams = (params, path, from) => {
+    if (params === void 0 || params === null) return;
+    const cost = "Native decode rejects it and drops the WHOLE screen from the seed, while web renders it fine";
+    if (typeof params !== "object" || Array.isArray(params)) {
+      out.push({
+        path,
+        message: `Action.params must be an object of strings, but the descriptor has ${kindOf(params)} ("Expected JsonObject"). ${cost} (reached from ${from})`
+      });
+      return;
+    }
+    for (const [key2, value] of Object.entries(params)) {
+      if (typeof value === "string" || value === void 0) continue;
+      out.push({
+        path: `${path}.${key2}`,
+        message: `Action.params values must be strings, but params.${key2} is ${kindOf(value)} ("Expected JsonPrimitive at ${key2}" on Android, typeMismatch on iOS). ${cost}. Flatten it into string keys of params, or move structured data to Action.args (reached from ${from})`
+      });
+    }
   };
   const walk2 = (node, at) => {
     if (Array.isArray(node)) {
@@ -7422,6 +7457,7 @@ function componentPropFindings(descriptor) {
             out.push({
               path,
               kind: "decode",
+              ...inArray ? { authoringOnly: true } : {},
               // TWO different defects share this branch, and they need DIFFERENT prose.
               //
               // For an ordinary typed slot the sentinel really is a screen-killer: kotlinx
@@ -8060,6 +8096,7 @@ function validateScreenDescriptor(screenId, descriptor, opts = {}) {
     if (!node || typeof node !== "object") return;
     for (const [k, val] of Object.entries(node)) {
       if (isOpaqueAuthorJson(k, val, at === "")) continue;
+      if (k === "params" && typeof node.actionId === "string") continue;
       const here = at ? `${at}.${k}` : k;
       const allowed2 = own(NATIVE_PROP_ENUMS, k);
       if (typeof val === "string" && enums.has(k) && DYNAMIC_PLACEHOLDER.test(val)) {
@@ -8067,6 +8104,7 @@ function validateScreenDescriptor(screenId, descriptor, opts = {}) {
           severity: "error",
           pass: "strict-enum",
           path: here,
+          nativeDecode: true,
           message: `enum field "${k}" carries a dynamic placeholder ("${val}") \u2014 native decode fails BEFORE substitution and kills the screen; use a literal (e.g. the spacer leadFill pattern for per-row alignment)`
         });
       } else if (allowed2 && val != null && typeof val !== "string") {
@@ -8074,6 +8112,7 @@ function validateScreenDescriptor(screenId, descriptor, opts = {}) {
           severity: "error",
           pass: "strict-enum",
           path: here,
+          nativeDecode: true,
           message: `enum field "${k}" has non-string value ${JSON.stringify(val)} \u2014 native decode rejects it (allowed: ${[...allowed2].join("|")}) and drops the whole screen`
         });
       } else if (typeof val === "string" && !DYNAMIC_PLACEHOLDER.test(val)) {
@@ -8082,6 +8121,7 @@ function validateScreenDescriptor(screenId, descriptor, opts = {}) {
             severity: "error",
             pass: "strict-enum",
             path: here,
+            nativeDecode: true,
             message: `enum field "${k}" has unknown value "${val}" \u2014 native decode rejects it (allowed: ${[...allowed2].join("|")}) and drops the whole screen; use one of those literals (HStack/VStack alignment: leading = top)`
           });
         }
@@ -8105,6 +8145,7 @@ function validateScreenDescriptor(screenId, descriptor, opts = {}) {
     issue2.pass = "strict-enum";
     issue2.path = finding.path;
     issue2.message = finding.message;
+    if (!("authoringOnly" in finding && finding.authoringOnly)) issue2.nativeDecode = true;
     if (!duplicate) issues.push(issue2);
     for (const extra of alsoAboutThisField) if (!consumed.has(extra)) superseded.add(extra);
   }
@@ -11670,11 +11711,16 @@ var init_catalog = __esm({
 // ../font-bake/plan-fonts.ts
 function demandFromTokens(tokens) {
   const demand = /* @__PURE__ */ new Map();
-  for (const token of Object.values(tokens.typography ?? {})) {
-    const family = token?.family;
-    if (typeof family !== "string" || family.length === 0) continue;
-    const weight = typeof token?.weight === "number" ? token.weight : 400;
-    demand.set(family, (demand.get(family) ?? /* @__PURE__ */ new Set()).add(weight));
+  const add = (family, weight) => {
+    if (typeof family !== "string" || family.length === 0) return;
+    demand.set(family, (demand.get(family) ?? /* @__PURE__ */ new Set()).add(typeof weight === "number" ? weight : 400));
+  };
+  const base = tokens.typography ?? {};
+  for (const token of Object.values(base)) add(token?.family, token?.weight);
+  for (const overlay of Object.values(tokens.idiom ?? {})) {
+    for (const [role, token] of Object.entries(overlay?.typography ?? {})) {
+      add(token?.family ?? base[role]?.family, token?.weight ?? base[role]?.weight);
+    }
   }
   return demand;
 }
@@ -16207,7 +16253,7 @@ function assignStableIds(descriptor) {
     used.add(out);
     return out;
   };
-  const assign = (node, path) => {
+  const assign2 = (node, path) => {
     const base = node.id && node.id.length > 0 ? node.id : path;
     node.id = uniquify(base);
     const typeCounts = {};
@@ -16216,12 +16262,12 @@ function assignStableIds(descriptor) {
       const n = typeCounts[t] ?? 0;
       typeCounts[t] = n + 1;
       const seg = n === 0 ? t : `${t}.${n}`;
-      assign(child, `${path}/${seg}`);
+      assign2(child, `${path}/${seg}`);
     });
   };
-  if (isNode(descriptor.payload)) assign(descriptor.payload, descriptor.screenId);
-  if (isNode(descriptor.stickyHeader)) assign(descriptor.stickyHeader, `${descriptor.screenId}/stickyHeader`);
-  if (isNode(descriptor.stickyFooter)) assign(descriptor.stickyFooter, `${descriptor.screenId}/stickyFooter`);
+  if (isNode(descriptor.payload)) assign2(descriptor.payload, descriptor.screenId);
+  if (isNode(descriptor.stickyHeader)) assign2(descriptor.stickyHeader, `${descriptor.screenId}/stickyHeader`);
+  if (isNode(descriptor.stickyFooter)) assign2(descriptor.stickyFooter, `${descriptor.screenId}/stickyFooter`);
 }
 var init_stable_ids = __esm({
   "../../core/dev-server/src/stable-ids.ts"() {
@@ -17606,6 +17652,70 @@ var init_env = __esm({
   }
 });
 
+// ../../core/ts/src/idiom.ts
+function authored(overlays, name) {
+  return typeof name === "string" && overlays !== void 0 && Object.hasOwn(overlays, name) && overlays[name] !== null && typeof overlays[name] === "object" && !Array.isArray(overlays[name]);
+}
+function selectIdiomOverlay(doc, ctx = {}) {
+  const policy = doc.idiomPolicy;
+  const overlays = doc.idiom;
+  const isRecord3 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+  if (!isRecord3(policy) || !isRecord3(overlays)) return void 0;
+  const kind = policy.policy ?? "follow-surface";
+  if (kind === "none") return void 0;
+  if (kind === "pinned") return authored(overlays, policy.pin) ? policy.pin : void 0;
+  if (kind !== "follow-surface") return void 0;
+  const surfaces = policy.surfaces;
+  const candidates = [
+    ctx.surface !== void 0 && isRecord3(surfaces) && Object.hasOwn(surfaces, ctx.surface) ? surfaces[ctx.surface] : void 0,
+    ...ctx.native ?? [],
+    policy.fallback
+  ];
+  return candidates.find((c) => authored(overlays, c));
+}
+function isPlainObject(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+function deepMerge2(base, overlay) {
+  if (!isPlainObject(overlay) || !isPlainObject(base)) return overlay;
+  const out = { ...base };
+  for (const [key2, value] of Object.entries(overlay)) {
+    if (UNSAFE_KEYS.has(key2)) continue;
+    out[key2] = Object.hasOwn(base, key2) ? deepMerge2(base[key2], value) : value;
+  }
+  return out;
+}
+function mergeIdiomOverlay(base, overlay) {
+  const merged = deepMerge2(base, overlay);
+  const baseColors = base.colors;
+  const overlayColors = overlay.colors;
+  if (isPlainObject(baseColors) && isPlainObject(overlayColors)) {
+    const colors = { ...merged.colors };
+    for (const [name, value] of Object.entries(overlayColors)) {
+      if (UNSAFE_KEYS.has(name)) continue;
+      const was = Object.hasOwn(baseColors, name) ? baseColors[name] : void 0;
+      if (typeof was === "string" && isPlainObject(value)) colors[name] = { light: was, ...value };
+    }
+    merged.colors = colors;
+  }
+  return merged;
+}
+function resolveIdiom(tokens, ctx = {}) {
+  const doc = tokens;
+  const name = selectIdiomOverlay(doc, ctx);
+  if (name === void 0) return tokens;
+  const merged = mergeIdiomOverlay(tokens, doc.idiom[name]);
+  const { idiomPolicy: _applied, ...final } = merged;
+  return final;
+}
+var UNSAFE_KEYS;
+var init_idiom = __esm({
+  "../../core/ts/src/idiom.ts"() {
+    "use strict";
+    UNSAFE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+  }
+});
+
 // ../../core/web-renderer/src/tokens.ts
 function isSerifFamily(family) {
   return !!family && SERIF_FAMILY_RE.test(family);
@@ -17731,7 +17841,8 @@ function resolveSchemeColor(o, scheme) {
   if (typeof o?.light === "string") return o.light;
   return typeof o?.dark === "string" ? o.dark : void 0;
 }
-function makeTokenResolvers(tokens, scheme) {
+function makeTokenResolvers(source, scheme, idiom = WEB_IDIOM_CONTEXT) {
+  const tokens = resolveIdiom(source, idiom);
   const color = (name, fallback = "#1a1a1a") => {
     if (name == null) return fallback;
     if (typeof name !== "string") {
@@ -17870,13 +17981,15 @@ function makeTokenResolvers(tokens, scheme) {
     scheme
   };
 }
-var REM_ROOT_PX, pxToRem, DEFAULT_FONT_STACK, SERIF_FAMILY_RE;
+var REM_ROOT_PX, pxToRem, DEFAULT_FONT_STACK, SERIF_FAMILY_RE, WEB_IDIOM_CONTEXT;
 var init_tokens2 = __esm({
   "../../core/web-renderer/src/tokens.ts"() {
+    init_idiom();
     REM_ROOT_PX = 16;
     pxToRem = (px) => `${px / REM_ROOT_PX}rem`;
     DEFAULT_FONT_STACK = '"Wix Madefor Text", system-ui';
     SERIF_FAMILY_RE = /\b(georgia|times|garamond|palatino|baskerville|didot|charter|bodoni|caslon|cambria|constantia|rockwell|playfair|merriweather|lora|literata|spectral|serif)\b/i;
+    WEB_IDIOM_CONTEXT = { surface: "desktop" };
   }
 });
 
@@ -28862,6 +28975,7 @@ var init_src5 = __esm({
     init_widget_vocabulary();
     init_preview_surfaces();
     init_tokens();
+    init_idiom();
     init_tier_caps();
     init_flags();
     init_flags_engine();
@@ -30225,11 +30339,11 @@ import { readFileSync as readFileSync40, existsSync as existsSync35, watch, mkdi
 import { extname, resolve as resolve30, normalize as normalize3, sep as sep7, join as join34 } from "node:path";
 import { createHash as createHash15, randomUUID } from "node:crypto";
 import { fileURLToPath as fileURLToPath18, pathToFileURL as pathToFileURL6 } from "node:url";
-function deepMerge2(base, patch) {
+function deepMerge3(base, patch) {
   if (patch === null || typeof patch !== "object" || Array.isArray(patch)) return patch;
   const out = Array.isArray(base) ? [...base] : { ...base };
   for (const [k, v] of Object.entries(patch)) {
-    out[k] = k in out ? deepMerge2(out[k], v) : v;
+    out[k] = k in out ? deepMerge3(out[k], v) : v;
   }
   return out;
 }
@@ -30290,15 +30404,15 @@ function effectiveAppConfigOverride(state) {
     }
   }
   if (!gitOverlay && !state.appConfigOverride) return void 0;
-  return deepMerge2(
-    deepMerge2({}, gitOverlay ?? {}),
+  return deepMerge3(
+    deepMerge3({}, gitOverlay ?? {}),
     state.appConfigOverride ?? {}
   );
 }
 function effectiveAppTokens(req, state) {
   const built = readAppTokens(state);
   if (!built) return null;
-  let tokens = state.tokensOverride ? deepMerge2(built, state.tokensOverride) : built;
+  let tokens = state.tokensOverride ? deepMerge3(built, state.tokensOverride) : built;
   let motionToggles = [];
   try {
     const motionDefs = state.flagStore.list().filter((d) => d.enabled && d.key.startsWith("motion_"));
@@ -30315,6 +30429,9 @@ function effectiveAppTokens(req, state) {
     const fontFaces = servedFontFaces(state.app.dir, tokens);
     if (fontFaces) tokens = { ...tokens, fontFaces };
   }
+  const config = state.app?.module.config;
+  const idiomPolicy = config && "idiom" in config ? config.idiom : void 0;
+  if (idiomPolicy !== void 0) tokens = { ...tokens, idiomPolicy };
   const body = JSON.stringify(tokens);
   return { tokens, etag: makeEtag(body), motionToggles };
 }
@@ -31137,6 +31254,8 @@ async function reloadAppModuleNow(state, opts) {
     }
     const oldMeta = current.meta;
     const oldNav = JSON.stringify(deriveNavigationConfig(oldMeta) ?? null);
+    const idiomOf = (m) => JSON.stringify(m.config.idiom ?? null);
+    const oldIdiom = idiomOf(current.module);
     state.app = {
       name: current.name,
       module: next,
@@ -31158,6 +31277,9 @@ async function reloadAppModuleNow(state, opts) {
     if (oldNav !== newNav) {
       publishSSE(state, "config.invalidated", { reason: opts.reason, at: Date.now() });
     }
+    if (idiomOf(next) !== oldIdiom) {
+      publishSSE(state, "tokens.changed", { reason: opts.reason, at: Date.now() });
+    }
     console.log(`[himalaya-dev] reloaded app module in-process: ${current.name} (${opts.reason})`);
     return { ok: true };
   } catch (err) {
@@ -31288,7 +31410,7 @@ async function handleFlagsEval(req, res, state) {
 function currentFlagConfig(state) {
   if (!state.app) return void 0;
   const base = deriveNavigationConfig(state.app.meta);
-  const merged = state.appConfigOverride ? deepMerge2(base, state.appConfigOverride) : base;
+  const merged = state.appConfigOverride ? deepMerge3(base, state.appConfigOverride) : base;
   return merged.flagConfig;
 }
 function attachAssignments(descriptor, state, ctx, overrides) {
@@ -32065,7 +32187,7 @@ async function handleAdminPlayground(req, res, state) {
   if (path === "/v1/admin/app-config" && state.app) {
     const built = deriveNavigationConfig(state.app.meta);
     if (req.method === "GET") {
-      const effective = state.appConfigOverride ? deepMerge2(built, state.appConfigOverride) : built;
+      const effective = state.appConfigOverride ? deepMerge3(built, state.appConfigOverride) : built;
       return sendJson(res, 200, { source: state.appConfigOverride ? "override" : "built", built, effective });
     }
     if (req.method === "PUT") {
@@ -32077,9 +32199,9 @@ async function handleAdminPlayground(req, res, state) {
       }
       if (!patch || typeof patch !== "object" || Array.isArray(patch)) return sendJson(res, 400, { error: "object_required" });
       const nav = isNavControlPatch(patch);
-      state.appConfigOverride = nav && state.appConfigOverride ? deepMerge2(state.appConfigOverride, patch) : patch;
+      state.appConfigOverride = nav && state.appConfigOverride ? deepMerge3(state.appConfigOverride, patch) : patch;
       publishSSE(state, "config.invalidated", { reason: nav ? "navigate" : "admin_override", at: Date.now() });
-      return sendJson(res, 200, { status: "ok", effective: deepMerge2(built, state.appConfigOverride) });
+      return sendJson(res, 200, { status: "ok", effective: deepMerge3(built, state.appConfigOverride) });
     }
     if (req.method === "DELETE") {
       const existed = state.appConfigOverride !== void 0;
@@ -32090,7 +32212,7 @@ async function handleAdminPlayground(req, res, state) {
   if (path === "/v1/admin/tokens" && state.app) {
     const built = readAppTokens(state) ?? {};
     if (req.method === "GET") {
-      const effective = state.tokensOverride ? deepMerge2(built, state.tokensOverride) : built;
+      const effective = state.tokensOverride ? deepMerge3(built, state.tokensOverride) : built;
       return sendJson(res, 200, { source: state.tokensOverride ? "override" : "built", built, effective });
     }
     if (req.method === "PUT") {
@@ -32103,7 +32225,7 @@ async function handleAdminPlayground(req, res, state) {
       if (!patch || typeof patch !== "object" || Array.isArray(patch)) return sendJson(res, 400, { error: "object_required" });
       state.tokensOverride = patch;
       publishSSE(state, "tokens.changed", { reason: "admin_override", at: Date.now() });
-      return sendJson(res, 200, { status: "ok", effective: deepMerge2(built, state.tokensOverride) });
+      return sendJson(res, 200, { status: "ok", effective: deepMerge3(built, state.tokensOverride) });
     }
     if (req.method === "DELETE") {
       const existed = state.tokensOverride !== void 0;
@@ -37273,10 +37395,11 @@ function notCarriedDiff(local, base) {
   const CARRIED = /* @__PURE__ */ new Set(["screens", "bundles", "tokensHash", "appConfigHash"]);
   const PROVENANCE = /* @__PURE__ */ new Set(["releaseId", "gitSha", "shellSha", "label", "notes", "publishedAt", "publishedBy", "attestation", "forcedPastErrors", "app", "appSourceHash"]);
   const REPORTED_IN_DETAIL = /* @__PURE__ */ new Set(["assets", "minBinaryVersion", "iconHash"]);
+  const comparable = (key2, value) => key2 === "widgets" ? stableWidgets(value) : value;
   for (const key2 of /* @__PURE__ */ new Set([...Object.keys(local), ...Object.keys(base)])) {
     if (CARRIED.has(key2) || PROVENANCE.has(key2) || REPORTED_IN_DETAIL.has(key2)) continue;
-    const l = local[key2] ?? null;
-    const b = base[key2] ?? null;
+    const l = comparable(key2, local[key2] ?? null);
+    const b = comparable(key2, base[key2] ?? null);
     const ls = JSON.stringify(l) ?? "null";
     const bs = JSON.stringify(b) ?? "null";
     if (ls === bs) continue;
@@ -37325,6 +37448,7 @@ function patchHonesty(opts) {
 var SELECTOR_KINDS;
 var init_release_patch = __esm({
   "src/release-patch.ts"() {
+    init_widget_identity();
     SELECTOR_KINDS = ["changed", "screen:<id|glob>", "bundle:<name>", "tokens", "app-config"];
   }
 });
@@ -37485,7 +37609,7 @@ async function navIssues(dir, strict) {
   const nav = cfg.navigation;
   pushRouteIssues(cfg.push, nav, warn);
   if (nav === void 0 || nav === null) return issues;
-  if (!isPlainObject(nav)) {
+  if (!isPlainObject2(nav)) {
     error("nav-not-an-object", `navigation must be an object (got ${Array.isArray(nav) ? "array" : typeof nav}).`);
     return issues;
   }
@@ -37515,10 +37639,10 @@ async function navIssues(dir, strict) {
   for (const key2 of ITEMS_BLOCKS) {
     const block = nav[key2];
     if (block === void 0) continue;
-    if (!isPlainObject(block) || !Array.isArray(block.items)) {
+    if (!isPlainObject2(block) || !Array.isArray(block.items)) {
       error(
         "nav-chrome-shape",
-        `navigation.${key2} must be an object with an \`items\` array \u2014 \`${key2}: { items: [ \u2026 ] }\` (got ${Array.isArray(block) ? "an array" : isPlainObject(block) ? "an object with no `items` array" : typeof block}). The server forwards this verbatim, so the shell finds no destinations and draws none.`
+        `navigation.${key2} must be an object with an \`items\` array \u2014 \`${key2}: { items: [ \u2026 ] }\` (got ${Array.isArray(block) ? "an array" : isPlainObject2(block) ? "an object with no `items` array" : typeof block}). The server forwards this verbatim, so the shell finds no destinations and draws none.`
       );
     }
   }
@@ -37534,7 +37658,7 @@ async function navIssues(dir, strict) {
   if (effectiveBottomTabs && !declaresOtherChrome && itemCount(nav.tabBar) === 0) {
     const linkables = Array.isArray(nav.linkableScreens) ? nav.linkableScreens : [];
     const topLevel = new Set(
-      linkables.filter((s) => isPlainObject(s) && !s.parentScreenId).map((s) => String(s.screenId ?? ""))
+      linkables.filter((s) => isPlainObject2(s) && !s.parentScreenId).map((s) => String(s.screenId ?? ""))
     );
     topLevel.delete("");
     if (topLevel.size > 1) {
@@ -37552,8 +37676,8 @@ async function navIssues(dir, strict) {
   return issues;
 }
 function pushRouteIssues(push, nav, warn) {
-  if (!isPlainObject(push) || push.payloadAdapter !== "wix-ping") return;
-  const routes = Array.isArray(push.routes) ? push.routes.filter(isPlainObject) : [];
+  if (!isPlainObject2(push) || push.payloadAdapter !== "wix-ping") return;
+  const routes = Array.isArray(push.routes) ? push.routes.filter(isPlainObject2) : [];
   if (routes.length === 0) {
     warn(
       "push-routes-missing",
@@ -37561,10 +37685,10 @@ function pushRouteIssues(push, nav, warn) {
     );
     return;
   }
-  const linkables = isPlainObject(nav) ? nav.linkableScreens : void 0;
+  const linkables = isPlainObject2(nav) ? nav.linkableScreens : void 0;
   if (!Array.isArray(linkables)) return;
   const declared = new Set(
-    linkables.filter(isPlainObject).map((s) => String(s.screenId ?? ""))
+    linkables.filter(isPlainObject2).map((s) => String(s.screenId ?? ""))
   );
   for (const route of routes) {
     const screenId = /:\/\/screen\/([^?]+)/.exec(String(route.link ?? ""))?.[1];
@@ -37576,7 +37700,7 @@ function pushRouteIssues(push, nav, warn) {
     }
   }
 }
-var NAVIGATION_KEYS, NAV_KINDS, ITEMS_BLOCKS, SERVED_ONLY_NAV_KEYS, MISPLACED_TOP_LEVEL_KEYS, isPlainObject, itemCount;
+var NAVIGATION_KEYS, NAV_KINDS, ITEMS_BLOCKS, SERVED_ONLY_NAV_KEYS, MISPLACED_TOP_LEVEL_KEYS, isPlainObject2, itemCount;
 var init_nav_lint = __esm({
   "src/nav-lint.ts"() {
     init_app_config_loader();
@@ -37621,8 +37745,8 @@ var init_nav_lint = __esm({
       "deepLinkPatterns",
       "linkableScreens"
     ];
-    isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-    itemCount = (v) => isPlainObject(v) && Array.isArray(v.items) ? v.items.length : 0;
+    isPlainObject2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+    itemCount = (v) => isPlainObject2(v) && Array.isArray(v.items) ? v.items.length : 0;
   }
 });
 
@@ -43361,29 +43485,49 @@ function scriptNonce() {
 function previewCsp(nonce) {
   return `script-src 'self' 'nonce-${nonce}'; base-uri 'self'; object-src 'none'`;
 }
-function indexHtml(asset, pathname) {
+function inlineJson(value) {
+  return JSON.stringify(value).replace(/</g, "\\u003c");
+}
+function previewCredentialsJs(creds) {
+  return `(function(){var d=${inlineJson(creds)};window.__himalayaPreview__=d;try{sessionStorage.setItem("himalaya.preview."+d.app,JSON.stringify(d))}catch(e){}try{var u=new URL(location.href);if(u.searchParams.has("h")){u.searchParams.delete("h");history.replaceState(null,"",u.pathname+u.search+u.hash)}}catch(e){}})();`;
+}
+function stripHandoverParamJs() {
+  return '(function(){window.__himalayaHandoverFailed__=true;try{var u=new URL(location.href);if(u.searchParams.has("h")){u.searchParams.delete("h");history.replaceState(null,"",u.pathname+u.search+u.hash)}}catch(e){}})();';
+}
+function indexHtml(asset, pathname, creds, handoverAttempted = false) {
   void pathname;
   const nonce = scriptNonce();
   const raw = new TextDecoder().decode(assetBytes(asset));
-  const html = raw.replace(/(=|url\()(["']?)\/preview\//g, "$1$2").replace(/<head(\s[^>]*)?>/i, (head) => `${head}<script nonce="${nonce}">${PREVIEW_BASE_JS}</script>`);
+  const head = `<script nonce="${nonce}">${PREVIEW_BASE_JS}</script>` + (creds ? `<script nonce="${nonce}">${previewCredentialsJs(creds)}</script>` : handoverAttempted ? `<script nonce="${nonce}">${stripHandoverParamJs()}</script>` : "");
+  const html = raw.replace(/(=|url\()(["']?)\/preview\//g, "$1$2").replace(/<head(\s[^>]*)?>/i, (tag) => `${tag}${head}`);
   return new Response(html, {
     status: 200,
     // The shell only changes on an artifact deploy, and everything it loads is
     // hash-addressed or release-pinned — so let repeat opens paint instantly from
     // cache while revalidating in the background (the measured cold TTFB through
     // the bo gateway was ~600ms, all of it this document).
+    //
+    // …UNLESS this document carries a redeemed bearer, OR reflects a FAILED handover attempt
+    // (#3042). A redeemed bearer makes it a one-recipient credential delivery, where
+    // `public, max-age=60` would authorize a shared cache to hand it to the next person who
+    // asks. A failed attempt carries the same risk for a different reason: the request URL names
+    // a code (`?h=`) that may still be live (a transient `store_unavailable`, say), and caching
+    // an inert answer to that exact URL would let a shared cache stand between the code and a
+    // legitimate retry. `no-store` also keeps either case out of the browser's own back/forward
+    // cache on disk. The plain (no handover attempted at all) document is untouched and keeps
+    // its cache.
     headers: {
       "content-type": asset.contentType || "text/html; charset=utf-8",
-      "cache-control": "public, max-age=60, stale-while-revalidate=600",
+      "cache-control": creds || handoverAttempted ? "no-store" : "public, max-age=60, stale-while-revalidate=600",
       "content-security-policy": previewCsp(nonce)
     }
   });
 }
-function previewResponse(pathname, assets, mount = "/preview") {
+function previewResponse(pathname, assets, mount = "/preview", creds, handoverAttempted = false) {
   const key2 = pathname.replace(MOUNT_STRIP[mount], "") || "index.html";
   const hit = assets.get(key2);
   if (hit) {
-    if (key2 === "index.html") return indexHtml(hit, pathname);
+    if (key2 === "index.html") return indexHtml(hit, pathname, creds, handoverAttempted);
     if (key2 === "t5-frame.html") {
       return new Response(assetBytes(hit), {
         status: 200,
@@ -43400,7 +43544,7 @@ function previewResponse(pathname, assets, mount = "/preview") {
     });
   }
   const index = assets.get("index.html");
-  if (index) return indexHtml(index, pathname);
+  if (index) return indexHtml(index, pathname, creds, handoverAttempted);
   return new Response(JSON.stringify({ error: "preview_not_built" }), {
     status: 503,
     headers: { "content-type": "application/json; charset=utf-8" }
@@ -43622,19 +43766,19 @@ var init_preview_assets_generated = __esm({
   "../../packages/serve/src/preview-assets.generated.ts"() {
     init_preview_assets_format();
     PREVIEW_ASSET_MANIFEST = [
-      { key: "assets/index-EUz_f6yu.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 987137, sha256: "7b526f22885a0dfed16aa63cc802e4d17c3565e78ba5a8a873bcb111ffe1a076" },
-      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 987145, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
-      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1078069, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
-      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1169053, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
-      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1260033, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
-      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1350905, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
-      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 1441885, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
-      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 1550521, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
-      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 1659605, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
-      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 1768653, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
-      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 1876353, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
-      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 1964461, length: 4448, sha256: "78be80518ed0f28fbf085b806c0d4ef5ec796da109a3f2f257f4ee31e1c01214" },
-      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 1968909, length: 13784, sha256: "cfb9465254fab84f0e084bb4542c282758ea29774b5f172840cc0b9e4194ef89" }
+      { key: "assets/index-BpbA_kgY.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 989132, sha256: "56294e0b1e3ed17b553d17b61856896ae8865ae57bc76443d12c5d6437a37d22" },
+      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 989140, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
+      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1080064, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
+      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1171048, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
+      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1262028, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
+      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1352900, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
+      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 1443880, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
+      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 1552516, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
+      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 1661600, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
+      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 1770648, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
+      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 1878348, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
+      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 1966456, length: 4448, sha256: "4b295aeb4c64dc9378313f44a384fca9054809e665c6a06e00c1b11f7a1596b7" },
+      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 1970904, length: 13784, sha256: "cfb9465254fab84f0e084bb4542c282758ea29774b5f172840cc0b9e4194ef89" }
     ];
   }
 });
@@ -49062,12 +49206,12 @@ function findRepoRoot(cwd) {
   }
   return null;
 }
-function deepMerge3(a, b) {
+function deepMerge4(a, b) {
   const out = { ...a };
   for (const [k, v] of Object.entries(b)) {
     const cur = out[k];
     if (v && typeof v === "object" && !Array.isArray(v) && cur && typeof cur === "object" && !Array.isArray(cur)) {
-      out[k] = deepMerge3(cur, v);
+      out[k] = deepMerge4(cur, v);
     } else {
       out[k] = v;
     }
@@ -49119,7 +49263,7 @@ function mergeCustomerOwned(committed, overlay) {
     if (typeof value === "string" && value.trim() === "") delete overlayIdentity[key2];
   }
   if (customer.identity !== void 0) customer.identity = overlayIdentity;
-  return deepMerge3(committed, customer);
+  return deepMerge4(committed, customer);
 }
 function buildMergedContract(options) {
   const { appDir: appDir2, packageDir, overlay } = options;
@@ -49236,7 +49380,7 @@ async function applyOverlays(input) {
   assertNotCommitted(pkgProv, input.forbiddenProvisioning);
   if (existsSync52(pkgProv)) {
     const cur = JSON.parse(readFileSync62(pkgProv, "utf8"));
-    const merged = deepMerge3(cur, overlay);
+    const merged = deepMerge4(cur, overlay);
     writeFileSync21(pkgProv, JSON.stringify(merged, null, 2) + "\n");
     wrote.push(pkgProv);
   } else {
@@ -49246,7 +49390,7 @@ async function applyOverlays(input) {
   const pkgTokens = join50(cwd, "tokens.json");
   if (existsSync52(pkgTokens) && (tokens.colors || tokens.typography)) {
     const cur = JSON.parse(readFileSync62(pkgTokens, "utf8"));
-    const merged = deepMerge3(cur, tokens);
+    const merged = deepMerge4(cur, tokens);
     const mergedColors = merged.colors;
     if (mergedColors && typeof mergedColors === "object" && !Array.isArray(mergedColors)) {
       merged.colors = alignAccentsToSurfaces(mergedColors, tokens.colors);
@@ -52200,6 +52344,7 @@ if (process.argv[1] && basename(process.argv[1]) === "diff-hash.mjs" && import.m
 }
 
 // src/attestation.ts
+init_widget_identity();
 var DEFAULT_MAX_RUNS = 20;
 var ATTESTATION_VERSION = 2;
 function attestationVersionOf(value) {
@@ -52238,12 +52383,7 @@ function releasePayloadHash(payload) {
   const manifestRecord = manifest;
   const widgets = manifestRecord.widgets;
   if (!widgets || typeof widgets !== "object" || Array.isArray(widgets)) return sha256(canonical(payload));
-  const stableWidgets = Object.fromEntries(Object.entries(widgets).map(([id, value]) => {
-    if (!value || typeof value !== "object" || Array.isArray(value)) return [id, value];
-    const { contentEtag: _generatedContentEtag, ...stable } = value;
-    return [id, stable];
-  }));
-  return sha256(canonical({ ...record2, manifest: { ...manifestRecord, widgets: stableWidgets } }));
+  return sha256(canonical({ ...record2, manifest: { ...manifestRecord, widgets: stableWidgets(widgets) } }));
 }
 function withoutSelfHash(attestation) {
   const { selfHash: _selfHash, ...body } = attestation;
@@ -54047,13 +54187,26 @@ function headers(session) {
 function truncate(token) {
   return token.length <= 20 ? token : `${token.slice(0, 8)}\u2026${token.slice(-8)}`;
 }
+function parseDataFlag(raw) {
+  if (raw === void 0) return {};
+  if (typeof raw === "boolean") return { error: "--data expects k=v" };
+  const entries = Array.isArray(raw) ? raw : [raw];
+  const out = {};
+  for (const entry of entries) {
+    if (typeof entry !== "string") return { error: "--data expects k=v" };
+    const eq = entry.indexOf("=");
+    if (eq <= 0) return { error: `--data expects k=v, got "${entry}"` };
+    out[entry.slice(0, eq)] = entry.slice(eq + 1);
+  }
+  return Object.keys(out).length ? { value: out } : {};
+}
 async function runNotify(pos, flags, io, deps = {}) {
   const doFetch = deps.fetchImpl ?? fetch;
   const str6 = (v) => typeof v === "string" ? v : void 0;
   const json5 = flags.json === true;
   const print = (v) => io.log(JSON.stringify(v, null, 2));
   const sub = pos[1];
-  const USAGE2 = "himi notify send --app <app> (--token <t> | --device <id> | --all) --title <s> [--body <s>] [--link <url>]\n                 [--platform ios|android] [--category <c>] [--badge <n>] [--channel <id>] [--silent] [--dry-run] [--json]\nhimi notify tokens --app <app> [--platform ios|android] [--include-disabled] [--json]\nhimi notify doctor [--json]";
+  const USAGE2 = "himi notify send --app <app> (--token <t> | --device <id> | --all) --title <s> [--body <s>] [--link <url>]\n                 [--platform ios|android] [--category <c>] [--badge <n>] [--channel <id>] [--silent] [--dry-run] [--json]\n                 [--data k=v ...]\nhimi notify tokens --app <app> [--platform ios|android] [--include-disabled] [--json]\nhimi notify doctor [--json]";
   if (!sub || !["send", "tokens", "doctor"].includes(sub)) {
     io.error(
       JSON.stringify({
@@ -54179,6 +54332,11 @@ async function runNotify(pos, flags, io, deps = {}) {
     io.error(JSON.stringify({ error: `targets are mutually exclusive \u2014 got ${targets.join(" and ")}`, usage: USAGE2 }));
     return 2;
   }
+  const data = parseDataFlag(flags.data);
+  if (data.error) {
+    io.error(JSON.stringify({ error: data.error, usage: USAGE2 }));
+    return 2;
+  }
   const silent = flags.silent === true;
   const title = str6(flags.title);
   if (!silent && !title) {
@@ -54199,7 +54357,10 @@ async function runNotify(pos, flags, io, deps = {}) {
     ...flags["dry-run"] === true ? { dryRun: true } : {},
     ...all ? { all: true } : {},
     ...token ? { token } : {},
-    ...device ? { tokenId: Number(device) } : {}
+    ...device ? { tokenId: Number(device) } : {},
+    // Absent rather than `{}` when unset: the route distinguishes the two, and an
+    // empty map is a request to send nothing rather than to send no map.
+    ...data.value ? { data: data.value } : {}
   };
   if (device && !Number.isInteger(Number(device))) {
     io.error(JSON.stringify({ error: `--device takes a numeric registry id (from \`himi notify tokens\`), got "${device}"` }));
@@ -54754,6 +54915,7 @@ function writeAgentContext(targetDir) {
 // src/cli.ts
 init_wix_placeholders();
 var defaultIO = { log: (l) => console.log(l), error: (l) => console.error(l), isTTY: process.stdout.isTTY === true };
+var REPEATABLE_FLAGS = /* @__PURE__ */ new Set(["data"]);
 var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "browser",
   "no-open",
@@ -54845,6 +55007,14 @@ function switchFlagErrors(argv) {
   }
   return out;
 }
+function assign(flags, name, value) {
+  if (!REPEATABLE_FLAGS.has(name)) {
+    flags[name] = value;
+    return;
+  }
+  const seen = flags[name];
+  flags[name] = Array.isArray(seen) ? [...seen, value] : seen === void 0 ? value : [String(seen), value];
+}
 function parseFlags(argv) {
   const _ = [];
   const flags = {};
@@ -54853,13 +55023,13 @@ function parseFlags(argv) {
     if (a.startsWith("--")) {
       const eq = a.indexOf("=");
       if (eq >= 0) {
-        flags[a.slice(2, eq)] = a.slice(eq + 1);
+        assign(flags, a.slice(2, eq), a.slice(eq + 1));
       } else {
         const next = argv[i + 1];
         const optionalNativeWithoutValue = a === "--native" && next !== "ios" && next !== "android";
         const booleanOnly = BOOLEAN_FLAGS.has(a.slice(2));
         if (!optionalNativeWithoutValue && !booleanOnly && next !== void 0 && !next.startsWith("--")) {
-          flags[a.slice(2)] = next;
+          assign(flags, a.slice(2), next);
           i++;
         } else {
           flags[a.slice(2)] = true;
@@ -55537,6 +55707,34 @@ function trustedConfiguredRegistry(env) {
   const configured = normalizeRegistry(env.npm_config_registry ?? env.NPM_CONFIG_REGISTRY);
   return isTrustedRegistry(configured) ? configured : void 0;
 }
+function createScopedRegistryResolver(exec = execFileSync7) {
+  let resolved2;
+  return () => {
+    if (resolved2) return resolved2.value;
+    let value;
+    try {
+      const configured = (key2) => {
+        const raw = exec("npm", ["config", "get", key2], {
+          cwd: homedir7(),
+          timeout: 5e3,
+          stdio: ["ignore", "pipe", "ignore"]
+        }).toString().trim();
+        return raw && raw !== "undefined" ? raw : void 0;
+      };
+      const effective = normalizeRegistry(configured("@wix:registry") ?? configured("registry"));
+      value = isTrustedRegistry(effective) ? effective : void 0;
+    } catch {
+      value = void 0;
+    }
+    resolved2 = { value };
+    return value;
+  };
+}
+var npmScopedWixRegistry = createScopedRegistryResolver();
+function registryCandidates(env, scoped) {
+  const ordered = [isTrustedRegistry(scoped) ? normalizeRegistry(scoped) : void 0, trustedConfiguredRegistry(env), PUBLIC_NPM_REGISTRY];
+  return [...new Set(ordered.filter((r) => r !== void 0))];
+}
 async function fetchPackumentFrom(registry, fetchImpl, timeoutMs) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -55557,10 +55755,8 @@ async function fetchPackumentFrom(registry, fetchImpl, timeoutMs) {
     clearTimeout(timer);
   }
 }
-async function fetchCliPackument(fetchImpl = fetch, timeoutMs = DOCTOR_TIMEOUT_MS, env = process.env) {
-  const configured = trustedConfiguredRegistry(env);
-  const candidates = configured && configured !== PUBLIC_NPM_REGISTRY ? [configured, PUBLIC_NPM_REGISTRY] : [PUBLIC_NPM_REGISTRY];
-  for (const registry of candidates) {
+async function fetchCliPackument(fetchImpl = fetch, timeoutMs = DOCTOR_TIMEOUT_MS, env = process.env, scopedRegistry = npmScopedWixRegistry) {
+  for (const registry of registryCandidates(env, scopedRegistry())) {
     const packument = await fetchPackumentFrom(registry, fetchImpl, timeoutMs);
     if (packument) return packument;
   }
@@ -55599,9 +55795,9 @@ function resolvedSdkVersion(fromDir = process.cwd(), bundledManifest = new URL("
     return {};
   }
 }
-async function doctorVersionReport(running, fetchImpl = fetch, sdk = resolvedSdkVersion()) {
+async function doctorVersionReport(running, fetchImpl = fetch, sdk = resolvedSdkVersion(), scopedRegistry = npmScopedWixRegistry) {
   const minimumSdk = "0.33.0";
-  const packument = await fetchCliPackument(fetchImpl);
+  const packument = await fetchCliPackument(fetchImpl, DOCTOR_TIMEOUT_MS, process.env, scopedRegistry);
   const latest = packument?.latest;
   const publishedAt = packument?.time[running];
   const ageDays = ageInDays(publishedAt);
@@ -55862,7 +56058,7 @@ async function maybeSelfUpdate(argv, io, opts = {}) {
   let answeredBy;
   let answeredLatest;
   if (!fresh) {
-    const packument = await fetchCliPackument(opts.fetchImpl ?? fetch, DOCTOR_TIMEOUT_MS, env);
+    const packument = await fetchCliPackument(opts.fetchImpl ?? fetch, DOCTOR_TIMEOUT_MS, env, opts.scopedRegistry);
     if (packument) {
       latest = packument.latest;
       runningPublishedAt = packument.time[running];
@@ -55912,7 +56108,7 @@ async function maybeSelfUpdate(argv, io, opts = {}) {
   }
   try {
     if (!answeredBy) {
-      const again = await fetchCliPackument(opts.fetchImpl ?? fetch, DOCTOR_TIMEOUT_MS, env);
+      const again = await fetchCliPackument(opts.fetchImpl ?? fetch, DOCTOR_TIMEOUT_MS, env, opts.scopedRegistry);
       answeredBy = again?.registry;
       answeredLatest = again?.latest;
     }
@@ -55969,10 +56165,11 @@ function helpJson() {
     ]
   };
 }
-function previewWebUrl(serveBase, app, release, screenId, surface, previewToken) {
+function previewWebUrl(serveBase, app, release, screenId, surface, previewToken, handover) {
   const base = serveBase.replace(/\/$/, "");
   const path = screenId ? `/preview/a/${app}/screen/${screenId}` : `/preview/a/${app}`;
-  return `${base}${path}?release=${encodeURIComponent(release)}${surface ? `&surface=${encodeURIComponent(surface)}` : ""}${previewToken ? `&pvt=${encodeURIComponent(previewToken)}` : ""}`;
+  const query = handover ? `?h=${encodeURIComponent(handover)}` : `?release=${encodeURIComponent(release)}`;
+  return `${base}${path}${query}${surface ? `&surface=${encodeURIComponent(surface)}` : ""}${!handover && previewToken ? `&pvt=${encodeURIComponent(previewToken)}` : ""}`;
 }
 function renderDeviceWidths() {
   return {
@@ -56037,14 +56234,16 @@ function servesAll(served, asked) {
   return Object.entries(asked).every(([k, v]) => stable(served[k]) === stable(v));
 }
 var GIT_FLAG_STORE_HALF_WRITE_NOTE = "the plane reported a failure, but this store writes flags.json BEFORE it commits \u2014 so the change may already be on the pod that served this request, uncommitted and lost on its next restart. servedNow says what that pod answers now; other pods may differ.";
+var PREVIEW_HANDOVER_NOTE = "the preview link carries a single-use code, not the bearer itself \u2014 it opens the draft ONCE, and the credential behind it has a limited lifetime this call has no usable expiry for. Run the `previewRenew` command printed beside this note \u2014 from the same plane and credentials as this call (any `--serve-url`/`--control-url`/token flags you passed) \u2014 for a fresh link.";
 var PREVIEW_TOKEN_NOTE = "the preview link carries a bearer with a limited lifetime, and this call has no usable expiry for it \u2014 the plane stated none, or the one it stated is unreadable, already past, or beyond the hour this CLI will reason about. Run the `previewRenew` command printed beside this note \u2014 from the same plane and credentials as this call (any `--serve-url`/`--control-url`/token flags you passed) \u2014 for a fresh one.";
-function previewTokenNote(expiresAt, now = Date.now()) {
+function previewTokenNote(expiresAt, now = Date.now(), viaHandover = false) {
+  const carrier = viaHandover ? "the preview link carries a single-use code, not the bearer itself" : "the preview link carries a bearer";
   const at = expiresAt ? Date.parse(expiresAt) : NaN;
-  if (!Number.isFinite(at)) return PREVIEW_TOKEN_NOTE;
+  if (!Number.isFinite(at)) return viaHandover ? PREVIEW_HANDOVER_NOTE : PREVIEW_TOKEN_NOTE;
   const seconds = (at - now) / 1e3;
-  if (seconds <= 0 || seconds > 3600) return PREVIEW_TOKEN_NOTE;
+  if (seconds <= 0 || seconds > 3600) return viaHandover ? PREVIEW_HANDOVER_NOTE : PREVIEW_TOKEN_NOTE;
   const minutes = Math.max(1, Math.round(seconds / 60));
-  return `the preview link carries a bearer that expires at ${expiresAt} \u2014 about ${minutes} minute${minutes === 1 ? "" : "s"} from now; run the \`previewRenew\` command printed beside this note \u2014 from the same plane and credentials as this call (any \`--serve-url\`/\`--control-url\`/token flags you passed) \u2014 for a fresh one.`;
+  return `${carrier}, and it expires at ${expiresAt} \u2014 about ${minutes} minute${minutes === 1 ? "" : "s"} from now; run the \`previewRenew\` command printed beside this note \u2014 from the same plane and credentials as this call (any \`--serve-url\`/\`--control-url\`/token flags you passed) \u2014 for a fresh one.`;
 }
 function previewRenewCommand(app, release, target, scope = {}) {
   return `himi preview --app ${app} --release ${release}` + (scope.screen ? ` --screen ${scope.screen}` : "") + (scope.surface ? ` --surface ${scope.surface}` : "") + (target !== "local" ? ` --target ${target}` : "");
@@ -57156,6 +57355,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
     const out = r.json ?? {};
     const release = out.releaseId ?? "";
     const previewToken = out.previewToken;
+    const previewHandover = out.previewHandover;
     const sbase = serveBase();
     const sourceMatchesLocal = opts.localSourceHash === void 0 ? null : opts.localSourceHash === (base.appSourceHash ?? null);
     const honesty = patchHonesty2({ door: opts.door, base, derivedReleaseId: release, sourceMatchesLocal, app });
@@ -57188,7 +57388,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
       ...opts.ux ? uxHandoverOverride(opts.ux.evidence, opts.ux.ctx) : {},
       ...out.visibility ? { visibility: out.visibility } : {},
       ...opts.extra ?? {},
-      previewWeb: sbase && release ? previewWebUrl(sbase, app, release, void 0, void 0, previewToken) : null,
+      previewWeb: sbase && release ? previewWebUrl(sbase, app, release, void 0, void 0, previewToken, previewHandover) : null,
       previewTokenExpiresAt: out.previewTokenExpiresAt ?? null,
       previewPlayerDebug: release ? previewPlayerDebugLink(app, release, void 0, previewToken) : null,
       context: sbase && release ? previewContextUrl(sbase, app, release) : null,
@@ -59130,6 +59330,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
         const sourceStored = r.json?.sourceStored;
         const previewToken = draft ? r.json?.previewToken : void 0;
         const previewTokenExpiresAt = draft ? r.json?.previewTokenExpiresAt : void 0;
+        const previewHandover = draft ? r.json?.previewHandover : void 0;
         const functionPreviewToken = r.json?.functionPreviewToken;
         const functionPreviewExpiresAt = r.json?.functionPreviewExpiresAt;
         const effectiveVisibility = r.json?.visibility;
@@ -59197,7 +59398,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           }),
           ...loopbackWarning ? { warning: loopbackWarning } : {},
           ...report.issues ? { issues: report.issues } : {},
-          previewWeb: base ? previewWebUrl(base, app, release, void 0, void 0, previewToken) : null,
+          previewWeb: base ? previewWebUrl(base, app, release, void 0, void 0, previewToken, previewHandover) : null,
           // A timestamp alone leaves the reader to work out both how long they have and how to
           // get another one. Print the duration and the re-mint command beside it (#2502 item 3).
           // No `mintedHere` guard is needed here, unlike `himi preview`: this bearer can only
@@ -59206,7 +59407,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           ...previewToken ? {
             previewTokenExpiresAt: previewTokenExpiresAt ?? null,
             previewRenew: previewRenewCommand(app, release, targetName()),
-            previewTokenNote: previewTokenNote(previewTokenExpiresAt)
+            previewTokenNote: previewTokenNote(previewTokenExpiresAt, Date.now(), previewHandover !== void 0)
           } : {},
           // RFC 0051 — the surfaces THIS RELEASE targets, read from the manifest the
           // push just published (never a re-read of the local file: review found the
@@ -59668,6 +59869,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
         }
         let previewToken = str5(flags["preview-token"]);
         let previewTokenExpiresAt;
+        let previewHandover;
         let mintedHere = false;
         let mintFailure;
         if (!previewToken) {
@@ -59695,6 +59897,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
                 const body = minted.json;
                 previewToken = typeof body.previewToken === "string" ? body.previewToken : void 0;
                 previewTokenExpiresAt = typeof body.previewTokenExpiresAt === "string" ? body.previewTokenExpiresAt : void 0;
+                previewHandover = typeof body.previewHandover === "string" ? body.previewHandover : void 0;
                 mintedHere = previewToken !== void 0;
                 if (!mintedHere) mintFailure = "the plane answered the mint request without a token \u2014 HIMALAYA_PREVIEW_TOKEN_SECRET may be unconfigured there. Your credential is fine";
               }
@@ -59709,7 +59912,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           release,
           ...screen ? { screen } : {},
           ...surface ? { surface } : {},
-          previewWeb: base ? previewWebUrl(base, app, release, screen, surface, previewToken) : null,
+          previewWeb: base ? previewWebUrl(base, app, release, screen, surface, previewToken, previewHandover) : null,
           // Gated on the MINT, like the two fields below: a plane that returns an expiry but no
           // token would otherwise print a lifetime for a bearer the same envelope says does not
           // exist.
@@ -59724,7 +59927,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           // in with `--preview-token` is one this command cannot promise to reissue.
           ...mintedHere ? {
             previewRenew: previewRenewCommand(app, release, targetName(), { screen, surface }),
-            previewTokenNote: previewTokenNote(previewTokenExpiresAt)
+            previewTokenNote: previewTokenNote(previewTokenExpiresAt, Date.now(), previewHandover !== void 0)
           } : previewToken || !mintFailure ? {} : { previewTokenNote: `no preview bearer was minted \u2014 ${mintFailure}. The link above carries no \`pvt\`, so it opens a LIVE release and will not open a draft.` },
           previewPlayerDebug: previewPlayerDebugLink(app, release, screen, previewToken),
           context: base ? previewContextUrl(base, app, release, screen) : null,
@@ -61408,8 +61611,9 @@ ${label2}`);
           return 1;
         }
         try {
-          const answered = await fetchCliPackument(up.fetchImpl ?? fetch, DOCTOR_TIMEOUT_MS, env);
-          const registry = answered?.registry ?? trustedConfiguredRegistry(env) ?? PUBLIC_NPM_REGISTRY;
+          const scoped = up.scopedRegistry ?? npmScopedWixRegistry;
+          const answered = await fetchCliPackument(up.fetchImpl ?? fetch, DOCTOR_TIMEOUT_MS, env, scoped);
+          const registry = answered?.registry ?? registryCandidates(env, scoped())[0];
           if (answered?.latest && compareVersions2(answered.latest, before) <= 0) {
             if (flags.json) print({ ok: true, running: before, installed: before, changed: false, registry, latest: answered.latest });
             else io.log(`himi ${before} (unchanged \u2014 ${registry} has nothing newer; its latest is ${answered.latest})`);
@@ -61891,6 +62095,7 @@ export {
   GIT_FLAG_STORE_NOTE,
   PLACEHOLDER_CLIENT_ID,
   PLACEHOLDER_SITE_URL,
+  PREVIEW_HANDOVER_NOTE,
   PREVIEW_TOKEN_NOTE,
   PUBLIC_NPM_REGISTRY,
   PUBLIC_WIX_API_BASE,
@@ -61900,6 +62105,7 @@ export {
   autoClaimSlug,
   buildDoctorReport,
   compareVersions2 as compareVersions,
+  createScopedRegistryResolver,
   createUpdateRunner,
   credentialKind,
   credentialSwapNotice,
@@ -61915,6 +62121,7 @@ export {
   formatSdkVersionLine,
   formatStaleLine,
   globalPrefixWritable,
+  handoverUxEvidence,
   humanDuration,
   inspectControlToken,
   isHimalayaMonorepoCheckout,
@@ -61929,6 +62136,7 @@ export {
   nativeConfigAdvisories,
   nativeConfigTokenNotice,
   npmInstallArgs,
+  npmScopedWixRegistry,
   ownerPlaneHint,
   ownerPlaneIsDark,
   parseFlags,
@@ -61949,6 +62157,7 @@ export {
   probeReachable,
   pushAuthHint,
   readUpdateCache,
+  registryCandidates,
   renderDataSource,
   renderDeviceWidths,
   resolveAppSlug,