@wix/himalaya-cli 0.995.0 → 0.996.0

package/dist/cli.mjs

@@ -5304,8 +5304,11 @@ function walk(node, registry, path, out) {
     walk(value, registry, `${path}.${key2}`, out);
   }
 }
+var SYSTEM_FONT_FAMILY;
 var init_tokens = __esm({
   "../../core/ts/src/tokens.ts"() {
+    "use strict";
+    SYSTEM_FONT_FAMILY = "$system";
   }
 });
 
@@ -11851,6 +11854,11 @@ import { fileURLToPath as fileURLToPath8 } from "node:url";
 import { join as join20 } from "node:path";
 function loadCatalog() {
   if (cached) return cached;
+  const override = process.env.HIMI_FONTS_CATALOG;
+  if (override) {
+    cached = JSON.parse(readFileSync17(override, "utf8"));
+    return cached;
+  }
   const path = CATALOG_CANDIDATES.find((p) => existsSync17(p));
   if (!path) {
     throw new Error(
@@ -11876,6 +11884,10 @@ function findFamily(name, catalog = loadCatalog()) {
   if (!canonical3) return void 0;
   return catalog.families[canonical3] ?? catalog.bundled[canonical3];
 }
+function canonicalFamilyName(name, catalog = loadCatalog()) {
+  if (catalog.families[name] ?? catalog.bundled[name] ?? catalog.system[name]) return name;
+  return familyIndex(catalog).get(normalizeFamily(name));
+}
 function isSystemFamily(name, catalog = loadCatalog()) {
   return catalog.system[name] !== void 0;
 }
@@ -11930,7 +11942,7 @@ var init_catalog = __esm({
 function demandFromTokens(tokens) {
   const demand = /* @__PURE__ */ new Map();
   const add = (family, weight) => {
-    if (typeof family !== "string" || family.length === 0) return;
+    if (typeof family !== "string" || family.length === 0 || family === SYSTEM_FONT_FAMILY) return;
     demand.set(family, (demand.get(family) ?? /* @__PURE__ */ new Set()).add(typeof weight === "number" ? weight : 400));
   };
   const base = tokens.typography ?? {};
@@ -11950,11 +11962,11 @@ function planFonts(tokens, policy = {}, catalog = loadCatalog()) {
     return new Set(fam ? fam.faces.map((f) => f.weight) : [400]);
   };
   for (const family of policy.families ?? []) {
-    if (demand.has(family)) continue;
+    if (demand.has(family) || family === SYSTEM_FONT_FAMILY) continue;
     demand.set(family, allWeights(family));
   }
   for (const family of policy.otaOnly ?? []) {
-    if (demand.has(family)) continue;
+    if (demand.has(family) || family === SYSTEM_FONT_FAMILY) continue;
     demand.set(family, allWeights(family));
   }
   for (const family of TIER1_FLOOR) if (!demand.has(family)) demand.set(family, allWeights(family));
@@ -12021,13 +12033,14 @@ var TIER1_FLOOR;
 var init_plan_fonts = __esm({
   "../font-bake/plan-fonts.ts"() {
     init_catalog();
+    init_tokens();
     TIER1_FLOOR = ["Wix Madefor Text"];
   }
 });
 
 // ../font-bake/face-source.ts
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync18, readFileSync as readFileSync18 } from "node:fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync9, readFileSync as readFileSync18, renameSync, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { basename as basename6, join as join21 } from "node:path";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
@@ -12043,12 +12056,563 @@ function faceSource(file, sha2565) {
   if (existsSync18(cached3)) return cached3;
   return null;
 }
-var REPO_ROOT5, VENDORED_DIR, CACHE_DIR;
+function upstreamFaceUrl(ref, dir, file) {
+  return `${RAW}/google/fonts/${ref}/${dir}/${encodeURIComponent(file)}`;
+}
+function faceUpstream(sha2565, catalog = loadCatalog()) {
+  for (const [name, fam] of Object.entries(catalog.families)) {
+    if (!fam.dir || !UPSTREAM_DIR.test(fam.dir)) continue;
+    const face = fam.faces.find((f) => f.sha256 === sha2565);
+    if (face) return { family: name, url: upstreamFaceUrl(catalog.source.ref, fam.dir, face.file) };
+  }
+  return null;
+}
+async function fetchUpstreamBytes(url) {
+  const res = await fetch(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+  if (!res.ok) throw new Error(`GET ${url} -> ${res.status} ${res.statusText}`);
+  return new Uint8Array(await res.arrayBuffer());
+}
+function writeCachedFace(bytes2) {
+  const hash = sha256Hex2(bytes2);
+  mkdirSync9(CACHE_DIR, { recursive: true });
+  const tmp = join21(CACHE_DIR, `.${hash}.${process.pid}.${Date.now()}.tmp`);
+  try {
+    writeFileSync8(tmp, bytes2);
+    renameSync(tmp, join21(CACHE_DIR, hash));
+  } catch (err) {
+    rmSync3(tmp, { force: true });
+    throw err;
+  }
+  return hash;
+}
+async function ensureFaceBytes(face, opts = {}) {
+  const local = faceSource(face.file, face.sha256);
+  if (local) {
+    const bytes2 = readFileSync18(local);
+    if (local !== join21(CACHE_DIR, face.sha256) || sha256Hex2(bytes2) === face.sha256) {
+      return { ok: true, bytes: bytes2, from: "local" };
+    }
+  }
+  const upstream = faceUpstream(face.sha256, opts.catalog);
+  if (!upstream) {
+    return { ok: false, reason: `${face.file} has no upstream in the font catalog \u2014 its bytes ship only in the vendored tree` };
+  }
+  const fetcher = opts.fetchFace ?? fetchUpstreamBytes;
+  let memo = recentFetches.get(fetcher);
+  if (!memo) recentFetches.set(fetcher, memo = /* @__PURE__ */ new Map());
+  const recent = memo.get(face.sha256);
+  if (recent && Date.now() - recent.at < FAILURE_MEMO_MS) return recent.result;
+  const result = fetchVerifyAndCache(upstream.url, face.sha256, fetcher);
+  memo.set(face.sha256, { at: Date.now(), result });
+  void result.then((r) => {
+    if (r.ok) memo.delete(face.sha256);
+  });
+  return result;
+}
+async function fetchVerifyAndCache(url, sha2565, fetcher) {
+  let bytes2;
+  try {
+    bytes2 = Buffer.from(await fetcher(url));
+  } catch (err) {
+    return { ok: false, reason: `fetching ${url} failed: ${err.message}` };
+  }
+  const got = sha256Hex2(bytes2);
+  if (got !== sha2565) {
+    return {
+      ok: false,
+      reason: `${url} returned bytes hashing to ${got.slice(0, 12)}\u2026, but the catalog pins ${sha2565.slice(0, 12)}\u2026 \u2014 refused`
+    };
+  }
+  try {
+    writeCachedFace(bytes2);
+  } catch {
+  }
+  return { ok: true, bytes: bytes2, from: "fetched" };
+}
+function isHostProvided(familyName, catalog = loadCatalog()) {
+  return catalog.bundled[canonicalFamilyName(familyName, catalog) ?? familyName] !== void 0;
+}
+async function offRepoFontBytes(plan, opts = {}) {
+  const catalog = opts.catalog ?? loadCatalog();
+  const out = { ready: [], hostProvided: [], unavailable: [] };
+  const families = plan.families.filter((f) => !f.builtin);
+  const resolved2 = await Promise.all(
+    families.map(async (family) => {
+      if (isHostProvided(family.name, catalog)) return { family, hostProvided: true };
+      const faces = await Promise.all(
+        family.faces.map(async (face) => ({ face, got: await ensureFaceBytes(face, { ...opts, catalog }) }))
+      );
+      return { family, faces };
+    })
+  );
+  for (const r of resolved2) {
+    if ("hostProvided" in r) {
+      out.hostProvided.push(r.family);
+      continue;
+    }
+    const failed = r.faces.find((f) => !f.got.ok);
+    if (failed && !failed.got.ok) {
+      out.unavailable.push({ family: r.family, reason: failed.got.reason });
+      continue;
+    }
+    out.ready.push({
+      family: r.family,
+      faces: r.faces.map(({ face, got }) => ({ face, bytes: got.bytes }))
+    });
+  }
+  return out;
+}
+async function catalogFaceBytes(sha2565, opts = {}) {
+  const catalog = opts.catalog ?? loadCatalog();
+  for (const family of [...Object.values(catalog.families), ...Object.values(catalog.bundled)]) {
+    const face = family.faces.find((f) => f.sha256 === sha2565);
+    if (!face) continue;
+    if (hasVendoredFloor()) {
+      const local = faceSource(face.file, face.sha256);
+      return local ? readFileSync18(local) : void 0;
+    }
+    const got = await ensureFaceBytes(face, { ...opts, catalog });
+    return got.ok ? got.bytes : void 0;
+  }
+  return void 0;
+}
+var REPO_ROOT5, VENDORED_DIR, CACHE_DIR, sha256Hex2, RAW, UPSTREAM_DIR, FETCH_TIMEOUT_MS, FAILURE_MEMO_MS, recentFetches;
 var init_face_source = __esm({
   "../font-bake/face-source.ts"() {
+    init_catalog();
     REPO_ROOT5 = fileURLToPath9(new URL("../..", import.meta.url));
     VENDORED_DIR = process.env.HIMI_FONTS_VENDORED_DIR || join21(REPO_ROOT5, "stdlib", "fonts", "vendored", "wix-madefor");
     CACHE_DIR = join21(process.env.XDG_CACHE_HOME || join21(homedir3(), ".cache"), "himi", "fonts");
+    sha256Hex2 = (bytes2) => createHash6("sha256").update(bytes2).digest("hex");
+    RAW = ["https://", "raw.", "githubuser", "content.com"].join("");
+    UPSTREAM_DIR = /^(ofl|apache|ufl)\/[a-z0-9_-]+$/;
+    FETCH_TIMEOUT_MS = 2e4;
+    FAILURE_MEMO_MS = 6e4;
+    recentFetches = /* @__PURE__ */ new WeakMap();
+  }
+});
+
+// ../../core/ts/src/idiom.ts
+function authored(overlays, name) {
+  return typeof name === "string" && overlays !== void 0 && Object.hasOwn(overlays, name) && overlays[name] !== null && typeof overlays[name] === "object" && !Array.isArray(overlays[name]);
+}
+function selectIdiomOverlay(doc, ctx = {}) {
+  const policy = doc.idiomPolicy;
+  const overlays = doc.idiom;
+  const isRecord3 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+  if (!isRecord3(policy) || !isRecord3(overlays)) return void 0;
+  const kind = policy.policy ?? "follow-surface";
+  if (kind === "none") return void 0;
+  if (kind === "pinned") return authored(overlays, policy.pin) ? policy.pin : void 0;
+  if (kind !== "follow-surface") return void 0;
+  const surfaces = policy.surfaces;
+  const candidates = [
+    ctx.surface !== void 0 && isRecord3(surfaces) && Object.hasOwn(surfaces, ctx.surface) ? surfaces[ctx.surface] : void 0,
+    ...ctx.native ?? [],
+    policy.fallback
+  ];
+  return candidates.find((c) => authored(overlays, c));
+}
+function isPlainObject(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+function deepMerge(base, overlay) {
+  if (!isPlainObject(overlay) || !isPlainObject(base)) return overlay;
+  const out = { ...base };
+  for (const [key2, value] of Object.entries(overlay)) {
+    if (UNSAFE_KEYS.has(key2)) continue;
+    out[key2] = Object.hasOwn(base, key2) ? deepMerge(base[key2], value) : value;
+  }
+  return out;
+}
+function mergeIdiomOverlay(base, overlay) {
+  const merged = deepMerge(base, overlay);
+  const baseColors = base.colors;
+  const overlayColors = overlay.colors;
+  if (isPlainObject(baseColors) && isPlainObject(overlayColors)) {
+    const colors = { ...merged.colors };
+    for (const [name, value] of Object.entries(overlayColors)) {
+      if (UNSAFE_KEYS.has(name)) continue;
+      const was = Object.hasOwn(baseColors, name) ? baseColors[name] : void 0;
+      if (typeof was === "string" && isPlainObject(value)) colors[name] = { light: was, ...value };
+    }
+    merged.colors = colors;
+  }
+  return merged;
+}
+function resolveIdiom(tokens, ctx = {}) {
+  const doc = tokens;
+  const name = selectIdiomOverlay(doc, ctx);
+  if (name === void 0) return tokens;
+  const merged = mergeIdiomOverlay(tokens, doc.idiom[name]);
+  const { idiomPolicy: _applied, ...final } = merged;
+  return final;
+}
+var UNSAFE_KEYS;
+var init_idiom = __esm({
+  "../../core/ts/src/idiom.ts"() {
+    "use strict";
+    UNSAFE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+  }
+});
+
+// ../../core/web-renderer/src/tokens.ts
+function isSerifFamily(family) {
+  return !!family && SERIF_FAMILY_RE.test(family);
+}
+function fontStack(family) {
+  if (!family) return DEFAULT_FONT_STACK;
+  if (family === SYSTEM_FONT_FAMILY) return SYSTEM_FONT_STACK;
+  if (isSerifFamily(family)) return `"${family}", serif`;
+  return `"${family}", ${DEFAULT_FONT_STACK}`;
+}
+function clamp(n, lo = 0, hi = 1) {
+  return Math.max(lo, Math.min(hi, n));
+}
+function hexToRgb2(hex2) {
+  let h = hex2.trim().replace(/^#/, "");
+  if (h.length === 3) h = h.split("").map((c) => c + c).join("");
+  if (!/^[\da-f]{6}$/i.test(h)) return null;
+  const int = parseInt(h, 16);
+  return [int >> 16 & 255, int >> 8 & 255, int & 255];
+}
+function rgba(color, alpha2) {
+  const rgb = hexToRgb2(color);
+  return rgb ? `rgba(${rgb[0]}, ${rgb[1]}, ${rgb[2]}, ${clamp(alpha2)})` : color;
+}
+function normalizeSpring(spring, durationMs) {
+  return {
+    response: clampTo(finite(spring.response) ?? durationMs / 1e3, SPRING_MIN_RESPONSE, SPRING_MAX_RESPONSE),
+    dampingFraction: clampTo(finite(spring.dampingFraction) ?? 0.8, SPRING_MIN_DAMPING, SPRING_MAX_DAMPING)
+  };
+}
+function springStep(response, zeta) {
+  const w0 = 2 * Math.PI / response;
+  if (zeta < 1) {
+    const wd = w0 * Math.sqrt(1 - zeta * zeta);
+    return (t) => 1 - Math.exp(-zeta * w0 * t) * (Math.cos(wd * t) + zeta * w0 / wd * Math.sin(wd * t));
+  }
+  if (zeta === 1) return (t) => 1 - Math.exp(-w0 * t) * (1 + w0 * t);
+  const root = Math.sqrt(zeta * zeta - 1);
+  const r1 = -w0 * (zeta - root), r2 = -w0 * (zeta + root);
+  return (t) => 1 - (r2 * Math.exp(r1 * t) - r1 * Math.exp(r2 * t)) / (r2 - r1);
+}
+function springCurve(spring, durationMs) {
+  const { response, dampingFraction: zeta } = normalizeSpring(spring, durationMs);
+  const key2 = `${response}|${zeta}`;
+  const cached3 = springCurves.get(key2);
+  if (cached3) return cached3;
+  const x = springStep(response, zeta);
+  const step = response / 64;
+  let settle = 0;
+  for (let t = 0; t <= SPRING_MAX_SECS; t += step) if (Math.abs(1 - x(t)) > SPRING_SETTLE_TOLERANCE) settle = t;
+  const secs = Math.min(settle + step, SPRING_MAX_SECS);
+  const samples = Math.min(200, Math.max(24, Math.ceil(12 * secs / response)));
+  const points = [];
+  for (let i = 0; i <= samples; i++) points.push(i === 0 ? 0 : i === samples ? 1 : Number(x(secs * i / samples).toFixed(3)));
+  const curve = { durationMs: Math.round(secs * 1e3), easing: `linear(${points.join(", ")})` };
+  springCurves.set(key2, curve);
+  return curve;
+}
+function linearEasingSupported() {
+  const css = globalThis.CSS;
+  return typeof css?.supports === "function" && css.supports("animation-timing-function", "linear(0, 1)");
+}
+function easingCss(e) {
+  switch (e) {
+    case "linear":
+      return "linear";
+    case "easeIn":
+      return "cubic-bezier(0.4,0,1,1)";
+    case "easeOut":
+      return "cubic-bezier(0,0,0.2,1)";
+    case "spring":
+      return "cubic-bezier(0.34,1.56,0.64,1)";
+    // Material 3's emphasized easing (#2930).
+    case "emphasized":
+      return "cubic-bezier(0.2,0,0,1)";
+    default:
+      return "cubic-bezier(0.4,0,0.2,1)";
+  }
+}
+function motionCss(m) {
+  if (m.easing === "spring" && m.spring && linearEasingSupported()) return springCurve(m.spring, m.duration);
+  return { durationMs: m.duration, easing: easingCss(m.easing) };
+}
+function hexToHsl(hex2) {
+  const m = /^#?([\da-f]{6})$/i.exec(hex2.trim());
+  if (!m) return null;
+  const int = parseInt(m[1], 16);
+  const r = (int >> 16 & 255) / 255, g = (int >> 8 & 255) / 255, b = (int & 255) / 255;
+  const max = Math.max(r, g, b), min = Math.min(r, g, b);
+  let h = 0, s = 0;
+  const l = (max + min) / 2;
+  if (max !== min) {
+    const d = max - min;
+    s = l > 0.5 ? d / (2 - max - min) : d / (max + min);
+    if (max === r) h = (g - b) / d + (g < b ? 6 : 0);
+    else if (max === g) h = (b - r) / d + 2;
+    else h = (r - g) / d + 4;
+    h /= 6;
+  }
+  return [h, s, l];
+}
+function hslToHex(h, s, l) {
+  const hue = (p, q, t) => {
+    if (t < 0) t += 1;
+    if (t > 1) t -= 1;
+    if (t < 1 / 6) return p + (q - p) * 6 * t;
+    if (t < 1 / 2) return q;
+    if (t < 2 / 3) return p + (q - p) * (2 / 3 - t) * 6;
+    return p;
+  };
+  let r, g, b;
+  if (s === 0) {
+    r = g = b = l;
+  } else {
+    const q = l < 0.5 ? l * (1 + s) : l + s - l * s;
+    const p = 2 * l - q;
+    r = hue(p, q, h + 1 / 3);
+    g = hue(p, q, h);
+    b = hue(p, q, h - 1 / 3);
+  }
+  const to = (x) => Math.round(clamp(x) * 255).toString(16).padStart(2, "0");
+  return `#${to(r)}${to(g)}${to(b)}`;
+}
+function roleOf(name) {
+  const n = name.toLowerCase();
+  if (n.startsWith("surface") || n.includes("background") || n.includes("canvas")) return "surface";
+  if (n.startsWith("text") || n.startsWith("on")) return "text";
+  if (n.includes("border") || n.includes("divider") || n.includes("separator")) return "border";
+  if (n.includes("accent") || n.includes("primary") || n.includes("link")) return "accent";
+  return "other";
+}
+function synthScheme(hex2, name, scheme) {
+  if (scheme === "light") return hex2;
+  const hsl = hexToHsl(hex2);
+  if (!hsl) return hex2;
+  const [h, s, l] = hsl;
+  const role = roleOf(name);
+  if (scheme === "dark") {
+    switch (role) {
+      case "surface":
+        return hslToHex(h, clamp(s * 0.6), clamp(0.07 + (1 - l) * 0.12, 0.06, 0.22));
+      case "text":
+        return hslToHex(h, clamp(s * 0.5), clamp(0.97 - l * 0.25, 0.7, 0.97));
+      case "border":
+        return hslToHex(h, clamp(s * 0.5), clamp(0.18 + (1 - l) * 0.12, 0.18, 0.34));
+      case "accent":
+        return hslToHex(h, s, clamp(l + 0.1, 0, 0.72));
+      default:
+        return hslToHex(h, s, clamp(l + 0.06));
+    }
+  }
+  switch (role) {
+    case "surface":
+      return l > 0.5 ? "#FFFFFF" : "#000000";
+    case "text":
+      return l > 0.5 ? "#FFFFFF" : "#000000";
+    case "border":
+      return "#000000";
+    case "accent":
+      return hslToHex(h, clamp(s + 0.2), clamp(l - 0.18, 0.18, 0.5));
+    default:
+      return hex2;
+  }
+}
+function resolveSchemeColor(o, scheme) {
+  const exact = o?.[scheme];
+  if (typeof exact === "string") return exact;
+  if (scheme === "highContrast" && typeof o?.dark === "string") return o.dark;
+  if (typeof o?.light === "string") return o.light;
+  return typeof o?.dark === "string" ? o.dark : void 0;
+}
+function makeTokenResolvers(source, scheme, idiom = WEB_IDIOM_CONTEXT) {
+  const tokens = resolveIdiom(source, idiom);
+  const color = (name, fallback = "#1a1a1a") => {
+    if (name == null) return fallback;
+    if (typeof name !== "string") {
+      const o = name;
+      const direct = resolveSchemeColor(o, scheme);
+      if (typeof direct === "string") return direct;
+      if (typeof o?.token === "string") return color(o.token, fallback);
+      if (typeof o?.name === "string") return color(o.name, fallback);
+      return fallback;
+    }
+    if (name.startsWith("#")) return name;
+    const v = tokens.colors?.[name];
+    if (v == null) return fallback;
+    if (typeof v === "object") {
+      const direct = resolveSchemeColor(v, scheme);
+      return typeof direct === "string" ? direct : fallback;
+    }
+    return synthScheme(v, name, scheme);
+  };
+  const font = (style = "body") => {
+    const t = tokens.typography?.[style] ?? tokens.fonts?.[style] ?? tokens.typography?.body ?? tokens.fonts?.body;
+    const size = t?.size ?? 14;
+    return {
+      size,
+      remSize: pxToRem(size),
+      weight: t?.weight ?? 400,
+      line: t?.line ?? 1.4,
+      family: t?.family,
+      letterSpacing: t?.letterSpacing
+    };
+  };
+  const radius = (name, fallback = 0) => {
+    if (typeof name === "number") return name;
+    if (typeof name === "string") return tokens.radius?.[name] ?? fallback;
+    return fallback;
+  };
+  const sp = (n) => typeof n === "number" ? n : 0;
+  const shadow = (name) => {
+    const key2 = typeof name === "string" ? name : name?.token ?? name?.name;
+    if (!key2) return void 0;
+    const v = tokens.shadows?.[key2];
+    if (v == null) return void 0;
+    if (typeof v === "string") return v;
+    const x = v.x ?? 0, y = v.y ?? 0;
+    return `${x}px ${y}px ${v.radius}px ${rgba(v.color ?? "#000000", v.opacity)}`;
+  };
+  const gradient = (name) => {
+    const key2 = typeof name === "string" ? name : name?.token;
+    if (!key2) return void 0;
+    const v = tokens.gradients?.[key2];
+    if (v == null) return void 0;
+    if (typeof v === "string") return v;
+    const stops = v.colors.map((c, i) => {
+      const at = v.locations?.[i];
+      return `${color(c)}${at != null ? ` ${Math.round(at * 100)}%` : ""}`;
+    });
+    return `linear-gradient(${v.angle ?? 0}deg, ${stops.join(", ")})`;
+  };
+  const meshGradient = (name) => {
+    const key2 = typeof name === "string" ? name : name?.token;
+    if (!key2) return void 0;
+    const v = tokens.gradients?.[key2];
+    if (v == null || typeof v === "string") return void 0;
+    const cols = v.colors.map((c) => color(c));
+    if (cols.length === 0) return void 0;
+    const pts = [[18, 22], [82, 18], [25, 82], [78, 80], [50, 45], [10, 55], [90, 60]];
+    const blobs = cols.map((c, i) => {
+      const [x, y] = pts[i % pts.length];
+      return `radial-gradient(circle at ${x}% ${y}%, ${c} 0%, transparent 55%)`;
+    });
+    return `${blobs.join(", ")}, ${cols[cols.length - 1]}`;
+  };
+  const material = (name) => {
+    const key2 = typeof name === "string" ? name : name?.token ?? name?.name;
+    if (!key2) return void 0;
+    const v = tokens.materials?.[key2];
+    if (v == null) return void 0;
+    if (!("style" in v)) return { background: v.background, backdropFilter: v.backdropFilter };
+    const m = v;
+    const tint = m.tint ? color(m.tint, "#000000") : void 0;
+    if (m.style === "glass" || m.style === "frosted") {
+      return {
+        background: tint ? rgba(tint, m.opacity ?? 0.6) : void 0,
+        backdropFilter: `blur(${m.blur ?? 20}px) saturate(180%)`
+      };
+    }
+    return tint ? { background: rgba(tint, m.opacity ?? 1) } : void 0;
+  };
+  const densityScale = (density) => {
+    switch (density) {
+      case "compact":
+        return 0.75;
+      case "spacious":
+        return 1.25;
+      default:
+        return 1;
+    }
+  };
+  const motionTransition = (motion) => {
+    switch (motion) {
+      case "crisp":
+        return "all 120ms cubic-bezier(0.2,0,0,1)";
+      case "bouncy":
+        return "all 320ms cubic-bezier(0.34,1.56,0.64,1)";
+      default:
+        return "all 240ms cubic-bezier(0.4,0,0.2,1)";
+    }
+  };
+  const appearMotion = (name) => {
+    if (!name) return void 0;
+    const m = tokens.motions?.[name];
+    if (!m) return void 0;
+    return motionCss(m);
+  };
+  const reduceMotion = () => {
+    const policy = tokens.kit?.reduceMotion ?? "system";
+    if (policy === "always") return true;
+    if (policy === "never") return false;
+    return typeof globalThis !== "undefined" && typeof globalThis.matchMedia === "function" && globalThis.matchMedia("(prefers-reduced-motion: reduce)").matches;
+  };
+  return {
+    color,
+    font,
+    radius,
+    sp,
+    shadow,
+    gradient,
+    meshGradient,
+    material,
+    densityScale,
+    motionTransition,
+    appearMotion,
+    reduceMotion,
+    kit: tokens.kit ?? {},
+    tokens,
+    scheme
+  };
+}
+var REM_ROOT_PX, pxToRem, DEFAULT_FONT_STACK, SYSTEM_FONT_STACK, SERIF_FAMILY_RE, SPRING_MIN_RESPONSE, SPRING_MAX_RESPONSE, SPRING_MIN_DAMPING, SPRING_MAX_DAMPING, clampTo, finite, SPRING_SETTLE_TOLERANCE, SPRING_MAX_SECS, springCurves, WEB_IDIOM_CONTEXT;
+var init_tokens2 = __esm({
+  "../../core/web-renderer/src/tokens.ts"() {
+    init_idiom();
+    init_tokens();
+    REM_ROOT_PX = 16;
+    pxToRem = (px) => `${px / REM_ROOT_PX}rem`;
+    DEFAULT_FONT_STACK = '"Wix Madefor Text", system-ui';
+    SYSTEM_FONT_STACK = 'system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif';
+    SERIF_FAMILY_RE = /\b(georgia|times|garamond|palatino|baskerville|didot|charter|bodoni|caslon|cambria|constantia|rockwell|playfair|merriweather|lora|literata|spectral|serif)\b/i;
+    SPRING_MIN_RESPONSE = 0.05;
+    SPRING_MAX_RESPONSE = 10;
+    SPRING_MIN_DAMPING = 0.1;
+    SPRING_MAX_DAMPING = 4;
+    clampTo = (v, lo, hi) => Math.min(hi, Math.max(lo, v));
+    finite = (v) => typeof v === "number" && Number.isFinite(v) ? v : void 0;
+    SPRING_SETTLE_TOLERANCE = 1e-3;
+    SPRING_MAX_SECS = 10;
+    springCurves = /* @__PURE__ */ new Map();
+    WEB_IDIOM_CONTEXT = { surface: "desktop" };
+  }
+});
+
+// ../font-bake/web-fallback.ts
+function webRenderedFallback(family) {
+  const stack = fontStack(family);
+  const own2 = `"${family}", `;
+  const tail = stack.startsWith(own2) ? stack.slice(own2.length) : stack;
+  return tail.split(",")[0].trim().replace(/^"(.*)"$/, "$1");
+}
+var init_web_fallback = __esm({
+  "../font-bake/web-fallback.ts"() {
+    init_tokens2();
+  }
+});
+
+// src/shell-quote.ts
+var shell_quote_exports = {};
+__export(shell_quote_exports, {
+  shellQuote: () => shellQuote
+});
+function shellQuote(arg) {
+  return /^[A-Za-z0-9_./:@=-]+$/.test(arg) ? arg : `'${arg.replace(/'/g, `'\\''`)}'`;
+}
+var init_shell_quote = __esm({
+  "src/shell-quote.ts"() {
   }
 });
 
@@ -12093,7 +12657,7 @@ function listReport(opts = {}) {
   }
   return { ok: true, count: families.length, totalBytes, families };
 }
-function fontFindings(appDir2) {
+async function fontFindings(appDir2, opts = {}) {
   const tokensPath = join22(appDir2, configuredTokensPath(appDir2).path ?? "tokens.json");
   if (!existsSync19(tokensPath)) return null;
   const catalog = loadCatalog();
@@ -12107,7 +12671,28 @@ function fontFindings(appDir2) {
       message: `"${family}" is not in the catalog \u2014 it will render as the system font. Add it to stdlib/fonts/catalog.source.json and run \`npm run fonts:catalog\`, or pick one from \`himi fonts list\`.`
     });
   }
-  if (hasVendoredFloor()) {
+  let offRepo;
+  if (!hasVendoredFloor()) {
+    const bytes2 = await offRepoFontBytes(plan, { ...opts.fetchFace ? { fetchFace: opts.fetchFace } : {}, catalog });
+    const published = new Map(
+      bytes2.ready.map(({ family }) => [
+        family.name,
+        { faces: family.faces.length, bytes: family.faces.reduce((n, f) => n + f.bytes, 0) }
+      ])
+    );
+    offRepo = {
+      published,
+      publishedBytes: [...published.values()].reduce((n, f) => n + f.bytes, 0),
+      hostProvided: new Set(bytes2.hostProvided.map((f) => f.name))
+    };
+    for (const { family, reason } of bytes2.unavailable) {
+      findings.push({
+        severity: "error",
+        webFallback: true,
+        message: `${family.name} will render as ${webRenderedFallback(family.name)} on web \u2014 its faces could not be fetched (${reason}), so the release will not declare it. Check the network and re-run \`himi fonts check\`.`
+      });
+    }
+  } else {
     for (const fam of plan.families) {
       for (const f of fam.faces.filter((f2) => !faceSource(f2.file, f2.sha256))) {
         findings.push({
@@ -12117,41 +12702,55 @@ function fontFindings(appDir2) {
       }
     }
   }
-  const share = plan.packedBytes / DEFAULT_ASSET_BUDGET_BYTES;
+  const share = (offRepo ? offRepo.publishedBytes : plan.packedBytes) / DEFAULT_ASSET_BUDGET_BYTES;
   if (share > 0.25) {
     findings.push({
       severity: "warning",
       message: `fonts are ${(share * 100).toFixed(0)}% of the ${DEFAULT_ASSET_BUDGET_BYTES / 1024 / 1024} MB per-app asset budget \u2014 consider moving a family to \`otaOnly\` in fonts.json.`
     });
   }
-  return { plan, findings };
+  return { plan, findings, ...offRepo ? { offRepo } : {} };
 }
-function checkReport(appDir2) {
-  const result = fontFindings(appDir2);
+async function checkReport(appDir2, opts = {}) {
+  const result = await fontFindings(appDir2, opts);
   if (!result) {
     const looked = configuredTokensPath(appDir2).path ?? "tokens.json";
     return { ok: false, count: 0, totalBytes: 0, problems: [`${appDir2}: no ${looked}`], hint: "run inside an app directory" };
   }
-  const { plan, findings } = result;
+  const { plan, findings, offRepo } = result;
   const catalog = loadCatalog();
-  const families = plan.families.map((fam) => ({
-    family: fam.name,
-    reason: fam.reason,
-    packedFaces: fam.faces.filter((f) => f.packed).length,
-    otaFaces: fam.faces.filter((f) => !f.packed).length,
-    kb: Math.round(fam.faces.reduce((n, f) => n + f.bytes, 0) / 1024),
-    ...isSystemFamily(fam.name, catalog) ? { note: "platform font \u2014 zero bytes" } : {}
-  }));
+  const families = plan.families.map((fam) => {
+    const common = {
+      family: fam.name,
+      reason: fam.reason,
+      kb: Math.round(fam.faces.reduce((n, f) => n + f.bytes, 0) / 1024),
+      ...isSystemFamily(fam.name, catalog) ? { note: "platform font \u2014 zero bytes" } : {}
+    };
+    if (!offRepo) {
+      return {
+        ...common,
+        packedFaces: fam.faces.filter((f) => f.packed).length,
+        otaFaces: fam.faces.filter((f) => !f.packed).length
+      };
+    }
+    return {
+      ...common,
+      packedFaces: 0,
+      otaFaces: offRepo.published.get(fam.name)?.faces ?? 0,
+      ...offRepo.hostProvided.has(fam.name) ? { note: "carried by every himi shell \u2014 not published" } : {}
+    };
+  });
+  const published = offRepo?.publishedBytes ?? 0;
   return {
     // Only an ERROR fails the exit code. A budget warning is real information, but it
     // describes an app that renders correctly, and turning CI red for it would teach people
     // to stop reading the output — which is how the silent degrade survived this long.
     ok: !findings.some((f) => f.severity === "error"),
     count: plan.families.length,
-    totalBytes: plan.packedBytes,
+    totalBytes: offRepo ? published : plan.packedBytes,
     problems: findings.map((f) => f.message),
     families,
-    hint: plan.otaBytes > 0 ? `${Math.round(plan.otaBytes / 1024)} KB declared OTA (fetched on first use)` : void 0
+    hint: offRepo ? published > 0 ? `${Math.round(published / 1024)} KB published with the release by \`himi push\` (fetched on first use)` : void 0 : plan.otaBytes > 0 ? `${Math.round(plan.otaBytes / 1024)} KB declared OTA (fetched on first use)` : void 0
   };
 }
 function resolveFamilyName(input) {
@@ -12179,13 +12778,21 @@ function addReport(appDir2, family) {
   }
   const fam = findFamily(resolved2);
   const bytes2 = fam?.faces.reduce((n, f) => n + f.bytes, 0) ?? 0;
+  const licence = `Licence: ${fam?.license.id ?? "system"}${fam?.license.copyright ? ` \u2014 ${fam.license.copyright}` : ""}`;
   return {
     ok: true,
     count: 1,
     totalBytes: bytes2,
     problems: [],
     families: [{ family: resolved2, license: fam?.license.id ?? "system", copyright: fam?.license.copyright, kb: Math.round(bytes2 / 1024) }],
-    hint: `add "${resolved2}" to ${join22(appDir2, "fonts.json")} under "families" (or name it in tokens.json typography), then run gen.sh. Licence: ${fam?.license.id ?? "system"}${fam?.license.copyright ? ` \u2014 ${fam.license.copyright}` : ""}`
+    // Where the faces go next depends on where this runs (#3047). In a checkout, the app's
+    // `gen.sh` bakes them into the binaries. Off-repo there is no gen.sh and no packer — the
+    // hint used to send authors to a script that does not exist; what gets the faces to a
+    // device there is `himi push`, which publishes them with the release.
+    //
+    // The gen.sh command is SHELL-QUOTED: it is pasted into a shell, and a checkout path with a
+    // space in it (`…/New Mobile Arc/…`) otherwise splits into a script that does not exist.
+    hint: hasVendoredFloor() ? `add "${resolved2}" to ${join22(appDir2, "fonts.json")} under "families" (or name it in tokens.json typography), then run \`bash ${shellQuote(join22(appDir2, "scripts", "gen.sh"))}\` to bake it into the app's binaries. ${licence}` : `name "${resolved2}" in tokens.json typography (or list it under "families" in ${join22(appDir2, "fonts.json")}); \`himi push\` publishes its faces with the release. ${licence}`
   };
 }
 var DEFAULT_ASSET_BUDGET_BYTES;
@@ -12194,7 +12801,9 @@ var init_fonts = __esm({
     init_catalog();
     init_plan_fonts();
     init_face_source();
+    init_web_fallback();
     init_token_lint();
+    init_shell_quote();
     DEFAULT_ASSET_BUDGET_BYTES = 32 * 1024 * 1024;
   }
 });
@@ -12361,16 +12970,16 @@ function applyTransform(t, upstream, caps) {
     try {
       const base = JSON.parse(body || "{}");
       const patch = JSON.parse(patchStr);
-      body = JSON.stringify(deepMerge(base, patch));
+      body = JSON.stringify(deepMerge2(base, patch));
     } catch {
     }
   }
   return { status, body, headers: headers2 };
 }
-function deepMerge(a, b) {
+function deepMerge2(a, b) {
   if (a && b && typeof a === "object" && typeof b === "object" && !Array.isArray(a) && !Array.isArray(b)) {
     const out = { ...a };
-    for (const [k, v] of Object.entries(b)) out[k] = deepMerge(out[k], v);
+    for (const [k, v] of Object.entries(b)) out[k] = deepMerge2(out[k], v);
     return out;
   }
   return b;
@@ -12381,7 +12990,7 @@ var init_wix_gateway_rules = __esm({
 });
 
 // src/ux-evidence.ts
-import { existsSync as existsSync21, mkdirSync as mkdirSync9, readFileSync as readFileSync21, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync21, mkdirSync as mkdirSync10, readFileSync as readFileSync21, writeFileSync as writeFileSync9 } from "node:fs";
 import { dirname as dirname13, isAbsolute as isAbsolute2, join as join24, relative as relative3, resolve as resolve15 } from "node:path";
 function isNativePlatform(value) {
   return typeof value === "string" && NATIVE_PLATFORMS.includes(value);
@@ -12426,8 +13035,8 @@ function recordedRenderWidths(content) {
   return renderEvidenceEntries(evidence).map((entry) => entry.width);
 }
 function writeEvidence(path, evidence) {
-  mkdirSync9(dirname13(path), { recursive: true });
-  writeFileSync8(path, JSON.stringify(evidence, null, 2) + "\n");
+  mkdirSync10(dirname13(path), { recursive: true });
+  writeFileSync9(path, JSON.stringify(evidence, null, 2) + "\n");
 }
 function recordedFilePath(dir, file) {
   const rel = relative3(dir, resolve15(file));
@@ -13861,7 +14470,7 @@ __export(gen_native_config_exports, {
   tvInfoPlan: () => tvInfoPlan,
   watchInfoPlan: () => watchInfoPlan
 });
-import { existsSync as existsSync26, mkdirSync as mkdirSync11, readFileSync as readFileSync26, readdirSync as readdirSync13, rmSync as rmSync3, writeFileSync as writeFileSync10 } from "node:fs";
+import { existsSync as existsSync26, mkdirSync as mkdirSync12, readFileSync as readFileSync26, readdirSync as readdirSync13, rmSync as rmSync4, writeFileSync as writeFileSync11 } from "node:fs";
 import { dirname as dirname16, join as join29 } from "node:path";
 function parseStringArray(configTs, field) {
   const m = new RegExp(`${field}:\\s*\\[([^\\]]*)\\]`).exec(configTs);
@@ -14041,21 +14650,21 @@ function applyToFile(path, kind, label2, render, check) {
   const after = injectBlock(before, kind, label2, render);
   if (after === before) return { path, outcome: "unchanged" };
   if (check) return { path, outcome: "drift" };
-  writeFileSync10(path, after);
+  writeFileSync11(path, after);
   return { path, outcome: "written" };
 }
 function applyWholeFile(path, content, check) {
   const current = existsSync26(path) ? readFileSync26(path, "utf8") : null;
   if (current === content) return { path, outcome: "unchanged" };
   if (check) return { path, outcome: "drift" };
-  mkdirSync11(dirname16(path), { recursive: true });
-  writeFileSync10(path, content);
+  mkdirSync12(dirname16(path), { recursive: true });
+  writeFileSync11(path, content);
   return { path, outcome: "written" };
 }
 function removeWholeFile(path, check) {
   if (!existsSync26(path)) return { path, outcome: "skipped" };
   if (check) return { path, outcome: "drift" };
-  rmSync3(path);
+  rmSync4(path);
   return { path, outcome: "removed" };
 }
 function genNativeConfig(app, opts = {}) {
@@ -14661,7 +15270,7 @@ var init_contained_dev_module = __esm({
 
 // ../../core/dev-server/src/loader.ts
 import { resolve as resolve21, basename as basename8, dirname as dirname17 } from "node:path";
-import { existsSync as existsSync29, readdirSync as readdirSync16, readFileSync as readFileSync28, mkdirSync as mkdirSync12 } from "node:fs";
+import { existsSync as existsSync29, readdirSync as readdirSync16, readFileSync as readFileSync28, mkdirSync as mkdirSync13 } from "node:fs";
 import { pathToFileURL as pathToFileURL5, fileURLToPath as fileURLToPath12 } from "node:url";
 function resolveWixWebAuthConfig(app) {
   const auth = app?.meta.auth;
@@ -14700,7 +15309,7 @@ async function devModuleUrl(entry, dir) {
   const hasTypeScriptLoader = process.execArgv.some((arg) => arg.includes("tsx"));
   if (!isOffRepo() && hasTypeScriptLoader) return pathToFileURL5(entry).href;
   const out = resolve21(dir, "dist/.himi/dev.mjs");
-  mkdirSync12(dirname17(out), { recursive: true });
+  mkdirSync13(dirname17(out), { recursive: true });
   await buildAppEntry(entry, out, {
     // Plain Node must resolve the published-style umbrella entry points for
     // both standalone and in-repo CLI content. In-repo workspace packages
@@ -14965,7 +15574,7 @@ var init_inject = __esm({
 });
 
 // ../../core/dev-server/src/store.ts
-import { mkdirSync as mkdirSync13 } from "node:fs";
+import { mkdirSync as mkdirSync14 } from "node:fs";
 import { dirname as dirname18, resolve as resolve22 } from "node:path";
 import { fileURLToPath as fileURLToPath13 } from "node:url";
 import { createRequire } from "node:module";
@@ -14984,7 +15593,7 @@ var init_store2 = __esm({
       /** The node:sqlite handle — opened, bootstrapped, and seeded on first access. */
       get db() {
         if (this._db) return this._db;
-        mkdirSync13(dirname18(this.dbPath), { recursive: true });
+        mkdirSync14(dirname18(this.dbPath), { recursive: true });
         const { DatabaseSync } = nodeRequire("node:sqlite");
         this._db = new DatabaseSync(this.dbPath, { timeout: 5e3 });
         this.bootstrap();
@@ -15997,7 +16606,7 @@ function sha2562(input) {
   o.setUint32(28, h7);
   return out;
 }
-function sha256Hex2(input) {
+function sha256Hex3(input) {
   return hex(sha2562(input));
 }
 async function sha256HexAsync(input) {
@@ -16204,7 +16813,7 @@ var init_wix_bridge = __esm({
        *  header with no session cookie falls back to itself — callers refuse that case before here. */
       key(msid, cookieHeader) {
         const session = /(?:^|;\s*)wixSession2=([^;]*)/.exec(cookieHeader)?.[1] ?? cookieHeader;
-        return sha256Hex2(`${msid}
+        return sha256Hex3(`${msid}
 ${session}`);
       }
       async instance(msid, cookieHeader, now = Date.now()) {
@@ -16245,7 +16854,7 @@ ${session}`);
       }
       cache = /* @__PURE__ */ new Map();
       key(cookieHeader, limit) {
-        return sha256Hex2(`${limit}
+        return sha256Hex3(`${limit}
 ${cookieHeader}`);
       }
       async sites(cookieHeader, limit, now = Date.now()) {
@@ -16536,7 +17145,7 @@ var init_stable_ids = __esm({
 // ../../core/dev-server/src/preview.ts
 import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash11 } from "node:crypto";
-import { existsSync as existsSync32, createReadStream, statSync as statSync6, readFileSync as readFileSync32, renameSync, unlinkSync as unlinkSync2 } from "node:fs";
+import { existsSync as existsSync32, createReadStream, statSync as statSync6, readFileSync as readFileSync32, renameSync as renameSync2, unlinkSync as unlinkSync2 } from "node:fs";
 import { homedir as homedir4, tmpdir as tmpdir2 } from "node:os";
 import { resolve as resolvePath, dirname as dirname19 } from "node:path";
 import { fileURLToPath as fileURLToPath15 } from "node:url";
@@ -16603,7 +17212,7 @@ async function buildMacosWinlist(bin) {
     return interpretWinlist();
   }
   try {
-    renameSync(staging, bin);
+    renameSync2(staging, bin);
   } catch {
     try {
       unlinkSync2(staging);
@@ -16742,7 +17351,7 @@ async function handlePreviewStream(req, res, url) {
     return;
   }
   const q = new URLSearchParams(url.split("?")[1] ?? "");
-  const fps = clamp(parseInt(q.get("fps") ?? "8", 10) || 8, 1, 15);
+  const fps = clamp2(parseInt(q.get("fps") ?? "8", 10) || 8, 1, 15);
   const intervalMs = Math.floor(1e3 / fps);
   const format = q.get("format") === "png" ? "png" : "jpeg";
   res.statusCode = 200;
@@ -16796,7 +17405,7 @@ ${note}\r
     }
   });
 }
-function clamp(n, lo, hi) {
+function clamp2(n, lo, hi) {
   return Math.max(lo, Math.min(hi, n));
 }
 async function getIosLogicalDims(udid) {
@@ -16848,8 +17457,8 @@ async function getAndroidPixelDims(serial) {
 }
 async function handlePreviewTap(res, payload) {
   const platform = payload.platform === "android" ? "android" : "ios";
-  const nx = clamp(Number(payload.nx ?? 0), 0, 1);
-  const ny = clamp(Number(payload.ny ?? 0), 0, 1);
+  const nx = clamp2(Number(payload.nx ?? 0), 0, 1);
+  const ny = clamp2(Number(payload.ny ?? 0), 0, 1);
   if (!Number.isFinite(nx) || !Number.isFinite(ny)) {
     res.statusCode = 400;
     res.setHeader("content-type", "application/json");
@@ -16904,16 +17513,16 @@ async function handlePreviewTap(res, payload) {
 }
 async function handlePreviewSwipe(res, payload) {
   const platform = payload.platform === "android" ? "android" : "ios";
-  const nx1 = clamp(Number(payload.nx1 ?? 0), 0, 1);
-  const ny1 = clamp(Number(payload.ny1 ?? 0), 0, 1);
-  const nx2 = clamp(Number(payload.nx2 ?? 0), 0, 1);
-  const ny2 = clamp(Number(payload.ny2 ?? 0), 0, 1);
+  const nx1 = clamp2(Number(payload.nx1 ?? 0), 0, 1);
+  const ny1 = clamp2(Number(payload.ny1 ?? 0), 0, 1);
+  const nx2 = clamp2(Number(payload.nx2 ?? 0), 0, 1);
+  const ny2 = clamp2(Number(payload.ny2 ?? 0), 0, 1);
   if (![nx1, ny1, nx2, ny2].every(Number.isFinite)) {
     res.statusCode = 400;
     res.setHeader("content-type", "application/json");
     return void res.end(JSON.stringify({ error: "invalid_coords", hint: "nx1,ny1,nx2,ny2 must be numbers in [0,1]" }));
   }
-  const durationMs = clamp(Number(payload.durationMs ?? 250), 50, 5e3);
+  const durationMs = clamp2(Number(payload.durationMs ?? 250), 50, 5e3);
   try {
     if (platform === "ios") {
       const udid = payload.device || await firstBootedIosUdid();
@@ -17140,8 +17749,8 @@ async function handlePreviewHitTest(res, payload) {
     res.statusCode = 404;
     return void res.end(JSON.stringify({ error: "no_layout", hint: "The app hasn't reported a layout yet (dev build + on a reported screen)." }));
   }
-  const nx = clamp(Number(payload.nx ?? 0), 0, 1);
-  const ny = clamp(Number(payload.ny ?? 0), 0, 1);
+  const nx = clamp2(Number(payload.nx ?? 0), 0, 1);
+  const ny = clamp2(Number(payload.ny ?? 0), 0, 1);
   const px = nx * snap.width, py = ny * snap.height;
   let best = null;
   for (const [id, f] of Object.entries(snap.frames)) {
@@ -17911,401 +18520,6 @@ var init_env = __esm({
   }
 });
 
-// ../../core/ts/src/idiom.ts
-function authored(overlays, name) {
-  return typeof name === "string" && overlays !== void 0 && Object.hasOwn(overlays, name) && overlays[name] !== null && typeof overlays[name] === "object" && !Array.isArray(overlays[name]);
-}
-function selectIdiomOverlay(doc, ctx = {}) {
-  const policy = doc.idiomPolicy;
-  const overlays = doc.idiom;
-  const isRecord3 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
-  if (!isRecord3(policy) || !isRecord3(overlays)) return void 0;
-  const kind = policy.policy ?? "follow-surface";
-  if (kind === "none") return void 0;
-  if (kind === "pinned") return authored(overlays, policy.pin) ? policy.pin : void 0;
-  if (kind !== "follow-surface") return void 0;
-  const surfaces = policy.surfaces;
-  const candidates = [
-    ctx.surface !== void 0 && isRecord3(surfaces) && Object.hasOwn(surfaces, ctx.surface) ? surfaces[ctx.surface] : void 0,
-    ...ctx.native ?? [],
-    policy.fallback
-  ];
-  return candidates.find((c) => authored(overlays, c));
-}
-function isPlainObject(v) {
-  return v !== null && typeof v === "object" && !Array.isArray(v);
-}
-function deepMerge2(base, overlay) {
-  if (!isPlainObject(overlay) || !isPlainObject(base)) return overlay;
-  const out = { ...base };
-  for (const [key2, value] of Object.entries(overlay)) {
-    if (UNSAFE_KEYS.has(key2)) continue;
-    out[key2] = Object.hasOwn(base, key2) ? deepMerge2(base[key2], value) : value;
-  }
-  return out;
-}
-function mergeIdiomOverlay(base, overlay) {
-  const merged = deepMerge2(base, overlay);
-  const baseColors = base.colors;
-  const overlayColors = overlay.colors;
-  if (isPlainObject(baseColors) && isPlainObject(overlayColors)) {
-    const colors = { ...merged.colors };
-    for (const [name, value] of Object.entries(overlayColors)) {
-      if (UNSAFE_KEYS.has(name)) continue;
-      const was = Object.hasOwn(baseColors, name) ? baseColors[name] : void 0;
-      if (typeof was === "string" && isPlainObject(value)) colors[name] = { light: was, ...value };
-    }
-    merged.colors = colors;
-  }
-  return merged;
-}
-function resolveIdiom(tokens, ctx = {}) {
-  const doc = tokens;
-  const name = selectIdiomOverlay(doc, ctx);
-  if (name === void 0) return tokens;
-  const merged = mergeIdiomOverlay(tokens, doc.idiom[name]);
-  const { idiomPolicy: _applied, ...final } = merged;
-  return final;
-}
-var UNSAFE_KEYS;
-var init_idiom = __esm({
-  "../../core/ts/src/idiom.ts"() {
-    "use strict";
-    UNSAFE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
-  }
-});
-
-// ../../core/web-renderer/src/tokens.ts
-function isSerifFamily(family) {
-  return !!family && SERIF_FAMILY_RE.test(family);
-}
-function fontStack(family) {
-  if (!family) return DEFAULT_FONT_STACK;
-  if (isSerifFamily(family)) return `"${family}", serif`;
-  return `"${family}", ${DEFAULT_FONT_STACK}`;
-}
-function clamp2(n, lo = 0, hi = 1) {
-  return Math.max(lo, Math.min(hi, n));
-}
-function hexToRgb2(hex2) {
-  let h = hex2.trim().replace(/^#/, "");
-  if (h.length === 3) h = h.split("").map((c) => c + c).join("");
-  if (!/^[\da-f]{6}$/i.test(h)) return null;
-  const int = parseInt(h, 16);
-  return [int >> 16 & 255, int >> 8 & 255, int & 255];
-}
-function rgba(color, alpha2) {
-  const rgb = hexToRgb2(color);
-  return rgb ? `rgba(${rgb[0]}, ${rgb[1]}, ${rgb[2]}, ${clamp2(alpha2)})` : color;
-}
-function normalizeSpring(spring, durationMs) {
-  return {
-    response: clampTo(finite(spring.response) ?? durationMs / 1e3, SPRING_MIN_RESPONSE, SPRING_MAX_RESPONSE),
-    dampingFraction: clampTo(finite(spring.dampingFraction) ?? 0.8, SPRING_MIN_DAMPING, SPRING_MAX_DAMPING)
-  };
-}
-function springStep(response, zeta) {
-  const w0 = 2 * Math.PI / response;
-  if (zeta < 1) {
-    const wd = w0 * Math.sqrt(1 - zeta * zeta);
-    return (t) => 1 - Math.exp(-zeta * w0 * t) * (Math.cos(wd * t) + zeta * w0 / wd * Math.sin(wd * t));
-  }
-  if (zeta === 1) return (t) => 1 - Math.exp(-w0 * t) * (1 + w0 * t);
-  const root = Math.sqrt(zeta * zeta - 1);
-  const r1 = -w0 * (zeta - root), r2 = -w0 * (zeta + root);
-  return (t) => 1 - (r2 * Math.exp(r1 * t) - r1 * Math.exp(r2 * t)) / (r2 - r1);
-}
-function springCurve(spring, durationMs) {
-  const { response, dampingFraction: zeta } = normalizeSpring(spring, durationMs);
-  const key2 = `${response}|${zeta}`;
-  const cached3 = springCurves.get(key2);
-  if (cached3) return cached3;
-  const x = springStep(response, zeta);
-  const step = response / 64;
-  let settle = 0;
-  for (let t = 0; t <= SPRING_MAX_SECS; t += step) if (Math.abs(1 - x(t)) > SPRING_SETTLE_TOLERANCE) settle = t;
-  const secs = Math.min(settle + step, SPRING_MAX_SECS);
-  const samples = Math.min(200, Math.max(24, Math.ceil(12 * secs / response)));
-  const points = [];
-  for (let i = 0; i <= samples; i++) points.push(i === 0 ? 0 : i === samples ? 1 : Number(x(secs * i / samples).toFixed(3)));
-  const curve = { durationMs: Math.round(secs * 1e3), easing: `linear(${points.join(", ")})` };
-  springCurves.set(key2, curve);
-  return curve;
-}
-function linearEasingSupported() {
-  const css = globalThis.CSS;
-  return typeof css?.supports === "function" && css.supports("animation-timing-function", "linear(0, 1)");
-}
-function easingCss(e) {
-  switch (e) {
-    case "linear":
-      return "linear";
-    case "easeIn":
-      return "cubic-bezier(0.4,0,1,1)";
-    case "easeOut":
-      return "cubic-bezier(0,0,0.2,1)";
-    case "spring":
-      return "cubic-bezier(0.34,1.56,0.64,1)";
-    // Material 3's emphasized easing (#2930).
-    case "emphasized":
-      return "cubic-bezier(0.2,0,0,1)";
-    default:
-      return "cubic-bezier(0.4,0,0.2,1)";
-  }
-}
-function motionCss(m) {
-  if (m.easing === "spring" && m.spring && linearEasingSupported()) return springCurve(m.spring, m.duration);
-  return { durationMs: m.duration, easing: easingCss(m.easing) };
-}
-function hexToHsl(hex2) {
-  const m = /^#?([\da-f]{6})$/i.exec(hex2.trim());
-  if (!m) return null;
-  const int = parseInt(m[1], 16);
-  const r = (int >> 16 & 255) / 255, g = (int >> 8 & 255) / 255, b = (int & 255) / 255;
-  const max = Math.max(r, g, b), min = Math.min(r, g, b);
-  let h = 0, s = 0;
-  const l = (max + min) / 2;
-  if (max !== min) {
-    const d = max - min;
-    s = l > 0.5 ? d / (2 - max - min) : d / (max + min);
-    if (max === r) h = (g - b) / d + (g < b ? 6 : 0);
-    else if (max === g) h = (b - r) / d + 2;
-    else h = (r - g) / d + 4;
-    h /= 6;
-  }
-  return [h, s, l];
-}
-function hslToHex(h, s, l) {
-  const hue = (p, q, t) => {
-    if (t < 0) t += 1;
-    if (t > 1) t -= 1;
-    if (t < 1 / 6) return p + (q - p) * 6 * t;
-    if (t < 1 / 2) return q;
-    if (t < 2 / 3) return p + (q - p) * (2 / 3 - t) * 6;
-    return p;
-  };
-  let r, g, b;
-  if (s === 0) {
-    r = g = b = l;
-  } else {
-    const q = l < 0.5 ? l * (1 + s) : l + s - l * s;
-    const p = 2 * l - q;
-    r = hue(p, q, h + 1 / 3);
-    g = hue(p, q, h);
-    b = hue(p, q, h - 1 / 3);
-  }
-  const to = (x) => Math.round(clamp2(x) * 255).toString(16).padStart(2, "0");
-  return `#${to(r)}${to(g)}${to(b)}`;
-}
-function roleOf(name) {
-  const n = name.toLowerCase();
-  if (n.startsWith("surface") || n.includes("background") || n.includes("canvas")) return "surface";
-  if (n.startsWith("text") || n.startsWith("on")) return "text";
-  if (n.includes("border") || n.includes("divider") || n.includes("separator")) return "border";
-  if (n.includes("accent") || n.includes("primary") || n.includes("link")) return "accent";
-  return "other";
-}
-function synthScheme(hex2, name, scheme) {
-  if (scheme === "light") return hex2;
-  const hsl = hexToHsl(hex2);
-  if (!hsl) return hex2;
-  const [h, s, l] = hsl;
-  const role = roleOf(name);
-  if (scheme === "dark") {
-    switch (role) {
-      case "surface":
-        return hslToHex(h, clamp2(s * 0.6), clamp2(0.07 + (1 - l) * 0.12, 0.06, 0.22));
-      case "text":
-        return hslToHex(h, clamp2(s * 0.5), clamp2(0.97 - l * 0.25, 0.7, 0.97));
-      case "border":
-        return hslToHex(h, clamp2(s * 0.5), clamp2(0.18 + (1 - l) * 0.12, 0.18, 0.34));
-      case "accent":
-        return hslToHex(h, s, clamp2(l + 0.1, 0, 0.72));
-      default:
-        return hslToHex(h, s, clamp2(l + 0.06));
-    }
-  }
-  switch (role) {
-    case "surface":
-      return l > 0.5 ? "#FFFFFF" : "#000000";
-    case "text":
-      return l > 0.5 ? "#FFFFFF" : "#000000";
-    case "border":
-      return "#000000";
-    case "accent":
-      return hslToHex(h, clamp2(s + 0.2), clamp2(l - 0.18, 0.18, 0.5));
-    default:
-      return hex2;
-  }
-}
-function resolveSchemeColor(o, scheme) {
-  const exact = o?.[scheme];
-  if (typeof exact === "string") return exact;
-  if (scheme === "highContrast" && typeof o?.dark === "string") return o.dark;
-  if (typeof o?.light === "string") return o.light;
-  return typeof o?.dark === "string" ? o.dark : void 0;
-}
-function makeTokenResolvers(source, scheme, idiom = WEB_IDIOM_CONTEXT) {
-  const tokens = resolveIdiom(source, idiom);
-  const color = (name, fallback = "#1a1a1a") => {
-    if (name == null) return fallback;
-    if (typeof name !== "string") {
-      const o = name;
-      const direct = resolveSchemeColor(o, scheme);
-      if (typeof direct === "string") return direct;
-      if (typeof o?.token === "string") return color(o.token, fallback);
-      if (typeof o?.name === "string") return color(o.name, fallback);
-      return fallback;
-    }
-    if (name.startsWith("#")) return name;
-    const v = tokens.colors?.[name];
-    if (v == null) return fallback;
-    if (typeof v === "object") {
-      const direct = resolveSchemeColor(v, scheme);
-      return typeof direct === "string" ? direct : fallback;
-    }
-    return synthScheme(v, name, scheme);
-  };
-  const font = (style = "body") => {
-    const t = tokens.typography?.[style] ?? tokens.fonts?.[style] ?? tokens.typography?.body ?? tokens.fonts?.body;
-    const size = t?.size ?? 14;
-    return {
-      size,
-      remSize: pxToRem(size),
-      weight: t?.weight ?? 400,
-      line: t?.line ?? 1.4,
-      family: t?.family,
-      letterSpacing: t?.letterSpacing
-    };
-  };
-  const radius = (name, fallback = 0) => {
-    if (typeof name === "number") return name;
-    if (typeof name === "string") return tokens.radius?.[name] ?? fallback;
-    return fallback;
-  };
-  const sp = (n) => typeof n === "number" ? n : 0;
-  const shadow = (name) => {
-    const key2 = typeof name === "string" ? name : name?.token ?? name?.name;
-    if (!key2) return void 0;
-    const v = tokens.shadows?.[key2];
-    if (v == null) return void 0;
-    if (typeof v === "string") return v;
-    const x = v.x ?? 0, y = v.y ?? 0;
-    return `${x}px ${y}px ${v.radius}px ${rgba(v.color ?? "#000000", v.opacity)}`;
-  };
-  const gradient = (name) => {
-    const key2 = typeof name === "string" ? name : name?.token;
-    if (!key2) return void 0;
-    const v = tokens.gradients?.[key2];
-    if (v == null) return void 0;
-    if (typeof v === "string") return v;
-    const stops = v.colors.map((c, i) => {
-      const at = v.locations?.[i];
-      return `${color(c)}${at != null ? ` ${Math.round(at * 100)}%` : ""}`;
-    });
-    return `linear-gradient(${v.angle ?? 0}deg, ${stops.join(", ")})`;
-  };
-  const meshGradient = (name) => {
-    const key2 = typeof name === "string" ? name : name?.token;
-    if (!key2) return void 0;
-    const v = tokens.gradients?.[key2];
-    if (v == null || typeof v === "string") return void 0;
-    const cols = v.colors.map((c) => color(c));
-    if (cols.length === 0) return void 0;
-    const pts = [[18, 22], [82, 18], [25, 82], [78, 80], [50, 45], [10, 55], [90, 60]];
-    const blobs = cols.map((c, i) => {
-      const [x, y] = pts[i % pts.length];
-      return `radial-gradient(circle at ${x}% ${y}%, ${c} 0%, transparent 55%)`;
-    });
-    return `${blobs.join(", ")}, ${cols[cols.length - 1]}`;
-  };
-  const material = (name) => {
-    const key2 = typeof name === "string" ? name : name?.token ?? name?.name;
-    if (!key2) return void 0;
-    const v = tokens.materials?.[key2];
-    if (v == null) return void 0;
-    if (!("style" in v)) return { background: v.background, backdropFilter: v.backdropFilter };
-    const m = v;
-    const tint = m.tint ? color(m.tint, "#000000") : void 0;
-    if (m.style === "glass" || m.style === "frosted") {
-      return {
-        background: tint ? rgba(tint, m.opacity ?? 0.6) : void 0,
-        backdropFilter: `blur(${m.blur ?? 20}px) saturate(180%)`
-      };
-    }
-    return tint ? { background: rgba(tint, m.opacity ?? 1) } : void 0;
-  };
-  const densityScale = (density) => {
-    switch (density) {
-      case "compact":
-        return 0.75;
-      case "spacious":
-        return 1.25;
-      default:
-        return 1;
-    }
-  };
-  const motionTransition = (motion) => {
-    switch (motion) {
-      case "crisp":
-        return "all 120ms cubic-bezier(0.2,0,0,1)";
-      case "bouncy":
-        return "all 320ms cubic-bezier(0.34,1.56,0.64,1)";
-      default:
-        return "all 240ms cubic-bezier(0.4,0,0.2,1)";
-    }
-  };
-  const appearMotion = (name) => {
-    if (!name) return void 0;
-    const m = tokens.motions?.[name];
-    if (!m) return void 0;
-    return motionCss(m);
-  };
-  const reduceMotion = () => {
-    const policy = tokens.kit?.reduceMotion ?? "system";
-    if (policy === "always") return true;
-    if (policy === "never") return false;
-    return typeof globalThis !== "undefined" && typeof globalThis.matchMedia === "function" && globalThis.matchMedia("(prefers-reduced-motion: reduce)").matches;
-  };
-  return {
-    color,
-    font,
-    radius,
-    sp,
-    shadow,
-    gradient,
-    meshGradient,
-    material,
-    densityScale,
-    motionTransition,
-    appearMotion,
-    reduceMotion,
-    kit: tokens.kit ?? {},
-    tokens,
-    scheme
-  };
-}
-var REM_ROOT_PX, pxToRem, DEFAULT_FONT_STACK, SERIF_FAMILY_RE, SPRING_MIN_RESPONSE, SPRING_MAX_RESPONSE, SPRING_MIN_DAMPING, SPRING_MAX_DAMPING, clampTo, finite, SPRING_SETTLE_TOLERANCE, SPRING_MAX_SECS, springCurves, WEB_IDIOM_CONTEXT;
-var init_tokens2 = __esm({
-  "../../core/web-renderer/src/tokens.ts"() {
-    init_idiom();
-    REM_ROOT_PX = 16;
-    pxToRem = (px) => `${px / REM_ROOT_PX}rem`;
-    DEFAULT_FONT_STACK = '"Wix Madefor Text", system-ui';
-    SERIF_FAMILY_RE = /\b(georgia|times|garamond|palatino|baskerville|didot|charter|bodoni|caslon|cambria|constantia|rockwell|playfair|merriweather|lora|literata|spectral|serif)\b/i;
-    SPRING_MIN_RESPONSE = 0.05;
-    SPRING_MAX_RESPONSE = 10;
-    SPRING_MIN_DAMPING = 0.1;
-    SPRING_MAX_DAMPING = 4;
-    clampTo = (v, lo, hi) => Math.min(hi, Math.max(lo, v));
-    finite = (v) => typeof v === "number" && Number.isFinite(v) ? v : void 0;
-    SPRING_SETTLE_TOLERANCE = 1e-3;
-    SPRING_MAX_SECS = 10;
-    springCurves = /* @__PURE__ */ new Map();
-    WEB_IDIOM_CONTEXT = { surface: "desktop" };
-  }
-});
-
 // ../../core/web-renderer/src/modifiers.ts
 function padStyle(p, scale = 1) {
   if (p == null) return {};
@@ -19144,6 +19358,7 @@ function shouldRevealError(args) {
 var EMAIL_RE, URL_HOST_RE, INTEGER_RE, NUMBER_RE;
 var init_validation = __esm({
   "../../core/ts/src/validation.ts"() {
+    "use strict";
     EMAIL_RE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/;
     URL_HOST_RE = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(:[0-9]+)?$/;
     INTEGER_RE = /^[+-]?[0-9]+$/;
@@ -22568,6 +22783,7 @@ function validateWorkerSubtree(raw, slotId, policy, actionCatalog) {
 var WORKER_SUBTREE_CEILINGS, ID_PART, ACTION_ID;
 var init_worker_subtree = __esm({
   "../../core/ts/src/worker-subtree.ts"() {
+    "use strict";
     init_worker_subtree_safe_types_generated();
     WORKER_SUBTREE_CEILINGS = Object.freeze({
       maxEncodedBytes: 65536,
@@ -30354,7 +30570,7 @@ var init_errors = __esm({
 
 // ../../core/serve-storage/src/contract.ts
 function strongEtag(body) {
-  return strongEtagForSha256(sha256Hex2(body));
+  return strongEtagForSha256(sha256Hex3(body));
 }
 function strongEtagForSha256(hex2) {
   return `"${hex2.slice(0, 32)}"`;
@@ -30403,7 +30619,7 @@ __export(config_exports2, {
   serializeRolloutYaml: () => serializeRolloutYaml,
   validateOverlayPatch: () => validateOverlayPatch
 });
-import { mkdirSync as mkdirSync14, readFileSync as readFileSync37, writeFileSync as writeFileSync11 } from "node:fs";
+import { mkdirSync as mkdirSync15, readFileSync as readFileSync37, writeFileSync as writeFileSync12 } from "node:fs";
 import { dirname as dirname20, join as join32, resolve as resolve29 } from "node:path";
 import { fileURLToPath as fileURLToPath17 } from "node:url";
 function strip(line) {
@@ -30531,8 +30747,8 @@ function readJsonAt(app, file, root) {
 }
 function writeJsonAt(app, file, root, value) {
   const path = appConfigPath(app, file, root);
-  mkdirSync14(dirname20(path), { recursive: true });
-  writeFileSync11(path, JSON.stringify(value, null, 2) + "\n");
+  mkdirSync15(dirname20(path), { recursive: true });
+  writeFileSync12(path, JSON.stringify(value, null, 2) + "\n");
   return path;
 }
 function sanitizeOverlay(raw) {
@@ -30647,7 +30863,7 @@ var init_config2 = __esm({
 // ../../core/dev-server/src/index.ts
 import { createServer as createServer2 } from "node:http";
 import { readFile, stat } from "node:fs/promises";
-import { readFileSync as readFileSync38, existsSync as existsSync35, watch, mkdirSync as mkdirSync15, rmSync as rmSync4 } from "node:fs";
+import { readFileSync as readFileSync38, existsSync as existsSync35, watch, mkdirSync as mkdirSync16, rmSync as rmSync5 } from "node:fs";
 import { extname, resolve as resolve30, normalize as normalize3, sep as sep7, join as join33 } from "node:path";
 import { createHash as createHash15, randomUUID } from "node:crypto";
 import { fileURLToPath as fileURLToPath18, pathToFileURL as pathToFileURL6 } from "node:url";
@@ -30828,23 +31044,17 @@ function servedFontFaces(appDir2, tokens) {
   try {
     const policyPath = join33(appDir2, "fonts.json");
     const policy = existsSync35(policyPath) ? JSON.parse(readFileSync38(policyPath, "utf8")) : {};
-    const plan = planFonts(tokens, policy);
+    let plan = planFonts(tokens, policy);
+    if (!hasVendoredFloor()) plan = { ...plan, families: plan.families.filter((f) => !isHostProvided(f.name)) };
     if (plan.families.length === 0) return void 0;
     return servedProjection(plan);
   } catch {
     return void 0;
   }
 }
-function fontFaceBytesBySha(_appDir, sha) {
+async function fontFaceBytesBySha(_appDir, sha) {
   try {
-    const catalog = loadCatalog();
-    for (const family of [...Object.values(catalog.families), ...Object.values(catalog.bundled)]) {
-      for (const face of family.faces) {
-        if (face.sha256 !== sha) continue;
-        const src = faceSource(face.file, face.sha256);
-        if (src) return readFileSync38(src);
-      }
-    }
+    return await catalogFaceBytes(sha);
   } catch {
   }
   return void 0;
@@ -31554,7 +31764,7 @@ async function reloadAppModuleNow(state, opts) {
   const current = state.app;
   if (!current) return { ok: false, error: "no_app" };
   const entry = resolve30(current.dir, "dev/index.ts");
-  mkdirSync15(HMR_TMP_DIR, { recursive: true });
+  mkdirSync16(HMR_TMP_DIR, { recursive: true });
   const outfile = resolve30(HMR_TMP_DIR, `${current.name}-${++appReloadSeq}.mjs`);
   try {
     const lib = await import(pathToFileURL6(resolve30(TIER5_SRC_ROOT, "build-lib.mjs")).href);
@@ -31600,7 +31810,7 @@ async function reloadAppModuleNow(state, opts) {
     return { ok: false, error };
   } finally {
     try {
-      rmSync4(outfile, { force: true });
+      rmSync5(outfile, { force: true });
     } catch {
     }
   }
@@ -33076,7 +33286,7 @@ function createDevServer(opts = {}) {
           const assetDir = state.app && assetApp === state.app.name ? state.app.dir : resolveAppDir(assetApp);
           const hit = assetDir ? collectAssets(assetDir).find((a) => assetSha256(readFileSync38(a.path)) === sha) : void 0;
           if (!hit && assetDir) {
-            const fontBytes = fontFaceBytesBySha(assetDir, sha);
+            const fontBytes = await fontFaceBytesBySha(assetDir, sha);
             if (fontBytes) {
               res.writeHead(200, {
                 "content-type": "font/ttf",
@@ -33428,7 +33638,6 @@ var init_src6 = __esm({
     init_inject();
     init_plan_fonts();
     init_face_source();
-    init_catalog();
     init_himi_report();
     init_store2();
     init_derive_transport_capability();
@@ -34944,7 +35153,7 @@ async function crawlScreenInner(opts) {
           severity: "error",
           message: `service "${svc}" never left its loading state (${waiting})`,
           actual: waiting,
-          hint: "the screen shows its skeleton forever \u2014 every path out of load() must clear the loading flag, including the failure path"
+          hint: `the screen shows its skeleton forever \u2014 every path out of load() must clear the loading flag, including the failure path; ${STALE_SNAPSHOT_HINT}`
         });
       }
     }
@@ -35282,7 +35491,7 @@ async function crawlScreenHostileInner(opts, variant) {
           axis,
           message: `under ${axis}, service "${svc}" never left its loading state (${waiting})`,
           actual: waiting,
-          hint: "the failure/empty path must also clear the loading flag \u2014 otherwise the skeleton shows forever the day the backend misbehaves"
+          hint: `the failure/empty path must also clear the loading flag \u2014 otherwise the skeleton shows forever the day the backend misbehaves; ${STALE_SNAPSHOT_HINT}`
         });
       }
     }
@@ -35745,7 +35954,7 @@ async function crawlScreenRelations(opts) {
     return { findings: dedupe(findings), checked, byKind };
   });
 }
-var ACTION_KEYS, UNTRACKED_ITEMS, NESTED_ITEMS_SEP, REJECT_ALL_MESSAGE, VLQ, WIX_DATA_QUERY, WIX_DATA_ANY, CAPABILITY_ACTION, detached, CRAWL_CLOCK, MEMBER_IDENTITY_ACTION, BLANK_WHEN_BOUND, UNBINDABLE_ROW;
+var ACTION_KEYS, UNTRACKED_ITEMS, NESTED_ITEMS_SEP, REJECT_ALL_MESSAGE, VLQ, WIX_DATA_QUERY, WIX_DATA_ANY, CAPABILITY_ACTION, detached, CRAWL_CLOCK, MEMBER_IDENTITY_ACTION, BLANK_WHEN_BOUND, STALE_SNAPSHOT_HINT, UNBINDABLE_ROW;
 var init_screen_crawl = __esm({
   "../../core/dev-server/src/screen-crawl.ts"() {
     init_validate_descriptor_core();
@@ -35785,6 +35994,7 @@ var init_screen_crawl = __esm({
       Marquee: ["items", "itemsPath", "text"],
       MediaPlayer: ["items", "itemsPath"]
     };
+    STALE_SNAPSHOT_HINT = 'if every path already does, look for a stale-snapshot write-back: `return s` (or `{ ...s }`) after an await or from an early-return guard writes back the state as it was BEFORE the await, loading flag included \u2014 to change nothing, return `undefined` instead (not `null` or `{}`); see `himi docs tier-5-add-a-screen`, "Should this result be committed at all?"';
     UNBINDABLE_ROW = Symbol("unbindable-row");
   }
 });
@@ -36444,10 +36654,13 @@ function withProdServeAppConfig(text4, prod) {
 function pinnedReleaseFromEnv(env = process.env) {
   return env.HIMI_DIST_RELEASE_PIN?.trim() || void 0;
 }
-async function buildRelease(app, dest, _opts = {}) {
+async function buildRelease(app, dest, opts = {}) {
   const loaded = await loadApp(app);
   const tier5Dir = hasBuiltBundles(loaded.dir) ? bundleOutDir(loaded.dir) : void 0;
-  return (await buildFromLoaded(loaded, dest, tier5Dir ? { tier5Dir } : {})).manifest;
+  return (await buildFromLoaded(loaded, dest, {
+    ...tier5Dir ? { tier5Dir } : {},
+    ...opts.fetchFace ? { fetchFace: opts.fetchFace } : {}
+  })).manifest;
 }
 function countingWixCall(base) {
   let returned = 0;
@@ -36699,7 +36912,8 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
   }
   let fontPlan;
   let publishedFontPlan;
-  const canEmitFonts = hasVendoredFloor();
+  const inRepo = hasVendoredFloor();
+  const fontWarnings = [];
   try {
     const appTokens = readTokensForLint(preloaded) ?? {};
     const policy = existsSync36(join34(preloaded.dir, "fonts.json")) ? JSON.parse(readFileSync39(join34(preloaded.dir, "fonts.json"), "utf8")) : {};
@@ -36709,7 +36923,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
       `[release-build] font plan failed for "${app}": ${String(err)}. Refusing to publish a release whose tokens name families it declares no faces for \u2014 fix apps/${app}/fonts.json or run \`npm run fonts:catalog\`.`
     );
   }
-  if (canEmitFonts && fontPlan && fontPlan.families.length > 0 && store.putAsset) {
+  if (inRepo && fontPlan && fontPlan.families.length > 0 && store.putAsset) {
     for (const family of fontPlan.families) {
       for (const face of family.faces) {
         const src = faceSource(face.file, face.sha256);
@@ -36731,12 +36945,38 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
           sri: sri2(bytes2),
           bytes: bytes2.length,
           contentType: "font/ttf",
-          origin: "repo",
+          origin: "catalog",
           ...face.packed ? { baked: true } : {}
         };
       }
     }
     publishedFontPlan = fontPlan;
+  } else if (!inRepo && fontPlan && fontPlan.families.length > 0 && store.putAsset) {
+    const off = await offRepoFontBytes(fontPlan, opts.fetchFace ? { fetchFace: opts.fetchFace } : {});
+    for (const { family, reason } of off.unavailable) {
+      const line = `[release-build] ${family.name} will render as ${webRenderedFallback(family.name)} on web: its faces could not be fetched (${reason}), so this release does not declare it. Re-run once the upstream is reachable.`;
+      fontWarnings.push(line);
+      console.warn(line);
+    }
+    for (const { faces } of off.ready) {
+      for (const { face, bytes: bytes2 } of faces) {
+        await store.putAsset(app, face.sha256, bytes2, "font/ttf");
+        assets[`fonts/${face.sha256}.ttf`] = {
+          sha256: face.sha256,
+          sri: sri2(bytes2),
+          bytes: bytes2.length,
+          contentType: "font/ttf",
+          origin: "catalog"
+        };
+      }
+    }
+    const declared = /* @__PURE__ */ new Set([
+      ...off.ready.map((r) => r.family),
+      ...fontPlan.families.filter((f) => f.builtin)
+    ]);
+    if (declared.size > 0) {
+      publishedFontPlan = { ...fontPlan, families: fontPlan.families.filter((f) => declared.has(f)) };
+    }
   }
   const brandFonts = [];
   if (store.putAsset) {
@@ -37143,6 +37383,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     }),
     ...tokensSnapshotFailure ? { tokensSnapshotFailure } : {},
     ...widgetBakeFailures.length ? { widgetBakeFailures } : {},
+    ...fontWarnings.length ? { fontWarnings } : {},
     ...collect2?.lint ? { lint, workers } : {},
     ...collect2?.render ? { renders } : {},
     ...collect2?.descriptors ? { descriptors: baked, linkableScreenIds: [...linkable] } : {},
@@ -37210,6 +37451,7 @@ var init_build3 = __esm({
     init_app_assets();
     init_plan_fonts();
     init_face_source();
+    init_web_fallback();
     init_src6();
     init_check();
     init_file_store();
@@ -37315,14 +37557,26 @@ function freezeTrafficToMocks(events, opts = {}) {
     if (ev.respBody === void 0) continue;
     if (!includeErrors && (ev.status < 200 || ev.status >= 300)) continue;
     if (hostFilter && ev.host && !hostFilter.has(ev.host)) continue;
-    const key2 = `${ev.method} ${scopeByHost ? ev.host ?? "" : ""} ${ev.path}`;
-    byKey.set(key2, ev);
-  }
+    const bodyContains = collectionMatcher(ev.reqBody);
+    const request = `${ev.method} ${scopeByHost ? ev.host ?? "" : ""} ${ev.path}`;
+    byKey.set(`${request} ${bodyContains ?? ""}`, { ev, request, bodyContains });
+  }
+  const kept = [...byKey.values()];
+  const firstPathOnly = /* @__PURE__ */ new Map();
+  kept.forEach((k, i) => {
+    if (!k.bodyContains && !firstPathOnly.has(k.request)) firstPathOnly.set(k.request, i);
+  });
+  const rank = (k, i) => {
+    const p = k.bodyContains ? firstPathOnly.get(k.request) : void 0;
+    return p !== void 0 && p < i ? p - 0.5 : i;
+  };
+  const ordered = kept.map((k, i) => ({ k, i, r: rank(k, i) })).sort((a, b) => a.r - b.r || a.i - b.i).map(({ k }) => k);
   const rules = [];
   let id = 0;
-  for (const ev of byKey.values()) {
+  for (const { ev, bodyContains } of ordered) {
     const matcher = { method: ev.method, pathGlob: ev.path };
     if (scopeByHost && ev.host) matcher.host = ev.host;
+    if (bodyContains) matcher.bodyContains = bodyContains;
     rules.push({
       id: ++id,
       enabled: true,
@@ -37337,6 +37591,17 @@ function freezeTrafficToMocks(events, opts = {}) {
   }
   return { mode: "mock", rules };
 }
+function collectionMatcher(reqBody) {
+  if (!reqBody || !reqBody.includes('"dataCollectionId"')) return void 0;
+  try {
+    const parsed = JSON.parse(reqBody);
+    const id = parsed && typeof parsed === "object" ? parsed.dataCollectionId : void 0;
+    return typeof id === "string" && id ? `"dataCollectionId":${JSON.stringify(id)}` : void 0;
+  } catch {
+    const m = /"dataCollectionId"\s*:\s*"((?:[^"\\]|\\.)+)"/.exec(reqBody);
+    return m ? `"dataCollectionId":"${m[1]}"` : void 0;
+  }
+}
 function pickContentType(headers2) {
   if (!headers2) return void 0;
   for (const [k, v] of Object.entries(headers2)) {
@@ -37972,7 +38237,7 @@ var init_push_setup_apple_credentials = __esm({
 });
 
 // src/push-onboarding.ts
-import { existsSync as existsSync37, mkdirSync as mkdirSync16, readFileSync as readFileSync41, statSync as statSync7, writeFileSync as writeFileSync12, chmodSync as chmodSync2 } from "node:fs";
+import { existsSync as existsSync37, mkdirSync as mkdirSync17, readFileSync as readFileSync41, statSync as statSync7, writeFileSync as writeFileSync13, chmodSync as chmodSync2 } from "node:fs";
 import { basename as basename9, dirname as dirname22, join as join35, resolve as resolve33 } from "node:path";
 function readJson2(path) {
   try {
@@ -38122,8 +38387,8 @@ function readPushOnboarding(dir) {
 }
 function writeFile(dir, file) {
   const path = join35(resolve33(dir), PUSH_ONBOARDING_PATH);
-  mkdirSync16(dirname22(path), { recursive: true, mode: 448 });
-  writeFileSync12(path, JSON.stringify(file, null, 2) + "\n", { mode: 384 });
+  mkdirSync17(dirname22(path), { recursive: true, mode: 448 });
+  writeFileSync13(path, JSON.stringify(file, null, 2) + "\n", { mode: 384 });
   try {
     chmodSync2(path, 384);
   } catch {
@@ -39111,7 +39376,7 @@ __export(pack_exports, {
 });
 import { createHash as createHash19 } from "node:crypto";
 import { deflateRawSync, inflateRawSync } from "node:zlib";
-import { existsSync as existsSync38, mkdirSync as mkdirSync17, readFileSync as readFileSync42, readdirSync as readdirSync20, rmSync as rmSync5, statSync as statSync8, writeFileSync as writeFileSync13 } from "node:fs";
+import { existsSync as existsSync38, mkdirSync as mkdirSync18, readFileSync as readFileSync42, readdirSync as readdirSync20, rmSync as rmSync6, statSync as statSync8, writeFileSync as writeFileSync14 } from "node:fs";
 import { dirname as dirname23, join as join36, resolve as resolve35 } from "node:path";
 function writeZip(entries) {
   const sorted = entries.slice().sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
@@ -39258,18 +39523,18 @@ function gatherReleaseEntries(appDir2) {
   }
   return { entries, manifest, skipped };
 }
-function sha256Hex3(bytes2) {
+function sha256Hex4(bytes2) {
   return createHash19("sha256").update(bytes2).digest("hex");
 }
 function computeContentHash(entries) {
-  const input = packageHashInput(entries.map((e) => ({ path: e.path, hash: sha256Hex3(e.bytes) })));
+  const input = packageHashInput(entries.map((e) => ({ path: e.path, hash: sha256Hex4(e.bytes) })));
   return "sha256-" + createHash19("sha256").update(input).digest("base64");
 }
 function buildEntries(appDir2, app, opts) {
   const { entries: released, manifest, skipped } = gatherReleaseEntries(appDir2);
   const entries = opts.source ? [...released, { path: HIMI_PACKAGE_SOURCE_PATH, bytes: opts.source }] : released;
   const contentHash = computeContentHash(entries);
-  const files = Object.fromEntries(entries.map((e) => [e.path, sha256Hex3(e.bytes)]));
+  const files = Object.fromEntries(entries.map((e) => [e.path, sha256Hex4(e.bytes)]));
   const header = buildPackageHeader({
     manifest,
     app,
@@ -39290,8 +39555,8 @@ function packRelease(releaseRoot, app, out, opts = {}) {
   const buf = writeZip(all);
   const isDir = existsSync38(out) && statSync8(out).isDirectory();
   const outFile = isDir ? join36(resolve35(out), packageFileName(app, header.releaseId)) : resolve35(out);
-  mkdirSync17(dirname23(outFile), { recursive: true });
-  writeFileSync13(outFile, buf);
+  mkdirSync18(dirname23(outFile), { recursive: true });
+  writeFileSync14(outFile, buf);
   return { app, releaseId: header.releaseId, header, out: outFile, bytes: buf.length, entryCount: all.length, skipped };
 }
 function resolvePackageDirDest(outDir, app, releaseId) {
@@ -39330,12 +39595,12 @@ function packReleaseToDir(releaseRoot, app, outDir, opts = {}) {
   const appDir2 = join36(resolve35(releaseRoot), app);
   const { all, header, skipped } = buildEntries(appDir2, app, opts);
   const dest = resolvePackageDirDest(resolve35(outDir), app, header.releaseId);
-  rmSync5(dest, { recursive: true, force: true });
+  rmSync6(dest, { recursive: true, force: true });
   let bytes2 = 0;
   for (const entry of all) {
     const target = join36(dest, entry.path);
-    mkdirSync17(dirname23(target), { recursive: true });
-    writeFileSync13(target, entry.bytes);
+    mkdirSync18(dirname23(target), { recursive: true });
+    writeFileSync14(target, entry.bytes);
     bytes2 += entry.bytes.length;
   }
   return { app, releaseId: header.releaseId, header, out: dest, bytes: bytes2, entryCount: all.length, skipped };
@@ -39413,11 +39678,11 @@ function unpackTo(buf, dest, appFallback) {
   if (!isSafeAppId(app)) throw new Error(`package declares an unsafe app id ${JSON.stringify(app)} \u2014 refusing to unpack it`);
   const root = resolve35(dest);
   const appDir2 = join36(root, app);
-  rmSync5(appDir2, { recursive: true, force: true });
+  rmSync6(appDir2, { recursive: true, force: true });
   for (const [rel, bytes2] of entries) {
     const target = join36(appDir2, rel);
-    mkdirSync17(dirname23(target), { recursive: true });
-    writeFileSync13(target, bytes2);
+    mkdirSync18(dirname23(target), { recursive: true });
+    writeFileSync14(target, bytes2);
   }
   return { root, appDir: appDir2, app };
 }
@@ -39451,7 +39716,7 @@ __export(app_source_exports, {
   writeConflicts: () => writeConflicts,
   zipAppSource: () => zipAppSource
 });
-import { readdirSync as readdirSync21, lstatSync as lstatSync5, readFileSync as readFileSync43, mkdirSync as mkdirSync18, writeFileSync as writeFileSync14, existsSync as existsSync39, rmSync as rmSync6, rmdirSync, unlinkSync as unlinkSync3 } from "node:fs";
+import { readdirSync as readdirSync21, lstatSync as lstatSync5, readFileSync as readFileSync43, mkdirSync as mkdirSync19, writeFileSync as writeFileSync15, existsSync as existsSync39, rmSync as rmSync7, rmdirSync, unlinkSync as unlinkSync3 } from "node:fs";
 import { join as join37, resolve as resolve36, sep as sep8 } from "node:path";
 import { deflateRawSync as deflateRawSync2 } from "node:zlib";
 function walkSourceTree(dir, file, skip) {
@@ -39529,7 +39794,7 @@ function writeAppSource(entries, destDir) {
       `refusing to restore into ${root}: the destination itself is a symlink, so every file would be written outside it. Remove it, or pass --out/--name somewhere else.`
     );
   }
-  mkdirSync18(root, { recursive: true });
+  mkdirSync19(root, { recursive: true });
   const written = [];
   for (const entry of entries) {
     if (isDeniedSourcePath(entry.path)) continue;
@@ -39540,11 +39805,11 @@ function writeAppSource(entries, destDir) {
       const kind = pathKind(dir);
       if (kind?.isSymbolicLink()) unlinkSync3(dir);
       else if (kind) continue;
-      mkdirSync18(dir);
+      mkdirSync19(dir);
     }
     const target = join37(root, ...segments);
     if (pathKind(target)?.isSymbolicLink()) unlinkSync3(target);
-    writeFileSync14(target, entry.bytes);
+    writeFileSync15(target, entry.bytes);
     written.push(entry.path);
   }
   return written;
@@ -39599,7 +39864,7 @@ function writeConflicts(entries, destDir) {
 function removeStaleSource(entries, destDir) {
   const root = resolve36(destDir);
   const removed = staleSourcePaths(entries, root);
-  for (const rel of removed) rmSync6(join37(root, ...rel.split("/")), { force: true });
+  for (const rel of removed) rmSync7(join37(root, ...rel.split("/")), { force: true });
   const needed = /* @__PURE__ */ new Set();
   for (const entry of entries) {
     if (isDeniedSourcePath(entry.path)) continue;
@@ -39679,7 +39944,7 @@ __export(eject_exports, {
   EJECTABLE: () => EJECTABLE,
   ejectModule: () => ejectModule
 });
-import { existsSync as existsSync40, mkdirSync as mkdirSync19, readFileSync as readFileSync44, writeFileSync as writeFileSync15 } from "node:fs";
+import { existsSync as existsSync40, mkdirSync as mkdirSync20, readFileSync as readFileSync44, writeFileSync as writeFileSync16 } from "node:fs";
 import { dirname as dirname24, join as join38, relative as relative5, resolve as resolve37, sep as sep9 } from "node:path";
 function locate(repoRootOrCwd, mod) {
   const inRepo = resolve37(repoRootOrCwd, `stdlib/flows/${mod}/src/index.ts`);
@@ -39710,7 +39975,7 @@ function ejectModule(opts) {
   }
   const ext = found.form === "source" ? "ts" : "mjs";
   const target = join38(contentDir2, "tier5-src", "_ejected", `${mod}.${ext}`);
-  mkdirSync19(dirname24(target), { recursive: true });
+  mkdirSync20(dirname24(target), { recursive: true });
   const banner = `// EJECTED from @wix/himalaya/${mod}. This app owns this file now.
 //
 // Central fixes to @wix/himalaya/${mod} NO LONGER REACH THIS APP \u2014 including any
@@ -39727,7 +39992,7 @@ function ejectModule(opts) {
     /(["'])@himalaya\/([a-z0-9-]+(?:\/[a-z0-9-]+)?)\1/g,
     (_m, q, sub) => `${q}@wix/himalaya/${sub}${q}`
   );
-  writeFileSync15(target, banner + normalized);
+  writeFileSync16(target, banner + normalized);
   const rewired = [];
   for (const f of files) {
     if (!existsSync40(f)) continue;
@@ -39743,7 +40008,7 @@ function ejectModule(opts) {
       );
     }
     if (after !== before) {
-      writeFileSync15(f, after);
+      writeFileSync16(f, after);
       rewired.push(f);
     }
   }
@@ -39779,7 +40044,7 @@ __export(test_exports, {
   scopeDescriptors: () => scopeDescriptors,
   writeRecordedMocks: () => writeRecordedMocks
 });
-import { existsSync as existsSync41, mkdirSync as mkdirSync20, readFileSync as readFileSync45, writeFileSync as writeFileSync16 } from "node:fs";
+import { existsSync as existsSync41, mkdirSync as mkdirSync21, readFileSync as readFileSync45, writeFileSync as writeFileSync17 } from "node:fs";
 import { join as join39, resolve as resolve38 } from "node:path";
 function readTestConfig(dir) {
   const p = resolve38(dir, TEST_CONFIG_FILE);
@@ -39955,8 +40220,8 @@ function writeRecordedMocks(opts) {
     };
   }
   const fs = opts.io ?? {
-    mkdir: (p) => mkdirSync20(p, { recursive: true }),
-    write: (p, s) => writeFileSync16(p, s)
+    mkdir: (p) => mkdirSync21(p, { recursive: true }),
+    write: (p, s) => writeFileSync17(p, s)
   };
   fs.mkdir(join39(opts.dir, "dev"));
   fs.write(join39(opts.dir, "dev", "net-mocks.json"), JSON.stringify(opts.mocks, null, 2) + "\n");
@@ -42264,7 +42529,7 @@ __export(native_decode_exports, {
   runNativeDecode: () => runNativeDecode
 });
 import { execFileSync as execFileSync5, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync44, mkdtempSync as mkdtempSync2, readFileSync as readFileSync48, rmSync as rmSync7, writeFileSync as writeFileSync17 } from "node:fs";
+import { existsSync as existsSync44, mkdtempSync as mkdtempSync2, readFileSync as readFileSync48, rmSync as rmSync8, writeFileSync as writeFileSync18 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join42 } from "node:path";
 import { fileURLToPath as fileURLToPath20 } from "node:url";
@@ -42398,7 +42663,7 @@ function runNativeDecode(options) {
       if (typeof descriptor.descriptorJson !== "string") {
         throw new Error(`native decode cannot judge ${descriptor.screenId}: the release builder did not return its exact baked JSON bytes`);
       }
-      writeFileSync17(join42(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
+      writeFileSync18(join42(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
     }
     options.progress?.("building cached Swift oracle");
     execFileSync5("swift", ["build", "--package-path", options.packageDir, "--product", "himi-decode-oracle"], {
@@ -42424,7 +42689,7 @@ function runNativeDecode(options) {
     const stderr = failure.stderr ? ` \u2014 ${String(failure.stderr).trim().slice(0, 2e3)}` : "";
     throw new Error(`iOS decoder oracle failed: ${failure.message}${stderr}`);
   } finally {
-    rmSync7(descriptorDir, { recursive: true, force: true });
+    rmSync8(descriptorDir, { recursive: true, force: true });
   }
 }
 function runAndroidNativeDecode(options) {
@@ -42436,7 +42701,7 @@ function runAndroidNativeDecode(options) {
       if (typeof descriptor.descriptorJson !== "string") {
         throw new Error(`native decode cannot judge ${descriptor.screenId}: the release builder did not return its exact baked JSON bytes`);
       }
-      writeFileSync17(join42(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
+      writeFileSync18(join42(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
     }
     options.progress?.(`running real Kotlin decoder over ${options.descriptors.length} screen${options.descriptors.length === 1 ? "" : "s"}`);
     execFileSync5(options.gradlew, [
@@ -42462,7 +42727,7 @@ function runAndroidNativeDecode(options) {
     const stderr = failure.stderr ? ` \u2014 ${String(failure.stderr).trim().slice(0, 2e3)}` : "";
     throw new Error(`Android decoder oracle failed: ${failure.message}${stderr}`);
   } finally {
-    rmSync7(descriptorDir, { recursive: true, force: true });
+    rmSync8(descriptorDir, { recursive: true, force: true });
   }
 }
 function fieldAt(path) {
@@ -42784,7 +43049,7 @@ __export(coverage_exports, {
   suppressedNativeKeys: () => suppressedNativeKeys,
   trendAndStore: () => trendAndStore
 });
-import { existsSync as existsSync46, mkdirSync as mkdirSync21, readFileSync as readFileSync50, writeFileSync as writeFileSync18 } from "node:fs";
+import { existsSync as existsSync46, mkdirSync as mkdirSync22, readFileSync as readFileSync50, writeFileSync as writeFileSync19 } from "node:fs";
 import { dirname as dirname25, join as join44 } from "node:path";
 function suppressedNativeKeys(oracle) {
   return [...oracle.ios ? [] : ["native-decode|ios"], ...oracle.android ? [] : ["native-decode|android"]];
@@ -42967,8 +43232,8 @@ function trendAndStore(dir, entries, suppressed) {
   const current = entries.map((e) => e.key);
   const stored = [.../* @__PURE__ */ new Set([...current, ...(previous ?? []).filter((key2) => (suppressed ?? []).includes(key2))])];
   try {
-    mkdirSync21(dirname25(p), { recursive: true });
-    writeFileSync18(p, JSON.stringify({ keys: stored, ts: (/* @__PURE__ */ new Date()).toISOString() }, null, 2));
+    mkdirSync22(dirname25(p), { recursive: true });
+    writeFileSync19(p, JSON.stringify({ keys: stored, ts: (/* @__PURE__ */ new Date()).toISOString() }, null, 2));
   } catch {
     return null;
   }
@@ -43012,8 +43277,8 @@ function diffAndStoreObservations(dir, current) {
   } catch {
   }
   try {
-    mkdirSync21(dirname25(p), { recursive: true });
-    writeFileSync18(p, JSON.stringify({ screens: current, ts: (/* @__PURE__ */ new Date()).toISOString() }, null, 2));
+    mkdirSync22(dirname25(p), { recursive: true });
+    writeFileSync19(p, JSON.stringify({ screens: current, ts: (/* @__PURE__ */ new Date()).toISOString() }, null, 2));
   } catch {
     return null;
   }
@@ -43168,6 +43433,7 @@ function verifyReport(dir, app, manifest) {
   const drift = [];
   const inSync = [];
   for (const [name, rec] of published) {
+    if (rec.origin === "catalog") continue;
     const mine = local.get(name);
     if (!mine) {
       drift.push(
@@ -43253,19 +43519,6 @@ var init_assets = __esm({
   }
 });
 
-// src/shell-quote.ts
-var shell_quote_exports = {};
-__export(shell_quote_exports, {
-  shellQuote: () => shellQuote
-});
-function shellQuote(arg) {
-  return /^[A-Za-z0-9_./:@=-]+$/.test(arg) ? arg : `'${arg.replace(/'/g, `'\\''`)}'`;
-}
-var init_shell_quote = __esm({
-  "src/shell-quote.ts"() {
-  }
-});
-
 // ../../core/serve-runtime/package-share.ts
 function parseStored(bytes2, id) {
   if (!bytes2) return null;
@@ -43516,7 +43769,7 @@ function makeServeHandler(opts) {
   }
   const PINNED_MANIFEST_CACHE_CAP = 100;
   const pinnedManifestCache = /* @__PURE__ */ new Map();
-  const sha256hex = (b) => sha256Hex2(b);
+  const sha256hex = (b) => sha256Hex3(b);
   function resolvePin(request, url) {
     return request.headers.get("x-himalaya-release") || url.searchParams.get("release") || null;
   }
@@ -44691,19 +44944,19 @@ var init_preview_assets_generated = __esm({
   "../../packages/serve/src/preview-assets.generated.ts"() {
     init_preview_assets_format();
     PREVIEW_ASSET_MANIFEST = [
-      { key: "assets/index-CeKHbRna.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 998645, sha256: "4e1a78d6443c5e1ccf0a16a87b5ca4ab1a62fb5b989182a5faa3f31b43932c47" },
-      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 998653, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
-      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1089577, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
-      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1180561, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
-      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1271541, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
-      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1362413, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
-      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 1453393, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
-      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 1562029, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
-      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 1671113, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
-      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 1780161, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
-      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 1887861, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
-      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 1975969, length: 4448, sha256: "79979ee36bb97117452963ece8b9816095ddcec8cc95fa1798448d0c9fc6402b" },
-      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 1980417, length: 13784, sha256: "cfb9465254fab84f0e084bb4542c282758ea29774b5f172840cc0b9e4194ef89" }
+      { key: "assets/index-D0JRTirJ.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1004613, sha256: "7e32dc45ae043c4ec3176c5defcadbb434e6748aef2c6b6135aee97d5ef2c093" },
+      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 1004621, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
+      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1095545, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
+      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1186529, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
+      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1277509, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
+      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1368381, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
+      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 1459361, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
+      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 1567997, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
+      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 1677081, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
+      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 1786129, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
+      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 1893829, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
+      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 1981937, length: 4448, sha256: "d37ab02eeaf4e6de05cd6b1928427b05e2585a871df0821d7879894db5155a76" },
+      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 1986385, length: 17209, sha256: "dffc9718e2faa63ae2cc919e0a842f585ed565aaaa7c53778e90379442c731b6" }
     ];
   }
 });
@@ -44719,7 +44972,7 @@ __export(run_exports, {
   runPackage: () => runPackage,
   withoutProdServe: () => withoutProdServe
 });
-import { cpSync, existsSync as existsSync48, mkdirSync as mkdirSync22, mkdtempSync as mkdtempSync3, readFileSync as readFileSync53, rmSync as rmSync8, statSync as statSync10 } from "node:fs";
+import { cpSync, existsSync as existsSync48, mkdirSync as mkdirSync23, mkdtempSync as mkdtempSync3, readFileSync as readFileSync53, rmSync as rmSync9, statSync as statSync10 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
 import { dirname as dirname26, join as join46 } from "node:path";
 import { fileURLToPath as fileURLToPath22 } from "node:url";
@@ -44754,8 +45007,8 @@ async function resolvePackage(source, workDir) {
       const root2 = workDir ?? mkdtempSync3(join46(tmpdir4(), "himi-run-"));
       const target = join46(root2, app2);
       if (join46(source) !== target) {
-        mkdirSync22(root2, { recursive: true });
-        rmSync8(target, { recursive: true, force: true });
+        mkdirSync23(root2, { recursive: true });
+        rmSync9(target, { recursive: true, force: true });
         cpSync(source, target, { recursive: true });
       }
       return {
@@ -44775,7 +45028,7 @@ async function resolvePackage(source, workDir) {
   const { app, appDir: appDir2 } = unpackTo(bytes2, root);
   const opened = openPackageDir(appDir2);
   if (!opened.validation.ok) {
-    rmSync8(workDir ? appDir2 : root, { recursive: true, force: true });
+    rmSync9(workDir ? appDir2 : root, { recursive: true, force: true });
     throw new Error(`package is not valid:
   ${opened.validation.errors.join("\n  ")}`);
   }
@@ -44826,7 +45079,7 @@ async function runPackage(source, opts = {}) {
   const resolved2 = await resolvePackage(source, opts.workDir);
   const assets = opts.assets ?? (opts.spa ? /* @__PURE__ */ new Map() : await loadPreviewAssets());
   if (!opts.spa && assets.size === 0) {
-    if (resolved2.temp) rmSync8(resolved2.temp, { recursive: true, force: true });
+    if (resolved2.temp) rmSync9(resolved2.temp, { recursive: true, force: true });
     throw new Error(NO_SPA_MESSAGE);
   }
   const handler = makePackageRunHandler({
@@ -44856,7 +45109,7 @@ async function runPackage(source, opts = {}) {
     warnings: resolved2.warnings,
     close: () => new Promise((done) => {
       server.close(() => {
-        if (resolved2.temp) rmSync8(resolved2.temp, { recursive: true, force: true });
+        if (resolved2.temp) rmSync9(resolved2.temp, { recursive: true, force: true });
         done();
       });
     })
@@ -46055,7 +46308,7 @@ __export(version_exports, {
   setAndroidVersion: () => setAndroidVersion,
   setIosVersion: () => setIosVersion
 });
-import { readFileSync as readFileSync58, writeFileSync as writeFileSync19 } from "node:fs";
+import { readFileSync as readFileSync58, writeFileSync as writeFileSync20 } from "node:fs";
 function readIosVersion(projectYml) {
   const marketing = matchScalar(projectYml, "CFBundleShortVersionString");
   const build2 = matchScalar(projectYml, "CFBundleVersion");
@@ -46120,8 +46373,8 @@ function bumpVersion(app, opts) {
     marketing: opts.marketing ?? current.marketing,
     build: opts.build === "increment" || opts.build === void 0 ? current.build + (opts.build === "increment" ? 1 : 0) : opts.build
   };
-  writeFileSync19(iosPath, setIosVersion(iosYml, next));
-  writeFileSync19(gradlePath, setAndroidVersion(gradle, next));
+  writeFileSync20(iosPath, setIosVersion(iosYml, next));
+  writeFileSync20(gradlePath, setAndroidVersion(gradle, next));
   return next;
 }
 var init_version = __esm({
@@ -46473,7 +46726,7 @@ __export(notify_exports, {
   runNotify: () => runNotify,
   saveAdminSession: () => saveAdminSession
 });
-import { chmodSync as chmodSync3, mkdirSync as mkdirSync23, readFileSync as readFileSync62, writeFileSync as writeFileSync20 } from "node:fs";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync24, readFileSync as readFileSync62, writeFileSync as writeFileSync21 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
 import { dirname as dirname29, join as join49 } from "node:path";
 function defaultSessionsPath() {
@@ -46489,8 +46742,8 @@ function loadSessionsFile(path = defaultSessionsPath()) {
 function saveAdminSession(adminUrl, session, path = defaultSessionsPath()) {
   const file = loadSessionsFile(path);
   file.sessions = { ...file.sessions, [adminUrl]: session };
-  mkdirSync23(dirname29(path), { recursive: true, mode: 448 });
-  writeFileSync20(path, JSON.stringify(file, null, 2) + "\n", { mode: 384 });
+  mkdirSync24(dirname29(path), { recursive: true, mode: 448 });
+  writeFileSync21(path, JSON.stringify(file, null, 2) + "\n", { mode: 384 });
   try {
     chmodSync3(dirname29(path), 448);
     chmodSync3(path, 384);
@@ -50066,7 +50319,7 @@ var init_brand_font = __esm({
 });
 
 // src/site-analyze/write-artifacts.ts
-import { mkdirSync as mkdirSync24, writeFileSync as writeFileSync21 } from "node:fs";
+import { mkdirSync as mkdirSync25, writeFileSync as writeFileSync22 } from "node:fs";
 import { join as join50 } from "node:path";
 function attachVeloSources(book, sources, put) {
   const byPath = new Map((sources ?? []).map((s) => [s.path, s.text]));
@@ -50222,13 +50475,13 @@ async function downloadMedia(book, fetchImpl, put) {
 }
 async function writeBusinessBook(result, opts) {
   const out = opts.outDir;
-  mkdirSync24(join50(out, "evidence/pages"), { recursive: true });
-  mkdirSync24(join50(out, "media/catalog"), { recursive: true });
+  mkdirSync25(join50(out, "evidence/pages"), { recursive: true });
+  mkdirSync25(join50(out, "media/catalog"), { recursive: true });
   const files = [];
   const put = (rel, body) => {
     const p = join50(out, rel);
-    mkdirSync24(join50(p, ".."), { recursive: true });
-    writeFileSync21(p, body);
+    mkdirSync25(join50(p, ".."), { recursive: true });
+    writeFileSync22(p, body);
     files.push(rel);
   };
   const book = result.book;
@@ -50648,7 +50901,7 @@ var init_home_descriptor = __esm({
 });
 
 // src/site-analyze/apply.ts
-import { existsSync as existsSync53, readFileSync as readFileSync63, writeFileSync as writeFileSync22, copyFileSync as copyFileSync3, mkdirSync as mkdirSync25, realpathSync as realpathSync5, statSync as statSync12 } from "node:fs";
+import { existsSync as existsSync53, readFileSync as readFileSync63, writeFileSync as writeFileSync23, copyFileSync as copyFileSync3, mkdirSync as mkdirSync26, realpathSync as realpathSync5, statSync as statSync12 } from "node:fs";
 import { dirname as dirname30, isAbsolute as isAbsolute4, join as join51, resolve as resolve42, sep as sep11 } from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
 function unpairedRedirectNote(overlay) {
@@ -50761,7 +51014,7 @@ function buildMergedContract(options) {
     if (!real.startsWith(realRoot + sep11)) return void 0;
     try {
       if (!statSync12(real).isFile()) return void 0;
-      mkdirSync25(dirname30(to), { recursive: true });
+      mkdirSync26(dirname30(to), { recursive: true });
       copyFileSync3(real, to);
     } catch {
       return void 0;
@@ -50797,10 +51050,10 @@ function buildMergedContract(options) {
   const body = `${JSON.stringify(merged, null, 2)}
 `;
   const path = join51(packageDir, "provisioning.contract.json");
-  writeFileSync22(path, body);
+  writeFileSync23(path, body);
   const localPath = join51(appDir2, LOCAL_CONTRACT_REL);
-  mkdirSync25(dirname30(localPath), { recursive: true });
-  writeFileSync22(localPath, body);
+  mkdirSync26(dirname30(localPath), { recursive: true });
+  writeFileSync23(localPath, body);
   staged.push(localPath);
   return { path, staged };
 }
@@ -50846,10 +51099,10 @@ async function applyOverlays(input) {
   if (existsSync53(pkgProv)) {
     const cur = JSON.parse(readFileSync63(pkgProv, "utf8"));
     const merged = deepMerge4(cur, overlay);
-    writeFileSync22(pkgProv, JSON.stringify(merged, null, 2) + "\n");
+    writeFileSync23(pkgProv, JSON.stringify(merged, null, 2) + "\n");
     wrote.push(pkgProv);
   } else {
-    writeFileSync22(pkgProv, JSON.stringify(overlay, null, 2) + "\n");
+    writeFileSync23(pkgProv, JSON.stringify(overlay, null, 2) + "\n");
     wrote.push(pkgProv);
   }
   const pkgTokens = join51(cwd, "tokens.json");
@@ -50860,7 +51113,7 @@ async function applyOverlays(input) {
     if (mergedColors && typeof mergedColors === "object" && !Array.isArray(mergedColors)) {
       merged.colors = alignAccentsToSurfaces(mergedColors, tokens.colors);
     }
-    writeFileSync22(pkgTokens, JSON.stringify(merged, null, 2) + "\n");
+    writeFileSync23(pkgTokens, JSON.stringify(merged, null, 2) + "\n");
     wrote.push(pkgTokens);
   }
   const homeAction = homeRefreshActionId(shell);
@@ -50882,7 +51135,7 @@ async function applyOverlays(input) {
       }
     }
     if (next !== prev) {
-      writeFileSync22(homeSrc, next);
+      writeFileSync23(homeSrc, next);
       wrote.push(homeSrc);
     }
     if (patched.unparsed) {
@@ -55393,7 +55646,7 @@ __export(site_create_exports, {
   runSiteList: () => runSiteList,
   writeProvisioningBinding: () => writeProvisioningBinding
 });
-import { existsSync as existsSync54, readFileSync as readFileSync65, writeFileSync as writeFileSync23 } from "node:fs";
+import { existsSync as existsSync54, readFileSync as readFileSync65, writeFileSync as writeFileSync24 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 function oauthClientName(projectName) {
   return `${projectName} client`;
@@ -55542,7 +55795,7 @@ async function runSiteCreate(opts) {
   if (!wantOauthApp) return { ...base, nextSteps: nextSteps(metaSiteId) };
   return { ...base, clientId, redirectUri, nextSteps: nextSteps(metaSiteId, clientId) };
 }
-function writeProvisioningBinding(target, binding2, fs = { existsSync: existsSync54, readFileSync: readFileSync65, writeFileSync: writeFileSync23 }) {
+function writeProvisioningBinding(target, binding2, fs = { existsSync: existsSync54, readFileSync: readFileSync65, writeFileSync: writeFileSync24 }) {
   const msid = binding2.siteId;
   const path = resolvePath2(target);
   const committed = committedShellProvisioning(path);
@@ -55874,7 +56127,7 @@ var init_site_oauth_client = __esm({
 });
 
 // src/cli.ts
-import { mkdtempSync as mkdtempSync4, readFileSync as readFileSync66, mkdirSync as mkdirSync26, writeFileSync as writeFileSync24, existsSync as existsSync55, rmSync as rmSync9, readdirSync as readdirSync25, statSync as statSync13, lstatSync as lstatSync6, accessSync, constants } from "node:fs";
+import { mkdtempSync as mkdtempSync4, readFileSync as readFileSync66, mkdirSync as mkdirSync27, writeFileSync as writeFileSync25, existsSync as existsSync55, rmSync as rmSync10, readdirSync as readdirSync25, statSync as statSync13, lstatSync as lstatSync6, accessSync, constants } from "node:fs";
 import { execFileSync as execFileSync7, spawnSync as spawnSync5, spawn as spawn5 } from "node:child_process";
 import { createHash as createHash24, randomUUID as randomUUID3 } from "node:crypto";
 import { tmpdir as tmpdir5, homedir as homedir7, hostname } from "node:os";
@@ -57685,16 +57938,47 @@ init_wix_owner();
 import { existsSync as existsSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "node:fs";
 import { join as join8 } from "node:path";
 var FOREIGN_DETAIL_LIMIT = 25;
+var MAX_COLLECTION_PAGES = 40;
 async function listCollections(call) {
   try {
-    const r = await withRetry(
-      "list collections",
-      () => call("GET", "/data/v2/collections")
-    );
-    const collections = r.collections ?? [];
-    const total = r.pagingMetadata?.total;
-    const unlisted = typeof total === "number" && Number.isFinite(total) ? Math.max(0, total - collections.length) : 0;
-    return unlisted > 0 ? { collections, unlisted } : { collections };
+    const collections = [];
+    const seen = /* @__PURE__ */ new Set();
+    let offset = 0;
+    let total;
+    let reachedEnd = false;
+    for (let page = 0; page < MAX_COLLECTION_PAGES; page++) {
+      const path = offset ? `/data/v2/collections?paging.offset=${offset}` : "/data/v2/collections";
+      const r = await withRetry(
+        "list collections",
+        () => call("GET", path)
+      );
+      const batch = r.collections ?? [];
+      const t = r.pagingMetadata?.total;
+      if (typeof t === "number" && Number.isFinite(t)) total = t;
+      let fresh = 0;
+      for (const c of batch) {
+        if (c.id && seen.has(c.id)) continue;
+        if (c.id) seen.add(c.id);
+        collections.push(c);
+        fresh++;
+      }
+      offset += batch.length;
+      if (batch.length === 0) {
+        reachedEnd = true;
+        break;
+      }
+      if (fresh === 0) break;
+      const more = total !== void 0 ? offset < total : r.pagingMetadata?.tooManyToCount === true;
+      if (!more) {
+        reachedEnd = true;
+        break;
+      }
+    }
+    if (total !== void 0) {
+      const unlisted = Math.max(0, total - collections.length);
+      return unlisted > 0 ? { collections, unlisted, incomplete: true } : { collections };
+    }
+    return reachedEnd ? { collections } : { collections, incomplete: true };
   } catch (err) {
     if (err instanceof WixApiError && err.isAppNotInstalled) {
       throw new Error(
@@ -57812,10 +58096,18 @@ async function queryCms(opts) {
   let remote;
   const foreign = [];
   let unlisted = 0;
+  let incomplete = false;
   if (all) {
     const listing = await listCollections(call);
     remote = listing.collections;
     unlisted = listing.unlisted ?? 0;
+    incomplete = listing.incomplete === true;
+    if (incomplete) {
+      const listed = new Set(remote.map((c) => c.id));
+      const unreached = [...declared.keys()].filter((id) => !listed.has(id));
+      const found = await mapLimit(unreached, 4, (id) => getCollection(call, id));
+      remote = [...remote, ...found.filter((c) => c !== null)];
+    }
   } else {
     const found = await mapLimit([...declared.keys()], 4, (id) => getCollection(call, id));
     remote = found.filter((c) => c !== null);
@@ -57861,10 +58153,17 @@ async function queryCms(opts) {
       foreign: {
         count: foreign.length,
         collections: foreign.slice(0, FOREIGN_DETAIL_LIMIT).map(describeForeign),
-        ...foreign.length > FOREIGN_DETAIL_LIMIT ? { truncated: foreign.length - FOREIGN_DETAIL_LIMIT } : {}
+        ...foreign.length > FOREIGN_DETAIL_LIMIT ? {
+          truncated: foreign.length - FOREIGN_DETAIL_LIMIT,
+          others: foreign.slice(FOREIGN_DETAIL_LIMIT).map((c) => ({
+            id: c.id,
+            ...c.displayName ? { displayName: c.displayName } : {}
+          }))
+        } : {}
       }
     } : {},
     ...unlisted ? { unlistedCollections: unlisted } : {},
+    ...incomplete ? { listingIncomplete: true } : {},
     siteScanned: all,
     drift
   };
@@ -58593,10 +58892,10 @@ async function iconIssues(dir, strict, opts = {}) {
 
 // src/font-lint.ts
 init_fonts();
-function fontIssues(dir, strict) {
+async function fontIssues(dir, strict, opts = {}) {
   let result;
   try {
-    result = fontFindings(dir);
+    result = await fontFindings(dir, opts);
   } catch {
     return [];
   }
@@ -58605,8 +58904,10 @@ function fontIssues(dir, strict) {
     screen: null,
     pass: "fonts",
     // A warning stays a warning under --strict only if it is genuinely advisory; the
-    // budget note is. Everything `fontFindings` calls an error already is one.
-    severity: f.severity === "error" ? "error" : strict ? "error" : "warning",
+    // budget note is. Everything `fontFindings` calls an error already is one — except a
+    // family that falls back on web because its faces could not be fetched off-repo, which
+    // this door, feeding `himi push`, reports as a warning: see `FontFinding.webFallback`.
+    severity: f.severity === "error" && !f.webFallback ? "error" : strict ? "error" : "warning",
     message: f.message
   }));
 }
@@ -58769,7 +59070,7 @@ function auditUx(content, strict = false) {
 
 // src/guides.ts
 init_mobile_ux_contract();
-import { readFileSync as readFileSync23, existsSync as existsSync23, mkdirSync as mkdirSync10, writeFileSync as writeFileSync9, copyFileSync as copyFileSync2 } from "node:fs";
+import { readFileSync as readFileSync23, existsSync as existsSync23, mkdirSync as mkdirSync11, writeFileSync as writeFileSync10, copyFileSync as copyFileSync2 } from "node:fs";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
 import { dirname as dirname14, join as join26, resolve as resolve17 } from "node:path";
 var GUIDES_DIR = resolve17(dirname14(fileURLToPath10(import.meta.url)), "../guides");
@@ -58913,13 +59214,13 @@ function writeAgentContext(targetDir) {
   const files = [];
   const write2 = (rel, body) => {
     const p = join26(targetDir, rel);
-    mkdirSync10(dirname14(p), { recursive: true });
-    writeFileSync9(p, body);
+    mkdirSync11(dirname14(p), { recursive: true });
+    writeFileSync10(p, body);
     files.push(rel);
   };
   const copy = (srcRel, destRel) => {
     const p = join26(targetDir, destRel);
-    mkdirSync10(dirname14(p), { recursive: true });
+    mkdirSync11(dirname14(p), { recursive: true });
     copyFileSync2(join26(GUIDES_DIR, srcRel), p);
     files.push(destRel);
   };
@@ -59168,9 +59469,11 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
                                            tokenless discovery path. Foreign collections are
                                            described up to a cap and never item-counted;
                                            foreign.truncated says how many of the LISTED ones
-                                           went undescribed, and unlistedCollections what the
-                                           listing left out (the list endpoint is paged and is
-                                           not followed, so foreign.count is not a census).
+                                           went undescribed, and foreign.others still names
+                                           each of them (id + displayName). The listing's pages
+                                           are followed; listingIncomplete: true says the walk
+                                           stopped short of the end, and unlistedCollections
+                                           says how many it left out when Wix gave a total.
                                            create reconciles only himi_<app>_* ; seed fills
                                            EMPTY owned collections from the config's seed: rows
                                            (--ai writes rows for you to review first)
@@ -59681,7 +59984,7 @@ var COMMANDS = [
   { name: "test", summary: "DERIVED behavioral crawl \u2014 no test files to write. Boots each screen's real worker, replays its onAppear, then dispatches every action site the descriptor already declares (each from a fresh boot) and checks a narrow set of unambiguous invariants: no uncaught throw, never stuck on `loading`, no `$service:` token or NaN/undefined/[object Object] reaching visible text, no binding aimed at state the worker never defines, no nav param silently dropped, no dead nav target. Catches what validate/render cannot \u2014 a WRONG REDUCER passes both with ok:true. Runs the worker in a DEVICE-PARITY sandbox (no setTimeout/setInterval, as on JSC/WebView) so a bundle that would die on device fails here. Crawls on HERMETIC DATA by default \u2014 zero network: the app's own dev/net-mocks.json first (--net <file> overrides), then the config's CMS `seed:` rows, then a canned fixture of frozen real vertical responses shipped with the CLI (exercises code paths, not API-contract truth) \u2014 so the success/mapping path runs, not just the failure UI. Two boot-only HOSTILE passes (every list empty; every request 500) then check the failure/empty day \u2014 corpus-proven, so their findings are errors. NAV EDGES are followed too: every himi.open site ($item params resolved against row 0 of its list, $service against worker state) and worker _nav directive is harvested, and each baked target is booted WITH the params the source sends \u2014 detail screens finally run their content arm; edge findings are errors tagged edge:<source>. --native runs both real native decoders over the exact baked JSON bytes; --native ios or --native android selects one. It is explicit, runs only from a Himalaya SOURCE CHECKOUT (the decoder oracles are that tree's own HimalayaCore Swift package and Gradle harness, which a published install does not ship), and needs the selected local toolchain. From a source checkout, default runs name missing native verdicts in the coverage ledger; elsewhere the ledger stays silent about them rather than offering a remedy you cannot run. --offline strips all data layers (the old reject-all axis); --no-hostile skips the hostile passes. --record (EXPLICIT, never automatic) refreshes dev/net-mocks.json from live reads first: it boots each screen (load + root onAppear ONLY \u2014 nothing the app's own launch would not fire; the tap/action crawl never sees the live transport, and only proven reads \u2014 GET, or read-shaped POST (/query, /search, /list*, \u2026) \u2014 ever reach the wire), freezes the round-trips, then crawls hermetically on the fresh fixture; record against a QA site, not production. Nodes it cannot judge headless are named, never silently passed. Exit 1 on any error. The CLI carries the authoring runtime off-repo; no per-app SDK install is required. --browser runs the whole loop (build \u2192 extract \u2192 validate \u2192 render \u2192 test) in YOUR browser instead of here, so the source never reaches a pod: it opens one screen's worker + descriptor in a tab, blocks on a loopback callback, and prints the report it posts back. One screen per tab \u2014 name it. --no-open prints the URL rather than launching a browser (SSH); --timeout <ms> bounds the wait, which matters because the page has no execution deadline of its own and an infinite loop in the worker hangs the tab.", required: "[<screenId>\u2026] [--content <dir>] [--net <file>] [--budget <ms>] [--deep [n]] [--record] [--native [ios|android]] [--no-shots] [--offline] [--no-hostile] [--all-screens] [--browser] [--no-open] [--timeout <ms>] [--json]" },
   { name: "ux", summary: "audit or record mobile UX evidence. `audit` checks the public-safe contract, seeded blank acceptance rows, placeholder source copy, app-specific mocks, and iOS/Android audit records. It warns while existing templates migrate; `--strict` promotes missing evidence. `record` stores checks performed on an installed iOS/Android build: `--checks` is required for passed|failed and empty for unavailable, which drove nothing and needs a `--reason` instead. `record` also STAMPS the release it audited (it resolves the id from a build, the same one a push would publish), because an unforced `himi push` of a release with screens refuses when no drive is recorded for THAT release, or when the one that is recorded says `failed` \u2014 the artifact stopped being advice nobody reads (#2955). `unavailable` still satisfies it; only `failed` refuses.", required: "audit [--content <dir>] [--strict] [--json] | record --content <dir> --platform ios|android --status passed|failed|unavailable [--checks back,keyboard,...] [--reason <text>]" },
   { name: "render", summary: "headless-render a screen with the web renderer: render-tree + diagnostics, optional --png <file>, --scheme dark, --tree. Local by default (content dir). Pass --remote --app --release to hit GET /v1/preview/\u2026/render on the serve plane after a push. Boots the worker so $service bindings resolve; --static raw bindings; --live real Wix fetches; --state injects worker state; --input supplies pre-boot navigation params; --width/--device for PNG viewport; --rtl for dir=rtl + $env:isRTL.", required: "<screenId> [--content <dir>] [--scheme dark] [--png <file>] [--tree] [--static] [--live] [--state <json|file>] [--input <json|file>] [--width <px> | --device <name>] [--rtl] [--remote --app --release]" },
-  { name: "cms", summary: "inspect, provision, and seed the app's CMS (Wix Data) collections, declared as a `cms` block in config.ts. `query` is READ-ONLY \u2014 by default it fetches ONLY the physical ids `config.ts` declares (item counts + schema drift) and reports `siteScanned: false`; it never lists the site, so an UNDECLARED `himi_<app>_` collection this app owns is not reached without `--all`. `--all` SCANS the site \u2014 every collection it lists is labeled `owned`/`adopted`/`foreign`, and it describes every foreign one \u2014 id, non-system field keys + types, and the site's read role \u2014 so an app with no `cms` block at all can DISCOVER a collection to adopt (`--all` is the one case where a missing `cms` block is not 'nothing to do'). Foreign collections are described up to a cap and are never item-counted (`itemCount: null`), because a row count is one query each; `foreign.count` is how many the scan LISTED \u2014 NOT a site census, since the list endpoint is paged and is not followed \u2014 and `foreign.truncated` says how many of those went undescribed, while `unlistedCollections` reports what the listing itself left out (from Wix's own paging total). The scan is OWNER-scoped \u2014 it needs --site <msid> (or WIX_SITE_ID) plus owner auth via `wix token`; a visitor token can read a public collection's ITEMS but can never enumerate collections, so there is no tokenless discovery path. `create` reconciles declared collections additively and idempotently, and REFUSES any id outside the app's `himi_<app>_` namespace, so it is safe against a production site. It reports declared-vs-site `permissionDrift` but never writes permissions unless asked with --apply-permissions, so a field reconcile can't silently revert access control changed in the dashboard. `seed` inserts the git-tracked `seed:` rows into EMPTY owned collections (--force to add to a non-empty one; --ai writes placeholder rows plus a refinement prompt for you to review). Adopted collections (declared by `wixId`) are read-only and never created, updated, or seeded. Site from --site <msid> or WIX_SITE_ID; owner auth via `wix token`.", required: "query|create|seed [--site <msid>] [--content <dir>] [--all] [--dry-run] [--force] [--allow-destructive] [--apply-permissions] [--only <id>] [--ai] [--count <n>]" },
+  { name: "cms", summary: "inspect, provision, and seed the app's CMS (Wix Data) collections, declared as a `cms` block in config.ts. `query` is READ-ONLY \u2014 by default it fetches ONLY the physical ids `config.ts` declares (item counts + schema drift) and reports `siteScanned: false`; it never lists the site, so an UNDECLARED `himi_<app>_` collection this app owns is not reached without `--all`. `--all` SCANS the site \u2014 every collection it lists is labeled `owned`/`adopted`/`foreign`, and it describes every foreign one \u2014 id, non-system field keys + types, and the site's read role \u2014 so an app with no `cms` block at all can DISCOVER a collection to adopt (`--all` is the one case where a missing `cms` block is not 'nothing to do'). Foreign collections are described up to a cap and are never item-counted (`itemCount: null`), because a row count is one query each; `foreign.count` is how many the scan LISTED \u2014 it follows the list endpoint's pages, and `listingIncomplete: true` says when the walk stopped short of the end, with `unlistedCollections` counting what it left out when Wix gave a paging total \u2014 and `foreign.truncated` says how many of those went undescribed, each still NAMED in `foreign.others` (id + displayName), so a collection the site already has is never hidden behind the cap. The scan is OWNER-scoped \u2014 it needs --site <msid> (or WIX_SITE_ID) plus owner auth via `wix token`; a visitor token can read a public collection's ITEMS but can never enumerate collections, so there is no tokenless discovery path. `create` reconciles declared collections additively and idempotently, and REFUSES any id outside the app's `himi_<app>_` namespace, so it is safe against a production site. It reports declared-vs-site `permissionDrift` but never writes permissions unless asked with --apply-permissions, so a field reconcile can't silently revert access control changed in the dashboard. `seed` inserts the git-tracked `seed:` rows into EMPTY owned collections (--force to add to a non-empty one; --ai writes placeholder rows plus a refinement prompt for you to review). Adopted collections (declared by `wixId`) are read-only and never created, updated, or seeded. Site from --site <msid> or WIX_SITE_ID; owner auth via `wix token`.", required: "query|create|seed [--site <msid>] [--content <dir>] [--all] [--dry-run] [--force] [--allow-destructive] [--apply-permissions] [--only <id>] [--ai] [--count <n>]" },
   { name: "data", summary: "read-only plan or explicitly provision/seed declared KV and Wix Data resources. Preview and production are separate scopes. KV administration uses the operator data plane from --data-url/HIMI_DATA_ADMIN_URL and HIMI_DATA_ADMIN_TOKEN; draft push never calls it.", required: "plan|create|seed [--site <msid>] [--environment preview|production] [--content <dir>] [--data-url <url>] [--dry-run] [--force]" },
   { name: "icons", summary: "list the valid Icon.name vocabulary (an unknown name renders a fallback glyph; validate warns on unknown names) (offline)", required: "[--json]" },
   { name: "icon", summary: "the app's LAUNCHER icon \u2014 the home-screen / store mark, which is BINARY-floor and never over-the-air (distinct from `himi icons`, the in-screen glyph vocabulary). `status`/`check` report what this app would actually ship and validate it against both stores: exact 1024x1024, no tRNS chunk, non-interlaced, and \u2014 when the optional image toolchain is installed \u2014 no transparent regions (Apple permits an alpha channel but not transparent pixels: ITMS-90717), no pre-masked corners, no letterboxed wordmark; they also print the store-policy checklist no checker can decide. `set <file.png>` installs supplied art, `from-site` installs the logo `himi site analyze` downloaded, and `generate` makes a gradient tile + glyph \u2014 all three trim, flatten onto the app's accent, write the 1024 opaque master plus the 512 Play listing icon (Play wants 32-bit WITH alpha, so it is a separate file), and DECLARE it in himalaya.content.json, without which the release bakes no icon at all", required: "[status|check] | set <file.png> | from-site [--book <dir>] | generate [--glyph <g>] [--accent <hex>] | glyphs [--content <dir>] [--json]" },
@@ -59901,8 +60204,8 @@ function readUpdateCache(path) {
 }
 function writeUpdateCache(path, cache) {
   try {
-    mkdirSync26(dirname31(path), { recursive: true, mode: 448 });
-    writeFileSync24(path, JSON.stringify(cache, null, 2) + "\n", { mode: 384 });
+    mkdirSync27(dirname31(path), { recursive: true, mode: 448 });
+    writeFileSync25(path, JSON.stringify(cache, null, 2) + "\n", { mode: 384 });
   } catch {
   }
 }
@@ -60043,7 +60346,7 @@ function acquireUpdateLock(cachePath, now, hooks = {}) {
   };
   const tryCreate = (path) => {
     try {
-      writeFileSync24(path, mine, { flag: "wx", mode: 384 });
+      writeFileSync25(path, mine, { flag: "wx", mode: 384 });
       return true;
     } catch {
       return false;
@@ -60051,13 +60354,13 @@ function acquireUpdateLock(cachePath, now, hooks = {}) {
   };
   const removeIfMine = (path) => {
     try {
-      if (readLock(path) === mine) rmSync9(path, { force: true });
+      if (readLock(path) === mine) rmSync10(path, { force: true });
     } catch {
     }
   };
   const release = () => removeIfMine(lockPath);
   try {
-    mkdirSync26(dirname31(lockPath), { recursive: true, mode: 448 });
+    mkdirSync27(dirname31(lockPath), { recursive: true, mode: 448 });
   } catch {
     return () => {
     };
@@ -60074,7 +60377,7 @@ function acquireUpdateLock(cachePath, now, hooks = {}) {
       hooks.underBreakLock?.();
       if (current === void 0) return tryCreate(lockPath) ? release : void 0;
       if (!isAbandoned(current)) return void 0;
-      rmSync9(lockPath, { force: true });
+      rmSync10(lockPath, { force: true });
       return tryCreate(lockPath) ? release : void 0;
     } finally {
       removeIfMine(breakPath);
@@ -60696,8 +60999,8 @@ function readConfigSource(dir) {
   }
 }
 function writePngFile(path, base64) {
-  mkdirSync26(dirname31(path), { recursive: true });
-  writeFileSync24(path, Buffer.from(base64, "base64"));
+  mkdirSync27(dirname31(path), { recursive: true });
+  writeFileSync25(path, Buffer.from(base64, "base64"));
   return path;
 }
 async function initFromRemoteTemplate(name, parentDir, template, c) {
@@ -60817,14 +61120,14 @@ function materializeForPreview(appDir2, slug, displayName) {
       if (!entry.isDirectory()) continue;
       const pid = Number(entry.name.startsWith(`${slug}-`) ? entry.name.slice(slug.length + 1) : NaN);
       if (Number.isInteger(pid) && pid > 0 && pid !== process.pid && !stillRunning(pid)) {
-        rmSync9(join52(root, entry.name), { recursive: true, force: true });
+        rmSync10(join52(root, entry.name), { recursive: true, force: true });
       }
     }
   } catch {
   }
   const dest = join52(root, `${slug}-${process.pid}`);
-  rmSync9(dest, { recursive: true, force: true });
-  mkdirSync26(dest, { recursive: true });
+  rmSync10(dest, { recursive: true, force: true });
+  mkdirSync27(dest, { recursive: true });
   materializeSource(forBuild, displayName, dest, slug);
   return dest;
 }
@@ -61075,7 +61378,7 @@ async function recordedReleaseForContentQuietly(dir, resolution) {
     return null;
   } finally {
     if (out !== void 0) try {
-      rmSync9(out, { recursive: true, force: true });
+      rmSync10(out, { recursive: true, force: true });
     } catch {
     }
   }
@@ -61630,7 +61933,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           const scaffoldSourceFindings = resolve44(sourceDir) === resolve44(appDir2) ? [] : [
             ...tokenColorIssues(sourceDir),
             ...surfaceIssues(sourceDir, void 0, strict),
-            ...fontIssues(sourceDir, strict),
+            ...await fontIssues(sourceDir, strict),
             ...storesV1Issues(sourceDir, strict)
           ].map((issue2) => ({
             ...issue2,
@@ -61643,7 +61946,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
             ...await cmsIssues(buildDir, app, strict, { local: true }),
             ...surfaceIssues(buildDir, outcome.surfaceNav, strict),
             ...tokenColorIssues(buildDir),
-            ...fontIssues(buildDir, strict),
+            ...await fontIssues(buildDir, strict),
             ...storesV1Issues(buildDir, strict),
             ...await navIssues2(buildDir, strict),
             ...scaffoldSourceFindings
@@ -61918,7 +62221,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           ...surfaceIssues(dir, outcome.surfaceNav, strict),
           ...tokenColorIssues(dir),
           ...await iconIssues(dir, strict),
-          ...fontIssues(dir, strict),
+          ...await fontIssues(dir, strict),
           ...mobileUxIssues2(dir, strict),
           ...await navIssues2(dir, strict),
           ...storesV1Issues(dir, strict),
@@ -62409,7 +62712,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
                 renderDescriptorWeb: renderDescriptorWeb2,
                 renderPngBatch: renderPngBatch2,
                 writePng: (path, base64) => writePngFile(path, base64),
-                clearDir: (d) => rmSync9(d, { recursive: true, force: true })
+                clearDir: (d) => rmSync10(d, { recursive: true, force: true })
               }
             });
             writtenShots = sp.written;
@@ -62702,7 +63005,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           return report2.ok ? 0 : 1;
         }
         if (sub === "check") {
-          const report2 = checkReport2(dir);
+          const report2 = await checkReport2(dir);
           print(report2);
           return report2.ok ? 0 : 1;
         }
@@ -63102,7 +63405,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           ...surfaceIssues(dir, outcome.surfaceNav, strict),
           ...tokenColorIssues(dir),
           ...await iconIssues(dir, strict),
-          ...fontIssues(dir, strict),
+          ...await fontIssues(dir, strict),
           ...storesV1Issues(dir, strict),
           ...await navIssues2(dir, strict)
         ]);
@@ -63614,12 +63917,12 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           ...surfaceIssues(dir, outcome.surfaceNav, strict),
           ...tokenColorIssues(dir),
           ...await iconIssues(dir, strict),
-          ...fontIssues(dir, strict),
+          ...await fontIssues(dir, strict),
           ...storesV1Issues(dir, strict),
           ...await navIssues2(dir, strict)
         ]);
         if (hasErrors && !force) {
-          rmSync9(built, { recursive: true, force: true });
+          rmSync10(built, { recursive: true, force: true });
           print({ ...report2, packed: false, hint: "lint found errors \u2014 fix them, or re-run `himi pack --force` to pack anyway" });
           return 1;
         }
@@ -63655,7 +63958,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           io.error(JSON.stringify({ error: e.message }));
           return 1;
         } finally {
-          rmSync9(built, { recursive: true, force: true });
+          rmSync10(built, { recursive: true, force: true });
         }
       }
       // ---- himi import — turn a dev .himi back into an editable content package ----
@@ -63908,7 +64211,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           io.error(JSON.stringify({ error: e.message }));
           return 1;
         } finally {
-          if (temp) rmSync9(temp, { recursive: true, force: true });
+          if (temp) rmSync10(temp, { recursive: true, force: true });
         }
       }
       case "preview": {