@wix/himalaya-cli 0.1027.0 → 0.1029.0

package/dist/cli.mjs

@@ -5378,6 +5378,7 @@ function resolveTranslation(value, catalog, sourceCatalog) {
 var BINDING_SIGILS, BINDING_SIGIL_RE, TRANSLATION_PREFIX, TRANSLATION_KEY_RE;
 var init_bindings = __esm({
   "../../core/ts/src/bindings.ts"() {
+    "use strict";
     BINDING_SIGILS = ["service", "flag", "item", "t"];
     BINDING_SIGIL_RE = new RegExp(
       `^\\$(?:${BINDING_SIGILS.filter((s) => s !== "t").join("|")})\\b|^\\$t:`
@@ -22579,6 +22580,75 @@ var init_icons = __esm({
   }
 });
 
+// ../../core/web-renderer/src/webviewFrame.ts
+function currentOrigin() {
+  try {
+    const origin = typeof window !== "undefined" ? window.location?.origin : void 0;
+    return origin && origin !== "null" ? origin : null;
+  } catch {
+    return null;
+  }
+}
+function webviewFrameSandbox(url, grants2 = [], pageOrigin = currentOrigin()) {
+  const target = classifyEmbedUrl(url, pageOrigin);
+  if (!target || !NETWORK_SCHEMES.has(target.protocol)) return null;
+  const tokens = ["allow-scripts", ...grants2.filter((g) => g !== "allow-scripts" && g !== "allow-same-origin")];
+  if (target.crossOrigin) tokens.splice(1, 0, "allow-same-origin");
+  return { src: target.crossOrigin ? target.href : url, sandbox: tokens.join(" ") };
+}
+function classifyEmbedUrl(url, pageOrigin = currentOrigin()) {
+  const parsed = url.replace(/^[\u0000-\u0020]+|[\u0000-\u0020]+$/g, "").replace(/[\t\n\r]/g, "");
+  const absolute = /^[a-z][a-z0-9+.-]*:/i.test(parsed);
+  const schemeRelative = !absolute && /^[\\/]{2}/.test(parsed);
+  let target;
+  try {
+    target = new URL(parsed, pageOrigin ?? "http://relative.invalid");
+  } catch {
+    return null;
+  }
+  const crossOrigin = pageOrigin !== null && target.origin !== pageOrigin;
+  return { protocol: target.protocol, href: target.href, absolute, schemeRelative, crossOrigin };
+}
+function isWebviewUrlAllowed(url) {
+  return webviewFrameSandbox(url, [], null) !== null;
+}
+var NETWORK_SCHEMES;
+var init_webviewFrame = __esm({
+  "../../core/web-renderer/src/webviewFrame.ts"() {
+    NETWORK_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:"]);
+  }
+});
+
+// ../../core/web-renderer/src/pdfSource.ts
+function pdfEmbedPlan(url, pageOrigin = currentOrigin()) {
+  const target = classifyEmbedUrl(url, pageOrigin);
+  if (!target) return null;
+  if (target.protocol === "http:" || target.protocol === "https:") {
+    if (pageOrigin === null) {
+      if (target.absolute) return { mode: "direct", src: target.href };
+      if (target.schemeRelative) return { mode: "direct", src: target.href.replace(/^https?:/, "") };
+      return null;
+    }
+    return { mode: target.crossOrigin ? "direct" : "retype", src: target.href };
+  }
+  if (target.protocol === "blob:" && pageOrigin !== null && !target.crossOrigin) {
+    return { mode: "retype", src: target.href };
+  }
+  return null;
+}
+async function retypeAsPdf(src, fetchImpl = fetch) {
+  const res = await fetchImpl(src, { credentials: "same-origin" });
+  if (!res.ok) return null;
+  if (/html|xml/i.test(res.headers.get("content-type") ?? "")) return null;
+  const body = await res.blob();
+  return URL.createObjectURL(body.slice(0, body.size, "application/pdf"));
+}
+var init_pdfSource = __esm({
+  "../../core/web-renderer/src/pdfSource.ts"() {
+    init_webviewFrame();
+  }
+});
+
 // ../../core/web-renderer/src/a11y/controls.tsx
 import React3 from "react";
 import { jsx as jsx4, jsxs } from "react/jsx-runtime";
@@ -24281,6 +24351,14 @@ function useResolvedMediaItems(items, ctx) {
     return out ?? it;
   }), [items, values, ctx]);
 }
+function sourceFragment(src) {
+  if (!src) return "";
+  try {
+    return new URL(src).hash;
+  } catch {
+    return "";
+  }
+}
 function isNativeInteractiveElement(el) {
   const props = el.props;
   return typeof el.type === "string" && (["button", "input", "select", "textarea"].includes(el.type) || el.type === "a" && typeof props.href === "string");
@@ -24321,9 +24399,10 @@ function withExtras(name, render) {
     const additive = addIntrinsicPadding(el.props.style, wrap ?? {});
     const inferredDecorative = el.props[INFERRED_DECORATIVE] === true;
     const iconGlyph2 = el.props[ICON_GLYPH] === true;
+    const roleWhenNamed = el.props[ROLE_WHEN_NAMED];
     if (!Object.keys(pass).length) {
-      if (inferredDecorative || iconGlyph2) {
-        return React5.cloneElement(el, { [INFERRED_DECORATIVE]: void 0, [ICON_GLYPH]: void 0, ...additive ? { style: additive } : {} });
+      if (inferredDecorative || iconGlyph2 || roleWhenNamed != null) {
+        return React5.cloneElement(el, { [INFERRED_DECORATIVE]: void 0, [ICON_GLYPH]: void 0, [ROLE_WHEN_NAMED]: void 0, ...additive ? { style: additive } : {} });
       }
       return additive ? React5.cloneElement(el, { style: additive }) : /* @__PURE__ */ jsx6(Fragment3, { children: el });
     }
@@ -24335,6 +24414,14 @@ function withExtras(name, render) {
       const nodeSpeaksForItself = pass["aria-label"] != null || passRole != null && passRole !== "presentation" && passRole !== "none" || typeof pass.onClick === "function" || typeof pass.onDoubleClick === "function";
       if (pass["aria-hidden"] == null && nodeSpeaksForItself) next["aria-hidden"] = void 0;
     }
+    if (roleWhenNamed != null) {
+      next[ROLE_WHEN_NAMED] = void 0;
+      const isControl = typeof pass.onClick === "function" || typeof pass.onDoubleClick === "function";
+      const roleAuthored = pass[AUTHORED_ROLE] === true;
+      if (typeof roleWhenNamed === "string" && pass["aria-label"] != null && pass.role == null && prev.role == null && !isControl && !roleAuthored) {
+        next.role = roleWhenNamed;
+      }
+    }
     if (iconGlyph2) {
       next[ICON_GLYPH] = void 0;
       if (pass.role === "presentation" && typeof pass.onClick !== "function" && typeof pass.onDoubleClick !== "function") {
@@ -24348,6 +24435,7 @@ function withExtras(name, render) {
     delete next[SYNTHETIC_TAP_ROLE];
     const tabIndexIsSynthetic = next[SYNTHETIC_TABINDEX] === true;
     delete next[SYNTHETIC_TABINDEX];
+    delete next[AUTHORED_ROLE];
     if (additive) next.style = additive;
     const ownsInteractiveSemantics = isNativeInteractiveElement(el) || hasInteractiveReactDescendant(el);
     if (ownsInteractiveSemantics) {
@@ -24896,6 +24984,7 @@ function applyA11ySemantics(node, ctx, extra) {
   if (typeof headingLevel === "number" && headingLevel >= 1 && headingLevel <= 6) {
     extra["aria-level"] = String(headingLevel);
   }
+  if (role != null && Object.prototype.hasOwnProperty.call(ARIA_ROLE, role)) extra[AUTHORED_ROLE] = true;
   const hint = str7(m.accessibilityHint ?? m.accessibility_hint);
   const value = str7(m.accessibilityValue ?? m.accessibility_value);
   if (value) extra["aria-valuetext"] = value;
@@ -25091,7 +25180,10 @@ function renderNodeInner(node, ctx) {
       if (composed) extra.style = composed;
     }
   }
-  if (typeof el.type === "string") delete extra[SYNTHETIC_TABINDEX];
+  if (typeof el.type === "string") {
+    delete extra[SYNTHETIC_TABINDEX];
+    delete extra[AUTHORED_ROLE];
+  }
   let out = Object.keys(extra).length ? React5.cloneElement(el, extra) : el;
   if (a11yHint) {
     out = /* @__PURE__ */ jsx6(A11yHintDescription, { hint: a11yHint, idBase: componentId, children: out });
@@ -25812,7 +25904,7 @@ function renderInner(node, ctx) {
     }
   }
 }
-var useIsomorphicLayoutEffect, ResponsiveGrid, SPLIT_EXPANDED_MIN_WIDTH, SPLIT_COLUMN_GAP, ResponsiveSplitView, ABSOLUTE_URL_RE, appearKeyframesInjected, pressStylesInjected, FOCUS_RING_CSS, focusStylesInjected, HLIST_CHILD_CSS, hListStylesInjected, listAnimateRuntimeInstalled, transitionKeyframesInjected, countUpRuntimeInjected, MEASURE_PREFIX, measureRuntimeInjected, revealRuntimeInjected, vectorAnimStylesInjected, scrollProgressRuntimeInjected, confettiRuntimeInjected, lottieRuntimeInjected, riveRuntimeInjected, gradientKeyframesInjected, parallaxRuntimeInjected, spinKeyframesInjected, marqueeKeyframesInjected, alignItems, zJustifyItems, hAlignItems, bodyFont, kids, rowKids, staggeredKids, asTextL10n, asBoundText, useBoundString, InterpolatedTextView, txt, selectFragmentCase, fragmentValueHash, fragmentSlotContent, FragmentSlotNode, WorkerSubtreeNode, resolveItemDeep2, resolveSwipeActions, resolveModBindings, resolvedComponentId, directServiceBindings, ReactiveDirectScalars, HiddenGate, KEYBOARD_INPUT_MODES, AUTOCAPITALIZE_VALUES, ENTER_KEY_HINTS, AUTOGROW_CEILING, EditableField, MenuNode, LoadMoreSentinel, FieldErrorNode, FormView, MediaSlotProvider, MEDIA_ITEM_BINDABLE, MediaPlayerView, VideoNode, PdfViewNode, WebViewNode, InteractivePicker, InteractiveDatePicker, InteractiveSearchField, InteractiveStepper, SYNTHETIC_TAP_ROLE, SYNTHETIC_TABINDEX, INFERRED_DECORATIVE, ICON_GLYPH, INTERACTIVE_ROLES, ALWAYS_INTERACTIVE_COMPONENT_TYPES, controlNode, ToggleNode, SliderNode, SelectionControlNode, TabsNode, SegmentedControlNode, DisclosureGroupNode, GridNode, SplitViewNode, TextNode, ImageNode, AvatarNode, IconNode, ButtonNode, OtpInputNode, ProgressBarNode, ActivityIndicatorNode, BottomSheetNode, ChipsInputNode, ChipNode, TableNode, GaugeRing, GaugeNode, RATING_METRICS, ratingMetrics, RatingNode, AvatarStripNode, CHART_STROKE_CYCLE, chartStrokeAt, chartBarCenter, ChartNode, donutSliceOpacity, DonutChartNode, LegendMarker, LegendNode, cellAlign, DataTableNode, voiceNoteState, voiceNoteDelivery, VOICE_NOTE_DEFAULT_BARS, clampBarCount, VoiceNoteNode, TimelineNode, WheelPickerNode, ColorPickerNode, FilterChipsNode, TILE_PX, MAX_MERCATOR_LAT, DEFAULT_TILE_MAX_ZOOM, CIRCLE_SEGMENTS, METRES_PER_DEG_LAT, MARKER_HIT_RADIUS, SHAPE_HIT_RADIUS, MapNode, CollapsingHeaderNode, UnsupportedOnSurface, CALENDAR_DATE_ONLY_RE, CAL_DEFAULT_MAX_DOTS, CAL_AGENDA_INITIAL_DAYS, CAL_AGENDA_PAGE_DAYS, CAL_DEFAULT_SNAP_MINUTES, CAL_UNASSIGNED_LANE_ID, MonthCalendarNode, TimeGridNode, AgendaNode, ARIA_ROLE, initialFocusScheduled, initialFocusSeen, PRESENTED_SCOPE, presentedOpeners, presentedObserver, A11yHintDescription, WebRenderer;
+var useIsomorphicLayoutEffect, ResponsiveGrid, SPLIT_EXPANDED_MIN_WIDTH, SPLIT_COLUMN_GAP, ResponsiveSplitView, ABSOLUTE_URL_RE, appearKeyframesInjected, pressStylesInjected, FOCUS_RING_CSS, focusStylesInjected, HLIST_CHILD_CSS, hListStylesInjected, listAnimateRuntimeInstalled, transitionKeyframesInjected, countUpRuntimeInjected, MEASURE_PREFIX, measureRuntimeInjected, revealRuntimeInjected, vectorAnimStylesInjected, scrollProgressRuntimeInjected, confettiRuntimeInjected, lottieRuntimeInjected, riveRuntimeInjected, gradientKeyframesInjected, parallaxRuntimeInjected, spinKeyframesInjected, marqueeKeyframesInjected, alignItems, zJustifyItems, hAlignItems, bodyFont, kids, rowKids, staggeredKids, asTextL10n, asBoundText, useBoundString, InterpolatedTextView, txt, selectFragmentCase, fragmentValueHash, fragmentSlotContent, FragmentSlotNode, WorkerSubtreeNode, resolveItemDeep2, resolveSwipeActions, resolveModBindings, resolvedComponentId, directServiceBindings, ReactiveDirectScalars, HiddenGate, KEYBOARD_INPUT_MODES, AUTOCAPITALIZE_VALUES, ENTER_KEY_HINTS, AUTOGROW_CEILING, EditableField, MenuNode, LoadMoreSentinel, FieldErrorNode, FormView, MediaSlotProvider, MEDIA_ITEM_BINDABLE, MediaPlayerView, VideoNode, PdfViewNode, WebViewNode, InteractivePicker, InteractiveDatePicker, InteractiveSearchField, InteractiveStepper, SYNTHETIC_TAP_ROLE, SYNTHETIC_TABINDEX, INFERRED_DECORATIVE, ICON_GLYPH, ROLE_WHEN_NAMED, AUTHORED_ROLE, INTERACTIVE_ROLES, ALWAYS_INTERACTIVE_COMPONENT_TYPES, controlNode, ToggleNode, SliderNode, SelectionControlNode, TabsNode, SegmentedControlNode, DisclosureGroupNode, GridNode, SplitViewNode, TextNode, ImageNode, AvatarNode, IconNode, ButtonNode, OtpInputNode, ProgressBarNode, ActivityIndicatorNode, BottomSheetNode, ChipsInputNode, ChipNode, TableNode, GaugeRing, GaugeNode, RATING_METRICS, ratingMetrics, RatingNode, AvatarStripNode, CHART_STROKE_CYCLE, chartStrokeAt, chartBarCenter, ChartNode, donutSliceOpacity, DonutChartNode, LegendMarker, LegendNode, cellAlign, DataTableNode, voiceNoteState, voiceNoteDelivery, VOICE_NOTE_DEFAULT_BARS, clampBarCount, VoiceNoteNode, TimelineNode, WheelPickerNode, ColorPickerNode, FilterChipsNode, TILE_PX, MAX_MERCATOR_LAT, DEFAULT_TILE_MAX_ZOOM, CIRCLE_SEGMENTS, METRES_PER_DEG_LAT, MARKER_HIT_RADIUS, SHAPE_HIT_RADIUS, MapNode, CollapsingHeaderNode, UnsupportedOnSurface, CALENDAR_DATE_ONLY_RE, CAL_DEFAULT_MAX_DOTS, CAL_AGENDA_INITIAL_DAYS, CAL_AGENDA_PAGE_DAYS, CAL_DEFAULT_SNAP_MINUTES, CAL_UNASSIGNED_LANE_ID, MonthCalendarNode, TimeGridNode, AgendaNode, ARIA_ROLE, initialFocusScheduled, initialFocusSeen, PRESENTED_SCOPE, presentedOpeners, presentedObserver, A11yHintDescription, WebRenderer;
 var init_renderNode = __esm({
   "../../core/web-renderer/src/renderNode.tsx"() {
     "use strict";
@@ -25829,6 +25921,8 @@ var init_renderNode = __esm({
     init_env();
     init_actionParams();
     init_icons();
+    init_webviewFrame();
+    init_pdfSource();
     init_icon_catalog_generated();
     init_controls();
     init_modalStack();
@@ -27006,8 +27100,32 @@ var init_renderNode = __esm({
     PdfViewNode = withExtras("PdfViewNode", ({ props, ctx, wrap }) => {
       const boundUrl = useResolvedScalar(props.url != null && isBinding(props.url) ? props.url : void 0, ctx);
       const url = props.url != null && isBinding(props.url) ? boundUrl : props.url;
-      const rawUrl = typeof url === "string" && !isBinding(url) ? url.trim() : "";
-      const ok = /^(https?:|blob:|\/)/i.test(rawUrl);
+      const rawUrl = typeof url === "string" && !isBinding(url) ? url : "";
+      const plan = rawUrl ? pdfEmbedPlan(rawUrl) : null;
+      const retypeSrc = plan?.mode === "retype" ? plan.src : null;
+      const [retyped, setRetyped] = React5.useState(null);
+      React5.useEffect(() => {
+        if (!retypeSrc) return;
+        let live2 = true;
+        let made = null;
+        const settle = (u) => {
+          made = u;
+          if (!live2) {
+            if (u) URL.revokeObjectURL(u);
+            return;
+          }
+          setRetyped({ from: retypeSrc, url: u });
+        };
+        retypeAsPdf(retypeSrc).then(settle, () => settle(null));
+        return () => {
+          live2 = false;
+          if (made) URL.revokeObjectURL(made);
+          setRetyped((cur) => cur?.from === retypeSrc ? null : cur);
+        };
+      }, [retypeSrc]);
+      const settled = retyped && retyped.from === retypeSrc ? retyped : null;
+      const src = plan?.mode === "direct" ? plan.src : settled?.url ?? null;
+      const loading = plan?.mode === "retype" && !settled;
       const ph = typeof props.height === "number" && props.height > 0 ? props.height : void 0;
       const frame = {
         width: "100%",
@@ -27018,7 +27136,19 @@ var init_renderNode = __esm({
         overflow: "hidden",
         ...wrap
       };
-      if (!ok) {
+      if (loading) {
+        return /* @__PURE__ */ jsx6(
+          "div",
+          {
+            "data-himalaya-pdf": "loading",
+            role: "img",
+            "aria-label": "loading document",
+            "aria-busy": "true",
+            style: { ...frame, background: "#f4f4f4" }
+          }
+        );
+      }
+      if (!src) {
         return /* @__PURE__ */ jsx6(
           "div",
           {
@@ -27034,7 +27164,7 @@ var init_renderNode = __esm({
         "object",
         {
           "data-himalaya-pdf": "document",
-          data: rawUrl + startPage,
+          data: src + (plan?.mode === "retype" ? startPage || sourceFragment(retypeSrc) : startPage),
           type: "application/pdf",
           "aria-label": typeof props.title === "string" && props.title ? props.title : "PDF document",
           style: frame
@@ -27048,13 +27178,14 @@ var init_renderNode = __esm({
       const inlineHtml = props.inlineHtml != null && isBinding(props.inlineHtml) ? boundHtml : props.inlineHtml;
       const urlStr = typeof url === "string" && url.length > 0 && !isBinding(url) ? url : void 0;
       const htmlStr = typeof inlineHtml === "string" && inlineHtml.length > 0 && !isBinding(inlineHtml) ? inlineHtml : void 0;
+      const urlFrame = urlStr ? webviewFrameSandbox(urlStr) : null;
       const h = typeof props.height === "number" && props.height > 0 ? props.height : void 0;
       const ar = typeof props.aspectRatio === "number" && props.aspectRatio > 0 ? props.aspectRatio : void 0;
       const frameStyle = { width: "100%", boxSizing: "border-box", border: "none", borderRadius: ctx.radius("md", 8), background: "#fff", ...h ? { height: h } : ar ? { aspectRatio: String(ar) } : { height: 200 } };
       const bandColor = typeof props.coverBandColor === "string" && props.coverBandColor.length > 0 ? props.coverBandColor : void 0;
       return /* @__PURE__ */ jsxs3("div", { style: { width: "100%", position: "relative", ...bandColor ? { background: bandColor, borderRadius: ctx.radius("md", 8), overflow: "hidden" } : {}, ...wrap }, children: [
         bandColor ? /* @__PURE__ */ jsx6("div", { "data-testid": "webview-cover-band", style: { height: 8, background: bandColor } }) : null,
-        htmlStr ? /* @__PURE__ */ jsx6("iframe", { title: "webview", srcDoc: htmlStr, sandbox: "allow-scripts", style: frameStyle }) : urlStr ? /* @__PURE__ */ jsx6("iframe", { title: "webview", src: urlStr, sandbox: "allow-scripts allow-same-origin", style: frameStyle }) : /* @__PURE__ */ jsx6("div", { style: { ...frameStyle, display: "grid", placeItems: "center", color: "#999", fontFamily: "ui-monospace, monospace", fontSize: 11, border: "1px dashed #ccc" }, children: "WebView (no url)" })
+        htmlStr ? /* @__PURE__ */ jsx6("iframe", { title: "webview", srcDoc: htmlStr, sandbox: "allow-scripts", style: frameStyle }) : urlFrame ? /* @__PURE__ */ jsx6("iframe", { title: "webview", src: urlFrame.src, sandbox: urlFrame.sandbox, style: frameStyle }) : /* @__PURE__ */ jsx6("div", { style: { ...frameStyle, display: "grid", placeItems: "center", color: "#999", fontFamily: "ui-monospace, monospace", fontSize: 11, border: "1px dashed #ccc" }, children: urlStr ? "WebView (url not allowed)" : "WebView (no url)" })
       ] });
     });
     InteractivePicker = withExtras("InteractivePicker", ({ props, ctx, wrap }) => {
@@ -27332,6 +27463,8 @@ var init_renderNode = __esm({
     SYNTHETIC_TABINDEX = "data-hm-synthetic-tabindex";
     INFERRED_DECORATIVE = "data-hm-inferred-decorative";
     ICON_GLYPH = "data-hm-icon-glyph";
+    ROLE_WHEN_NAMED = "data-hm-role-when-named";
+    AUTHORED_ROLE = "data-hm-authored-role";
     INTERACTIVE_ROLES = /* @__PURE__ */ new Set([
       "button",
       "checkbox",
@@ -27539,7 +27672,7 @@ var init_renderNode = __esm({
       const iconName = isBinding(props.name) ? String(bound ?? "") : props.name;
       const contentDescription = useResolvedScalar(props.contentDescription, ctx);
       const described = contentDescription != null && String(contentDescription).trim() !== "";
-      const a11y = described ? { role: "img", "aria-label": String(contentDescription), [ICON_GLYPH]: true } : { "aria-hidden": "true", [INFERRED_DECORATIVE]: true, [ICON_GLYPH]: true };
+      const a11y = described ? { role: "img", "aria-label": String(contentDescription), [ICON_GLYPH]: true } : { "aria-hidden": "true", [INFERRED_DECORATIVE]: true, [ICON_GLYPH]: true, [ROLE_WHEN_NAMED]: "img" };
       return /* @__PURE__ */ jsx6("span", { ...a11y, style: { display: "inline-grid", placeItems: "center", width: size + 6, height: size + 6, lineHeight: 1, flex: "none", ...wrap }, children: iconSvg(iconName, { size, color: C(resolveScalarStatic(props.tint, ctx) ?? "textPrimary", "#636b78") }) });
     });
     ButtonNode = withExtras("ButtonNode", ({ props, ctx, wrap }) => {
@@ -27675,11 +27808,13 @@ var init_renderNode = __esm({
       const thick = Math.max(3, Math.round(size / 8));
       const bound = useResolvedScalar(props.valuePath, ctx);
       const aiRaw = props.valuePath != null ? bound : props.value;
-      const determinate = !props.indeterminate && typeof aiRaw === "number";
+      const aiNum = typeof aiRaw === "number" ? aiRaw : typeof aiRaw === "string" && aiRaw.trim() !== "" ? Number(aiRaw) : void 0;
+      const determinate = !props.indeterminate && aiNum !== void 0 && Number.isFinite(aiNum);
       if (determinate) {
-        const pct = Math.max(0, Math.min(1, aiRaw));
+        const pct = Math.max(0, Math.min(1, aiNum));
         const ringMask = `radial-gradient(farthest-side, transparent calc(100% - ${thick}px), #000 calc(100% - ${thick}px))`;
-        return /* @__PURE__ */ jsx6("div", { role: "progressbar", style: { width: size, height: size, borderRadius: "50%", flex: "none", background: `conic-gradient(${tint} ${pct * 360}deg, ${track} 0deg)`, WebkitMask: ringMask, mask: ringMask, ...wrap } });
+        const a11y = { "aria-valuemin": 0, "aria-valuemax": 100, "aria-valuenow": Math.round(pct * 100) };
+        return /* @__PURE__ */ jsx6("div", { role: "progressbar", ...a11y, style: { width: size, height: size, borderRadius: "50%", flex: "none", background: `conic-gradient(${tint} ${pct * 360}deg, ${track} 0deg)`, WebkitMask: ringMask, mask: ringMask, ...wrap } });
       }
       ensureSpinKeyframes();
       return /* @__PURE__ */ jsx6("div", { role: "progressbar", style: { width: size, height: size, borderRadius: "50%", border: `${thick}px solid ${track}`, borderTopColor: tint, boxSizing: "border-box", flex: "none", animation: ctx.empty ? void 0 : "himalaya-spin 0.8s linear infinite", ...wrap } });
@@ -29374,6 +29509,7 @@ __export(src_exports, {
   isBinding: () => isBinding,
   isNodeLike: () => isNodeLike,
   isSerifFamily: () => isSerifFamily,
+  isWebviewUrlAllowed: () => isWebviewUrlAllowed,
   makeCtx: () => makeCtx,
   makeModStyle: () => makeModStyle,
   makeTokenResolvers: () => makeTokenResolvers,
@@ -29382,7 +29518,8 @@ __export(src_exports, {
   renderDescriptorToHtml: () => renderDescriptorToHtml,
   renderNode: () => renderNode,
   servicePath: () => servicePath,
-  useBoundValue: () => useBoundValue
+  useBoundValue: () => useBoundValue,
+  webviewFrameSandbox: () => webviewFrameSandbox
 });
 var init_src3 = __esm({
   "../../core/web-renderer/src/index.ts"() {
@@ -29396,6 +29533,7 @@ var init_src3 = __esm({
     init_AppRegistry();
     init_helpers();
     init_icons();
+    init_webviewFrame();
   }
 });
 
@@ -48891,7 +49029,14 @@ function indexHtml(asset, pathname, creds, handoverAttempted = false) {
     headers: {
       "content-type": asset.contentType || "text/html; charset=utf-8",
       "cache-control": creds || handoverAttempted ? "no-store" : "public, max-age=60, stale-while-revalidate=600",
-      "content-security-policy": previewCsp(nonce)
+      "content-security-policy": previewCsp(nonce),
+      // This document's URL can name a credential: `?pvt=` (still accepted from an embedder such
+      // as the dashboard frame) or a `?h=` code before the inline script strips it. The browser
+      // default sends the FULL URL as `Referer` on same-origin requests, so every `/v1/*` read,
+      // the gateway's request log and the Tier-5 frame's `document.referrer` would carry it.
+      // `strict-origin` sends the origin alone. Not `no-referrer`: that also turns a same-origin
+      // POST's `Origin` header into `null`, and `/v1/telemetry/ingest` is one (#2386).
+      "referrer-policy": "strict-origin"
     }
   });
 }
@@ -48925,7 +49070,7 @@ function previewResponse(pathname, assets, mount = "/preview", creds, handoverAt
 var T5_FRAME_CSP, PREVIEW_BASE_JS, PREVIEW_ENTRY_RECOVERY_JS, MOUNT_STRIP;
 var init_preview2 = __esm({
   "../../packages/serve/src/preview.ts"() {
-    T5_FRAME_CSP = "default-src 'none'; script-src 'unsafe-inline' 'unsafe-eval'; connect-src 'none'; img-src 'none'; media-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'";
+    T5_FRAME_CSP = "default-src 'none'; script-src 'unsafe-inline' 'unsafe-eval'; connect-src 'none'; img-src 'none'; media-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'; sandbox allow-scripts";
     PREVIEW_BASE_JS = // Both serve mounts (/preview framed + /app unframed — RFC 0051 track D) serve the SAME
     // embedded artifact, so one shim derives whichever mount the browser is on. Non-greedy:
     // the EARLIEST mount segment wins, mirroring the SPA's own deployBase (an app literally
@@ -49178,21 +49323,21 @@ var init_preview_assets_generated = __esm({
   "../../packages/serve/src/preview-assets.generated.ts"() {
     init_preview_assets_format();
     PREVIEW_ASSET_MANIFEST = [
-      { key: "assets/index-BvsDhZYW.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1043409, sha256: "98882914dcb360867c5f265e3d6542774f18c0b0c8f18813b66b304a122c1b01" },
-      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 1043417, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
-      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 1048027, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
-      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 1536611, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
-      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1627535, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
-      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1718519, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
-      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1809499, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
-      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1900371, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
-      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 1991351, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
-      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 2099987, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
-      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 2209071, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
-      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 2318119, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
-      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 2425819, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
-      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 2513927, length: 4947, sha256: "3dd02534fef5e0c2bb40b6c6a6c994641728fde306921e66ffab3e9a7dfa6bbe" },
-      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 2518874, length: 17209, sha256: "dffc9718e2faa63ae2cc919e0a842f585ed565aaaa7c53778e90379442c731b6" }
+      { key: "assets/index---zsKTyk.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1046198, sha256: "4ca35bb22d26776fdb371a4cfb2137ecbb7bd03924695269ac6364171187fe89" },
+      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 1046206, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
+      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 1050816, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
+      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 1539400, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
+      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1630324, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
+      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1721308, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
+      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1812288, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
+      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1903160, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
+      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 1994140, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
+      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 2102776, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
+      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 2211860, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
+      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 2320908, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
+      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 2428608, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
+      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 2516716, length: 4947, sha256: "684c954fbc5b82e4513932286c45f00f08b2d988c71614f0700f3cc57716fa84" },
+      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 2521663, length: 17209, sha256: "dffc9718e2faa63ae2cc919e0a842f585ed565aaaa7c53778e90379442c731b6" }
     ];
   }
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1027.0",
+  "version": "0.1029.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -65,5 +65,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "9ce64db92bfef4391297f6111f02ad23a382a5e206bd732aae1df4b1"
+  "falconPackageHash": "785b6d68758b001717f983ccbdad398a5765dced9bf5544af3865811"
 }

package/templates/beauty-salon/dev/index.ts

@@ -144,10 +144,22 @@ const SCREENS = runtimeSetting({
                           }
                         },
                         "cornerRadius": 8,
-                        "hiddenPath": "$service:himiBrandedHome.hideHeroSkeleton",
-                        "padding": {
-                          "bottom": 16
+                        "hiddenPath": "$service:himiBrandedHome.hideHeroSkeleton"
+                      }
+                    },
+                    {
+                      "id": "himi_branded_home.salon.hero_skeleton.gap",
+                      "body": {
+                        "package": "himalaya",
+                        "type": "VStack",
+                        "props": {
+                          "children": []
                         }
+                      },
+                      "modifiers": {
+                        "height": 16,
+                        "fillMaxWidth": true,
+                        "hiddenPath": "$service:himiBrandedHome.hideHeroSkeleton"
                       }
                     },
                     {

package/templates/beauty-salon-owner/dev/index.ts

@@ -55191,7 +55191,7 @@ const SCREENS = runtimeSetting({
                           "spacing": 3,
                           "children": [
                             {
-                              "id": "himi_owner_lite_aria.msg_$item.id.who",
+                              "id": "himi_owner_lite_aria.msg_$item.id.content",
                               "body": {
                                 "package": "himalaya",
                                 "type": "HStack",
@@ -55210,43 +55210,34 @@ const SCREENS = runtimeSetting({
                                       }
                                     },
                                     {
-                                      "id": "",
+                                      "id": "himi_owner_lite_aria.msg_$item.id.bubble",
                                       "body": {
                                         "package": "himalaya",
                                         "type": "Text",
                                         "props": {
-                                          "text": "$item.who",
-                                          "style": "footnote",
-                                          "color": "textSecondary",
-                                          "maxLines": 1
+                                          "text": "$item.content",
+                                          "style": "body",
+                                          "maxLines": 50
                                         }
-                                      }
-                                    }
-                                  ]
-                                }
-                              }
-                            },
-                            {
-                              "id": "himi_owner_lite_aria.msg_$item.id.content",
-                              "body": {
-                                "package": "himalaya",
-                                "type": "HStack",
-                                "props": {
-                                  "spacing": 0,
-                                  "children": [
-                                    {
-                                      "id": "",
-                                      "body": {
-                                        "package": "himalaya",
-                                        "type": "Spacer",
-                                        "props": {}
                                       },
                                       "modifiers": {
+                                        "accessibilityLabel": "$item.spoken",
+                                        "padding": {
+                                          "leading": 16,
+                                          "trailing": 16,
+                                          "top": 8,
+                                          "bottom": 8
+                                        },
+                                        "background": {
+                                          "token": "surfaceSecondary"
+                                        },
+                                        "cornerRadius": 20,
+                                        "maxWidth": 300,
                                         "hiddenPath": "$item.notUser"
                                       }
                                     },
                                     {
-                                      "id": "",
+                                      "id": "himi_owner_lite_aria.msg_$item.id.text",
                                       "body": {
                                         "package": "himalaya",
                                         "type": "Text",
@@ -55255,6 +55246,10 @@ const SCREENS = runtimeSetting({
                                           "style": "body",
                                           "maxLines": 50
                                         }
+                                      },
+                                      "modifiers": {
+                                        "accessibilityLabel": "$item.spoken",
+                                        "hiddenPath": "$item.notAria"
                                       }
                                     }
                                   ]

package/templates/beauty-salon-owner/tier5-src/_shared/aria-chat.ts

@@ -83,6 +83,11 @@ export interface AriaBubble {
    *  that right-aligns the owner renders two templates and collapses one. */
   notUser: boolean;
   notAria: boolean;
+  /** What a screen reader says for the row: the author, then the words. A
+   *  screen that draws the speaker only as a bubble and a side of the screen
+   *  (`messageStyle: 'userBubble'`) has no visible author line to read, and
+   *  without this the owner's question and Aria's reply sound the same. */
+  spoken: string;
   link1Label: string; link1Url: string; link1Hidden: boolean;
   link2Label: string; link2Url: string; link2Hidden: boolean;
   link3Label: string; link3Url: string; link3Hidden: boolean;
@@ -561,9 +566,23 @@ export function disclosedLabel(link: { label: string; url: string }): string {
  *  machinery dies. (Measured: 20 tests, every one of them about polling.) */
 export { stripMarkdown };
 
+/** The screen-reader line for a bubble — see `AriaBubble.spoken`. */
+export function spokenOf(who: string, content: string): string {
+  return who ? `${who}: ${content}` : content;
+}
+
+/** A persisted transcript from before `spoken` existed, made whole. A `$item.`
+ *  path missing on a row does not substitute, so a row without the field would
+ *  announce the literal binding until the next rebuild replaced it. */
+export function withSpoken(bubbles: AriaBubble[]): AriaBubble[] {
+  return bubbles.every((b) => typeof b.spoken === "string")
+    ? bubbles
+    : bubbles.map((b) => (typeof b.spoken === "string" ? b : { ...b, spoken: spokenOf(b.who, b.content) }));
+}
+
 /** A greeting or optimistic bubble: no links, all slots defaulted. */
 export function plainBubble(id: string, role: string, who: string, content: string): AriaBubble {
-  return { id, role, who, content, notUser: role !== "USER", notAria: role === "USER", ...linkFieldsOf("", role) };
+  return { id, role, who, content, notUser: role !== "USER", notAria: role === "USER", spoken: spokenOf(who, content), ...linkFieldsOf("", role) };
 }
 
 /** Server transcript → bubbles. USER text is literal; ASSISTANT replies are
@@ -644,6 +663,7 @@ function bubbleOf(id: string, role: string, who: string, raw: string, writing: b
     content,
     notUser: role !== "USER",
     notAria: role === "USER",
+    spoken: spokenOf(who, content),
     ...linkFieldsOf(prose, role),
   };
 }
@@ -2004,7 +2024,7 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
         // a rehydrated turn there was no ladder at all, leaving "Aria is
         // typing…" on screen with nothing ever fetching the answer.
         if (s._pending || s.status === "sending") {
-          const held: AriaChatState = { ...s, status: "sending", prompts: [] };
+          const held: AriaChatState = { ...s, status: "sending", prompts: [], messages: withSpoken(s.messages) };
           return cadence(held, o.poll ? o.poll.fastMs : null, null);
         }
         // …but the self-kick pass runs BEFORE the pack is stashed, so the
@@ -2013,7 +2033,7 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
         // still the only thing on screen — `prompts` is already recomputed
         // here, and a chip pack that localizes beside a greeting that does not
         // is the visible half of the same bug.
-        const messages = isGreetingOnly(s.messages) ? greetingOnly() : s.messages;
+        const messages = isGreetingOnly(s.messages) ? greetingOnly() : withSpoken(s.messages);
         return { ...s, status: "ready", messages, prompts: promptsFor(messages, promptList()) };
       }
       try {

package/templates/branded-lite/dev/index.ts

@@ -190,10 +190,22 @@ const SCREENS = runtimeSetting({
                           }
                         },
                         "cornerRadius": 8,
-                        "hiddenPath": "$service:himiBrandedHome.hideHeroSkeleton",
-                        "padding": {
-                          "bottom": 16
+                        "hiddenPath": "$service:himiBrandedHome.hideHeroSkeleton"
+                      }
+                    },
+                    {
+                      "id": "himi_branded_home.hero_skeleton.gap",
+                      "body": {
+                        "package": "himalaya",
+                        "type": "VStack",
+                        "props": {
+                          "children": []
                         }
+                      },
+                      "modifiers": {
+                        "height": 16,
+                        "fillMaxWidth": true,
+                        "hiddenPath": "$service:himiBrandedHome.hideHeroSkeleton"
                       }
                     },
                     {
@@ -294,8 +306,24 @@ const SCREENS = runtimeSetting({
                           "leading": 24,
                           "trailing": 24,
                           "top": 24,
-                          "bottom": 16
+                          "bottom": 24
                         },
+                        "fillMaxWidth": true,
+                        "hiddenPath": "$service:himiBrandedHome.hideHeroFallback"
+                      }
+                    },
+                    {
+                      "id": "himi_branded_home.hero.gap",
+                      "body": {
+                        "package": "himalaya",
+                        "type": "VStack",
+                        "props": {
+                          "children": []
+                        }
+                      },
+                      "modifiers": {
+                        "height": 16,
+                        "fillMaxWidth": true,
                         "hiddenPath": "$service:himiBrandedHome.hideHeroFallback"
                       }
                     },