@wix/himalaya-cli 0.1177.0 → 0.1179.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/sdk/state/src/index.d.ts

@@ -8,6 +8,13 @@ export interface ServiceDefinition<S> {
      * (native side) updates the service's state and notifies subscribers.
      */
     actions?: Record<string, (state: S, ...args: never[]) => S | undefined | Promise<S | undefined>>;
+    /**
+     * Keys a cold boot takes from `state`, never from the persisted snapshot (cold-boot
+     * hydration). For UI state that must describe THIS run — an editor's one-shot seed, a
+     * "still loading" gate, an open sheet — where last run's value would be wrong, not just stale.
+     * Runtimes that honour it set `himalaya.hydrationOptOut`; an older one ignores the option.
+     */
+    notHydrated?: readonly (keyof S & string)[];
 }
 export interface ServiceHandle<S> {
     /** Snapshot of the current state. Cheap; safe to call from anywhere. */

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/wix-sdk/rich-content/src/index.d.ts

@@ -38,6 +38,14 @@ export declare const RICH_CONTENT_LIMITS: {
     readonly maxNodes: 5000;
     readonly maxDepth: 16;
 };
+/** Which of the rich-content limits (`RICH_CONTENT_LIMITS`) a document's JSON string breaks — checked as every viewer does, in its order:
+ *  the raw string's UTF-8 bytes (before parsing), then nesting depth (top-level nodes are depth 1), then the node
+ *  count (every object in a `nodes` array). `null` when within all three. A worker runs it on the string it is
+ *  about to WRITE: a body past a limit renders as every viewer's fallback, so it must not be saved. The document's
+ *  shape is not checked here (a string that does not parse is within the limits) — `parseRicosJson` does that.
+ *  Pass `parsed` (the string's own parse) when the caller has it, so the document is parsed once; pass `null`
+ *  to check the bytes alone, before deciding to parse. */
+export declare function richContentOverLimits(json: string, parsed?: unknown): "too_large" | "too_deep" | "too_many_nodes" | null;
 /** Reads a Ricos document from a JSON string or an already-parsed object (page messages arrive as either,
  *  depending on the platform). Returns null for empty input, invalid JSON, or anything without a `nodes` array. */
 export declare function parseRicosJson(value: unknown): RicosDocument | null;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-rich-content.mjs

@@ -121,6 +121,29 @@ function ricosVideoUrl(src) {
 
 // ../../stdlib/wix-sdk/rich-content/src/index.ts
 var RICH_CONTENT_LIMITS = { maxBytes: 262144, maxNodes: 5e3, maxDepth: 16 };
+function richContentOverLimits(json, parsed) {
+  if (utf8Length(json) > RICH_CONTENT_LIMITS.maxBytes) return "too_large";
+  let doc = parsed;
+  if (doc === void 0) {
+    try {
+      doc = JSON.parse(json);
+    } catch {
+      return null;
+    }
+  }
+  const nodes = isObj(doc) && Array.isArray(doc.nodes) ? doc.nodes : null;
+  if (!nodes) return null;
+  if (deeperThan(nodes, 1, RICH_CONTENT_LIMITS.maxDepth)) return "too_deep";
+  return countNodes(nodes) > RICH_CONTENT_LIMITS.maxNodes ? "too_many_nodes" : null;
+}
+function deeperThan(nodes, depth, max) {
+  for (const n of nodes) {
+    if (!isObj(n)) continue;
+    if (depth > max) return true;
+    if (Array.isArray(n.nodes) && deeperThan(n.nodes, depth + 1, max)) return true;
+  }
+  return false;
+}
 var isObj = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 function parseRicosJson(value) {
   let v = value;
@@ -340,6 +363,7 @@ export {
   isPlainRicos,
   parseRicosJson,
   plainTextToRicos,
+  richContentOverLimits,
   ricosToPlainText
 };
 //# sourceMappingURL=wix-rich-content.mjs.map

package/dist/cli.mjs

@@ -31775,7 +31775,7 @@ function RichContentEditorView({ props, ctx, wrap, nodeId, renderChild, ...dom }
     }
     setLink(null);
   };
-  const root = { position: "relative", display: "flex", flexDirection: "column", width: "100%", ...fill ? { flex: "1 1 auto", minHeight: 0 } : { minHeight }, ...wrap };
+  const root = { position: "relative", display: "flex", flexDirection: "column", width: "100%", ...fill ? { flex: "1 1 auto" } : {}, minHeight, ...wrap };
   if (!live3) {
     const { paddingTop: _t, paddingBottom: _b, paddingLeft: _l, paddingRight: _r, ...rootNoSides } = root;
     const own3 = { ...rootNoSides, border: `1px solid ${C("border", "#e3e3e3")}`, borderRadius: 8, padding: 12, boxSizing: "border-box" };
@@ -60291,21 +60291,21 @@ var init_preview_assets_generated = __esm({
   "../../packages/serve/src/preview-assets.generated.ts"() {
     init_preview_assets_format();
     PREVIEW_ASSET_MANIFEST = [
-      { key: "assets/index-DfY-tQ6i.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1132878, sha256: "3d63b2fab780ecf40caeff8f5576743a1dade0dd92e7cbc4fa9ee26a60985b7e" },
-      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 1132886, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
-      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 1137496, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
-      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 1626080, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
-      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1717004, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
-      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1807988, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
-      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1898968, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
-      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1989840, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
-      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 2080820, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
-      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 2189456, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
-      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 2298540, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
-      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 2407588, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
-      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 2515288, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
-      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 2603396, length: 4947, sha256: "4c476f213d92ec00b1f5e5fe4f88d458ccdd9cf6c6e7684f49f115f70930f9bb" },
-      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 2608343, length: 17344, sha256: "d057298d75e7373e5e2c4d11b7d1bcbea88e03af555ba63d97641c78509c58e4" }
+      { key: "assets/index-B7qO1NPG.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1133532, sha256: "b950705c43efae2ae266278ca6b108a89b7de1c88172890d9b862808cfcf9d83" },
+      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 1133540, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
+      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 1138150, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
+      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 1626734, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
+      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1717658, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
+      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1808642, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
+      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1899622, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
+      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1990494, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
+      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 2081474, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
+      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 2190110, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
+      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 2299194, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
+      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 2408242, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
+      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 2515942, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
+      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 2604050, length: 4947, sha256: "dca3aa5b2c45744b1c376ca6462b1c64093e59076238eccc4b9fcb30025fe850" },
+      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 2608997, length: 17344, sha256: "d057298d75e7373e5e2c4d11b7d1bcbea88e03af555ba63d97641c78509c58e4" }
     ];
   }
 });

package/guides/sdk-reference.json

@@ -8,7 +8,7 @@
         "name": "ServiceDefinition",
         "kind": "interface",
         "jsdoc": "",
-        "decl": "export interface ServiceDefinition<S> {\n  /** Initial state for the service. Must be JSON-serializable. */\n  state: S;\n\n  /**\n   * Actions: pure functions of `(state, ...args) → newState` (or async). The\n   * platform wraps each action so calling it from JS or from `__invokeAction`\n   * (native side) updates the service's state and notifies subscribers.\n   */\n  actions?: Record<\n    string,\n    // `never[]`, not `unknown[]` — same reason as defineService's constraint below:\n    // parameters are contravariant, so `unknown[]` rejects every handler that narrows\n    // its payload. Leaving this one loose would reintroduce the same TS2344 for anyone\n    // who annotates a `ServiceDefinition<S>` explicitly instead of inferring it.\n    (state: S, ...args: never[]) => S | undefined | Promise<S | undefined>\n  >;\n}"
+        "decl": "export interface ServiceDefinition<S> {\n  /** Initial state for the service. Must be JSON-serializable. */\n  state: S;\n\n  /**\n   * Actions: pure functions of `(state, ...args) → newState` (or async). The\n   * platform wraps each action so calling it from JS or from `__invokeAction`\n   * (native side) updates the service's state and notifies subscribers.\n   */\n  actions?: Record<\n    string,\n    // `never[]`, not `unknown[]` — same reason as defineService's constraint below:\n    // parameters are contravariant, so `unknown[]` rejects every handler that narrows\n    // its payload. Leaving this one loose would reintroduce the same TS2344 for anyone\n    // who annotates a `ServiceDefinition<S>` explicitly instead of inferring it.\n    (state: S, ...args: never[]) => S | undefined | Promise<S | undefined>\n  >;\n\n  /**\n   * Keys a cold boot takes from `state`, never from the persisted snapshot (cold-boot\n   * hydration). For UI state that must describe THIS run — an editor's one-shot seed, a\n   * \"still loading\" gate, an open sheet — where last run's value would be wrong, not just stale.\n   * Runtimes that honour it set `himalaya.hydrationOptOut`; an older one ignores the option.\n   */\n  notHydrated?: readonly (keyof S & string)[];\n}"
       },
       {
         "name": "ServiceHandle",
@@ -21599,6 +21599,12 @@
         "jsdoc": "/** The RichContent viewer's ceilings; every renderer rejects a document past any of them. Kept equal to the platform limits file by a test. */",
         "decl": "export const RICH_CONTENT_LIMITS = { maxBytes: 262144, maxNodes: 5000, maxDepth: 16 } as const;"
       },
+      {
+        "name": "richContentOverLimits",
+        "kind": "function",
+        "jsdoc": "/** Which of the rich-content limits (`RICH_CONTENT_LIMITS`) a document's JSON string breaks — checked as every viewer does, in its order:\n *  the raw string's UTF-8 bytes (before parsing), then nesting depth (top-level nodes are depth 1), then the node\n *  count (every object in a `nodes` array). `null` when within all three. A worker runs it on the string it is\n *  about to WRITE: a body past a limit renders as every viewer's fallback, so it must not be saved. The document's\n *  shape is not checked here (a string that does not parse is within the limits) — `parseRicosJson` does that.\n *  Pass `parsed` (the string's own parse) when the caller has it, so the document is parsed once; pass `null`\n *  to check the bytes alone, before deciding to parse. */",
+        "decl": "export function richContentOverLimits(json: string, parsed?: unknown): \"too_large\" | \"too_deep\" | \"too_many_nodes\" | null;"
+      },
       {
         "name": "parseRicosJson",
         "kind": "function",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1177.0",
+  "version": "0.1179.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -67,5 +67,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "15229e67f419da11dc290da268c774bb17a7e61e83d8ae6a395fd5fb"
+  "falconPackageHash": "73904175073399d3fbbcc0f3bf365e9dfe2b2ce4bef46062df2f0a88"
 }

package/templates/beauty-salon-owner/tier5-src/_shared/owner-editor-value.ts

@@ -8,7 +8,7 @@
 // drops nodes the owner never touched).
 // Inside the platform source this import is a relative path, so node test runs resolve it; an app's
 // copy imports "@himalaya/wix-rich-content".
-import { parseRicosJson, isPlainRicos, RICH_CONTENT_LIMITS, type RicosDocument } from "@himalaya/wix-rich-content";
+import { parseRicosJson, isPlainRicos, richContentOverLimits, type RicosDocument } from "@himalaya/wix-rich-content";
 
 export type EditorValue =
   | { kind: "absent" }                                  // leave the stored body untouched
@@ -17,34 +17,6 @@ export type EditorValue =
   | { kind: "too_large" }                               // past the rich-content limits: save the rest, say why
   | { kind: "invalid" };                                // not a Ricos document: refuse, write nothing
 
-function utf8Bytes(s: string): number {
-  let n = 0;
-  for (let i = 0; i < s.length; i++) {
-    const c = s.charCodeAt(i);
-    if (c < 0x80) n += 1;
-    else if (c < 0x800) n += 2;
-    else if (c >= 0xd800 && c <= 0xdbff && i + 1 < s.length) { n += 4; i++; }
-    else n += 3;
-  }
-  return n;
-}
-
-/** Every viewer renders a body past the rich-content limits as its fallback, so it is never written.
- *  The viewer's order: bytes (before parsing), then depth, then the node count. */
-function overLimits(doc: RicosDocument): boolean {
-  let count = 0;
-  const work: Array<[unknown, number]> = doc.nodes.map((n) => [n, 1] as [unknown, number]);
-  while (work.length) {
-    const [n, depth] = work.pop()!;
-    if (!n || typeof n !== "object" || Array.isArray(n)) continue;
-    if (depth > RICH_CONTENT_LIMITS.maxDepth) return true;
-    if (++count > RICH_CONTENT_LIMITS.maxNodes) return true;
-    const kids = (n as { nodes?: unknown }).nodes;
-    if (Array.isArray(kids)) for (const k of kids) work.push([k, depth + 1]);
-  }
-  return false;
-}
-
 const TEXT_ONLY = new Set(["PARAGRAPH", "TEXT", "HEADING", "BULLETED_LIST", "ORDERED_LIST", "LIST_ITEM", "BLOCKQUOTE", "CODE_BLOCK"]);
 /** No visible text and no non-text node (an image, a divider, an embed…): an empty body. */
 export function isEmptyDocument(doc: RicosDocument): boolean {
@@ -55,10 +27,12 @@ export function isEmptyDocument(doc: RicosDocument): boolean {
 
 /** A Ricos JSON string checked as every viewer would: the limits first, then the shape. */
 function checkedDocument(raw: string): EditorValue {
-  if (utf8Bytes(raw) > RICH_CONTENT_LIMITS.maxBytes) return { kind: "too_large" };
+  // Every viewer renders a body past the limits as its fallback, so it is never written. One parse
+  // feeds both checks; a string past the byte limit is refused before it is parsed at all.
+  if (richContentOverLimits(raw, null) === "too_large") return { kind: "too_large" };
   const doc = parseRicosJson(raw);
   if (!doc) return { kind: "invalid" };
-  return overLimits(doc) ? { kind: "too_large" } : { kind: "doc", doc, json: raw };
+  return richContentOverLimits(raw, doc) ? { kind: "too_large" } : { kind: "doc", doc, json: raw };
 }
 
 /** `raw` is `values[name]`; `seededJson` is the string the form published as the editor's seed. */
@@ -108,15 +82,59 @@ export function cachedRichVerdict(doc: RicosDocument | null, knownPlain: boolean
   return knownPlain ? "false" : "true";
 }
 
-/** Cold boot: the runtime lays this service's last persisted snapshot over its declared state, so the
- *  editor's first seed would be the document as it was when the screen last ran — and a Save after
- *  typing would write it over whatever the record holds now. Blank the hydrated seed and reset the gate
- *  before anything renders, in place (no action has run yet). `extra` resets further UI state. */
-export function resetHydratedEditor(svc: unknown, keys: { json: string; pending: string; dirty: string }, pendingAtBoot: boolean, extra: Record<string, unknown> = {}): void {
+/** The keys of one editor field that describe THIS run, never the last one: the seed (`<key>Json`),
+ *  the load gate (`<key>Pending`), the edit flag (`<key>Dirty`) and its counter (`<key>Edits`). A form
+ *  lists them in `defineService(name, { notHydrated })`, so a cold boot takes their DECLARED values: the
+ *  editor seeds once, and a persisted seed would be painted as its content and saved back over a newer
+ *  record. */
+export function editorRunKeys<K extends string>(key: K): [`${K}Json`, `${K}Pending`, `${K}Dirty`, `${K}Edits`] {
+  return [`${key}Json`, `${key}Pending`, `${key}Dirty`, `${key}Edits`];
+}
+
+/** The same keys on a runtime that ignores `notHydrated` (a binary from before #3644, still served new
+ *  bundles over the air): reset them in place, before any action runs. A no-op where the runtime
+ *  honours the option (`himalaya.hydrationOptOut`). */
+export function resetHydratedEditorOnOlderRuntime(svc: unknown, key: string, pendingAtBoot: boolean, extra: Record<string, unknown> = {}): void {
+  if ((globalThis as { himalaya?: { hydrationOptOut?: unknown } }).himalaya?.hydrationOptOut === true) return;
   const booted = (svc as { getState?: () => Record<string, unknown> | undefined }).getState?.();
   if (!booted || typeof booted !== "object") return;
-  if (booted[keys.json]) booted[keys.json] = "";
-  booted[keys.pending] = pendingAtBoot;
-  booted[keys.dirty] = false;
+  if (booted[`${key}Json`]) booted[`${key}Json`] = "";
+  booted[`${key}Pending`] = pendingAtBoot;
+  booted[`${key}Dirty`] = false;
+  booted[`${key}Edits`] = 0;
   Object.assign(booted, extra);
 }
+
+/** What an awaited save leaves the field as, read from the LIVE state when it lands. An on_change that
+ *  arrived while the save was in flight (`<key>Edits` moved) is an edit the save did not write: the
+ *  field stays dirty and the save's confirmation is stale. Otherwise a save that wrote the field
+ *  re-bases it as saved. `live` is the service's state now (none, or one that never moved: the start state). */
+export function editorAfterSave(key: string, start: Record<string, unknown>, live: Record<string, unknown> | undefined, wrote: boolean):
+  { dirty: boolean; edits: number; editedDuringSave: boolean } {
+  const atStart = Number(start[`${key}Edits`] ?? 0);
+  const now = Number(live?.[`${key}Edits`] ?? atStart);
+  // Only a counter that MOVED ON counts; one behind the start is a host that does not apply results.
+  const editedDuringSave = now > atStart;
+  return editedDuringSave
+    ? { dirty: true, edits: now, editedDuringSave }
+    : { dirty: wrote ? false : Boolean(start[`${key}Dirty`]), edits: atStart, editedDuringSave };
+}
+
+/** The live state of a service handle, when the runtime gives one. */
+export function liveState(svc: unknown): Record<string, unknown> | undefined {
+  const st = (svc as { getState?: () => unknown } | undefined)?.getState?.();
+  return st && typeof st === "object" ? st as Record<string, unknown> : undefined;
+}
+
+/** An awaited action's result, laid over the LIVE state: only the keys the action CHANGED (against the
+ *  state it started from) are written, so anything the owner did while it awaited — an edit, a field in
+ *  the details sheet, closing the sheet — survives a save that lands after it, success or failure. A
+ *  key both changed goes to the action. Where the host gives no live state, the result as it is. */
+export function settleOverLive<S extends object>(svc: unknown, start: S, result: S): S {
+  const now = liveState(svc) as S | undefined;
+  if (!now || now === start || now === result) return result;
+  const out = { ...now } as Record<string, unknown>;
+  const r = result as Record<string, unknown>, s0 = start as Record<string, unknown>;
+  for (const k of Object.keys(r)) if (!Object.is(r[k], s0[k])) out[k] = r[k];
+  return out as S;
+}

package/templates/beauty-salon-owner/tier5-src/himi-owner-lite-post-form/index.ts

@@ -4,7 +4,7 @@
 // screen (himiOwnerLitePost.publish). Bound by buildForm ($service:himiOwnerLitePostForm.*).
 
 import { postBodyText, plainPostBody, postCoverUrl } from "../_shared/owner-post-content.js";
-import { editorSubmitValue, queuedDocument, editorChanged, resetHydratedEditor } from "../_shared/owner-editor-value.js";
+import { editorSubmitValue, queuedDocument, editorChanged, editorRunKeys, resetHydratedEditorOnOlderRuntime, editorAfterSave, liveState, settleOverLive } from "../_shared/owner-editor-value.js";
 import { ricosUploadService } from "@himalaya/wix-rich-content-editor";
 import { wixCall } from "@himalaya/wix-site-media";
 import { wixMediaUrl, WIX_DETAIL_IMAGE } from "../_shared/himi-store.js";
@@ -46,6 +46,8 @@ interface PostFormState {
    *  the body was loaded or saved, and (edit mode) the editor is hidden until this run's load lands. */
   bodyDirty: boolean;
   bodyPending: boolean;
+  /** Counts the editor's on_change events, so a save can tell an edit made while it was in flight. */
+  bodyEdits: number;
   coverUrl: string;
   originalCoverUrl: string;
   coverPreview: string;
@@ -120,6 +122,7 @@ function shape(s: Partial<PostFormState>): PostFormState {
     detailsOpen: s.detailsOpen ?? false,
     bodyDirty: s.bodyDirty ?? false,
     bodyPending: s.bodyPending ?? false,
+    bodyEdits: s.bodyEdits ?? 0,
     coverUrl: s.coverUrl ?? "",
     originalCoverUrl: s.originalCoverUrl ?? "",
     coverPreview: wixMediaUrl(s.coverUrl ?? "", WIX_DETAIL_IMAGE),
@@ -150,9 +153,8 @@ function demoRefusal(s: Parameters<typeof shape>[0]): ReturnType<typeof shape> {
 
 // [rico] #3371 — the RichContentEditor's image tool (the editor's upload contract). The component picks
 // and PUTs the bytes; this service mints the signed Wix Media URL with the worker's own wixApi
-// (@himalaya/wix-site-media rides the `wix_api` grant), so no token reaches the page. Registered
-// BEFORE the form's service on purpose: the worker test harnesses treat a bundle's
-// LAST defineService as its service.
+// (@himalaya/wix-site-media rides the `wix_api` grant), so no token reaches the page. Any order:
+// the worker test harnesses find each service by name.
 ricosUploadService("himiOwnerLitePostFormUploads");
 
 const svc = defineService<PostFormState, {
@@ -165,6 +167,9 @@ const svc = defineService<PostFormState, {
   submit: (s: PostFormState, values?: Record<string, unknown>) => Promise<PostFormState>;
 }>("himiOwnerLitePostForm", {
   state: shape({ mode: startMode, id: initialInput.id ?? "", bodyPending: startMode === "edit" }),
+  // [rico] #3644 — this run's editor state and UI: a cold boot takes these from `state`, never from
+  // the persisted snapshot (the editor seeds once; last run's sheet is not this run's).
+  notHydrated: [...editorRunKeys("body"), "detailsOpen"],
   actions: {
     load: async (s, arg) => {
       stashCopy(arg); // absorb the descriptor's onAppear copy-pack param
@@ -236,8 +241,9 @@ const svc = defineService<PostFormState, {
     detailsOpen: (s) => shape({ ...s, detailsOpen: true }),
     detailsClose: (s) => shape({ ...s, detailsOpen: false }),
     // The editor's `on_change` carries `args.dirty` only; the document stays in the form bag.
-    bodyChanged: (s) => shape({ ...s, bodyDirty: true, ...editorChanged(s) }),
-    submit: async (s, values) => {
+    bodyChanged: (s) => shape({ ...s, bodyDirty: true, bodyEdits: s.bodyEdits + 1, ...editorChanged(s) }),
+    // Laid over the live state ([rico] #3644): what the owner did while the save awaited survives it.
+    submit: async (s, values): Promise<PostFormState> => settleOverLive(svc, s, await (async (): Promise<PostFormState> => {
       if (isOwnerPreviewDemo() || s.demoNote) return demoRefusal(s);
       const v = values ?? {};
       const title = String(v.title ?? s.title).trim();
@@ -292,14 +298,19 @@ const svc = defineService<PostFormState, {
       let kept: WixRichContent | null = bodyEdited ? richContent : (replay ? null : s.richContent);
       const localRow = (id: string): DbEntity => ({ id, name: title, title, excerpt, body: postBodyText(kept), coverUrl, ...(kept ? { richContent: JSON.stringify(kept) } : {}), isFeatured: isFeatured ? "true" : "false", postStatus: "Draft", postStatusRaw: "DRAFT" });
       const localId = editing ? targetId : `local-${Date.now()}`;
-      const savedState = (id: string, savedMessage: string) => shape({
+      const savedState = (id: string, savedMessage: string) => {
+        // An edit typed while this save was in flight stays unsaved work ([rico] #3644).
+        const after = editorAfterSave("body", s as never, liveState(svc), bodyEdited);
+        return shape({
         ...s, mode: "edit", id, heading: copyParam("ownerPostForm.headingEdit", "Edit post"),
         title, excerpt, body: postBodyText(kept), richContent: kept, bodyJson: bodyEdited ? bodyRaw : s.bodyJson,
-        bodyDirty: bodyEdited ? false : s.bodyDirty,
+        bodyDirty: after.dirty, bodyEdits: after.edits,
         coverUrl, originalCoverUrl: coverUrl, isFeatured: isFeatured ? "true" : "false",
         status: "saved", savedMessage, savedId: id,
+        ...(after.editedDuringSave ? { status: "idle" as const, savedMessage: "" } : {}),
         error: bodyTooLarge ? copyParam("ownerPostForm.bodyTooLarge", "The post body is too long to save, so it was left as it was. Your other changes were saved.") : "",
-      });
+        });
+      };
       try {
         // A replay worker starts without the loaded document. Entity upserts replace whole rows, so
         // retain the cached rich body before writing back.
@@ -349,12 +360,11 @@ const svc = defineService<PostFormState, {
         }
         return shape({ ...s, status: "error", error: ownerLoadError(e), savedMessage: "" });
       }
-    },
+    })()),
   },
 });
 
-// [rico] #3371 — adopter contract: the editor seeds once, so a cold boot must not seed it with the last
-// run's document. Nor does it carry this run's UI over: the details sheet is shut.
-resetHydratedEditor(svc, { json: "bodyJson", pending: "bodyPending", dirty: "bodyDirty" }, startMode === "edit", { detailsOpen: false });
+// The same reset on a runtime from before `notHydrated` existed (an older binary on a new bundle).
+resetHydratedEditorOnOlderRuntime(svc, "body", startMode === "edit", { detailsOpen: false });
 
 export { svc };

package/templates/beauty-salon-owner/tier5-src/himi-owner-lite-product-form/index.ts

@@ -18,7 +18,7 @@ import {
 import { get as dbGet, upsert as dbUpsert, remove as dbRemove, enqueue as dbEnqueue, type DbEntity } from "../_shared/owner-local-db.js";
 import { htmlIsTrivial, htmlPreviewText } from "../_shared/owner-rich-guard.js";
 import { postBodyText, plainPostBody } from "../_shared/owner-post-content.js";
-import { editorSubmitValue, queuedDocument, editorChanged, cachedRichVerdict, resetHydratedEditor } from "../_shared/owner-editor-value.js";
+import { editorSubmitValue, queuedDocument, editorChanged, cachedRichVerdict, editorRunKeys, resetHydratedEditorOnOlderRuntime, editorAfterSave, liveState, settleOverLive } from "../_shared/owner-editor-value.js";
 import { parseRicosJson } from "@himalaya/wix-rich-content";
 import { ricosUploadService } from "@himalaya/wix-rich-content-editor";
 import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo, shouldQueueOwnerWrite } from "../_shared/owner-load-error.js";
@@ -69,6 +69,8 @@ interface ProductFormState {
    *  hidden until this run's load lands. */
   descriptionDirty: boolean;
   descriptionPending: boolean;
+  /** Counts the editor's on_change events, so a save can tell an edit made while it was in flight. */
+  descriptionEdits: number;
   /** Derived from the mode: "locked" shows the preview + `descriptionNote`, and refuses an edit. */
   descriptionProtected: boolean;
   descriptionEditable: boolean;
@@ -154,6 +156,7 @@ function shape(s: Partial<ProductFormState>): ProductFormState {
     descriptionEditorHidden: dMode !== "editor",
     descriptionDirty: s.descriptionDirty ?? false,
     descriptionPending: s.descriptionPending ?? false,
+    descriptionEdits: s.descriptionEdits ?? 0,
     descriptionProtected: dMode === "locked",
     descriptionEditable: dMode !== "locked",
     descriptionNote: dMode === "locked" ? copyParam("ownerProductForm.richDescriptionNote", "This description has formatting or media. Edit it in your site dashboard to keep that content intact; name, price and SKU can be changed here.") : "",
@@ -183,8 +186,8 @@ function demoRefusal(s: Parameters<typeof shape>[0]): ReturnType<typeof shape> {
 
 // The RichContentEditor's image tool (the editor's upload contract). The component picks and PUTs
 // the bytes; this service mints the signed Wix Media URL with the worker's own wixApi, so no token
-// reaches the page. Registered BEFORE the form's service on purpose: the worker test harnesses treat a
-// bundle's LAST defineService as its service.
+// reaches the page. Any order: the
+// worker test harnesses find each service by name.
 ricosUploadService("himiOwnerLiteProductFormUploads");
 
 const svc = defineService<ProductFormState, {
@@ -194,6 +197,8 @@ const svc = defineService<ProductFormState, {
   remove: (s: ProductFormState) => Promise<ProductFormState>;
 }>("himiOwnerLiteProductForm", {
   state: shape({ mode: startMode, id: initialInput.id ?? "", descriptionPending: startMode === "edit" }),
+  // [rico] #3644 — this run's editor state: a cold boot takes it from `state`, never the snapshot.
+  notHydrated: editorRunKeys("description"),
   actions: {
     load: async (s, arg) => {
       stashCopy(arg); // absorb the descriptor's onAppear copy-pack param
@@ -279,8 +284,9 @@ const svc = defineService<ProductFormState, {
       }
     },
     // The editor's on_change carries `args.dirty` only; the document stays in the form bag.
-    descriptionChanged: (s) => shape({ ...s, descriptionDirty: true, ...editorChanged(s) }),
-    submit: async (s, values) => {
+    descriptionChanged: (s) => shape({ ...s, descriptionDirty: true, descriptionEdits: s.descriptionEdits + 1, ...editorChanged(s) }),
+    // Laid over the live state ([rico] #3644): what the owner did while the save awaited survives it.
+    submit: async (s, values): Promise<ProductFormState> => settleOverLive(svc, s, await (async (): Promise<ProductFormState> => {
       if (isOwnerPreviewDemo() || s.demoNote) return demoRefusal(s);
       const v = values ?? {};
       const name = String(v.name ?? s.name).trim();
@@ -352,9 +358,13 @@ const svc = defineService<ProductFormState, {
       const savedDescription = {
         description, originalDescription: descriptionEdited || wrote ? description : s.originalDescription,
         ...(docRaw ? { descriptionJson: docRaw } : {}),
-        descriptionDirty: wrote ? false : s.descriptionDirty,
         error: tooLarge ? copyParam("ownerProductForm.descriptionTooLarge", "The description is too long to save, so it was left as it was. Your other changes were saved.") : "",
       };
+      // Read when the save lands: an edit typed while it was in flight stays unsaved work ([rico] #3644).
+      const afterSaved = () => {
+        const a = editorAfterSave("description", s as never, liveState(svc), wrote);
+        return { descriptionDirty: a.dirty, descriptionEdits: a.edits, ...(a.editedDuringSave ? { status: "idle" as const, savedMessage: "" } : {}) };
+      };
       const localId = s.mode === "edit" && s.id ? s.id : `local-${Date.now()}`;
       await cachePut(localRow(localId));
       try {
@@ -380,6 +390,7 @@ const svc = defineService<ProductFormState, {
           ...savedDescription,
           savedMessage: copyParam("ownerProductForm.savedMessage", "Product saved."),
           savedId: id,
+          ...afterSaved(),
         });
       } catch (e) {
         if (shouldQueueOwnerWrite(e)) {
@@ -398,11 +409,12 @@ const svc = defineService<ProductFormState, {
             visible: visible ? "true" : "false", status: "saved",
             savedMessage: copyParam("ownerProductForm.savedOffline", "Saved offline — will sync when you reconnect."),
             savedId: localId,
+            ...afterSaved(),
           });
         }
         return shape({ ...s, status: "error", error: ownerLoadError(e), savedMessage: "" });
       }
-    },
+    })()),
     remove: async (s) => {
       if (isOwnerPreviewDemo() || s.demoNote) return demoRefusal(s);
       if (!s.id) return shape({ ...s, status: "error", error: copyParam("ownerProductForm.errorNoDelete", "No product to delete."), savedMessage: "" });
@@ -424,6 +436,6 @@ const svc = defineService<ProductFormState, {
 });
 
 // Adopter contract: the editor seeds once, so a cold boot must not seed it with the last run's document.
-resetHydratedEditor(svc, { json: "descriptionJson", pending: "descriptionPending", dirty: "descriptionDirty" }, startMode === "edit");
+resetHydratedEditorOnOlderRuntime(svc, "description", startMode === "edit");
 
 export { svc };

package/templates/community-club-owner/tier5-src/_shared/owner-editor-value.ts

@@ -8,7 +8,7 @@
 // drops nodes the owner never touched).
 // Inside the platform source this import is a relative path, so node test runs resolve it; an app's
 // copy imports "@himalaya/wix-rich-content".
-import { parseRicosJson, isPlainRicos, RICH_CONTENT_LIMITS, type RicosDocument } from "@himalaya/wix-rich-content";
+import { parseRicosJson, isPlainRicos, richContentOverLimits, type RicosDocument } from "@himalaya/wix-rich-content";
 
 export type EditorValue =
   | { kind: "absent" }                                  // leave the stored body untouched
@@ -17,34 +17,6 @@ export type EditorValue =
   | { kind: "too_large" }                               // past the rich-content limits: save the rest, say why
   | { kind: "invalid" };                                // not a Ricos document: refuse, write nothing
 
-function utf8Bytes(s: string): number {
-  let n = 0;
-  for (let i = 0; i < s.length; i++) {
-    const c = s.charCodeAt(i);
-    if (c < 0x80) n += 1;
-    else if (c < 0x800) n += 2;
-    else if (c >= 0xd800 && c <= 0xdbff && i + 1 < s.length) { n += 4; i++; }
-    else n += 3;
-  }
-  return n;
-}
-
-/** Every viewer renders a body past the rich-content limits as its fallback, so it is never written.
- *  The viewer's order: bytes (before parsing), then depth, then the node count. */
-function overLimits(doc: RicosDocument): boolean {
-  let count = 0;
-  const work: Array<[unknown, number]> = doc.nodes.map((n) => [n, 1] as [unknown, number]);
-  while (work.length) {
-    const [n, depth] = work.pop()!;
-    if (!n || typeof n !== "object" || Array.isArray(n)) continue;
-    if (depth > RICH_CONTENT_LIMITS.maxDepth) return true;
-    if (++count > RICH_CONTENT_LIMITS.maxNodes) return true;
-    const kids = (n as { nodes?: unknown }).nodes;
-    if (Array.isArray(kids)) for (const k of kids) work.push([k, depth + 1]);
-  }
-  return false;
-}
-
 const TEXT_ONLY = new Set(["PARAGRAPH", "TEXT", "HEADING", "BULLETED_LIST", "ORDERED_LIST", "LIST_ITEM", "BLOCKQUOTE", "CODE_BLOCK"]);
 /** No visible text and no non-text node (an image, a divider, an embed…): an empty body. */
 export function isEmptyDocument(doc: RicosDocument): boolean {
@@ -55,10 +27,12 @@ export function isEmptyDocument(doc: RicosDocument): boolean {
 
 /** A Ricos JSON string checked as every viewer would: the limits first, then the shape. */
 function checkedDocument(raw: string): EditorValue {
-  if (utf8Bytes(raw) > RICH_CONTENT_LIMITS.maxBytes) return { kind: "too_large" };
+  // Every viewer renders a body past the limits as its fallback, so it is never written. One parse
+  // feeds both checks; a string past the byte limit is refused before it is parsed at all.
+  if (richContentOverLimits(raw, null) === "too_large") return { kind: "too_large" };
   const doc = parseRicosJson(raw);
   if (!doc) return { kind: "invalid" };
-  return overLimits(doc) ? { kind: "too_large" } : { kind: "doc", doc, json: raw };
+  return richContentOverLimits(raw, doc) ? { kind: "too_large" } : { kind: "doc", doc, json: raw };
 }
 
 /** `raw` is `values[name]`; `seededJson` is the string the form published as the editor's seed. */
@@ -108,15 +82,59 @@ export function cachedRichVerdict(doc: RicosDocument | null, knownPlain: boolean
   return knownPlain ? "false" : "true";
 }
 
-/** Cold boot: the runtime lays this service's last persisted snapshot over its declared state, so the
- *  editor's first seed would be the document as it was when the screen last ran — and a Save after
- *  typing would write it over whatever the record holds now. Blank the hydrated seed and reset the gate
- *  before anything renders, in place (no action has run yet). `extra` resets further UI state. */
-export function resetHydratedEditor(svc: unknown, keys: { json: string; pending: string; dirty: string }, pendingAtBoot: boolean, extra: Record<string, unknown> = {}): void {
+/** The keys of one editor field that describe THIS run, never the last one: the seed (`<key>Json`),
+ *  the load gate (`<key>Pending`), the edit flag (`<key>Dirty`) and its counter (`<key>Edits`). A form
+ *  lists them in `defineService(name, { notHydrated })`, so a cold boot takes their DECLARED values: the
+ *  editor seeds once, and a persisted seed would be painted as its content and saved back over a newer
+ *  record. */
+export function editorRunKeys<K extends string>(key: K): [`${K}Json`, `${K}Pending`, `${K}Dirty`, `${K}Edits`] {
+  return [`${key}Json`, `${key}Pending`, `${key}Dirty`, `${key}Edits`];
+}
+
+/** The same keys on a runtime that ignores `notHydrated` (a binary from before #3644, still served new
+ *  bundles over the air): reset them in place, before any action runs. A no-op where the runtime
+ *  honours the option (`himalaya.hydrationOptOut`). */
+export function resetHydratedEditorOnOlderRuntime(svc: unknown, key: string, pendingAtBoot: boolean, extra: Record<string, unknown> = {}): void {
+  if ((globalThis as { himalaya?: { hydrationOptOut?: unknown } }).himalaya?.hydrationOptOut === true) return;
   const booted = (svc as { getState?: () => Record<string, unknown> | undefined }).getState?.();
   if (!booted || typeof booted !== "object") return;
-  if (booted[keys.json]) booted[keys.json] = "";
-  booted[keys.pending] = pendingAtBoot;
-  booted[keys.dirty] = false;
+  if (booted[`${key}Json`]) booted[`${key}Json`] = "";
+  booted[`${key}Pending`] = pendingAtBoot;
+  booted[`${key}Dirty`] = false;
+  booted[`${key}Edits`] = 0;
   Object.assign(booted, extra);
 }
+
+/** What an awaited save leaves the field as, read from the LIVE state when it lands. An on_change that
+ *  arrived while the save was in flight (`<key>Edits` moved) is an edit the save did not write: the
+ *  field stays dirty and the save's confirmation is stale. Otherwise a save that wrote the field
+ *  re-bases it as saved. `live` is the service's state now (none, or one that never moved: the start state). */
+export function editorAfterSave(key: string, start: Record<string, unknown>, live: Record<string, unknown> | undefined, wrote: boolean):
+  { dirty: boolean; edits: number; editedDuringSave: boolean } {
+  const atStart = Number(start[`${key}Edits`] ?? 0);
+  const now = Number(live?.[`${key}Edits`] ?? atStart);
+  // Only a counter that MOVED ON counts; one behind the start is a host that does not apply results.
+  const editedDuringSave = now > atStart;
+  return editedDuringSave
+    ? { dirty: true, edits: now, editedDuringSave }
+    : { dirty: wrote ? false : Boolean(start[`${key}Dirty`]), edits: atStart, editedDuringSave };
+}
+
+/** The live state of a service handle, when the runtime gives one. */
+export function liveState(svc: unknown): Record<string, unknown> | undefined {
+  const st = (svc as { getState?: () => unknown } | undefined)?.getState?.();
+  return st && typeof st === "object" ? st as Record<string, unknown> : undefined;
+}
+
+/** An awaited action's result, laid over the LIVE state: only the keys the action CHANGED (against the
+ *  state it started from) are written, so anything the owner did while it awaited — an edit, a field in
+ *  the details sheet, closing the sheet — survives a save that lands after it, success or failure. A
+ *  key both changed goes to the action. Where the host gives no live state, the result as it is. */
+export function settleOverLive<S extends object>(svc: unknown, start: S, result: S): S {
+  const now = liveState(svc) as S | undefined;
+  if (!now || now === start || now === result) return result;
+  const out = { ...now } as Record<string, unknown>;
+  const r = result as Record<string, unknown>, s0 = start as Record<string, unknown>;
+  for (const k of Object.keys(r)) if (!Object.is(r[k], s0[k])) out[k] = r[k];
+  return out as S;
+}