@wix/himalaya-cli 0.1316.0 → 0.1318.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/index.d.ts

@@ -21,3 +21,4 @@ export * from "./app-link.js";
 export * from "./app-identity.js";
 export * from "./app-registry-client.js";
 export * from "./site-shell.js";
+export * from "./site-menu.js";

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/schema.d.ts

@@ -2679,6 +2679,11 @@ export interface SiteNavConfig {
     /** The screen an on-site URL no route owns opens in. `""`/absent ⇒ the `/` route's
      *  screen; no `/` route either ⇒ the link does not resolve. */
     fallbackScreenId?: string;
+    /** Where the shell's tabs and drawer come from. `"runtime"`: the device reads the
+     *  site's own menu as pages load and builds the NEXT launch's chrome from it
+     *  (`mergeSiteMenu` in `@himalaya/core/site-menu`). `"contract"`/absent: the served
+     *  `tabBar`/`drawer`/`sidebar` exactly as they are. OTA, like the rest of this block. */
+    menuSource?: "contract" | "runtime";
 }
 /** One entry of {@link SiteNavConfig.routes}. */
 export interface SiteRoute {

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/site-menu-script.generated.d.ts

@@ -0,0 +1,6 @@
+export declare const SITE_MENU_MESSAGE_NAME = "himalayaSiteMenu";
+export declare const SITE_NAV_LINKS_JS = "(function(){var q=document.querySelectorAll(\"nav a, header a, [role=navigation] a\"),o=[],i,a,t,h;for(i=0;i<q.length&&o.length<24;i++){a=q[i];t=String(a.textContent||\"\").replace(/\\s+/g,\" \").trim();h=String(a.href||\"\");if(t&&/^https?:/.test(h))o.push({label:t,href:h})}return o})()";
+export declare const SITE_MENU_SYSTEM_SEGMENT = "^(popup-.*|lightbox.*|.*thank-?you.*|checkout|cart(-page)?|payment-request(-page)?|expired-reset-link|access-restricted|reservation|(event|experience|reservation|order|item)-details|(product|service|category|group|project|collection|reviews-collection|donation-thank-you)-page|post|project|collection|group|booking-(form|calendar)|plan-customization|notifications?|followers?|following|my-(?!account$)[a-z-]+|profile|search(-results)?|blank(-\\d+)?|404)$";
+export declare const SITE_MENU_SYSTEM_TITLE = "\\b(thank you|\\(popup\\)|leave (a )?review|notifications|followers|side cart|order error|pending approval|my (rewards|subscriptions|bookings|orders|groups|wallet))\\b|\\b(group|service|product|project|collection|category|cart|payment request) pages?$|\\b(event|experience|reservation|item) details\\b";
+export declare const SITE_MENU_MEMBER_SEGMENT = "^(members?|account(-settings)?|my-account|login|sign-?in)$";
+export declare const SITE_MENU_PAGE_SCRIPT = "(function(){try{if(window.top!==window||window.__himalayaSiteMenu)return;window.__himalayaSiteMenu=1;var S=new RegExp(\"^(popup-.*|lightbox.*|.*thank-?you.*|checkout|cart(-page)?|payment-request(-page)?|expired-reset-link|access-restricted|reservation|(event|experience|reservation|order|item)-details|(product|service|category|group|project|collection|reviews-collection|donation-thank-you)-page|post|project|collection|group|booking-(form|calendar)|plan-customization|notifications?|followers?|following|my-(?!account$)[a-z-]+|profile|search(-results)?|blank(-\\\\d+)?|404)$\",\"i\"),T=new RegExp(\"\\\\b(thank you|\\\\(popup\\\\)|leave (a )?review|notifications|followers|side cart|order error|pending approval|my (rewards|subscriptions|bookings|orders|groups|wallet))\\\\b|\\\\b(group|service|product|project|collection|category|cart|payment request) pages?$|\\\\b(event|experience|reservation|item) details\\\\b\",\"i\"),M=new RegExp(\"^(members?|account(-settings)?|my-account|login|sign-?in)$\",\"i\"),n=0,p=\"\";function bridge(){var w=window.webkit;return(w&&w.messageHandlers&&w.messageHandlers.himalayaSiteMenu)||window.himalayaSiteMenu||null}function read(){var l=(function(){var q=document.querySelectorAll(\"nav a, header a, [role=navigation] a\"),o=[],i,a,t,h;for(i=0;i<q.length&&o.length<24;i++){a=q[i];t=String(a.textContent||\"\").replace(/\\s+/g,\" \").trim();h=String(a.href||\"\");if(t&&/^https?:/.test(h))o.push({label:t,href:h})}return o})(),o=[],i,u,s;for(i=0;i<l.length;i++){try{u=new URL(l[i].href)}catch(e){continue}s=u.pathname.split(\"/\").filter(Boolean).pop()||\"\";try{s=decodeURIComponent(s)}catch(e){}if(S.test(s)||M.test(s)||T.test(l[i].label))continue;o.push({label:l[i].label,href:l[i].href})}return o}function tick(){var b=bridge();if(!b)return;var o=read(),j=JSON.stringify(o);if(o.length&&(j===p||n>=5)){b.postMessage(JSON.stringify({v:1,href:String(location.href),items:o}));return}p=o.length?j:\"\";if(++n<=5)setTimeout(tick,500*n)}if(document.readyState===\"loading\")document.addEventListener(\"DOMContentLoaded\",tick);else tick()}catch(e){}})();";

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/site-menu.d.ts

@@ -0,0 +1,82 @@
+import type { DrawerItem, LinkableScreen, NavTabItem, SiteNavConfig } from "./schema.js";
+export { SITE_MENU_MEMBER_SEGMENT, SITE_MENU_MESSAGE_NAME, SITE_MENU_PAGE_SCRIPT, SITE_MENU_SYSTEM_SEGMENT, SITE_MENU_SYSTEM_TITLE, SITE_NAV_LINKS_JS, } from "./site-menu-script.generated.js";
+/** Where a site shell's tabs and drawer come from. Absent ⇒ `"contract"`. */
+export type SiteMenuSource = "contract" | "runtime";
+export declare const SITE_MENU_SOURCES: readonly SiteMenuSource[];
+/** The most menu items a device keeps — the analyzer's own page cap is 10. */
+export declare const SITE_MENU_MAX_ITEMS = 12;
+/** A menu label's cap, in code points — the contract's page-title cap. */
+export declare const SITE_MENU_LABEL_MAX = 40;
+/** The longest page message the native side parses, in UTF-16 units. */
+export declare const SITE_MENU_PAYLOAD_MAX = 16384;
+/** The longest item href the native side considers. */
+export declare const SITE_MENU_HREF_MAX = 2048;
+/** The most page items the native side reads before it caps (the page script caps at 24 too). */
+export declare const SITE_MENU_RAW_ITEMS_MAX = 24;
+/** Id prefixes for a runtime-only page's rows. A hyphen keeps them out of the page-id space
+ *  (`[a-z0-9_]+`), so a page id can never collide with one. */
+export declare const SITE_MENU_DRAWER_ID_PREFIX = "drawer_site-menu-";
+export declare const SITE_MENU_SIDEBAR_ID_PREFIX = "site-menu-";
+/** The icon a page the contract does not know gets. */
+export declare const SITE_MENU_DEFAULT_ICON = "globe";
+/** One item of a site's menu, as the device keeps it: a clean label and a path RELATIVE to the
+ *  site's base URL (`"/"`, `"/book-online"`), percent-encoded as the page sent it. */
+export interface SiteMenuItem {
+    label: string;
+    path: string;
+}
+/** The chrome a merge reconciles: the served tab bar, drawer and rail items, plus the linkable
+ *  screens whose `tabId` must not name a tab the menu dropped. */
+export interface SiteMenuNav {
+    tabs: NavTabItem[];
+    drawer: DrawerItem[];
+    sidebar: NavTabItem[];
+    linkableScreens: LinkableScreen[];
+}
+/** What a runtime menu changed relative to the contract — reported as telemetry. */
+export interface SiteMenuDrift {
+    /** Paths the menu lists that no contract page owns. */
+    added: string[];
+    /** Contract page screens (that had a tab or a row) the menu no longer lists. */
+    removed: string[];
+    /** Contract page screens the menu labels differently. */
+    renamed: string[];
+}
+export interface SiteMenuMerge extends SiteMenuNav {
+    /** Row id → the absolute URL that row opens, for every runtime-only page's drawer and rail row. */
+    links: Record<string, string>;
+    drift: SiteMenuDrift;
+}
+/** Whether a site description opts into the runtime menu. */
+export declare function siteMenuIsRuntime(site: Pick<SiteNavConfig, "menuSource"> | undefined): boolean;
+/** A menu label in its kept form: control characters and whitespace runs as one space, trimmed,
+ *  Wix's `(New)` editor marker dropped, capped at {@link SITE_MENU_LABEL_MAX} code points. */
+export declare function cleanSiteMenuLabel(raw: string): string;
+/** A site-relative path in comparable form: segments percent-decoded, empty ones dropped. `""` is
+ *  the home page. */
+export declare function siteMenuPathKey(path: string): string;
+/**
+ * `href` relative to the site, or null when it is not one of the site's own pages: https only, no
+ * credentials, on one of `origins` (exact host, `:443` the default port, the path the origin's
+ * boundary or under it), and no `.`/`..` segment (a WebView resolves them, and on a free
+ * `<user>.wixsite.com` host `/my-site/../other` is somebody else's site). The result has a leading
+ * slash, no trailing one, and no query or fragment.
+ */
+export declare function siteMenuPath(href: string, origins: readonly string[]): string | null;
+/**
+ * The page's menu message, validated. `payload` is what the page posted — a JSON STRING
+ * `{ v: 1, href, items: [{ label, href }] }`, which is all the page script ever sends; anything else
+ * (a parsed object, a number) is refused, so the size bound always applies. Returns null for anything that
+ * is not a menu (malformed, oversized, wrong version, no usable item). Items are kept in the page's
+ * order; each must be a labelled page of the site; the first item for a path wins; at most
+ * {@link SITE_MENU_MAX_ITEMS}.
+ */
+export declare function normalizeSiteMenu(payload: unknown, site: Pick<SiteNavConfig, "origins"> | undefined): SiteMenuItem[] | null;
+/**
+ * Reconcile the contract's chrome with a site's menu (see the module header for the rules). Returns
+ * null — "show the contract" — when the site does not opt in (`menuSource !== "runtime"`), when
+ * there is no menu, or when the merge would leave the tab bar with no site page.
+ */
+export declare function mergeSiteMenu(nav: SiteMenuNav, site: SiteNavConfig | undefined, menu: readonly SiteMenuItem[] | null | undefined): SiteMenuMerge | null;
+/** Whether a merge changed anything the operator should hear about. */
+export declare function siteMenuDrifted(drift: SiteMenuDrift): boolean;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/site-shell.d.ts

@@ -71,6 +71,12 @@ export interface SiteShellConfig {
      *  not a destination), so they live here rather than in {@link pages}; the site analyzer fills
      *  them from the pages it actually found. Absent ⇒ that notification opens the home page. */
     memberPages?: SiteMemberPages;
+    /** Where the native tabs and drawer come from. Absent ⇒ `"contract"`: exactly {@link pages}.
+     *  `"runtime"`: the device reads the site's own menu as pages load and the NEXT launch builds the
+     *  chrome from it (`mergeSiteMenu`, `@himalaya/core/site-menu`) — {@link pages} still decides each
+     *  page's placement and icon, and stays the chrome until a menu has been read. Served OTA in
+     *  `navigation.site.menuSource`. */
+    menuSource?: "contract" | "runtime";
 }
 /** Members Area pages, by what a notification is about. */
 export interface SiteMemberPages {

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/core.mjs

@@ -2804,8 +2804,8 @@ var require_validate = __commonJS({
           return data;
       }
       let expr = data;
-      const segments = jsonPointer.split("/");
-      for (const segment of segments) {
+      const segments2 = jsonPointer.split("/");
+      for (const segment of segments2) {
         if (segment) {
           data = (0, codegen_1._)`${data}${(0, codegen_1.getProperty)((0, util_1.unescapeJsonPointer)(segment))}`;
           expr = (0, codegen_1._)`${expr} && ${data}`;
@@ -4314,9 +4314,9 @@ var require_core = __commonJS({
         const rules = this.RULES.all;
         metaSchema = JSON.parse(JSON.stringify(metaSchema));
         for (const jsonPointer of keywordsJsonPointers) {
-          const segments = jsonPointer.split("/").slice(1);
+          const segments2 = jsonPointer.split("/").slice(1);
           let keywords = metaSchema;
-          for (const seg of segments)
+          for (const seg of segments2)
             keywords = keywords[seg];
           for (const key in rules) {
             const rule = rules[key];
@@ -7665,6 +7665,9 @@ function validateSiteNav(site) {
   if (site.fallbackScreenId !== void 0 && typeof site.fallbackScreenId !== "string") {
     throw new Error("defineApp: navigation.site.fallbackScreenId must be a string.");
   }
+  if (site.menuSource !== void 0 && site.menuSource !== "contract" && site.menuSource !== "runtime") {
+    throw new Error('defineApp: navigation.site.menuSource must be "contract" or "runtime".');
+  }
 }
 var SPLASH_MIN_VISIBLE_MS_MAX = 2e3;
 var SPLASH_MAX_HOLD_MS_MAX = 8e3;
@@ -13371,7 +13374,9 @@ function siteNavConfig(site) {
   return {
     origins: siteAllowedOrigins(site.origin, site.kind),
     routes: site.pages.map((page) => ({ path: siteRoutePath(page.path), screenId: siteScreenId(page) })),
-    fallbackScreenId: SITE_PAGE_SCREEN_ID
+    fallbackScreenId: SITE_PAGE_SCREEN_ID,
+    // Emitted only when the site opts in, so a contract-menu app serves the same config as before.
+    ...site.menuSource === "runtime" ? { menuSource: "runtime" } : {}
   };
 }
 function siteLinkableScreens(site) {
@@ -13507,10 +13512,224 @@ function assertSiteShellConfig(site) {
   if (site.layout !== void 0 && !SITE_LAYOUTS.includes(site.layout)) {
     throw new Error(`site layout ${JSON.stringify(site.layout)} must be one of ${SITE_LAYOUTS.join(", ")}`);
   }
+  if (site.menuSource !== void 0 && site.menuSource !== "contract" && site.menuSource !== "runtime") {
+    throw new Error(`site menuSource ${JSON.stringify(site.menuSource)} must be "contract" or "runtime"`);
+  }
   if (!site.pages.some((page) => (page.placement ?? "tab") === "tab")) {
     throw new Error('a site shell needs at least one page with placement "tab"');
   }
 }
+
+// ../../core/ts/src/site-menu-script.generated.ts
+var SITE_MENU_MESSAGE_NAME = "himalayaSiteMenu";
+var SITE_NAV_LINKS_JS = '(function(){var q=document.querySelectorAll("nav a, header a, [role=navigation] a"),o=[],i,a,t,h;for(i=0;i<q.length&&o.length<24;i++){a=q[i];t=String(a.textContent||"").replace(/\\s+/g," ").trim();h=String(a.href||"");if(t&&/^https?:/.test(h))o.push({label:t,href:h})}return o})()';
+var SITE_MENU_SYSTEM_SEGMENT = "^(popup-.*|lightbox.*|.*thank-?you.*|checkout|cart(-page)?|payment-request(-page)?|expired-reset-link|access-restricted|reservation|(event|experience|reservation|order|item)-details|(product|service|category|group|project|collection|reviews-collection|donation-thank-you)-page|post|project|collection|group|booking-(form|calendar)|plan-customization|notifications?|followers?|following|my-(?!account$)[a-z-]+|profile|search(-results)?|blank(-\\d+)?|404)$";
+var SITE_MENU_SYSTEM_TITLE = "\\b(thank you|\\(popup\\)|leave (a )?review|notifications|followers|side cart|order error|pending approval|my (rewards|subscriptions|bookings|orders|groups|wallet))\\b|\\b(group|service|product|project|collection|category|cart|payment request) pages?$|\\b(event|experience|reservation|item) details\\b";
+var SITE_MENU_MEMBER_SEGMENT = "^(members?|account(-settings)?|my-account|login|sign-?in)$";
+var SITE_MENU_PAGE_SCRIPT = '(function(){try{if(window.top!==window||window.__himalayaSiteMenu)return;window.__himalayaSiteMenu=1;var S=new RegExp("^(popup-.*|lightbox.*|.*thank-?you.*|checkout|cart(-page)?|payment-request(-page)?|expired-reset-link|access-restricted|reservation|(event|experience|reservation|order|item)-details|(product|service|category|group|project|collection|reviews-collection|donation-thank-you)-page|post|project|collection|group|booking-(form|calendar)|plan-customization|notifications?|followers?|following|my-(?!account$)[a-z-]+|profile|search(-results)?|blank(-\\\\d+)?|404)$","i"),T=new RegExp("\\\\b(thank you|\\\\(popup\\\\)|leave (a )?review|notifications|followers|side cart|order error|pending approval|my (rewards|subscriptions|bookings|orders|groups|wallet))\\\\b|\\\\b(group|service|product|project|collection|category|cart|payment request) pages?$|\\\\b(event|experience|reservation|item) details\\\\b","i"),M=new RegExp("^(members?|account(-settings)?|my-account|login|sign-?in)$","i"),n=0,p="";function bridge(){var w=window.webkit;return(w&&w.messageHandlers&&w.messageHandlers.himalayaSiteMenu)||window.himalayaSiteMenu||null}function read(){var l=(function(){var q=document.querySelectorAll("nav a, header a, [role=navigation] a"),o=[],i,a,t,h;for(i=0;i<q.length&&o.length<24;i++){a=q[i];t=String(a.textContent||"").replace(/\\s+/g," ").trim();h=String(a.href||"");if(t&&/^https?:/.test(h))o.push({label:t,href:h})}return o})(),o=[],i,u,s;for(i=0;i<l.length;i++){try{u=new URL(l[i].href)}catch(e){continue}s=u.pathname.split("/").filter(Boolean).pop()||"";try{s=decodeURIComponent(s)}catch(e){}if(S.test(s)||M.test(s)||T.test(l[i].label))continue;o.push({label:l[i].label,href:l[i].href})}return o}function tick(){var b=bridge();if(!b)return;var o=read(),j=JSON.stringify(o);if(o.length&&(j===p||n>=5)){b.postMessage(JSON.stringify({v:1,href:String(location.href),items:o}));return}p=o.length?j:"";if(++n<=5)setTimeout(tick,500*n)}if(document.readyState==="loading")document.addEventListener("DOMContentLoaded",tick);else tick()}catch(e){}})();';
+
+// ../../core/ts/src/site-menu.ts
+var SITE_MENU_SOURCES = ["contract", "runtime"];
+var SITE_MENU_MAX_ITEMS = 12;
+var SITE_MENU_LABEL_MAX = 40;
+var SITE_MENU_PAYLOAD_MAX = 16384;
+var SITE_MENU_HREF_MAX = 2048;
+var SITE_MENU_RAW_ITEMS_MAX = 24;
+var SITE_MENU_DRAWER_ID_PREFIX = "drawer_site-menu-";
+var SITE_MENU_SIDEBAR_ID_PREFIX = "site-menu-";
+var SITE_MENU_DEFAULT_ICON = "globe";
+function siteMenuIsRuntime(site) {
+  return site?.menuSource === "runtime";
+}
+function cleanSiteMenuLabel(raw) {
+  const one = raw.replace(/[\u0000-\u001F\u007F\s]+/g, " ").trim().replace(/\s*\(new\)\s*$/i, "").trim();
+  const points = Array.from(one);
+  return points.length <= SITE_MENU_LABEL_MAX ? one : points.slice(0, SITE_MENU_LABEL_MAX).join("").trimEnd();
+}
+function segments(path) {
+  return path.split("/").filter(Boolean);
+}
+function decodeSegment2(segment) {
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return segment;
+  }
+}
+function siteMenuPathKey(path) {
+  const bare = path.split(/[?#]/, 1)[0] ?? "";
+  return segments(bare).map(decodeSegment2).join("/");
+}
+function siteMenuPath(href, origins) {
+  if (typeof href !== "string" || href.length > SITE_MENU_HREF_MAX) return null;
+  const raw = href.trim();
+  const rawPath = raw.replace(/^[a-z][a-z0-9+.-]*:\/\/[^/?#]*/i, "").split(/[?#]/, 1)[0] ?? "";
+  if (/%2f|%5c/i.test(rawPath)) return null;
+  if (rawPath.split("/").some((seg) => {
+    const d = decodeSegment2(seg);
+    return d === "." || d === "..";
+  })) return null;
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "https:" || parsed.username || parsed.password) return null;
+  for (const origin of origins) {
+    let o;
+    try {
+      o = new URL(origin);
+    } catch {
+      continue;
+    }
+    if (o.protocol !== "https:" || o.host !== parsed.host) continue;
+    const base = o.pathname.replace(/\/+$/, "");
+    const path = parsed.pathname;
+    if (path === base || path === `${base}/` || path.startsWith(`${base}/`)) {
+      return `/${segments(path.slice(base.length)).join("/")}`;
+    }
+  }
+  return null;
+}
+function normalizeSiteMenu(payload, site) {
+  if (!site?.origins?.length) return null;
+  if (typeof payload !== "string" || payload.length > SITE_MENU_PAYLOAD_MAX) return null;
+  let message;
+  try {
+    message = JSON.parse(payload);
+  } catch {
+    return null;
+  }
+  if (!message || typeof message !== "object" || Array.isArray(message)) return null;
+  const { v, items } = message;
+  if (v !== 1 || !Array.isArray(items)) return null;
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const item of items.slice(0, SITE_MENU_RAW_ITEMS_MAX)) {
+    if (out.length >= SITE_MENU_MAX_ITEMS) break;
+    if (!item || typeof item !== "object") continue;
+    const { label, href } = item;
+    if (typeof label !== "string" || typeof href !== "string") continue;
+    const clean = cleanSiteMenuLabel(label);
+    if (!clean) continue;
+    const path = siteMenuPath(href, site.origins);
+    if (path === null) continue;
+    const key = siteMenuPathKey(path);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push({ label: clean, path });
+  }
+  return out.length ? out : null;
+}
+function spliceSiteBlock(list, isSite, block) {
+  const out = [];
+  let inserted = false;
+  for (const item of list) {
+    if (!isSite(item)) {
+      out.push(item);
+      continue;
+    }
+    if (!inserted) {
+      out.push(...block);
+      inserted = true;
+    }
+  }
+  return out;
+}
+function mergeSiteMenu(nav, site, menu) {
+  if (!site || !siteMenuIsRuntime(site) || !menu?.length) return null;
+  const routes = (site.routes ?? []).filter((r) => r?.screenId);
+  if (!routes.length) return null;
+  const fallback = site.fallbackScreenId ?? "";
+  const base = (site.origins ?? [])[0];
+  const screenByKey = /* @__PURE__ */ new Map();
+  for (const route of routes) {
+    const key = siteMenuPathKey(route.path ?? "");
+    if (!screenByKey.has(key)) screenByKey.set(key, route.screenId);
+  }
+  const siteScreens2 = new Set(routes.map((r) => r.screenId));
+  const home = screenByKey.get("");
+  const entries = [];
+  const kept = /* @__PURE__ */ new Set();
+  for (const item of menu) {
+    const key = siteMenuPathKey(item.path);
+    const screenId = screenByKey.get(key);
+    if (screenId) {
+      if (kept.has(screenId)) continue;
+      kept.add(screenId);
+      entries.push({ kind: "page", screenId, label: screenId === home ? null : item.label });
+    } else if (key !== "" && fallback && base) {
+      entries.push({ kind: "new", path: item.path, label: item.label });
+    }
+  }
+  if (home) {
+    const at = entries.findIndex((e) => e.kind === "page" && e.screenId === home);
+    if (at > 0) entries.unshift(...entries.splice(at, 1));
+    if (at < 0) entries.unshift({ kind: "page", screenId: home, label: null });
+    kept.add(home);
+  }
+  const isSite = (item) => !!item.screenId && siteScreens2.has(item.screenId);
+  const labelOf = (e, fallbackLabel) => e.label ?? fallbackLabel;
+  const siteTabs = nav.tabs.filter(isSite);
+  const tabBlock = [];
+  for (const e of entries) {
+    if (e.kind !== "page") continue;
+    const tab = siteTabs.find((t) => t.screenId === e.screenId);
+    if (tab && tabBlock.length < SITE_SHELL_MAX_TABS) tabBlock.push({ ...tab, label: labelOf(e, tab.label) });
+  }
+  if (siteTabs.length && !tabBlock.length) return null;
+  const tabs = siteTabs.length ? spliceSiteBlock(nav.tabs, isSite, tabBlock) : [...nav.tabs];
+  const links = {};
+  const urlOf = (path) => `${base.endsWith("/") ? base : `${base}/`}${path.replace(/^\/+/, "")}`;
+  const siteRows = nav.drawer.filter(isSite);
+  const siteRail = nav.sidebar.filter(isSite);
+  const drawerBlock = [];
+  const railBlock = [];
+  let n = 0;
+  for (const e of entries) {
+    if (e.kind === "page") {
+      const row = siteRows.find((r) => r.screenId === e.screenId);
+      if (row) drawerBlock.push({ ...row, label: labelOf(e, row.label) });
+      const rail = siteRail.find((r) => r.screenId === e.screenId);
+      if (rail) railBlock.push({ ...rail, label: labelOf(e, rail.label) });
+      continue;
+    }
+    n += 1;
+    const url = urlOf(e.path);
+    if (siteRows.length) {
+      const id = `${SITE_MENU_DRAWER_ID_PREFIX}${n}`;
+      drawerBlock.push({ id, screenId: fallback, label: e.label, icon: SITE_MENU_DEFAULT_ICON });
+      links[id] = url;
+    }
+    if (siteRail.length) {
+      const id = `${SITE_MENU_SIDEBAR_ID_PREFIX}${n}`;
+      railBlock.push({ id, screenId: fallback, label: e.label, icon: SITE_MENU_DEFAULT_ICON });
+      links[id] = url;
+    }
+  }
+  const drawer = siteRows.length ? spliceSiteBlock(nav.drawer, isSite, drawerBlock) : [...nav.drawer];
+  const sidebar = siteRail.length ? spliceSiteBlock(nav.sidebar, isSite, railBlock) : [...nav.sidebar];
+  const tabIds = new Set(tabs.map((t) => t.id));
+  const droppedTabs = new Set(nav.tabs.filter((t) => !tabIds.has(t.id)).map((t) => t.id));
+  const linkableScreens = nav.linkableScreens.map((s) => s.tabId && droppedTabs.has(s.tabId) ? { ...s, tabId: "" } : s);
+  const listed = [...nav.tabs, ...nav.drawer, ...nav.sidebar].filter(isSite);
+  const removed = [];
+  for (const item of listed) {
+    if (!kept.has(item.screenId) && !removed.includes(item.screenId)) removed.push(item.screenId);
+  }
+  const renamed = [];
+  for (const e of entries) {
+    if (e.kind !== "page" || e.label === null) continue;
+    const contract = listed.find((item) => item.screenId === e.screenId)?.label;
+    if (contract !== void 0 && contract !== e.label && !renamed.includes(e.screenId)) renamed.push(e.screenId);
+  }
+  const added = entries.flatMap((e) => e.kind === "new" ? [e.path] : []);
+  return { tabs, drawer, sidebar, linkableScreens, links, drift: { added, removed, renamed } };
+}
+function siteMenuDrifted(drift) {
+  return drift.added.length > 0 || drift.removed.length > 0 || drift.renamed.length > 0;
+}
 export {
   ALL_ORIENTATIONS,
   APP_ID_PATTERN,
@@ -13551,6 +13770,21 @@ export {
   RICH_CONTENT_EDITOR_TOOLS,
   RTL_LOCALES,
   SITE_LAYOUTS,
+  SITE_MENU_DEFAULT_ICON,
+  SITE_MENU_DRAWER_ID_PREFIX,
+  SITE_MENU_HREF_MAX,
+  SITE_MENU_LABEL_MAX,
+  SITE_MENU_MAX_ITEMS,
+  SITE_MENU_MEMBER_SEGMENT,
+  SITE_MENU_MESSAGE_NAME,
+  SITE_MENU_PAGE_SCRIPT,
+  SITE_MENU_PAYLOAD_MAX,
+  SITE_MENU_RAW_ITEMS_MAX,
+  SITE_MENU_SIDEBAR_ID_PREFIX,
+  SITE_MENU_SOURCES,
+  SITE_MENU_SYSTEM_SEGMENT,
+  SITE_MENU_SYSTEM_TITLE,
+  SITE_NAV_LINKS_JS,
   SITE_PAGE_SCREEN_ID,
   SITE_SCREEN_PREFIX,
   SITE_SHELL_MAX_TABS,
@@ -13584,6 +13818,7 @@ export {
   chassisOuterSize,
   checkTierCaps,
   chooseCandidate,
+  cleanSiteMenuLabel,
   coerceSupportedLocale,
   dataSchemaScopeOf,
   decideSwitch,
@@ -13618,7 +13853,9 @@ export {
   isWidgetFamilySurface,
   layoutDirection,
   mergeIdiomOverlay,
+  mergeSiteMenu,
   normalizeServeApp,
+  normalizeSiteMenu,
   normalizeSiteOrigin,
   parseNumeric,
   primarySubtag,
@@ -13646,6 +13883,10 @@ export {
   siteAllowedOrigins,
   siteHost,
   siteLinkableScreens,
+  siteMenuDrifted,
+  siteMenuIsRuntime,
+  siteMenuPath,
+  siteMenuPathKey,
   siteNav,
   siteNavConfig,
   siteNavKind,

package/dist/cli.mjs

@@ -7530,6 +7530,7 @@ function buttonVariant(style) {
 var SYSTEM_FONT_FAMILY, TONAL_ELEVATION_ALPHA, BUTTON_MIN_HIT_TARGET, nonNegative, nonEmpty, own, COLOR_TOKEN_PROPS, TYPOGRAPHY_TOKEN_PROPS, BUTTON_VARIANTS;
 var init_tokens = __esm({
   "../../core/ts/src/tokens.ts"() {
+    "use strict";
     SYSTEM_FONT_FAMILY = "$system";
     TONAL_ELEVATION_ALPHA = [0, 0.05, 0.08, 0.11, 0.12, 0.14];
     BUTTON_MIN_HIT_TARGET = 44;
@@ -7585,6 +7586,7 @@ function resolveTranslation(value, catalog3, sourceCatalog) {
 var BINDING_SIGILS, BINDING_SIGIL_RE, TRANSLATION_PREFIX, TRANSLATION_KEY_RE;
 var init_bindings = __esm({
   "../../core/ts/src/bindings.ts"() {
+    "use strict";
     BINDING_SIGILS = ["service", "flag", "item", "t"];
     BINDING_SIGIL_RE = new RegExp(
       `^\\$(?:${BINDING_SIGILS.filter((s2) => s2 !== "t").join("|")})\\b|^\\$t:`
@@ -16622,6 +16624,7 @@ function resolveIdiom(tokens2, ctx = {}) {
 var IDIOM_CONTEXTS, UNSAFE_KEYS;
 var init_idiom = __esm({
   "../../core/ts/src/idiom.ts"() {
+    "use strict";
     IDIOM_CONTEXTS = {
       ios: { native: ["ios"] },
       android: { native: ["material"] },
@@ -20102,7 +20105,7 @@ var init_catalog_cache = __esm({
           this.save({ ...before, latestAvailable, latestCompatible });
           fail(
             "catalog_incompatible",
-            "requested kit is absent/incompatible; keep installed kit and inspect himi docs status"
+            "requested kit is absent/incompatible; keep installed kit and inspect himi docs status, or refresh --unpin to follow the current catalog"
           );
         }
         const manifestBytes = await this.download(
@@ -32256,6 +32259,9 @@ function assertSiteShellConfig(site) {
   if (site.layout !== void 0 && !SITE_LAYOUTS.includes(site.layout)) {
     throw new Error(`site layout ${JSON.stringify(site.layout)} must be one of ${SITE_LAYOUTS.join(", ")}`);
   }
+  if (site.menuSource !== void 0 && site.menuSource !== "contract" && site.menuSource !== "runtime") {
+    throw new Error(`site menuSource ${JSON.stringify(site.menuSource)} must be "contract" or "runtime"`);
+  }
   if (!site.pages.some((page) => (page.placement ?? "tab") === "tab")) {
     throw new Error('a site shell needs at least one page with placement "tab"');
   }
@@ -32271,6 +32277,24 @@ var init_site_shell = __esm({
   }
 });
 
+// ../../core/ts/src/site-menu-script.generated.ts
+var SITE_NAV_LINKS_JS, SITE_MENU_SYSTEM_SEGMENT, SITE_MENU_SYSTEM_TITLE;
+var init_site_menu_script_generated = __esm({
+  "../../core/ts/src/site-menu-script.generated.ts"() {
+    SITE_NAV_LINKS_JS = '(function(){var q=document.querySelectorAll("nav a, header a, [role=navigation] a"),o=[],i,a,t,h;for(i=0;i<q.length&&o.length<24;i++){a=q[i];t=String(a.textContent||"").replace(/\\s+/g," ").trim();h=String(a.href||"");if(t&&/^https?:/.test(h))o.push({label:t,href:h})}return o})()';
+    SITE_MENU_SYSTEM_SEGMENT = "^(popup-.*|lightbox.*|.*thank-?you.*|checkout|cart(-page)?|payment-request(-page)?|expired-reset-link|access-restricted|reservation|(event|experience|reservation|order|item)-details|(product|service|category|group|project|collection|reviews-collection|donation-thank-you)-page|post|project|collection|group|booking-(form|calendar)|plan-customization|notifications?|followers?|following|my-(?!account$)[a-z-]+|profile|search(-results)?|blank(-\\d+)?|404)$";
+    SITE_MENU_SYSTEM_TITLE = "\\b(thank you|\\(popup\\)|leave (a )?review|notifications|followers|side cart|order error|pending approval|my (rewards|subscriptions|bookings|orders|groups|wallet))\\b|\\b(group|service|product|project|collection|category|cart|payment request) pages?$|\\b(event|experience|reservation|item) details\\b";
+  }
+});
+
+// ../../core/ts/src/site-menu.ts
+var init_site_menu = __esm({
+  "../../core/ts/src/site-menu.ts"() {
+    init_site_shell();
+    init_site_menu_script_generated();
+  }
+});
+
 // ../../core/ts/src/index.ts
 var init_src4 = __esm({
   "../../core/ts/src/index.ts"() {
@@ -32298,6 +32322,7 @@ var init_src4 = __esm({
     init_app_identity();
     init_app_registry_client();
     init_site_shell();
+    init_site_menu();
   }
 });
 
@@ -168276,6 +168301,7 @@ var init_crawl_look = __esm({
     init_rest();
     init_net_guard();
     init_write_artifacts();
+    init_site_menu_script_generated();
     PLAYWRIGHT_HINT = "npx playwright install chromium";
     PAGE_EVAL = `(() => {
   const wst = {};
@@ -168335,10 +168361,10 @@ var init_crawl_look = __esm({
   const navAnchors = Array.from(document.querySelectorAll("nav a, header a, [role=navigation] a"));
   const nav = navAnchors.map((a) => (a.textContent || "").trim()).filter(Boolean).slice(0, 24);
   // WHERE each label goes \u2014 a site shell orders its tabs by these (RFC 0062). a.href is
-  // already absolute; an anchor with no text or no href is not a page link.
-  const navLinks = navAnchors
-    .map((a) => ({ label: txt(a), href: String(a.href || "") }))
-    .filter((l) => l.label && /^https?:/.test(l.href)).slice(0, 24);
+  // already absolute; an anchor with no text or no href is not a page link. The SAME extraction a
+  // site shell runs on the device for its runtime menu (#3675) \u2014 one generated source, so the menu
+  // read at build time and the menu read at runtime agree.
+  const navLinks = ${SITE_NAV_LINKS_JS};
   const headings = Array.from(document.querySelectorAll("h1,h2")).map((h) => (h.textContent || "").trim()).filter(Boolean).slice(0, 12);
   const hero = ((document.querySelector("h1") && document.querySelector("h1").textContent) || "").trim();
 
@@ -170508,6 +170534,7 @@ var DERIVED_SITE_MAX_PAGES, SITE_PAGE_TITLE_MAX, ROLE_ICON, TAB_ROLES, SYSTEM_SE
 var init_site_shell_derive = __esm({
   "src/site-analyze/site-shell-derive.ts"() {
     init_site_shell();
+    init_site_menu_script_generated();
     init_traits();
     DERIVED_SITE_MAX_PAGES = 10;
     SITE_PAGE_TITLE_MAX = 40;
@@ -170528,8 +170555,8 @@ var init_site_shell_derive = __esm({
       other: "globe"
     };
     TAB_ROLES = /* @__PURE__ */ new Set(["shop", "book", "menu", "events", "plans", "blog", "gallery", "library"]);
-    SYSTEM_SEGMENT = /^(popup-.*|lightbox.*|.*thank-?you.*|checkout|cart(-page)?|payment-request(-page)?|expired-reset-link|access-restricted|reservation|(event|experience|reservation|order|item)-details|(product|service|category|group|project|collection|reviews-collection|donation-thank-you)-page|post|project|collection|group|booking-(form|calendar)|plan-customization|notifications?|followers?|following|my-(?!account$)[a-z-]+|profile|search(-results)?|blank(-\d+)?|404)$/i;
-    SYSTEM_TITLE = /\b(thank you|\(popup\)|leave (a )?review|notifications|followers|side cart|order error|pending approval|my (rewards|subscriptions|bookings|orders|groups|wallet))\b|\b(group|service|product|project|collection|category|cart|payment request) pages?$|\b(event|experience|reservation|item) details\b/i;
+    SYSTEM_SEGMENT = new RegExp(SITE_MENU_SYSTEM_SEGMENT, "i");
+    SYSTEM_TITLE = new RegExp(SITE_MENU_SYSTEM_TITLE, "i");
     HOME_WORD = /^(home|home ?page|main|start|accueil|inicio|início|startseite|home ?sweet ?home|בית|דף הבית|ראשי|الرئيسية|ホーム|首页|홈)$/i;
     MEMBER_PAGE_ROUTES = {
       "account/my-orders": "orders",

package/guides/sdk-reference.json

@@ -1058,7 +1058,7 @@
         "name": "SiteNavConfig",
         "kind": "interface",
         "jsdoc": "/** How an incoming site URL finds its screen. */",
-        "decl": "export interface SiteNavConfig {\n  /** https PATH BOUNDARIES (`https://owner.wixsite.com/my-shop/`), the same form as the\n   *  site's WebView `allowedOrigins`: exact host, and the path is the boundary or under it. */\n  origins: string[];\n  /** Longest path-segment prefix wins, on the path RELATIVE to the matched origin.\n   *  `/` matches the home page only. */\n  routes: SiteRoute[];\n  /** The screen an on-site URL no route owns opens in. `\"\"`/absent ⇒ the `/` route's\n   *  screen; no `/` route either ⇒ the link does not resolve. */\n  fallbackScreenId?: string;\n}"
+        "decl": "export interface SiteNavConfig {\n  /** https PATH BOUNDARIES (`https://owner.wixsite.com/my-shop/`), the same form as the\n   *  site's WebView `allowedOrigins`: exact host, and the path is the boundary or under it. */\n  origins: string[];\n  /** Longest path-segment prefix wins, on the path RELATIVE to the matched origin.\n   *  `/` matches the home page only. */\n  routes: SiteRoute[];\n  /** The screen an on-site URL no route owns opens in. `\"\"`/absent ⇒ the `/` route's\n   *  screen; no `/` route either ⇒ the link does not resolve. */\n  fallbackScreenId?: string;\n  /** Where the shell's tabs and drawer come from. `\"runtime\"`: the device reads the\n   *  site's own menu as pages load and builds the NEXT launch's chrome from it\n   *  (`mergeSiteMenu` in `@himalaya/core/site-menu`). `\"contract\"`/absent: the served\n   *  `tabBar`/`drawer`/`sidebar` exactly as they are. OTA, like the rest of this block. */\n  menuSource?: \"contract\" | \"runtime\";\n}"
       },
       {
         "name": "SiteRoute",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1316.0",
+  "version": "0.1318.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "c93d8a8f42002d89399db4200dcc4c2052fb748a839303eb6a3faa0f"
+  "falconPackageHash": "dfd3f0fd8aa48b52c1b817a8496d8d6db5a934ad7ca0aaf6b203615f"
 }