@wix/himalaya-cli 0.1418.0 → 0.1420.0

package/dist/cli.mjs

@@ -10096,7 +10096,10 @@ var validate_descriptor_core_exports = {};
 __export(validate_descriptor_core_exports, {
   CORE_PACKAGES: () => CORE_PACKAGES,
   CRAWL_BLOCKING_PASSES: () => CRAWL_BLOCKING_PASSES,
+  DESCRIPTOR_DEPTH_BUDGETS: () => DESCRIPTOR_DEPTH_BUDGETS,
+  DEVICE_NETWORK_WITHHELD: () => DEVICE_NETWORK_WITHHELD,
   DEVICE_PARITY_WITHHELD: () => DEVICE_PARITY_WITHHELD,
+  DEVICE_WITHHELD: () => DEVICE_WITHHELD,
   EMBEDDED_BINDING: () => EMBEDDED_BINDING,
   INTEGER_MODIFIERS: () => INTEGER_MODIFIERS,
   INTEGER_PROPS: () => INTEGER_PROPS,
@@ -10118,6 +10121,8 @@ __export(validate_descriptor_core_exports, {
   bootBundleWorker: () => bootBundleWorker,
   collectServiceBindings: () => collectServiceBindings,
   componentPropFindings: () => componentPropFindings,
+  depthBudgetFindings: () => depthBudgetFindings,
+  depthBudgetIssues: () => depthBudgetIssues,
   dryRunBundle: () => dryRunBundle,
   enumFieldNames: () => enumFieldNames,
   extractBundleContract: () => extractBundleContract,
@@ -10473,9 +10478,12 @@ async function bootBundleWorker(bundleJs, opts) {
     }, info() {
     }, debug() {
     } },
-    // A raw fetch is still a signal, not a silent hang (mirrors runBundleSandbox).
-    fetch: () => {
-      throw new Error("`fetch` is not available \u2014 workers load data via the sanctioned Wix transport (`@himalaya/wix-*` or `globalThis.himalaya.wixApi.call`), not raw `fetch`.");
+    // A raw fetch is still a signal, not a silent hang (mirrors runBundleSandbox). Under
+    // deviceParity it is ABSENT instead, as on every device (#4499 — DEVICE_NETWORK_WITHHELD).
+    ...opts.deviceParity ? {} : {
+      fetch: () => {
+        throw new Error("`fetch` is not available \u2014 workers load data via the sanctioned Wix transport (`@himalaya/wix-*` or `globalThis.himalaya.wixApi.call`), not raw `fetch`.");
+      }
     },
     // Under deviceParity these are ABSENT so a bundle touching one throws here exactly as it
     // would on the FLOOR. Measured, not assumed (engine-parity runners, #1367): JSC and the
@@ -10522,7 +10530,7 @@ async function bootBundleWorker(bundleJs, opts) {
   let guestActions;
   let guestSession;
   try {
-    const hide = opts.deviceParity ? DEVICE_PARITY_WITHHELD : void 0;
+    const hide = opts.deviceParity ? DEVICE_WITHHELD : void 0;
     if (realm.runWithActions) {
       const ran = await realm.runWithActions(bundleJs, sandbox, {
         timeoutMs: 2e3 + budgetMs,
@@ -11612,6 +11620,100 @@ function bottomSheetFindings(descriptor) {
   visit(descriptor, "", true);
   return out2;
 }
+function depthBudgetIssues(findings) {
+  return findings.map((f2) => ({
+    severity: "error",
+    pass: "depth-budget",
+    path: f2.path,
+    message: f2.message,
+    limit: f2.limit,
+    actual: f2.actual
+  }));
+}
+function depthBudgetFindings(descriptor) {
+  const out2 = [];
+  const templates = [];
+  const isComponent = (v2) => {
+    const body = v2?.body;
+    return !!body && typeof body === "object" && typeof body.type === "string" && typeof body.package === "string";
+  };
+  const hostedTemplates = (v2, path2) => {
+    const props = v2.body.props;
+    const found = [];
+    if (!props) return found;
+    const itemsPath = props.itemsPath ?? props.items_path;
+    const rowHost = v2.body.package === "himalaya" ? ROW_TEMPLATE_HOST_TYPES.has(v2.body.type) : true;
+    if (rowHost && typeof itemsPath === "string" && itemsPath !== "" && Array.isArray(props.items) && isComponent(props.items[0])) {
+      found.push({ node: props.items[0], path: `${path2}.body.props.items[0]`, host: `${v2.body.type} at ${path2}` });
+    }
+    if (isComponent(props.eventTemplate)) {
+      found.push({ node: props.eventTemplate, path: `${path2}.body.props.eventTemplate`, host: `${v2.body.type} at ${path2}` });
+    }
+    return found;
+  };
+  const measure2 = (root, rootPath, mode) => {
+    let depth = 0, nodes = 0, deepest = rootPath;
+    const skip = /* @__PURE__ */ new Set();
+    const stack = [
+      { v: root, path: rootPath, depth: 0, atRoot: mode === "screen" }
+    ];
+    while (stack.length) {
+      const { v: v2, path: path2, depth: parentDepth, atRoot } = stack.pop();
+      if (skip.has(v2)) continue;
+      if (Array.isArray(v2)) {
+        for (let i2 = v2.length - 1; i2 >= 0; i2--) stack.push({ v: v2[i2], path: `${path2}[${i2}]`, depth: parentDepth, atRoot: false });
+        continue;
+      }
+      if (!v2 || typeof v2 !== "object") continue;
+      let here = parentDepth;
+      if (isComponent(v2)) {
+        here = parentDepth + 1;
+        nodes += 1;
+        if (here > depth) {
+          depth = here;
+          deepest = path2;
+        }
+        for (const t2 of hostedTemplates(v2, path2)) {
+          if (mode === "screen") templates.push(t2);
+          else skip.add(t2.node);
+        }
+      }
+      const entries = Object.entries(v2);
+      for (let i2 = entries.length - 1; i2 >= 0; i2--) {
+        const [key2, child] = entries[i2];
+        if (!child || typeof child !== "object" || isOpaqueAuthorJson(key2, child, atRoot)) continue;
+        stack.push({ v: child, path: `${path2}.${key2}`, depth: here, atRoot: false });
+      }
+    }
+    return { depth, nodes, deepest };
+  };
+  const flatten = "flatten the layout \u2014 drop wrapper stacks, or move a section into its own screen";
+  const report3 = (what, m2, budget, rootPath) => {
+    if (m2.depth > budget.maxDepth) {
+      out2.push({
+        measure: "depth",
+        path: m2.deepest,
+        limit: budget.maxDepth,
+        actual: m2.depth,
+        message: `${what} nests ${m2.depth} component levels; the limit is ${budget.maxDepth} (deepest node at ${m2.deepest}) \u2014 ${flatten}`
+      });
+    }
+    if (m2.nodes > budget.maxNodes) {
+      out2.push({
+        measure: "nodes",
+        path: rootPath,
+        limit: budget.maxNodes,
+        actual: m2.nodes,
+        message: `${what} has ${m2.nodes} components; the limit is ${budget.maxNodes} \u2014 ${flatten}`
+      });
+    }
+  };
+  report3("screen", measure2(descriptor, "$", "screen"), DESCRIPTOR_DEPTH_BUDGETS.screen, "$");
+  for (const t2 of templates) {
+    report3(`row template of the ${t2.host}`, measure2(t2.node, t2.path, "template"), DESCRIPTOR_DEPTH_BUDGETS.rowTemplate, t2.path);
+  }
+  return out2;
+}
 function topBarFindings(descriptor) {
   const out2 = [];
   const bar = descriptor?.topBar;
@@ -11763,6 +11865,11 @@ function validateScreenDescriptor(screenId, descriptor, opts = {}) {
   const issues = [];
   const strict = opts.strict ?? false;
   const hygiene = strict ? "error" : "warning";
+  const depthFindings = depthBudgetFindings(descriptor);
+  const depthIssues = depthBudgetIssues(depthFindings);
+  if (depthFindings.some((f2) => f2.measure === "depth" && f2.actual > UNSAFE_TO_RECURSE_DEPTH)) {
+    return { screenId, ok: false, strict, issues: depthIssues, services: [] };
+  }
   const fixture = new FixtureValidator({ tokens: opts.tokens, allowedComponents: opts.allowedComponents });
   const v2 = fixture.validate(descriptor);
   const lbIntegrity = descriptor?.logicBundle?.integrity;
@@ -11866,6 +11973,7 @@ function validateScreenDescriptor(screenId, descriptor, opts = {}) {
   for (const finding of topBarFindings(descriptor)) {
     issues.push({ severity: "warning", pass: "top-bar", path: finding.path, message: finding.message });
   }
+  issues.push(...depthIssues);
   const bindings = collectServiceBindings(descriptor);
   const descriptorActions = collectDescriptorActions(descriptor);
   const workerActions = descriptorActions.filter(({ actionId }) => actionId.startsWith("tier5."));
@@ -12365,7 +12473,7 @@ function validateScreenDescriptor(screenId, descriptor, opts = {}) {
     services: Object.keys(services)
   };
 }
-var CRAWL_BLOCKING_PASSES, BOOT_EVAL_TIMEOUT_MS, DRIFT_PROBES, DEVICE_PARITY_WITHHELD, defaultEvaluator, bootEvaluator, actionEvaluator, NATIVE_PROP_ENUMS, KNOWN_PROPS, IN_ARRAY_BINDING_PROPS, SERVICE_SIGIL, INTEGER_PROPS, NATIVE_REQUIRED_PROPS, bareNestedClass, NATIVE_NESTED_CLASSES, NATIVE_MODIFIERS_CLASS, NATIVE_DESCRIPTOR_CLASS, NATIVE_DESCRIPTOR_NESTED, NATIVE_NESTED_PROPS, LENIENT_TOP_BAR_BLOCKS, MODIFIER_KEYS, INTEGER_MODIFIERS, MODIFIER_KINDS, SCHEMA_SCORED_NODES, CORE_PACKAGES, LEGACY_UNSCORED_KEYS, DYNAMIC_PLACEHOLDER, LITERAL_ONLY_PROPS, SERVICE_ONLY_BINDING_PROPS, WHOLE_VALUE_BINDING, EMBEDDED_BINDING, OPTIONS_BINDING_PROPS, EDITOR_SERVICE_NAME, SHEET_PLACEMENTS, TOP_BAR_TRAILING_LIMIT, TOP_BAR_NON_TRAILING, BUTTON_STYLES, EMPTY_STATE_ACTION_STYLES, EMPTY_STATE_ACTION_SIZES;
+var CRAWL_BLOCKING_PASSES, BOOT_EVAL_TIMEOUT_MS, DRIFT_PROBES, DEVICE_PARITY_WITHHELD, DEVICE_NETWORK_WITHHELD, DEVICE_WITHHELD, defaultEvaluator, bootEvaluator, actionEvaluator, NATIVE_PROP_ENUMS, KNOWN_PROPS, IN_ARRAY_BINDING_PROPS, SERVICE_SIGIL, INTEGER_PROPS, NATIVE_REQUIRED_PROPS, bareNestedClass, NATIVE_NESTED_CLASSES, NATIVE_MODIFIERS_CLASS, NATIVE_DESCRIPTOR_CLASS, NATIVE_DESCRIPTOR_NESTED, NATIVE_NESTED_PROPS, LENIENT_TOP_BAR_BLOCKS, MODIFIER_KEYS, INTEGER_MODIFIERS, MODIFIER_KINDS, SCHEMA_SCORED_NODES, CORE_PACKAGES, LEGACY_UNSCORED_KEYS, DYNAMIC_PLACEHOLDER, LITERAL_ONLY_PROPS, SERVICE_ONLY_BINDING_PROPS, WHOLE_VALUE_BINDING, EMBEDDED_BINDING, OPTIONS_BINDING_PROPS, EDITOR_SERVICE_NAME, SHEET_PLACEMENTS, DESCRIPTOR_DEPTH_BUDGETS, UNSAFE_TO_RECURSE_DEPTH, ROW_TEMPLATE_HOST_TYPES, TOP_BAR_TRAILING_LIMIT, TOP_BAR_NON_TRAILING, BUTTON_STYLES, EMPTY_STATE_ACTION_STYLES, EMPTY_STATE_ACTION_SIZES;
 var init_validate_descriptor_core = __esm({
   "../../core/dev-server/src/validate-descriptor.core.ts"() {
     init_validator();
@@ -12379,6 +12487,7 @@ var init_validate_descriptor_core = __esm({
     init_media_value();
     init_frame_limits();
     init_rich_content();
+    init_worker_subtree();
     CRAWL_BLOCKING_PASSES = /* @__PURE__ */ new Set([
       // A screen whose bindings do not resolve has no state to crawl.
       "bindings",
@@ -12386,7 +12495,11 @@ var init_validate_descriptor_core = __esm({
       "worker-subtree",
       // A value outside a strict native enum decodes to nothing on device, so the crawl would be
       // exercising a screen the device cannot render.
-      "strict-enum"
+      "strict-enum",
+      // #4498 — a screen or row template over the nesting/node budget overflows a native stack on
+      // decode/render, so there is no screen to crawl. (The publish refusal is separate: the pass is
+      // always an error, and `himi push` refuses a depth-budget error even under `--force`.)
+      "depth-budget"
     ]);
     BOOT_EVAL_TIMEOUT_MS = 2e3;
     DRIFT_PROBES = [
@@ -12406,6 +12519,25 @@ var init_validate_descriptor_core = __esm({
       "TextDecoder",
       "AbortController"
     ];
+    DEVICE_NETWORK_WITHHELD = [
+      "fetch",
+      "XMLHttpRequest",
+      "WebSocket",
+      "EventSource",
+      "importScripts",
+      "WebTransport",
+      "RTCPeerConnection",
+      "webkitRTCPeerConnection",
+      "Worker",
+      "SharedWorker",
+      "Image",
+      "Audio",
+      "open",
+      "Request",
+      "Response",
+      "Headers"
+    ];
+    DEVICE_WITHHELD = [...DEVICE_NETWORK_WITHHELD, ...DEVICE_PARITY_WITHHELD];
     defaultEvaluator = null;
     bootEvaluator = null;
     actionEvaluator = null;
@@ -13358,6 +13490,12 @@ var init_validate_descriptor_core = __esm({
     OPTIONS_BINDING_PROPS = /* @__PURE__ */ new Set(["optionsPath"]);
     EDITOR_SERVICE_NAME = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
     SHEET_PLACEMENTS = /* @__PURE__ */ new Set(["overlay", "inline"]);
+    DESCRIPTOR_DEPTH_BUDGETS = Object.freeze({
+      screen: Object.freeze({ maxDepth: 40, maxNodes: 2e3 }),
+      rowTemplate: Object.freeze({ maxDepth: WORKER_SUBTREE_CEILINGS.maxDepth, maxNodes: WORKER_SUBTREE_CEILINGS.maxNodes })
+    });
+    UNSAFE_TO_RECURSE_DEPTH = 128;
+    ROW_TEMPLATE_HOST_TYPES = /* @__PURE__ */ new Set(["LazyList", "Grid", "Carousel", "Menu"]);
     TOP_BAR_TRAILING_LIMIT = 2;
     TOP_BAR_NON_TRAILING = /* @__PURE__ */ new Set(["leading", "principal", "bottom", "keyboard", "overflow"]);
     BUTTON_STYLES = /* @__PURE__ */ new Set(["filled", "tonal", "outlined", "text", "elevated", "bordered", "prominent", "plain", "glass", "primary", "secondary", "tertiary", "link", "destructive"]);
@@ -13882,7 +14020,10 @@ var validate_descriptor_exports = {};
 __export(validate_descriptor_exports, {
   CORE_PACKAGES: () => CORE_PACKAGES,
   CRAWL_BLOCKING_PASSES: () => CRAWL_BLOCKING_PASSES,
+  DESCRIPTOR_DEPTH_BUDGETS: () => DESCRIPTOR_DEPTH_BUDGETS,
+  DEVICE_NETWORK_WITHHELD: () => DEVICE_NETWORK_WITHHELD,
   DEVICE_PARITY_WITHHELD: () => DEVICE_PARITY_WITHHELD,
+  DEVICE_WITHHELD: () => DEVICE_WITHHELD,
   EMBEDDED_BINDING: () => EMBEDDED_BINDING,
   INTEGER_MODIFIERS: () => INTEGER_MODIFIERS,
   INTEGER_PROPS: () => INTEGER_PROPS,
@@ -13906,6 +14047,8 @@ __export(validate_descriptor_exports, {
   bundleNameFromUrl: () => bundleNameFromUrl,
   collectServiceBindings: () => collectServiceBindings,
   componentPropFindings: () => componentPropFindings,
+  depthBudgetFindings: () => depthBudgetFindings,
+  depthBudgetIssues: () => depthBudgetIssues,
   discoverNativeActions: () => discoverNativeActions,
   dryRunBundle: () => dryRunBundle,
   enumFieldNames: () => enumFieldNames,
@@ -16083,6 +16226,9 @@ ${opts.liveTransport ? `      var handle = { getState: function () { return def
   globalThis.fetch = function () {
     throw new Error("\`fetch\` is not available in the author-time sandbox \u2014 workers load data via the sanctioned Wix transport (\`@himalaya/wix-*\` or \`globalThis.himalaya.wixApi.call\`), not raw \`fetch\`.");
   };
+  // ...unless \`hide\` withholds it (deviceParity, #4499): every device has NO \`fetch\`, so a
+  // stub here would let a \`typeof fetch === "function"\` branch pass and fail on the device.
+${(opts.hide ?? []).includes("fetch") ? "  delete globalThis.fetch;" : ""}
   // Timers honour \`hide\`. Installing them unconditionally made \`deviceParity\` report
   // \`typeof setTimeout === "function"\` where node:vm correctly reported "undefined" \u2014 a FALSE
   // GREEN on exactly the floor gate this realm exists to enforce. The URL family is never
@@ -141168,7 +141314,8 @@ var init_push_errors = __esm({
       "not_carried_by_patch",
       "authoring_unavailable",
       "push_failed",
-      "binary_capability_gap"
+      "binary_capability_gap",
+      "depth_budget_exceeded"
     ];
     UX_CODES = {
       absent: "ux_evidence_absent",
@@ -180506,6 +180653,10 @@ function describeNondeterministicWorkers(workers) {
   return workers.length <= 1 ? workers.map(one).join("") : `${workers.slice(0, -1).map(one).join(", ")} and ${one(workers[workers.length - 1])}`;
 }
 var NONDETERMINISTIC_FIX = "move those clock or random values out of the service's initial state and compute them in an action instead (for example one the screen's onAppear dispatches)";
+function depthBudgetExceeded(report3) {
+  return (report3.issues ?? []).some((i2) => i2.severity === "error" && i2.pass === "depth-budget");
+}
+var DEPTH_BUDGET_HINT = "a screen or row template is over the depth budget (see the depth-budget issues' path and limit) \u2014 flatten it; `--force` does not override this";
 function summarizeLint(app, bres, outcome, strict, extraIssues = []) {
   const issues = (outcome.lint ?? []).flatMap((s2) => s2.issues.map((i2) => ({ screen: s2.screenId, ...i2 })));
   issues.push(...extraIssues);
@@ -184630,6 +184781,10 @@ ${doNow.map((l2) => `  ${l2}`).join("\n")}`);
               ...await navIssues2(buildDir, strict),
               ...scaffoldSourceFindings
             ]);
+            if (depthBudgetExceeded(report3)) {
+              print({ ...report3, published: false, code: "depth_budget_exceeded", hint: DEPTH_BUDGET_HINT });
+              return 1;
+            }
             if (hasErrors && !force) {
               print({ ...report3, published: false, hint: "lint found errors \u2014 fix them, or re-run with --force to publish anyway" });
               return 1;
@@ -186445,6 +186600,10 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           ...storesV1Issues(dir, strict),
           ...await navIssues2(dir, strict)
         ]);
+        if (depthBudgetExceeded(report3)) {
+          print(pushFailure2("depth_budget_exceeded", { ...report3, pushed: false, hint: DEPTH_BUDGET_HINT }));
+          return 1;
+        }
         if (hasErrors && !force) {
           print(pushFailure2("lint_errors", { ...report3, pushed: false, hint: "lint found errors \u2014 fix them, or re-run `himi push --force` to publish anyway" }));
           return 1;
@@ -187012,6 +187171,11 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           ...storesV1Issues(dir, strict),
           ...await navIssues2(dir, strict)
         ]);
+        if (depthBudgetExceeded(report3)) {
+          rmSync24(built, { recursive: true, force: true });
+          print({ ...report3, packed: false, code: "depth_budget_exceeded", hint: DEPTH_BUDGET_HINT });
+          return 1;
+        }
         if (hasErrors && !force) {
           rmSync24(built, { recursive: true, force: true });
           print({ ...report3, packed: false, hint: "lint found errors \u2014 fix them, or re-run `himi pack --force` to pack anyway" });
@@ -188143,12 +188307,29 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             return 2;
           }
           const descriptor = readFileSync103(file2, "utf8");
+          let parsed;
           try {
-            JSON.parse(descriptor);
+            parsed = JSON.parse(descriptor);
           } catch (e2) {
             io2.error(JSON.stringify({ ok: false, error: "invalid_descriptor", file: file2, screen: id, message: `${file2} is not valid JSON: ${e2.message}` }));
             return 1;
           }
+          const { depthBudgetFindings: depthBudgetFindings2, depthBudgetIssues: depthBudgetIssues2 } = await Promise.resolve().then(() => (init_validate_descriptor_core(), validate_descriptor_core_exports));
+          const tooDeep = depthBudgetIssues2(depthBudgetFindings2(parsed));
+          if (tooDeep.length > 0) {
+            io2.error(JSON.stringify({
+              ok: false,
+              code: "depth_budget_exceeded",
+              error: "depth_budget_exceeded",
+              patched: false,
+              app,
+              screen: id,
+              file: file2,
+              issues: tooDeep,
+              hint: "flatten the descriptor below the depth budget (see each issue's path and limit); `--force` does not override this"
+            }, null, 2));
+            return 1;
+          }
           const baseFound = await fetchReleaseManifest(client2, app, fromRelease);
           if ("error" in baseFound) {
             io2.error(JSON.stringify(baseFound));

package/guides/himi-json-output.md

@@ -47,6 +47,7 @@ keeps its existing fields and adds the code:
 | `ux_evidence_inherited_screens` | A partial push inherits screens not covered by local UX evidence. |
 | `ux_evidence_unreadable` | The UX evidence artifact cannot be read. |
 | `lint_errors` | Build/lint validation found errors. |
+| `depth_budget_exceeded` | A screen or a bound list/grid row template nests deeper, or has more components, than the depth budget (`depth-budget` validator pass). Each `issues[]` entry with `pass: "depth-budget"` carries the JSON `path` of the deepest node (or the tree root for a node count), the `limit` and the `actual` value. Takes precedence over `lint_errors`, and `--force` does not override it: content over the budget overflows the renderer's stack on devices already in the field. Flatten the layout and push again. `himi patch screen` refuses an over-deep raw descriptor with the same code, before any network request, and `himi pack` / `himi template publish` refuse with it even under `--force`. |
 | `control_token_expired` | The selected control token has expired. |
 | `app_source_contains_secrets` | Source archiving detected a possible credential. |
 | `app_source_too_large` | The encoded source archive exceeds its limit. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1418.0",
+  "version": "0.1420.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "94d6b78b2f9a4cc26ea336364cbbfa4d015375f8a456cf857359fa46"
+  "falconPackageHash": "d2a780fce1a8d60a36a6f5cf4f8860d5d454764049e49a0fa39c2885"
 }