@wix/himalaya-cli 0.1422.0 → 0.1424.0

package/dist/cli.mjs

@@ -7715,6 +7715,7 @@ function resolveTranslation(value, catalog3, sourceCatalog) {
 var BINDING_SIGILS, BINDING_SIGIL_RE, TRANSLATION_PREFIX, TRANSLATION_KEY_RE;
 var init_bindings = __esm({
   "../../core/ts/src/bindings.ts"() {
+    "use strict";
     BINDING_SIGILS = ["service", "flag", "item", "t"];
     BINDING_SIGIL_RE = new RegExp(
       `^\\$(?:${BINDING_SIGILS.filter((s2) => s2 !== "t").join("|")})\\b|^\\$t:`
@@ -10165,16 +10166,104 @@ var init_rich_content = __esm({
   }
 });
 
+// ../../core/dev-server/src/raw-json-depth.ts
+function rawJsonDepthFinding(value, limit = RAW_JSON_MAX_DEPTH) {
+  const EXIT = Symbol("exit");
+  const stack = [];
+  const trail = [];
+  const onTrail = /* @__PURE__ */ new Set();
+  let max = 0;
+  let path2;
+  if (value && typeof value === "object") stack.push({ v: value, depth: 1, key: "" });
+  while (stack.length) {
+    const step = stack.pop();
+    if (step === EXIT) {
+      onTrail.delete(trail.pop());
+      trail.pop();
+      continue;
+    }
+    const v2 = step.v;
+    if (onTrail.has(v2)) continue;
+    onTrail.add(v2);
+    trail.push(step.key, v2);
+    stack.push(EXIT);
+    if (step.depth > max) max = step.depth;
+    if (step.depth > limit && path2 === void 0) {
+      let p2 = "$";
+      for (let i2 = 2; i2 < trail.length; i2 += 2) {
+        const k2 = trail[i2];
+        p2 += typeof k2 === "number" ? `[${k2}]` : /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(k2) ? `.${k2}` : `[${JSON.stringify(k2)}]`;
+      }
+      path2 = p2;
+    }
+    if (Array.isArray(v2)) {
+      for (let i2 = v2.length - 1; i2 >= 0; i2--) {
+        const c2 = v2[i2];
+        if (c2 && typeof c2 === "object") stack.push({ v: c2, depth: step.depth + 1, key: i2 });
+      }
+    } else {
+      const keys = Object.keys(v2);
+      for (let i2 = keys.length - 1; i2 >= 0; i2--) {
+        const c2 = v2[keys[i2]];
+        if (c2 && typeof c2 === "object") stack.push({ v: c2, depth: step.depth + 1, key: keys[i2] });
+      }
+    }
+  }
+  if (path2 === void 0) return null;
+  return {
+    measure: "json",
+    path: path2,
+    limit,
+    actual: max,
+    message: `JSON nests ${max} levels deep; the limit is ${limit} (it crosses the limit at ${path2}). Native decoders recurse once per level and iOS refuses JSON nested past 512 \u2014 flatten that value (store it as a flat list or a string) or move it out of the descriptor`
+  };
+}
+var RAW_JSON_MAX_DEPTH;
+var init_raw_json_depth = __esm({
+  "../../core/dev-server/src/raw-json-depth.ts"() {
+    RAW_JSON_MAX_DEPTH = 256;
+  }
+});
+
 // ../../core/dev-server/src/realm-parity.ts
-function withheldGlobalsSource(hide) {
-  if (!hide?.length) return "";
-  return `${JSON.stringify(hide)}.forEach(function (n) { try { delete globalThis[n]; } catch (e) { /* non-configurable: leave it */ } });`;
+function allowlistSweepSource(keep = []) {
+  const key2 = [...keep].sort().join(",");
+  let source = sweepSources.get(key2);
+  if (source === void 0) {
+    source = buildSweepSource([.../* @__PURE__ */ new Set([...WORKER_ALLOWLIST, ...keep])].sort());
+    if (sweepSources.size >= 32) sweepSources.clear();
+    sweepSources.set(key2, source);
+  }
+  return source;
+}
+function buildSweepSource(allow) {
+  return `(function (allow) {
+  var keep = Object.create(null);
+  for (var i = 0; i < allow.length; i++) keep[allow[i]] = true;
+  for (var o = globalThis; o && o !== Object.prototype; o = Object.getPrototypeOf(o)) {
+    var names = Object.getOwnPropertyNames(o);
+    for (var j = 0; j < names.length; j++) {
+      var n = names[j];
+      if (keep[n] || n === "constructor" || n.indexOf("himi.quickjs.") === 0) continue;
+      try { delete o[n]; } catch (e) { /* non-configurable: leave it */ }
+    }
+  }
+})(${JSON.stringify(allow)});`;
+}
+function explainWithheldError(message, deviceParity) {
+  if (!deviceParity || message.includes(FETCH_ADVICE)) return message;
+  return BARE_FETCH_UNDEFINED.test(message) ? `${message} \u2014 ${FETCH_ADVICE}` : message;
 }
 function realmInstallsIntl(intl, hide) {
   return intl === true && !(hide ?? []).includes("Intl");
 }
+var sweepSources, FETCH_ADVICE, BARE_FETCH_UNDEFINED;
 var init_realm_parity = __esm({
   "../../core/dev-server/src/realm-parity.ts"() {
+    init_allowlist();
+    sweepSources = /* @__PURE__ */ new Map();
+    FETCH_ADVICE = "`fetch` is not available to a Tier-5 worker (no device has it: iOS's JSContext never did and the Android worker strips it, #4499) \u2014 load data through the sanctioned Wix transport (`@himalaya/wix-*` or `globalThis.himalaya.wixApi.call`).";
+    BARE_FETCH_UNDEFINED = /(?:^|[^.\w$'])'?fetch'? is not (?:defined|a function)\b/;
   }
 });
 
@@ -10204,8 +10293,10 @@ __export(validate_descriptor_core_exports, {
   NATIVE_NESTED_PROPS: () => NATIVE_NESTED_PROPS,
   NATIVE_PROP_ENUMS: () => NATIVE_PROP_ENUMS,
   NATIVE_REQUIRED_PROPS: () => NATIVE_REQUIRED_PROPS,
+  RAW_JSON_MAX_DEPTH: () => RAW_JSON_MAX_DEPTH,
   SERVICE_ONLY_BINDING_PROPS: () => SERVICE_ONLY_BINDING_PROPS,
   WHOLE_VALUE_BINDING: () => WHOLE_VALUE_BINDING,
+  allowlistSweepSource: () => allowlistSweepSource,
   bareNestedClass: () => bareNestedClass,
   bootBundleWorker: () => bootBundleWorker,
   collectServiceBindings: () => collectServiceBindings,
@@ -10215,6 +10306,7 @@ __export(validate_descriptor_core_exports, {
   deviceParityWithheldFrom: () => deviceParityWithheldFrom,
   dryRunBundle: () => dryRunBundle,
   enumFieldNames: () => enumFieldNames,
+  explainWithheldError: () => explainWithheldError,
   extractBundleContract: () => extractBundleContract,
   extractBundleServices: () => extractBundleServices,
   findSkipDerive: () => findSkipDerive,
@@ -10229,17 +10321,18 @@ __export(validate_descriptor_core_exports, {
   pathCrossesOpaqueAuthorJson: () => pathCrossesOpaqueAuthorJson,
   pathValue: () => pathValue,
   pinnedIntrinsicsSource: () => pinnedIntrinsicsSource,
+  rawJsonDepthFinding: () => rawJsonDepthFinding,
   realmInstallsIntl: () => realmInstallsIntl,
   resolveActionEvaluator: () => resolveActionEvaluator,
   resolveBootEvaluator: () => resolveBootEvaluator,
   resolveEvaluator: () => resolveEvaluator,
+  screenDepthFindings: () => screenDepthFindings,
   serviceOnlyBindingValues: () => serviceOnlyBindingValues,
   setActionEvaluator: () => setActionEvaluator,
   setBootEvaluator: () => setBootEvaluator,
   setDefaultEvaluator: () => setDefaultEvaluator,
   topBarFindings: () => topBarFindings,
   validateScreenDescriptor: () => validateScreenDescriptor,
-  withheldGlobalsSource: () => withheldGlobalsSource,
   workerSubtreeAllowed: () => workerSubtreeAllowed
 });
 function makeInert() {
@@ -10637,6 +10730,7 @@ async function bootBundleWorker(bundleJs, opts) {
         timeoutMs: 2e3 + budgetMs,
         filename: "himi-bundle.js",
         hide,
+        deviceParity: opts.deviceParity === true,
         wixCall: wixApi.call,
         dispatch: dispatchHost,
         skipLoad: opts.skipLoad === true,
@@ -10647,13 +10741,13 @@ async function bootBundleWorker(bundleJs, opts) {
       guestActions = ran.actions;
       guestSession = ran.session;
       if (ran.error) {
-        errors.push({ service: "(boot)", message: ran.error });
+        errors.push({ service: "(boot)", message: explainWithheldError(ran.error, opts.deviceParity === true) });
       }
     } else {
-      realm.run(bundleJs, sandbox, { timeoutMs: 2e3, filename: "himi-bundle.js", hide, ...pins });
+      realm.run(bundleJs, sandbox, { timeoutMs: 2e3, filename: "himi-bundle.js", hide, deviceParity: opts.deviceParity === true, ...pins });
     }
   } catch (err) {
-    errors.push({ service: "(boot)", message: err?.message ?? String(err), ...err?.stack ? { stack: err.stack } : {} });
+    errors.push({ service: "(boot)", message: explainWithheldError(err?.message ?? String(err), opts.deviceParity === true), ...err?.stack ? { stack: err.stack } : {} });
   }
   const clone = (v2) => {
     try {
@@ -10726,6 +10820,17 @@ async function bootBundleWorker(bundleJs, opts) {
     delete state._error;
     return state;
   }
+  const explainActionError = (err) => {
+    if (!(err && typeof err === "object" && typeof err.message === "string")) return;
+    const e2 = err;
+    const explained = explainWithheldError(e2.message, opts.deviceParity === true);
+    if (explained !== e2.message) {
+      try {
+        e2.message = explained;
+      } catch {
+      }
+    }
+  };
   const commitActionFailure = (def, err) => {
     const prev = def.state;
     if (!prev || typeof prev !== "object" || Array.isArray(prev)) return;
@@ -10756,6 +10861,7 @@ async function bootBundleWorker(bundleJs, opts) {
       const next = await Promise.race([Promise.resolve(fn2(def.state, ...args)), timeout]);
       applyResult(def, next);
     } catch (err) {
+      explainActionError(err);
       commitActionFailure(def, err);
       throw err;
     } finally {
@@ -10771,6 +10877,7 @@ async function bootBundleWorker(bundleJs, opts) {
         def.state = entry.state;
       }
       if (entry.error !== void 0) {
+        entry.error = explainWithheldError(entry.error, opts.deviceParity === true);
         commitActionFailure(def, entry.error);
         if (recordErrors && entry.reportError) errors.push({ service: entry.name, message: entry.error });
         continue;
@@ -11721,6 +11828,10 @@ function bottomSheetFindings(descriptor) {
   visit(descriptor, "", true);
   return out2;
 }
+function screenDepthFindings(descriptor) {
+  const raw = rawJsonDepthFinding(descriptor);
+  return raw ? [raw] : depthBudgetFindings(descriptor);
+}
 function depthBudgetIssues(findings) {
   return findings.map((f2) => ({
     severity: "error",
@@ -11966,9 +12077,9 @@ function validateScreenDescriptor(screenId, descriptor, opts = {}) {
   const issues = [];
   const strict = opts.strict ?? false;
   const hygiene = strict ? "error" : "warning";
-  const depthFindings = depthBudgetFindings(descriptor);
+  const depthFindings = screenDepthFindings(descriptor);
   const depthIssues = depthBudgetIssues(depthFindings);
-  if (depthFindings.some((f2) => f2.measure === "depth" && f2.actual > UNSAFE_TO_RECURSE_DEPTH)) {
+  if (depthFindings.some((f2) => f2.measure === "json" || f2.measure === "depth" && f2.actual > UNSAFE_TO_RECURSE_DEPTH)) {
     return { screenId, ok: false, strict, issues: depthIssues, services: [] };
   }
   const fixture = new FixtureValidator({ tokens: opts.tokens, allowedComponents: opts.allowedComponents });
@@ -12590,6 +12701,8 @@ var init_validate_descriptor_core = __esm({
     init_frame_limits();
     init_rich_content();
     init_worker_subtree();
+    init_raw_json_depth();
+    init_realm_parity();
     init_realm_parity();
     CRAWL_BLOCKING_PASSES = /* @__PURE__ */ new Set([
       // A screen whose bindings do not resolve has no state to crawl.
@@ -14171,8 +14284,10 @@ __export(validate_descriptor_exports, {
   NATIVE_NESTED_PROPS: () => NATIVE_NESTED_PROPS,
   NATIVE_PROP_ENUMS: () => NATIVE_PROP_ENUMS,
   NATIVE_REQUIRED_PROPS: () => NATIVE_REQUIRED_PROPS,
+  RAW_JSON_MAX_DEPTH: () => RAW_JSON_MAX_DEPTH,
   SERVICE_ONLY_BINDING_PROPS: () => SERVICE_ONLY_BINDING_PROPS,
   WHOLE_VALUE_BINDING: () => WHOLE_VALUE_BINDING,
+  allowlistSweepSource: () => allowlistSweepSource,
   appWorkerActionsFor: () => appWorkerActionsFor,
   bareNestedClass: () => bareNestedClass,
   bootBundleWorker: () => bootBundleWorker,
@@ -14185,6 +14300,7 @@ __export(validate_descriptor_exports, {
   discoverNativeActions: () => discoverNativeActions,
   dryRunBundle: () => dryRunBundle,
   enumFieldNames: () => enumFieldNames,
+  explainWithheldError: () => explainWithheldError,
   extractBundleContract: () => extractBundleContract,
   extractBundleServices: () => extractBundleServices,
   findSkipDerive: () => findSkipDerive,
@@ -14202,6 +14318,7 @@ __export(validate_descriptor_exports, {
   pathCrossesOpaqueAuthorJson: () => pathCrossesOpaqueAuthorJson,
   pathValue: () => pathValue,
   pinnedIntrinsicsSource: () => pinnedIntrinsicsSource,
+  rawJsonDepthFinding: () => rawJsonDepthFinding,
   readBuiltBundle: () => readBuiltBundle,
   readBuiltBundleMap: () => readBuiltBundleMap,
   realmInstallsIntl: () => realmInstallsIntl,
@@ -14209,13 +14326,13 @@ __export(validate_descriptor_exports, {
   resolveActionEvaluator: () => resolveActionEvaluator,
   resolveBootEvaluator: () => resolveBootEvaluator,
   resolveEvaluator: () => resolveEvaluator,
+  screenDepthFindings: () => screenDepthFindings,
   serviceOnlyBindingValues: () => serviceOnlyBindingValues,
   setActionEvaluator: () => setActionEvaluator,
   setBootEvaluator: () => setBootEvaluator,
   setDefaultEvaluator: () => setDefaultEvaluator,
   topBarFindings: () => topBarFindings,
   validateScreenDescriptor: () => validateScreenDescriptor,
-  withheldGlobalsSource: () => withheldGlobalsSource,
   workerSubtreeAllowed: () => workerSubtreeAllowed
 });
 import { readFileSync as readFileSync15, existsSync as existsSync13, readdirSync as readdirSync11 } from "node:fs";
@@ -14317,8 +14434,9 @@ var init_validate_descriptor = __esm({
     nodeVmEvaluator = {
       run(code, sandbox, opts) {
         const context = createContext(sandbox);
-        const hideSource = withheldGlobalsSource((opts.hide ?? []).filter((name) => !(name in sandbox)));
-        if (hideSource) runInContext(hideSource, context, { filename: "himi-hide.js" });
+        if (opts.deviceParity) {
+          runInContext(allowlistSweepSource(Object.keys(sandbox)), context, { filename: "himi-sweep.js" });
+        }
         const pins = pinnedIntrinsicsSource(opts);
         if (pins) {
           const pinned = runInContext(`(${pins})(Date, Math)`, context, { timeout: opts.timeoutMs, filename: "himi-pins.js" });
@@ -16057,6 +16175,10 @@ ${opts.liveTransport ? `  // Every action completion crosses as a RAW, ordered r
   // minimum local overlay needed for the worker's own subsequent reads; the host replays these
   // records through applyResult, which remains the authoritative merge/directive dialect.
   var actionBody = "";
+  // The host bridges, captured into this closure: under deviceParity the closing sweep deletes
+  // them from globalThis, so a bundle cannot call a bridge that exists on no device (#4537).
+  var hostWixCall = globalThis.__himiWixCall;
+  var hostDispatch = globalThis.__himiDispatch;
   var isArray = Array.isArray;
   var promiseResolve = Promise.resolve.bind(Promise);
   var promiseReject = Promise.reject.bind(Promise);
@@ -16305,7 +16427,7 @@ ${opts.liveTransport ? `      var handle = { getState: function () { return def
       call: function (method, path, body, headers) {
         var raw;
         try {
-          raw = __himiWixCall(
+          raw = hostWixCall(
             String(method),
             String(path),
             stringify(body === undefined ? null : body),
@@ -16327,7 +16449,7 @@ ${opts.liveTransport ? `      var handle = { getState: function () { return def
     dispatch: function (action, params) {
       var raw;
       try {
-        raw = __himiDispatch(stringValue(action), stringify(params === undefined ? null : params));
+        raw = hostDispatch(stringValue(action), stringify(params === undefined ? null : params));
       } catch (e) {
         return promiseReject(e instanceof Error ? e : new Error(stringValue(e)));
       }
@@ -16456,9 +16578,11 @@ ${opts.clock === void 0 ? "" : opts.freezeDate ? `  globalThis.Date = (${pinnedI
       return sweepPromise;
     },
   });` : ""}
-  // LAST, so nothing the prelude installed (the \`fetch\` stub) or the engine carries natively
-  // (QuickJS-ng 0.15's \`performance\`, \`queueMicrotask\`) survives deviceParity (#4511).
-  ${withheldGlobalsSource(opts.hide)}
+  // LAST, under deviceParity: the realm sweeps its OWN globals against the worker allow-list
+  // (#4537), so nothing the prelude installed (the \`fetch\` stub), nothing the engine carries
+  // natively (QuickJS-ng 0.15's \`performance\`, \`queueMicrotask\`) and none of the host bridges
+  // (\`__himiWixCall\`, \`__himiDispatch\` \u2014 captured into this closure above) survives.
+  ${opts.deviceParity ? allowlistSweepSource() : ""}
   return ${opts.liveTransport ? "{ readback: readback, dispatch: dispatchAction, actions: readActions }" : "readback"};
 })();
 `;
@@ -16527,6 +16651,7 @@ async function createQuickJsEvaluator(options = {}) {
             clock: opts.clock ?? options.clock,
             freezeDate: opts.clock !== void 0,
             hide: opts.hide,
+            deviceParity: opts.deviceParity === true,
             ...opts.seed === void 0 ? {} : { seed: opts.seed },
             ...opts.mirrorRandom ? { mirrorRandom: true } : {}
           }),
@@ -130765,6 +130890,10 @@ function composeStickyTree(payload, header, footer) {
 }
 async function renderDescriptorWeb(descriptor, tokens2, scheme, wantPng, services = null, width, isRTL, idiomContext) {
   const desc = descriptor;
+  const tooDeep = rawJsonDepthFinding(descriptor);
+  if (tooDeep) return { renderable: false, reason: `depth_budget_exceeded: ${tooDeep.message}` };
+  const tooDeepState = services ? rawJsonDepthFinding(services) : null;
+  if (tooDeepState) return { renderable: false, reason: `depth_budget_exceeded: worker state \u2014 ${tooDeepState.message}` };
   const payload = desc.payload;
   if (!payload || typeof payload !== "object" || !payload.body) {
     const renderer = desc.renderer ?? "unknown";
@@ -130932,6 +131061,7 @@ var init_render_descriptor = __esm({
     init_FakeServiceProvider();
     init_env();
     init_media_value();
+    init_raw_json_depth();
     init_message_format();
     init_a11y_contract();
     A11Y_MODIFIER_KEYS = [
@@ -132515,15 +132645,22 @@ async function handleBootRequest(req, res, state) {
   const tokenDocument = effectiveAppTokens(req, state);
   const homeScreenId = config.homeScreenId ?? state.app.meta.homeScreenId ?? null;
   let screen = null;
+  let homeScreenRefusal;
   if (homeScreenId) {
     const evalCtx = evalContextFromReq(req, state.appName);
     const caller = await resolveCaller(state.app.module, req);
-    const descriptor = await buildDescriptorForScreenId(
-      reqState,
-      homeScreenId,
-      new URLSearchParams(),
-      { ctx: evalCtx, caller }
-    );
+    let descriptor = null;
+    try {
+      descriptor = await buildDescriptorForScreenId(
+        reqState,
+        homeScreenId,
+        new URLSearchParams(),
+        { ctx: evalCtx, caller }
+      );
+    } catch (err) {
+      if (!(err instanceof DescriptorDepthRefusal)) throw err;
+      homeScreenRefusal = { error: "depth_budget_exceeded", screenId: err.screenId, finding: err.finding };
+    }
     if (descriptor && typeof descriptor === "object") {
       assignStableIds(descriptor);
       const acceptLanguage = req.headers["accept-language"];
@@ -132540,7 +132677,8 @@ async function handleBootRequest(req, res, state) {
     tokens: tokenDocument?.tokens ?? null,
     homeScreenId,
     screen,
-    homeBundle: null
+    homeBundle: null,
+    ...homeScreenRefusal ? { screenRefusal: homeScreenRefusal } : {}
   };
   const body = JSON.stringify(payload);
   const etag = makeEtag(body);
@@ -132738,10 +132876,15 @@ function descriptorCacheKey(reqBaseUrl, localeKey, flagKey, caller) {
   const who = caller.memberId ? `::mid=${caller.memberId}` : "";
   return `${reqBaseUrl}::${localeKey}::${flagKey}::ent=${caller.entitled ? 1 : 0}${who}`;
 }
+function refuseTooDeep(screenId, descriptor) {
+  const finding = rawJsonDepthFinding(descriptor);
+  if (finding) throw new DescriptorDepthRefusal(screenId, finding);
+  return descriptor;
+}
 async function buildDescriptorForScreenId(state, screenId, query = new URLSearchParams(), options = {}) {
   if (!options.skipOverride) {
     const preview = state.localOverrides.get(screenId);
-    if (preview) return { ...preview, screenId };
+    if (preview) return refuseTooDeep(screenId, { ...preview, screenId });
   }
   if (state.app) {
     await state.flagSync.refresh(state.app?.dir, state.flagStore, Date.now());
@@ -132767,7 +132910,7 @@ async function buildDescriptorForScreenId(state, screenId, query = new URLSearch
       }
       return null;
     })();
-    return built ? postprocessDescriptor(built, {
+    return built ? postprocessDescriptor(refuseTooDeep(screenId, built), {
       config: uiConfig(state.app.module.config),
       flagDefinitions: state.flagStore.list(),
       evalContext: evalCtx,
@@ -135488,6 +135631,9 @@ function createDevServer(opts = {}) {
         send(res, 404, "not found");
       } catch (err) {
         console.error("[himalaya-dev] handler error:", err);
+        if (err instanceof DescriptorDepthRefusal) {
+          return sendJson(res, 422, { error: "depth_budget_exceeded", screenId: err.screenId, finding: err.finding });
+        }
         if (isContainedCapabilityRefusal(err)) {
           return sendJson(res, 422, {
             error: "contained_capability_refused",
@@ -135539,7 +135685,7 @@ ${err.message}`);
   });
   return httpServer;
 }
-var ROOT6, TIER3_ROOT, TIER4_ROOT, tier4Verifier, TIER5_ROOT2, ACTION_HANDLERS_ROOT, SAMPLES_ROOT, TELEMETRY_BUFFER_CAP, overrideHistorySeq, CACHE_CONTROL, TIER5_SRC_ROOT, HMR_TMP_DIR, appReloadSeq, appReloadChain, WEBWIX_CLIENT_ID, WEBWIX_REDIRECT, WEBWIX_COOKIE, webOwnerPreviewInstances, webAccountMemberInstances, MIME, widgetOverrides;
+var ROOT6, TIER3_ROOT, TIER4_ROOT, tier4Verifier, TIER5_ROOT2, ACTION_HANDLERS_ROOT, SAMPLES_ROOT, TELEMETRY_BUFFER_CAP, overrideHistorySeq, CACHE_CONTROL, DescriptorDepthRefusal, TIER5_SRC_ROOT, HMR_TMP_DIR, appReloadSeq, appReloadChain, WEBWIX_CLIENT_ID, WEBWIX_REDIRECT, WEBWIX_COOKIE, webOwnerPreviewInstances, webAccountMemberInstances, MIME, widgetOverrides;
 var init_src6 = __esm({
   "../../core/dev-server/src/index.ts"() {
     init_inject();
@@ -135568,6 +135714,7 @@ var init_src6 = __esm({
     init_player_proxy();
     init_app_icon();
     init_app_assets();
+    init_raw_json_depth();
     init_app_module();
     init_provisioning_facts();
     init_validate();
@@ -135594,6 +135741,14 @@ var init_src6 = __esm({
     TELEMETRY_BUFFER_CAP = 1e3;
     overrideHistorySeq = 0;
     CACHE_CONTROL = "max-age=600, stale-while-revalidate=86400";
+    DescriptorDepthRefusal = class extends Error {
+      constructor(screenId, finding) {
+        super(finding.message);
+        this.screenId = screenId;
+        this.finding = finding;
+        this.name = "DescriptorDepthRefusal";
+      }
+    };
     TIER5_SRC_ROOT = resolve38(ROOT6, "core/dev-server/tier5-bundles-src");
     HMR_TMP_DIR = resolve38(ROOT6, "node_modules/.cache/himalaya-hmr");
     appReloadSeq = 0;
@@ -139631,11 +139786,33 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     base = BAKE_OFFLINE_BASE;
   }
   const devFetch = (url, init) => dev.inject(new Request(url, init));
+  const depthRefusalFromText = (status, text9) => {
+    if (status !== 422) return null;
+    try {
+      const body = JSON.parse(text9);
+      return body?.error === "depth_budget_exceeded" && body.finding ? body.finding : null;
+    } catch {
+      return null;
+    }
+  };
+  const depthRefusalOf = async (res) => depthRefusalFromText(res.status, await res.text());
+  const recordUnbuilt = async (screenId, res) => {
+    const text9 = await res.text();
+    const finding = depthRefusalFromText(res.status, text9);
+    if (finding) {
+      failedToBuild.push({ screenId, status: res.status, error: finding.message });
+      if (collect2?.lint && !lint.some((l2) => l2.screenId === screenId)) {
+        lint.push({ screenId, ok: false, issues: depthBudgetIssues([finding]) });
+      }
+      return;
+    }
+    failedToBuild.push({ screenId, status: res.status, error: text9.slice(0, 2e3) });
+  };
   try {
     for (const screenId of screenIds) {
       const res = await devFetch(`${base}/v1/screen/${screenId}`, { headers: { "X-Himalaya-App": app } });
       if (!res.ok) {
-        failedToBuild.push({ screenId, status: res.status, error: (await res.text()).slice(0, 2e3) });
+        await recordUnbuilt(screenId, res);
         continue;
       }
       const descriptor = await res.json();
@@ -139728,6 +139905,10 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
         const { services, liveCalls, liveReturned, liveErrors, mockCalls, mockUnserved, mockBootFailed, liveFailed } = await renderServicesFor(bundleName, descriptor, wantedRender);
         const rr2 = await renderDescriptorWeb(descriptor, renderTokens, renderScheme, collect2.render.png === true, services, collect2.render.width, collect2.render.rtl === true);
         renders.push({ screenId: wantedRender, scheme: renderScheme, ...rr2, ...await renderCompare(descriptor, services), ...collect2.render.dumpState && services ? { serviceState: services } : {}, ...liveCalls ? { liveCalls } : {}, ...liveReturned !== void 0 ? { liveReturned } : {}, ...liveFailed ? { liveFailed } : {}, ...liveErrors ? { liveErrors } : {}, ...mockCalls ? { mockCalls, mockUnserved } : {}, ...mockBootFailed ? { mockBootFailed } : {} });
+      } else if (res.status === 422 && collect2?.lint) {
+        const finding = await depthRefusalOf(res);
+        const recorded = lint.some((l2) => l2.screenId === wantedRender) || failedToBuild.some((f2) => f2.screenId === wantedRender);
+        if (finding && !recorded) lint.push({ screenId: wantedRender, ok: false, issues: depthBudgetIssues([finding]) });
       }
     }
     for (const t2 of preloaded.module.screens.templated ?? []) {
@@ -139782,7 +139963,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
           if (screenId.includes("/") || screenId.includes("..")) continue;
           const res = await devFetch(`${base}/v1/screen/${encodeURIComponent(screenId)}`, { headers: { "X-Himalaya-App": app } });
           if (!res.ok) {
-            failedToBuild.push({ screenId, status: res.status, error: (await res.text()).slice(0, 2e3) });
+            await recordUnbuilt(screenId, res);
             continue;
           }
           const descriptor = await res.json();
@@ -180791,7 +180972,7 @@ var NONDETERMINISTIC_FIX = "move those clock or random values out of the service
 function depthBudgetExceeded(report3) {
   return (report3.issues ?? []).some((i2) => i2.severity === "error" && i2.pass === "depth-budget");
 }
-var DEPTH_BUDGET_HINT = "a screen or row template is over the depth budget (see the depth-budget issues' path and limit) \u2014 flatten it; `--force` does not override this";
+var DEPTH_BUDGET_HINT = "a screen or row template nests too many components, or JSON in its props, modifiers, `input` or action `args` nests past the 256-level ceiling (see the depth-budget issues' path and limit) \u2014 flatten it; `--force` does not override this";
 function summarizeLint(app, bres, outcome, strict, extraIssues = []) {
   const issues = (outcome.lint ?? []).flatMap((s2) => s2.issues.map((i2) => ({ screen: s2.screenId, ...i2 })));
   issues.push(...extraIssues);
@@ -186198,7 +186379,8 @@ ${[...afterRun.next, ...testReminder ? [testReminder] : []].join("\n")}`);
         });
         const r2 = (outcome.renders ?? [])[0];
         if (!r2) {
-          print({ ok: false, screenId, error: "screen not found or did not build", failedToBuild: outcome.failedToBuild });
+          const why = (outcome.lint ?? []).find((s2) => s2.screenId === screenId)?.issues ?? [];
+          print({ ok: false, screenId, error: "screen not found or did not build", failedToBuild: outcome.failedToBuild, ...why.length ? { issues: why.map((i2) => ({ screen: screenId, ...i2 })) } : {} });
           return 1;
         }
         const diagnostics = (outcome.lint ?? []).find((s2) => s2.screenId === screenId)?.issues ?? [];
@@ -188449,8 +188631,8 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             io2.error(JSON.stringify({ ok: false, error: "invalid_descriptor", file: file2, screen: id, message: `${file2} is not valid JSON: ${e2.message}` }));
             return 1;
           }
-          const { depthBudgetFindings: depthBudgetFindings2, depthBudgetIssues: depthBudgetIssues2 } = await Promise.resolve().then(() => (init_validate_descriptor_core(), validate_descriptor_core_exports));
-          const tooDeep = depthBudgetIssues2(depthBudgetFindings2(parsed));
+          const { screenDepthFindings: screenDepthFindings2, depthBudgetIssues: depthBudgetIssues2 } = await Promise.resolve().then(() => (init_validate_descriptor_core(), validate_descriptor_core_exports));
+          const tooDeep = depthBudgetIssues2(screenDepthFindings2(parsed));
           if (tooDeep.length > 0) {
             io2.error(JSON.stringify({
               ok: false,
@@ -188461,7 +188643,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
               screen: id,
               file: file2,
               issues: tooDeep,
-              hint: "flatten the descriptor below the depth budget (see each issue's path and limit); `--force` does not override this"
+              hint: DEPTH_BUDGET_HINT
             }, null, 2));
             return 1;
           }

package/guides/himi-json-output.md

@@ -47,7 +47,7 @@ keeps its existing fields and adds the code:
 | `ux_evidence_inherited_screens` | A partial push inherits screens not covered by local UX evidence. |
 | `ux_evidence_unreadable` | The UX evidence artifact cannot be read. |
 | `lint_errors` | Build/lint validation found errors. |
-| `depth_budget_exceeded` | A screen or a bound list/grid row template nests deeper, or has more components, than the depth budget (`depth-budget` validator pass). Each `issues[]` entry with `pass: "depth-budget"` carries the JSON `path` of the deepest node (or the tree root for a node count), the `limit` and the `actual` value. Takes precedence over `lint_errors`, and `--force` does not override it: content over the budget overflows the renderer's stack on devices already in the field. Flatten the layout and push again. `himi patch screen` refuses an over-deep raw descriptor with the same code, before any network request, and `himi pack` / `himi template publish` refuse with it even under `--force`. |
+| `depth_budget_exceeded` | A screen or a bound list/grid row template nests deeper, or has more components, than the depth budget (`depth-budget` validator pass), or any of its JSON — props, modifiers, `input`, action `args` — nests past the raw-JSON ceiling of 256 levels. Each `issues[]` entry with `pass: "depth-budget"` carries the JSON `path` of the deepest node (the tree root for a node count, the first value past the ceiling for raw JSON), the `limit` and the `actual` value. Takes precedence over `lint_errors`, and `--force` does not override it: content over the budget overflows the renderer's stack on devices already in the field. Flatten the layout and push again. `himi patch screen` refuses an over-deep raw descriptor with the same code, before any network request, and `himi pack` / `himi template publish` refuse with it even under `--force`. |
 | `control_token_expired` | The selected control token has expired. |
 | `app_source_contains_secrets` | Source archiving detected a possible credential. |
 | `app_source_too_large` | The encoded source archive exceeds its limit. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1422.0",
+  "version": "0.1424.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "1e2ddc2aad76a7124c849d88d5862e6b66a03a169e9c066cea398548"
+  "falconPackageHash": "a0147b33ea7375fa7cf11b0027a0388feef592ede284346c3d5c9919"
 }