@wix/himalaya-cli 0.1480.0 → 0.1481.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/dev-server/src/app-module.d.ts

@@ -212,7 +212,7 @@ export interface DerivedAppMeta {
     platforms?: Record<string, boolean>;
     /** Forwarded from AppConfig.navigation.sidebar — RFC 0010 nav-modes sidebar structure. */
     sidebar?: import("@wix/himalaya/core").SidebarConfig;
-    /** Forwarded from AppConfig.navigation.navLogicBundle — RFC 0010 (dynamic-chrome
+    /** Forwarded from AppConfig.app.logicBundle, or its alias AppConfig.navigation.navLogicBundle — RFC 0010 (dynamic-chrome
      *  amendment, slots half): the app-level nav worker feeding the `*Path` bindings
      *  on tabs / drawer rows / top-bar actions. Authored with a RELATIVE `url`
      *  (`/v1/bundles/<name>`) and an empty `integrity`; `deriveNavigationConfig`

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/dev-server/src/builder.d.ts

@@ -53,6 +53,9 @@ export interface ScreenDescriptor {
     /** RFC 0069 — the chat transcript scroll policy. Mirror of
      *  ScreenDescriptor.transcript_scroll in core.proto. */
     transcriptScroll?: import("@wix/himalaya/core").TranscriptScroll;
+    /** The page's title for a host that shows it in its own navigation bar. Mirror of
+     *  ScreenDescriptor.host_title in core.proto. */
+    hostTitle?: import("@wix/himalaya/core").HostTitle;
 }
 /** Tier 3/4 + embeddable WebView behavior. Mirror of WebViewConfig in core.proto
  *  (RFC 0038). All fields optional; zero values reproduce legacy behavior. */

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/sdk/state/src/index.d.ts

@@ -24,6 +24,22 @@ export interface ServiceDefinition<S> {
      */
     perVisit?: readonly (keyof S & string)[];
 }
+/**
+ * App services — `defineService(name, { …, exports })`: what SCREEN-WORKER code may reach when this
+ * service is an app service (a `defineService` in the app's `app.logicBundle`). `app.dispatch` to an
+ * action not listed, and `app.read` of a path not under a listed state entry, reject `not_exported`.
+ * Each `state` entry is a top-level state key or a dotted path under one. Descriptor `$app:` bindings
+ * and descriptor-authored `app.*` actions are app-authored and NOT limited by it. Ignored in a screen
+ * bundle. The validator checks every entry exists. `A` narrows `actions` to the service's own names.
+ *
+ * Typed on `defineService`'s parameter, NOT on `ServiceDefinition<S>`: there it would be
+ * `ServiceExports<S, Record<string, unknown>>`, and a helper that spreads a `ServiceDefinition<S>`
+ * into `defineService` would fail to assign `string[]` to the narrowed action names.
+ */
+export interface ServiceExports<S, A = Record<string, unknown>> {
+    actions?: readonly (keyof A & string)[];
+    state?: readonly ((keyof S & string) | `${keyof S & string}.${string}`)[];
+}
 export interface ServiceHandle<S> {
     /** Snapshot of the current state. Cheap; safe to call from anywhere. */
     getState(): S;
@@ -249,7 +265,38 @@ export declare function encodeSubtree(component: Component): string;
  */
 export declare function defineService<S, A extends Record<string, (s: S, ...args: never[]) => S | undefined | Promise<S | undefined>>>(name: string, def: ServiceDefinition<S> & {
     actions?: A;
+    exports?: ServiceExports<S, A>;
 }): ServiceHandle<S> & {
     [K in keyof A]: (...args: Parameters<A[K]> extends [unknown, ...infer R] ? R : never[]) => Promise<S>;
 };
+/** Why an app-service call could not run. Mirrors `APP_SERVICE_ERROR_CODES` in `@himalaya/core`. */
+export type AppServiceErrorCode = "not_booted" | "unavailable" | "no_service" | "no_action" | "not_exported" | "undeclared";
+/**
+ * The rejection `app.read` / `app.dispatch` produce: an `Error` named `AppServiceError` with a
+ * `code`. Never a null result — "nothing ran" always rejects. A plain `Error` rather than a
+ * subclass, because worker bundles target an engine floor that has no `class` syntax.
+ */
+export type AppServiceError = Error & {
+    readonly code: AppServiceErrorCode;
+};
+/** Is this an `app.read` / `app.dispatch` rejection? Narrows to {@link AppServiceError}. */
+export declare function isAppServiceError(err: unknown): err is AppServiceError;
+/**
+ * The app's services, from a SCREEN worker. Requires the bundle to declare the
+ * `app_services` capability, and an app whose minimum binary ships app services.
+ */
+export declare const app: {
+    /**
+     * A read-only, point-in-time JSON copy of an exported app-service path (`"jobs.active"`).
+     * Resolves `undefined` only for an exported path that is unset; rejects with an
+     * {@link AppServiceError} when it cannot answer.
+     */
+    read(path: string): Promise<unknown>;
+    /**
+     * Run an exported app-service action (`"jobs.start"`) and resolve with its result payload
+     * (never its state). Rejects with an {@link AppServiceError} when the call cannot run, so
+     * "it started" can never be confused with "nothing ran".
+     */
+    dispatch(action: string, args?: unknown): Promise<unknown>;
+};
 export { validate, isValid as isValidValue, validators, validateAll, type ValidationFailure, type ValidationFailureRule, } from "@wix/himalaya/core/validation";

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/app-services-gate.d.ts

@@ -0,0 +1,86 @@
+import type { LogicBundleRef } from "./schema.js";
+/**
+ * The first binary version that ships RFC 0074's runtime (S3 iOS/macOS, S5 Android, S7 web).
+ *
+ * UNSET until the release that ships those arms sets it, so no app with shipped binaries
+ * qualifies yet — only a declared new app (`app.newApp`) does. Setting it is the one edit that
+ * opens the gate for apps whose rollout floor has been raised past it.
+ */
+export declare const APP_SERVICES_MIN_BINARY: string | undefined;
+/**
+ * The worker bridge functions `app.read` / `app.dispatch` call (RFC 0074 §4/§5/§9). Their names
+ * appear verbatim in any built bundle that uses them, which is how the validator (and the S2
+ * capability scan) detects a screen bundle reaching app services.
+ */
+export declare const APP_SERVICES_BRIDGE_MARKERS: readonly ["__himalaya_app_read", "__himalaya_app_dispatch"];
+/** Why an `app.read` / `app.dispatch` (or an `app.*` dispatch) could not run (RFC 0074 §4/§5). */
+export declare const APP_SERVICE_ERROR_CODES: readonly ["not_booted", "unavailable", "no_service", "no_action", "not_exported", "undeclared"];
+export type AppServiceErrorCode = (typeof APP_SERVICE_ERROR_CODES)[number];
+/** `defineApp({ app })` — RFC 0074 §3. */
+export interface AppServicesConfig {
+    /**
+     * The app-level worker bundle: every `defineService` in it is an app service. Canonical
+     * spelling of `navigation.navLogicBundle` (the RFC 0010 alias, still accepted); declaring
+     * both is an error. Bakes into the same wire field (`NavigationConfig.navLogicBundle`, 15).
+     */
+    logicBundle?: LogicBundleRef;
+    /**
+     * This app has never shipped a binary older than RFC 0074, so every binary it will ever
+     * serve supports app services (RFC 0074 §4: "a brand-new app qualifies from day one").
+     * Opens the §4 gate without a rollout floor. Authoring-only: it never reaches the wire.
+     * A rollout ring that declares a floor below {@link APP_SERVICES_MIN_BINARY} contradicts it
+     * and still fails.
+     */
+    newApp?: boolean;
+}
+/** The app-level bundle, whichever spelling declared it. */
+export declare function appLogicBundleRef(config: unknown): LogicBundleRef | undefined;
+/** The both-declared error (RFC 0074 §3.1), or null. */
+export declare function appLogicBundleConflict(config: unknown): string | null;
+/** The release floors the gate reads: `apps/<app>/rollout.yaml` rings (core/serve-control). */
+export interface AppServicesRollout {
+    rings: readonly {
+        name?: string;
+        minBinaryVersion?: string;
+    }[];
+}
+export interface AppServicesVerdict {
+    ok: boolean;
+    /** The lowest ring floor, or null when some ring (or the absent rollout) is unbounded. */
+    floor: string | null;
+    /** One sentence naming the floor, the required version and how to qualify. */
+    reason: string;
+}
+/**
+ * Numeric `major.minor.patch` compare (`1.10.0` > `1.9.2`), read EXACTLY as serve-control's
+ * `semverGte` reads a ring floor (`parts()` in core/serve-control/src/rollout.ts): a leading digit is
+ * required and a fourth number is ignored, so `v1.7.0` is 0.0.0 to both. Reading it more leniently here
+ * would let the lint gate open on a floor the serve plane ignores. The one deliberate difference is
+ * stricter: a pre-release ranks below its release.
+ */
+export declare function compareBinaryVersions(a: string, b: string): number;
+/** The lowest `minBinaryVersion` across the rings; null if any ring has none (unbounded) or there are none. */
+export declare function rolloutFloor(rollout: AppServicesRollout | null | undefined): string | null;
+/**
+ * RFC 0074 §4 — may this app use app services (`$app:`, `app.*`, `app_services`, the bridges)?
+ *
+ * Yes when the app's minimum served binary — the LOWEST rollout ring floor, a ring with none
+ * meaning "unbounded" — is at or above {@link APP_SERVICES_MIN_BINARY}, or when the app declares
+ * `app.newApp` and no ring floor contradicts it. NEVER while the constant is unset — not even for a
+ * new app: until a binary ships the runtime (S3/S5/S7), nothing resolves `$app:` or routes `app.*`,
+ * so a green lint would ship bindings that never resolve and taps that do nothing.
+ */
+export declare function appServicesAllowed(appConfig: unknown, rollout: AppServicesRollout | null | undefined, minBinary?: string | undefined): AppServicesVerdict;
+/**
+ * `app.<svc>.<action>` — EXACTLY three segments (RFC 0074 §5). `app.analytics` or
+ * `app.a.b.c` are not app-service ids, so `app.` stays usable as a flat handler prefix
+ * outside the reserved form.
+ */
+export declare function parseAppActionId(actionId: unknown): {
+    service: string;
+    action: string;
+} | null;
+/** Does this id use the reserved three-segment `app.` form? */
+export declare function isReservedAppActionId(actionId: unknown): boolean;
+/** Does this built bundle call `app.read` / `app.dispatch` (the bridge markers)? */
+export declare function bundleUsesAppServiceBridges(js: string | undefined): boolean;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/bindings.d.ts

@@ -11,10 +11,32 @@ export type BindingSigil = (typeof BINDING_SIGILS)[number];
  * render verbatim becomes an unresolved-binding placeholder. `service`/`flag`/`item`
  * are long enough for that collision to be implausible; one letter is not, and the
  * token grammar is always `$t:<key>` anyway.
+ *
+ * RFC 0074's `$app:` is deliberately NOT in this list yet. Every renderer gates on it (web
+ * `isBinding`, RN), and none resolves `$app:` until the runtime arms land (S3/S5/S7): adding it here
+ * alone made web/RN blank a field's literal sibling while iOS/Android printed it. It joins with the
+ * resolvers, all surfaces at once. Until then `isAppBinding` / `parseAppBinding` below are the
+ * validator's grammar, and the per-app gate keeps `$app:` out of served content.
  */
 export declare const BINDING_SIGIL_RE: RegExp;
 /** Is this value a binding rather than a literal? */
 export declare function isBindingExpr(v: unknown): v is string;
+/** RFC 0074 — the app-service sigil. `$app:<svc>.<path>`, resolved against the app-level worker. */
+export declare const APP_BINDING_PREFIX = "$app:";
+/**
+ * Split `$app:<svc>.<path>` into its service and path, or `null` when this is not one.
+ *
+ * Splits on the FIRST dot, as the runtimes do for `$service:`. A malformed expression (`$app:`,
+ * `$app:jobs`, `$app:jobs/active`, a space) returns null rather than a half-parsed result, so a
+ * caller cannot subscribe to an empty service or path. Leading/trailing whitespace is not
+ * trimmed: the renderers do not trim a bound value either.
+ */
+export declare function parseAppBinding(v: unknown): {
+    service: string;
+    path: string;
+} | null;
+/** Is this an `$app:` expression (well formed or not)? */
+export declare function isAppBinding(v: unknown): v is string;
 /** RFC 0054 — the localization sigil. `$t:<key>`, resolved against the app catalog. */
 export declare const TRANSLATION_PREFIX = "$t:";
 /** Key characters: dotted, lowercase-ish identifiers (`cart.add_to_cart`). */

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/define-app.d.ts

@@ -2,6 +2,7 @@ import type { DesignTokens } from "./tokens.js";
 import type { PushRoute, PushPayloadAdapter } from "./push-routes.js";
 import type { PushScreenMapEntry } from "./wix-push-links.js";
 import type { NavigationConfig, SplashConfig } from "./schema.js";
+import { type AppServicesConfig } from "./app-services-gate.js";
 import { type LocaleConfig } from "./locale.js";
 import { type DistributionConfig } from "./distribution.js";
 import type { CmsConfig } from "./cms.js";
@@ -428,6 +429,15 @@ export interface AppConfig {
     workerSubtreeScreens?: string[];
     /** RFC 0010 — navigation structure + deep-link mapping, served OTA. */
     navigation?: NavigationConfig;
+    /**
+     * RFC 0074 — app services. `app.logicBundle` is the app-level worker bundle: every
+     * `defineService` in it runs for the whole session, readable from any descriptor as
+     * `$app:<svc>.<path>` and callable as `app.<svc>.<action>`. The canonical spelling of
+     * `navigation.navLogicBundle` (still accepted as an alias); declaring both is an error. Both
+     * bake into the same wire field, so an old binary boots it as a plain nav worker — which is
+     * why `$app:` / `app.*` are gated per app on its release floor (see `appServicesAllowed`).
+     */
+    app?: AppServicesConfig;
     /**
      * RFC 0059 — how each surface picks its overlay from `tokens.json`'s `idiom` block.
      *

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/index.d.ts

@@ -3,6 +3,7 @@ export * from "./stream-policy.js";
 export * from "./locale.js";
 export * from "./media.js";
 export * from "./define-app.js";
+export * from "./app-services-gate.js";
 export * from "./distribution.js";
 export * from "./validator.js";
 export * from "./validation.js";

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/schema.d.ts

@@ -3002,6 +3002,9 @@ export interface TopBarConfig {
     visibility?: string;
     /** RFC 0066 §1 — bar fill token. iOS 26 keeps the system glass (amendment R12). */
     background?: TokenRef;
+    /** RFC 0010 "Native top-bar search" — the screen's search, drawn by whoever draws its bar natively (an embed's host
+     *  today: iOS `himalayaEmbedSearch`, Android `ProvideHimalayaEmbedSearch`). Read per screen only. */
+    searchable?: SearchableConfig;
     /** RFC 0066 amendment — the screen's logo; overrides `NavigationConfig.topBarLogo`. */
     logo?: TopBarLogo;
     /** RFC 0066 amendment — the title as a menu. */
@@ -3453,6 +3456,34 @@ export interface TranscriptScroll {
     /** Accessible name of the jump-to-latest control. Default "Jump to latest". */
     jumpLabel?: string;
 }
+/** RFC 0066 §2 as amended by RFC 0010 "Native top-bar search": `TopBarConfig.searchable`. Suggestions and scopes
+ *  (fields 6–11) come with the shell slot. The page's own search field hides with `hiddenPath: "$env:topBarSearch"`. */
+export interface SearchableConfig {
+    placeholder?: string;
+    /** `$service:` path to the current query. */
+    valuePath?: string;
+    /** `args.value` (string), after `debounceMs` of idle time. */
+    onChange?: Action;
+    /** `args.value`; a pending `onChange` fires first. */
+    onSubmit?: Action;
+    /** 0 or less = 250 ms. */
+    debounceMs?: number;
+    /** "automatic" (default, = "bar") | "bar" | "drawer" (a field under the bar) | "button" (a bar button that becomes the field). */
+    placement?: "automatic" | "bar" | "drawer" | "button";
+    /** `$service:` focus token (TextField.focusPath semantics). */
+    focusPath?: string;
+    /** The user ends the search without submitting; the query is cleared first. */
+    onCancel?: Action;
+    /** `$service:` bool: the search is busy. */
+    loadingPath?: string;
+}
+/** `ScreenDescriptor.hostTitle`. Each value is a literal, a `$t:` key, or a `$service:` path. */
+export interface HostTitle {
+    title: string;
+    subtitle?: string;
+    /** Id of the in-content component that draws the title and subtitle, which such a host's region does not draw. */
+    replaces?: string;
+}
 export interface ScreenDescriptor {
     screenId: string;
     renderer: RendererKind;
@@ -3476,6 +3507,10 @@ export interface ScreenDescriptor {
      *  when the reply outgrows it the host follows the tail. A drag pauses
      *  following, and only then is a jump-to-latest control shown. */
     transcriptScroll?: TranscriptScroll;
+    /** The page's title for a host that shows it in its own navigation bar (iOS `himalayaEmbedTitle`, Android
+     *  `ProvideHimalayaEmbedTitle`): it gets the title as soon as it has the descriptor, before the worker boots, and
+     *  `replaces` is not drawn. Every other host ignores it, so the in-content header stays. */
+    hostTitle?: HostTitle;
     /** Present when `renderer` is `webview_native_bridge` or `webview_ds`. */
     url?: string;
     capabilitiesRequired?: string[];

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/validator.d.ts

@@ -56,6 +56,21 @@ export declare const screenDescriptorSchema: {
                 };
             };
         };
+        readonly hostTitle: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly properties: {
+                readonly title: {
+                    readonly type: "string";
+                };
+                readonly subtitle: {
+                    readonly type: "string";
+                };
+                readonly replaces: {
+                    readonly type: "string";
+                };
+            };
+        };
         readonly url: {
             readonly type: "string";
             readonly format: "uri";
@@ -359,6 +374,9 @@ export declare const screenDescriptorSchema: {
                 readonly style: {
                     readonly type: "string";
                 };
+                readonly searchable: {
+                    readonly $ref: "#/$defs/searchableConfig";
+                };
                 readonly items: {
                     readonly type: "array";
                     readonly items: {
@@ -394,6 +412,39 @@ export declare const screenDescriptorSchema: {
                 };
             };
         };
+        readonly searchableConfig: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly properties: {
+                readonly placeholder: {
+                    readonly type: "string";
+                };
+                readonly valuePath: {
+                    readonly type: "string";
+                };
+                readonly onChange: {
+                    readonly $ref: "#/$defs/action";
+                };
+                readonly onSubmit: {
+                    readonly $ref: "#/$defs/action";
+                };
+                readonly debounceMs: {
+                    readonly type: "integer";
+                };
+                readonly placement: {
+                    readonly type: "string";
+                };
+                readonly focusPath: {
+                    readonly type: "string";
+                };
+                readonly onCancel: {
+                    readonly $ref: "#/$defs/action";
+                };
+                readonly loadingPath: {
+                    readonly type: "string";
+                };
+            };
+        };
         readonly toolbarItem: {
             readonly type: "object";
             readonly additionalProperties: false;
@@ -1655,6 +1706,9 @@ export declare const widgetSnapshotSchema: {
                 readonly style: {
                     readonly type: "string";
                 };
+                readonly searchable: {
+                    readonly $ref: "#/$defs/searchableConfig";
+                };
                 readonly items: {
                     readonly type: "array";
                     readonly items: {
@@ -1690,6 +1744,39 @@ export declare const widgetSnapshotSchema: {
                 };
             };
         };
+        readonly searchableConfig: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly properties: {
+                readonly placeholder: {
+                    readonly type: "string";
+                };
+                readonly valuePath: {
+                    readonly type: "string";
+                };
+                readonly onChange: {
+                    readonly $ref: "#/$defs/action";
+                };
+                readonly onSubmit: {
+                    readonly $ref: "#/$defs/action";
+                };
+                readonly debounceMs: {
+                    readonly type: "integer";
+                };
+                readonly placement: {
+                    readonly type: "string";
+                };
+                readonly focusPath: {
+                    readonly type: "string";
+                };
+                readonly onCancel: {
+                    readonly $ref: "#/$defs/action";
+                };
+                readonly loadingPath: {
+                    readonly type: "string";
+                };
+            };
+        };
         readonly toolbarItem: {
             readonly type: "object";
             readonly additionalProperties: false;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/core.mjs

@@ -7125,6 +7125,110 @@ function activeMediaItem(props, index = props.startIndex ?? 0) {
   return props.items?.[index];
 }
 
+// ../../core/ts/src/app-services-gate.ts
+var APP_SERVICES_MIN_BINARY = void 0;
+var APP_SERVICES_BRIDGE_MARKERS = ["__himalaya_app_read", "__himalaya_app_dispatch"];
+var APP_SERVICE_ERROR_CODES = [
+  "not_booted",
+  "unavailable",
+  "no_service",
+  "no_action",
+  "not_exported",
+  "undeclared"
+];
+function appLogicBundleRef(config) {
+  const c = config;
+  return c?.app?.logicBundle ?? c?.navigation?.navLogicBundle ?? void 0;
+}
+function appLogicBundleConflict(config) {
+  const c = config;
+  if (c?.app?.logicBundle !== void 0 && c?.navigation?.navLogicBundle !== void 0) {
+    return "app.logicBundle and navigation.navLogicBundle are both declared. They are the same app-level bundle (navigation.navLogicBundle is the RFC 0010 alias), and an app has one. Keep app.logicBundle.";
+  }
+  return null;
+}
+function compareBinaryVersions(a, b) {
+  const parts = (v) => {
+    const m = /^(\d+)(?:\.(\d+))?(?:\.(\d+))?/.exec(v.trim()) ?? [];
+    return [Number(m[1] ?? 0), Number(m[2] ?? 0), Number(m[3] ?? 0)];
+  };
+  const x = parts(a);
+  const y = parts(b);
+  for (let i = 0; i < 3; i++) {
+    if (x[i] !== y[i]) return x[i] < y[i] ? -1 : 1;
+  }
+  const pre = (v) => /^\d+(?:\.\d+){0,2}-/.test(v.trim());
+  if (pre(a) !== pre(b)) return pre(a) ? -1 : 1;
+  return 0;
+}
+function rolloutFloor(rollout) {
+  const rings = rollout?.rings ?? [];
+  if (rings.length === 0) return null;
+  let floor = null;
+  for (const ring of rings) {
+    const v = typeof ring.minBinaryVersion === "string" ? ring.minBinaryVersion.trim() : "";
+    if (!v) return null;
+    if (floor === null || compareBinaryVersions(v, floor) < 0) floor = v;
+  }
+  return floor;
+}
+function appServicesAllowed(appConfig, rollout, minBinary = APP_SERVICES_MIN_BINARY) {
+  const floor = rolloutFloor(rollout);
+  const newApp = appConfig?.app?.newApp === true;
+  const howTo = `raise every ring's minBinaryVersion in rollout.yaml to ${minBinary ?? "the first release that ships RFC 0074 (not cut yet)"}, or declare defineApp({ app: { newApp: true } }) if this app has never shipped an older binary`;
+  if (newApp && minBinary === void 0) {
+    return {
+      ok: false,
+      floor,
+      reason: "app.newApp is declared, but no released binary ships app services yet (APP_SERVICES_MIN_BINARY is unset), so nothing would resolve $app: or route app.* \u2014 the gate opens for new apps in the release that ships the runtime"
+    };
+  }
+  if (newApp) {
+    const lowest = lowestDeclaredFloor(rollout);
+    if (lowest !== null && compareBinaryVersions(lowest, minBinary) < 0) {
+      return {
+        ok: false,
+        floor,
+        reason: `app.newApp is declared, but a rollout ring still serves binaries from ${lowest}, below ${minBinary} (the first binary with app services) \u2014 raise that ring's minBinaryVersion, or drop newApp`
+      };
+    }
+    return { ok: true, floor, reason: "app.newApp: every binary this app serves ships app services" };
+  }
+  if (minBinary === void 0) {
+    return {
+      ok: false,
+      floor,
+      reason: `no released binary ships app services yet (APP_SERVICES_MIN_BINARY is unset) and this app's minimum binary is ${floor ?? "unbounded"} \u2014 ${howTo}`
+    };
+  }
+  if (floor === null) {
+    return { ok: false, floor, reason: `this app's minimum binary is unbounded (a rollout ring has no minBinaryVersion, or there is no rollout.yaml) \u2014 ${howTo}` };
+  }
+  if (compareBinaryVersions(floor, minBinary) < 0) {
+    return { ok: false, floor, reason: `this app's minimum binary is ${floor}, below ${minBinary} (the first binary with app services) \u2014 ${howTo}` };
+  }
+  return { ok: true, floor, reason: `minimum binary ${floor} ships app services (>= ${minBinary})` };
+}
+function lowestDeclaredFloor(rollout) {
+  let lowest = null;
+  for (const ring of rollout?.rings ?? []) {
+    const v = typeof ring.minBinaryVersion === "string" ? ring.minBinaryVersion.trim() : "";
+    if (v && (lowest === null || compareBinaryVersions(v, lowest) < 0)) lowest = v;
+  }
+  return lowest;
+}
+function parseAppActionId(actionId) {
+  if (typeof actionId !== "string") return null;
+  const m = /^app\.([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]+)$/.exec(actionId);
+  return m ? { service: m[1], action: m[2] } : null;
+}
+function isReservedAppActionId(actionId) {
+  return parseAppActionId(actionId) !== null;
+}
+function bundleUsesAppServiceBridges(js) {
+  return typeof js === "string" && APP_SERVICES_BRIDGE_MARKERS.some((m) => js.includes(m));
+}
+
 // ../../core/ts/src/distribution.ts
 var DEFAULT_DISTRIBUTION = { core: "source", coreVersion: null };
 var SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
@@ -7716,6 +7820,8 @@ function validateConfigShape(config) {
   }
   validateLadderConfig(config);
   validateAuthGateScreen(config.auth);
+  const appBundleConflict = appLogicBundleConflict(config);
+  if (appBundleConflict) throw new Error(`defineApp: ${appBundleConflict}`);
   if (config.tier5Cap) {
     const c = config.tier5Cap;
     if (c.percentageOfActiveScreens < 0 || c.percentageOfActiveScreens > 100) {
@@ -8273,8 +8379,9 @@ function isComponentAllowedForFamily(key, family) {
 
 // ../../core/ts/src/bindings.ts
 var BINDING_SIGILS = ["service", "flag", "item", "t"];
+var COLON_SIGILS = /* @__PURE__ */ new Set(["t"]);
 var BINDING_SIGIL_RE = new RegExp(
-  `^\\$(?:${BINDING_SIGILS.filter((s) => s !== "t").join("|")})\\b|^\\$t:`
+  `^\\$(?:${BINDING_SIGILS.filter((s) => !COLON_SIGILS.has(s)).join("|")})\\b|^\\$(?:${[...COLON_SIGILS].join("|")}):`
 );
 
 // ../../core/ts/src/validator.ts
@@ -8317,6 +8424,16 @@ var screenDescriptorSchema = {
         jumpLabel: { type: "string" }
       }
     },
+    // RFC 0010 "Native search in an embed host" companion: the page's title for a host that shows it in its own bar.
+    hostTitle: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        title: { type: "string" },
+        subtitle: { type: "string" },
+        replaces: { type: "string" }
+      }
+    },
     url: { type: "string", format: "uri" },
     capabilitiesRequired: {
       type: "array",
@@ -8522,8 +8639,9 @@ var screenDescriptorSchema = {
         leading: { type: "string" },
         style: { type: "string" },
         // RFC 0066 §1 (fields 4–8) + the "top-bar gap items" amendment (#4414, fields
-        // 10–14). Discriminators stay free strings (invariant 6). Field 9 (`searchable`)
-        // arrives with the RFC 0010 search implementation.
+        // 10–14). Discriminators stay free strings (invariant 6). Field 9 is the RFC 0010
+        // native search.
+        searchable: { $ref: "#/$defs/searchableConfig" },
         items: { type: "array", items: { $ref: "#/$defs/toolbarItem" } },
         titleDisplay: { type: "string" },
         subtitle: { type: "string" },
@@ -8536,6 +8654,22 @@ var screenDescriptorSchema = {
         dirtyPath: { type: "string" }
       }
     },
+    // RFC 0010 "Native top-bar search" (SearchableConfig fields 1–5, 12–15). `placement` stays a free string.
+    searchableConfig: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        placeholder: { type: "string" },
+        valuePath: { type: "string" },
+        onChange: { $ref: "#/$defs/action" },
+        onSubmit: { $ref: "#/$defs/action" },
+        debounceMs: { type: "integer" },
+        placement: { type: "string" },
+        focusPath: { type: "string" },
+        onCancel: { $ref: "#/$defs/action" },
+        loadingPath: { type: "string" }
+      }
+    },
     toolbarItem: {
       type: "object",
       additionalProperties: false,
@@ -14536,6 +14670,9 @@ function webViewEmbeddedAppFindings(screens) {
 export {
   ALL_ORIENTATIONS,
   APP_ID_PATTERN,
+  APP_SERVICES_BRIDGE_MARKERS,
+  APP_SERVICES_MIN_BINARY,
+  APP_SERVICE_ERROR_CODES,
   AppRegistryClient,
   BASE44_BUILTIN_FIELDS,
   BASE44_FIELD_TYPES,
@@ -14614,6 +14751,9 @@ export {
   WORKER_SUBTREE_COMMON_ACTION_PATHS,
   WORKER_SUBTREE_SAFE_TYPE_RULES,
   activeMediaItem,
+  appLogicBundleConflict,
+  appLogicBundleRef,
+  appServicesAllowed,
   assertSiteShellConfig,
   baselineMediaCapabilities,
   bucket,
@@ -14621,6 +14761,7 @@ export {
   buildPackageShareUrl,
   buildPlayerPreviewUrl,
   buildTokenRegistry,
+  bundleUsesAppServiceBridges,
   buttonHitSlop,
   buttonVariant,
   canonicalJson,
@@ -14630,6 +14771,7 @@ export {
   chooseCandidate,
   cleanSiteMenuLabel,
   coerceSupportedLocale,
+  compareBinaryVersions,
   dataSchemaScopeOf,
   decideSwitch,
   decodeLaunchFromQuery,
@@ -14655,6 +14797,7 @@ export {
   isComponentAllowedForFamily,
   isPlayerRequirements,
   isRTL,
+  isReservedAppActionId,
   isSupportedLocale,
   isTargeted,
   isValid,
@@ -14669,6 +14812,7 @@ export {
   normalizeServeApp,
   normalizeSiteMenu,
   normalizeSiteOrigin,
+  parseAppActionId,
   parseNumeric,
   physicalEntityName,
   primarySubtag,
@@ -14689,6 +14833,7 @@ export {
   resolveSurfaceNav,
   resolveSurfaceViewKey,
   resolveTabBarPresentation,
+  rolloutFloor,
   screenDescriptorSchema,
   selectIdiomOverlay,
   shipsLocale,