@wix/himalaya-cli 0.1489.0 → 0.1490.0

package/dist/cli.mjs

@@ -22149,6 +22149,7 @@ function resolveIdiom(tokens2, ctx = {}) {
 var IDIOM_CONTEXTS, UNSAFE_KEYS;
 var init_idiom = __esm({
   "../../core/ts/src/idiom.ts"() {
+    "use strict";
     IDIOM_CONTEXTS = {
       ios: { native: ["ios"] },
       android: { native: ["material"] },
@@ -130176,7 +130177,7 @@ function stableWidgets(widgets) {
   if (!widgets || typeof widgets !== "object" || Array.isArray(widgets)) return widgets;
   return Object.fromEntries(Object.entries(widgets).map(([id, value]) => {
     if (!value || typeof value !== "object" || Array.isArray(value)) return [id, value];
-    const { contentEtag: _regenerated, ...stable } = value;
+    const { contentEtag: _regenerated, family: _listed, ...stable } = value;
     return [id, stable];
   }));
 }
@@ -135146,7 +135147,9 @@ async function bakeWidgets(fetchPath, putWidget, ownBundles) {
     await putWidget(widgetId, json8);
     widgets[widgetId] = {
       contentEtag: snap.contentEtag ?? sha2563(json8),
-      ttlSeconds: snap.refresh?.ttlSeconds ?? 0
+      ttlSeconds: snap.refresh?.ttlSeconds ?? 0,
+      // Listed so a device fetches only the families it draws (RFC 0039 M2); absent in older releases.
+      ...typeof snap.family === "string" ? { family: snap.family } : {}
     };
   }
   return { widgets, failures };
@@ -163610,12 +163613,15 @@ ${releaseId}`;
           headers: { "content-type": JSON_CT3, etag, "cache-control": DOC_CACHE_CONTROL, "x-himalaya-app": app }
         });
       }
+      const widgetSite = path2 === "/v1/widgets" || path2.startsWith("/v1/widget/") ? url.searchParams.get("site") : null;
+      if (widgetSite !== null && !/^[A-Za-z0-9_-]{1,64}$/.test(widgetSite)) return json5(400, { error: "invalid_site" });
+      const widgetScope = widgetSite !== null ? { "x-himalaya-widget-scope": "app" } : {};
       if (path2 === "/v1/widgets") {
         if (!app) return json5(400, { error: "missing_app" });
         const m2 = pin ? await pinnedManifest(app, pin) : await manifest(app);
         if (!m2) return json5(404, { error: pin ? "release_not_found" : "no_release", app });
-        const widgets = Object.entries(m2.widgets ?? {}).map(([widgetId, meta]) => ({ widgetId, contentEtag: meta.contentEtag }));
-        return json5(200, { widgets });
+        const widgets = Object.entries(m2.widgets ?? {}).map(([widgetId, meta]) => ({ widgetId, contentEtag: meta.contentEtag, ...meta.family ? { family: meta.family } : {} }));
+        return json5(200, { widgets }, widgetScope);
       }
       const widgetMatch = /^\/v1\/widget\/([^/]+)$/.exec(path2);
       if (widgetMatch) {
@@ -163629,13 +163635,13 @@ ${releaseId}`;
         const cache = pin ? PINNED_CACHE_CONTROL : `max-age=${meta.ttlSeconds}`;
         const vary = pin ? { vary: "x-himalaya-release" } : {};
         if (request.headers.get("if-none-match") === etag) {
-          return new Response(null, { status: 304, headers: { etag, "cache-control": cache, ...vary } });
+          return new Response(null, { status: 304, headers: { etag, "cache-control": cache, ...vary, ...widgetScope } });
         }
         const body = await store.getWidget(app, widgetId);
         if (!body) return json5(404, { error: "widget_not_found", widgetId });
         return new Response(body, {
           status: 200,
-          headers: { "content-type": JSON_CT3, etag, "cache-control": cache, ...vary, "x-himalaya-app": app }
+          headers: { "content-type": JSON_CT3, etag, "cache-control": cache, ...vary, "x-himalaya-app": app, ...widgetScope }
         });
       }
       return json5(404, { error: "not_found" });

package/guides/widgets.md

@@ -46,13 +46,23 @@ bindings, only **resolved literal values**. Reading the clock is the one allowed
 the last produce (see [refresh](#refresh-taps-and-previews)). A `render` that throws, or returns a
 tree with a binding in it, makes that widget fail to produce.
 
-### There is no live-data path yet
-
-Data your worker fetches **cannot** reach a widget today. `refresh.pushTopic` exists in the type
-definitions, but nothing consumes it yet: setting it does not make the widget update when data
-changes. Plan the widget around what you know when the app is built — a call to action, a
-constant, or a schedule (see [timelines](#content-whose-future-you-know-live-time-and-timelines)) — and let the
-tap take the user into the app, where the live data is.
+### Live data reaches a widget only through the app on the device
+
+The produce above has no credential, so data your worker fetches **cannot** reach a widget through
+`defineWidget`. The one path for live data runs on the device, in the app: the app fetches the
+widget's descriptors, runs their worker **headlessly** with the signed-in session, resolves every
+`$service:` binding to a literal, and publishes the frozen tree itself —
+`WidgetSnapshotSync.publishLocal` on iOS, `WidgetSnapshotSync.publishLocalBlocking` on Android.
+Owner Lite's Today widget works this way (`OwnerLiteHomeWidget`): it refreshes when the app runs or
+the OS grants a background refresh, never on its own. An app that embeds Himalaya apps gets the same
+produce from `HimalayaEmbedSurfaces.publishWidgets` (see
+[embedding → widgets](embedding-sdk.md#home-and-lock-screen-widgets)).
+
+`refresh.pushTopic` exists in the type definitions, but nothing consumes it yet: setting it does not
+make the widget update when data changes. Without a device produce, plan the widget around what you
+know when the app is built — a call to action, a constant, or a schedule (see
+[timelines](#content-whose-future-you-know-live-time-and-timelines)) — and let the tap take the user
+into the app, where the live data is.
 
 ## A widget that stays inside the contract
 
@@ -217,6 +227,9 @@ not, because the car lays out its own rows. It never goes through `defineWidget`
   request, not a schedule.
 - **`deepLink`** is where a tap takes the user. Point it at the screen that shows the live version
   of what the widget summarises.
+- **`GET /v1/widgets?site=<metaSiteId>`** (and `/v1/widget/<id>?site=`) is accepted for a host that
+  shows one app on many sites. The snapshot is still the app's — nothing is produced per site — and
+  the response says so with `x-himalaya-widget-scope: app`.
 - **Preview a widget** while you work: `himi run --watch --content .` serves it at
   `GET /v1/widget/<widget id>`, and `GET /v1/widgets` lists every widget the app produces.
   `himi surfaces --measure-widgets` reports which families your package actually produces.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1489.0",
+  "version": "0.1490.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "7ca79201b3e70513fa54a458c1442bfddacbd2ffccbfab9959d76964"
+  "falconPackageHash": "cb54373a9c2a773492e66c5579403c0720caa00367681b4479fbc0e3"
 }