@wix/himalaya-cli 0.1612.0 → 0.1614.0

package/fixtures/wix-canned.json

@@ -625,6 +625,10 @@
       "total": 2
     }
   },
+  "POST /online-programs/participants/v3/join-applications/query": {
+    "joinApplications": [],
+    "pagingMetadata": { "count": 0, "total": 0 }
+  },
   "GET /pricing-plans/v2/plans/public": {
     "plans": [
       {

package/guides/component-reference.json

@@ -515,14 +515,17 @@
         "currentIndexPath",
         "itemsPath"
       ],
-      "propsSource": "export interface CarouselProps {\n  /** Opt-in paging for itemsPath; absent preserves the horizontal card rail. */\n  paged?: boolean;\n  /** Worker-driven page index; clamped to the current page count. */\n  currentIndexPath?: string;\n  items: Component[];\n  currentIndex?: number;\n  onChange?: Action;\n  autoplayIntervalMs?: number;\n  /** `$service:` binding → a live array to render as slides (overrides `items`). */\n  itemsPath?: string;\n  /** 0 (default) = all slides mounted; N ⇒ mount current ± N, unmount the rest. */\n  liveWindow?: number;\n}"
+      "propsSource": "export interface CarouselProps {\n  /** Opt-in paging for itemsPath; absent preserves the horizontal card rail. */\n  paged?: boolean;\n  /** #4673 — `$service:` path to the page index, two-way with `onChange`: a CHANGE of the resolved\n   *  value animates the carousel there (instantly under reduced motion); a swipe still fires\n   *  `onChange` with `args.index`, which the worker writes back. Out of range ⇒ clamped; not an\n   *  integer ⇒ ignored; equal to the current page ⇒ nothing; a move the binding made fires no\n   *  `onChange`. Drives literal `items` and `paged` bound ones; inside a bound row a substituted\n   *  literal places the page like `currentIndex`. A rail (`itemsPath` without `paged`) ignores it. */\n  currentIndexPath?: string;\n  items: Component[];\n  currentIndex?: number;\n  onChange?: Action;\n  autoplayIntervalMs?: number;\n  /** `$service:` binding → a live array to render as slides (overrides `items`). */\n  itemsPath?: string;\n  /** 0 (default) = all slides mounted; N ⇒ mount current ± N, unmount the rest. */\n  liveWindow?: number;\n}"
     },
     {
       "name": "Pager",
       "category": "Navigation primitives",
       "propsType": "PagerProps",
-      "bindings": [],
-      "propsSource": "export interface PagerProps {\n  pages: Component[];\n  currentIndex?: number;\n  onChange?: Action;\n  showIndicator?: boolean;\n  /** As {@link CarouselProps.liveWindow}. */\n  liveWindow?: number;\n}"
+      "bindings": [
+        "currentIndexPath",
+        "pagesPath"
+      ],
+      "propsSource": "export interface PagerProps {\n  pages: Component[];\n  currentIndex?: number;\n  onChange?: Action;\n  showIndicator?: boolean;\n  /** As {@link CarouselProps.liveWindow}. */\n  liveWindow?: number;\n  /** #4673 — as {@link CarouselProps.currentIndexPath}: a worker-driven page, two-way with `onChange`. */\n  currentIndexPath?: string;\n  /** #4673 — `$service:` path to an array: `pages[0]` is the page TEMPLATE, instantiated once per\n   *  element with `$item.` substitution (as `Carousel.itemsPath`). Pages are keyed by `$item.id`, so\n   *  the page on screen stays on screen when items are inserted before it. */\n  pagesPath?: string;\n}"
     },
     {
       "name": "StepIndicator",
@@ -562,7 +565,7 @@
       "category": "Feedback",
       "propsType": "SnackbarProps",
       "bindings": [],
-      "propsSource": "export interface SnackbarProps {\n  message: string;\n  action?: Action;\n  durationMs?: number;\n  severity?: Severity;\n  /** #1059 — action label; overridable for localized hosts. Default \"Take action\". */\n  actionLabel?: string;\n}"
+      "propsSource": "export interface SnackbarProps {\n  message: string;\n  action?: Action;\n  durationMs?: number;\n  severity?: Severity;\n  /** #1059 — action label; overridable for localized hosts. Default \"Take action\". */\n  actionLabel?: string;\n  /** #4661 — a 40 pt/dp thumbnail at the leading edge (`https:` or a local file/asset URL; any\n   *  other is ignored), drawn by the same presenter as a worker's `ui.snackbar({ imageUrl })`. */\n  imageUrl?: string;\n}"
     },
     {
       "name": "AlertDialog",

package/guides/component-reference.md

@@ -63,7 +63,7 @@ See also **[Modifiers](#modifiers)** (the `modifiers` block) and **[Actions](#ac
 | `Tabs` | Navigation primitives | `optionsPath`, `activeColorPath`, `selectedId` |
 | `SegmentedControl` | Navigation primitives | `optionsPath`, `selectedId` |
 | `Carousel` | Navigation primitives | `currentIndexPath`, `itemsPath` |
-| `Pager` | Navigation primitives | — |
+| `Pager` | Navigation primitives | `currentIndexPath`, `pagesPath` |
 | `StepIndicator` | Navigation primitives | — |
 | `CollapsingHeader` | Navigation primitives | — |
 | `AvatarStrip` | Navigation primitives | `avatarsPath` |
@@ -1075,7 +1075,12 @@ export interface SegmentedControlProps {
 export interface CarouselProps {
   /** Opt-in paging for itemsPath; absent preserves the horizontal card rail. */
   paged?: boolean;
-  /** Worker-driven page index; clamped to the current page count. */
+  /** #4673 — `$service:` path to the page index, two-way with `onChange`: a CHANGE of the resolved
+   *  value animates the carousel there (instantly under reduced motion); a swipe still fires
+   *  `onChange` with `args.index`, which the worker writes back. Out of range ⇒ clamped; not an
+   *  integer ⇒ ignored; equal to the current page ⇒ nothing; a move the binding made fires no
+   *  `onChange`. Drives literal `items` and `paged` bound ones; inside a bound row a substituted
+   *  literal places the page like `currentIndex`. A rail (`itemsPath` without `paged`) ignores it. */
   currentIndexPath?: string;
   items: Component[];
   currentIndex?: number;
@@ -1098,6 +1103,12 @@ export interface PagerProps {
   showIndicator?: boolean;
   /** As {@link CarouselProps.liveWindow}. */
   liveWindow?: number;
+  /** #4673 — as {@link CarouselProps.currentIndexPath}: a worker-driven page, two-way with `onChange`. */
+  currentIndexPath?: string;
+  /** #4673 — `$service:` path to an array: `pages[0]` is the page TEMPLATE, instantiated once per
+   *  element with `$item.` substitution (as `Carousel.itemsPath`). Pages are keyed by `$item.id`, so
+   *  the page on screen stays on screen when items are inserted before it. */
+  pagesPath?: string;
 }
 ```
 
@@ -1189,6 +1200,9 @@ export interface SnackbarProps {
   severity?: Severity;
   /** #1059 — action label; overridable for localized hosts. Default "Take action". */
   actionLabel?: string;
+  /** #4661 — a 40 pt/dp thumbnail at the leading edge (`https:` or a local file/asset URL; any
+   *  other is ignored), drawn by the same presenter as a worker's `ui.snackbar({ imageUrl })`. */
+  imageUrl?: string;
 }
 ```
 

package/guides/designing-himi-screens.md

@@ -307,7 +307,10 @@ contextual actions/detail; `Tooltip`/`Popover` for a small anchored hint. *Reach
 inline where you place it; for a transient toast that floats at the bottom of the screen — an app
 error after a failed action, say — use the `snackbar` presentation verb or `ui.snackbar({ message,
 tone: "danger" })` from a worker: it floats above the tab bar, animates in and out, queues, honours
-`durationMs`, and is announced to screen readers on every platform.
+`durationMs`, and is announced to screen readers on every platform. It stays a toast: two lines of
+message, one optional 40 pt thumbnail (`imageUrl`), one action of up to 24 characters, 2–10 s on screen.
+For "Item deleted — Undo", a screen worker can `await` it and read `actionTapped` instead of wiring an
+action id; anything richer is a descriptor overlay, not a snackbar.
 
 **Status & data-viz** — `Badge`/`Tag`/`Chip` for compact labels; `Rating` for stars (`size: "sm"` in a
 dense row); `ProgressBar` for determinate progress, `ActivityIndicator` for indeterminate; `Gauge` for

package/guides/getting-started.md

@@ -256,8 +256,9 @@ product. Right after `init`:
    typed input → submit → the persisted result with a typed journey in `himi-test.json`
    (`.himi/himi-test.stub.json` has a skeleton per form: fill the values and expected text)
    (`--deep` replays action chains but never types a field value), then prove the destination
-   and cancel/back recovery separately — a typed journey is screen-local and does not follow
-   navigation, so use a render of the destination or a device drive. A fresh-screen crawl alone
+   and cancel/back recovery separately. For device-local records, add explicit `coldVisits`
+   assertions from `himi docs himi-test` so another cold worker must read the same saved record.
+   Cold visits do not drive navigation or prove warm repaint/relaunch: drive those in the UI. A fresh-screen crawl alone
    does not prove a flow.
 
 Before authoring a multi-screen mobile app, ensure the customer-approved `SPEC.md` and

package/guides/hhp.md

@@ -210,13 +210,13 @@ Declare the mockup each screen was designed from in `hhp.json`:
 A screen may also carry `params` (the navigation input a device opens it with, used by native capture, #4935) and `fidelity: { "warn": 80, "fail": 60 }`. Thresholds can also be set app-wide at the top level.
 
 ```bash
-himi fidelity --content <dir> [--screen a,b] [--variant light,dark,rtl,tablet] [--ios <udid>] [--android <serial>] [--ios-tablet <udid>] [--android-tablet <serial>] [--app-id <id>] [--release <id>] [--no-native] [--json] [--post-pr <n>]
+himi fidelity --content <dir> [--screen a,b] [--variant light,dark,rtl,tablet] [--ios <udid>] [--android <serial>] [--ios-tablet <udid>] [--android-tablet <serial>] [--app-id <id>] [--release <id>] [--serve <port>] [--no-native] [--json] [--post-pr <n>]
 ```
 
 For each screen and variant (`light`, `dark`, `rtl`, `tablet`), the command does four things:
 
 1. **Captures the mockup.** It draws the page in Chromium at the variant's width. Dark mode is drawn by emulating `prefers-color-scheme`. RTL is drawn by setting `dir=rtl` on the page.
-2. **Captures the web render** from the app's recorded data, as `himi render` does by default. Native frames come from Himi Player on the devices you pass: `--ios <udid>` and `--android <serial>`, plus `--ios-tablet` and `--android-tablet` for the tablet variant. Only those devices are touched. For each variant the command sets dark or light appearance and, for `rtl`, the Hebrew language (iOS `AppleLanguages`, Android per-app locale, API 33+). It opens `himi://app/<app>/screen/<screen>` and captures once two frames match. Every setting it changed is restored afterwards, also on Ctrl-C. A variant with no device is reported `skipped`, never passed. Without `--release <id>` the Player shows the app's **live** release, not your working copy. A screen that declares `params` is skipped natively for now, because the Player's deep link does not carry them yet. On a fresh iOS simulator, open one `himi://` link by hand first and accept iOS's "Open in Himi Player?" prompt: the command cannot answer it, and until it is accepted every iOS capture shows the prompt.
+2. **Captures the web render** from the app's recorded data, as `himi render` does by default. Native frames come from Himi Player on the devices you pass: `--ios <udid>` and `--android <serial>`, plus `--ios-tablet` and `--android-tablet` for the tablet variant. Only those devices are touched. For each variant the command sets dark or light appearance and, for `rtl`, the Hebrew language (iOS `AppleLanguages`, Android per-app locale, API 33+). It opens `himi://app/<app>/screen/<screen>` and captures once two frames match. Every setting it changed is restored afterwards, also on Ctrl-C. A variant with no device is reported `skipped`, never passed. Without `--release <id>` or `--serve <port>` the Player shows the app's **live** release, not your working copy. `--serve <port>` serves the working copy on `127.0.0.1:<port>` as `himi run` does, so native and web render the same release. The Player reads a local origin only from a Debug build that compiled it in (see [View your package on a device](himi-player-implementation.md#view-your-package-on-a-device)): build it with `HIMALAYA_API_BASE_URL_INFO=http://127.0.0.1:<port>` on iOS and `-PhimalayaDevServeBaseUrl=http://10.0.2.2:<port>` on Android. An iOS device whose Player reads another origin is skipped with the rebuild to run. Android's origin cannot be read back from the installed app, so check that build yourself. A screen that declares `params` is skipped natively for now, because the Player's deep link does not carry them yet. On a fresh iOS simulator, open one `himi://` link by hand first and accept iOS's "Open in Himi Player?" prompt: the command cannot answer it, and until it is accepted every iOS capture shows the prompt.
 3. **Scores mockup↔web** with ImageMagick SSIM, globally and per tile. The worst tile says where the screens differ most.
 4. **Asks a fresh model** two questions, using the repo's fidelity judge prompt. The model never ran in the session that wrote the app.
    - **Design:** does WEB look like the MOCKUP? This judges the port.

package/guides/himi-json-output.md

@@ -44,7 +44,10 @@ keeps its existing fields and adds the code:
 
 | Code | Meaning |
 | --- | --- |
+| `test_journey_budget_exceeded` | The authored config exceeds a shared journey/visit/worker-segment/step/assertion work bound. Exit 2 with `ok: false` and the existing `error` on stderr before compilation or worker boot. Tokenless `POST /v1/test` uses the same code with HTTP422 before upload compilation/evaluation. Split the evaluation into separately identified bounded runs; no truncated pass is emitted. |
 | `test_journey_failed` | At least one unsuppressed authored journey failed: its destination is absent, initialization/action failed, or the expected rendered values were missing. The existing `failures`, `journeys`, counts and exit 1 remain. This includes cold-entry journeys with `steps: []`. |
+| `test_browser_cold_visits_unsupported` | `--browser` was requested with an authored `coldVisits` contract. Exit 2 before compilation or opening a browser; run without `--browser` to exercise those visits. The browser loop cannot certify saved-record return behavior. |
+| `test_browser_journeys_unsupported` | `--browser` was requested with authored journeys that have no `coldVisits`. Exit 2 before compilation or opening a browser. The single-screen browser loop does not execute authored steps or root `expectText`/`absentText` assertions; run without `--browser` to execute that contract. The existing cold-visit code remains in use when any journey has `coldVisits`. |
 | `test_input_evidence_requires_json` | `--input-evidence` was requested without explicit `--json`. Exit 2 before build or worker execution. |
 | `test_input_evidence_unsupported_mode` | `--input-evidence` was combined with `--browser`, or the content is a functions package rather than an app worker crawl. Exit 2 before execution. |
 | `test_input_evidence_unavailable` | The isolated input crawl cannot establish all contained realms, cannot read a stable source archive before/after the crawl, or fails to return one complete JSON report (including interruption, process timeout or output limit). Exit 1; no host-realm fallback or positive input acceptance. |

package/guides/himi-skill.md

@@ -279,8 +279,9 @@ product. Right after `init`:
    typed input → submit → the persisted result with a typed journey in `himi-test.json`
    (`.himi/himi-test.stub.json` has a skeleton per form: fill the values and expected text)
    (`--deep` replays action chains but never types a field value), then prove the destination
-   and cancel/back recovery separately — a typed journey is screen-local and does not follow
-   navigation, so use a render of the destination or a device drive. A fresh-screen crawl alone
+   and cancel/back recovery separately. For device-local records, add explicit `coldVisits`
+   assertions from `himi docs himi-test` so another cold worker must read the same saved record.
+   Cold visits do not drive navigation or prove warm repaint/relaunch: drive those in the UI. A fresh-screen crawl alone
    does not prove a flow.
 
 Before authoring a multi-screen mobile app, ensure the customer-approved `SPEC.md` and

package/guides/himi-test.md

@@ -110,7 +110,7 @@ The receipt has these fields:
 | `execution` | CLI-established `devModule`, `appConfig`, `workerBoot` and `workerAction` modes, each `quickjs-wasm`. A v1 report missing these fields predates the contained CLI path; do not accept it as contained execution. This marker is meaningful only when captured from the trusted pinned producer. |
 | `probes` | Each synthesized typed dispatch's screen/component/action/hook, contract control and injected field/value, actual argument list, precondition input/current value/state hash, post-state hash, and observed state/navigation/request/host-call/throw results. Zero probes is not proof that required controls ran. |
 | `journeys` | Actual screen/input, each attempted step's scope, raw `declaredPayload`, effective row-resolved `descriptorPayload`, exact `testOverrides`, final merged `payload`, pre/post state hashes, executed/threw/not-dispatched status, final visible observations and evaluator-computed assertions. Unavailable actions remain not-dispatched, never successful steps. |
-| `unavailableScreens`, `unavailableJourneys` | Requested coverage for which the evaluator did not supply v1 evidence, including older engines, invalid/collapsed screens and unavailable journeys. With positional screen IDs, these lists contain only requested roots; requested unknown IDs remain unavailable. Unrelated configured journeys do not run or fail a scoped run. These gaps are not accepted behavior. |
+| `unavailableScreens`, `unavailableJourneys` | Requested coverage for which the evaluator did not supply evaluated v1 evidence, including older engines, invalid/collapsed screens and explicitly unavailable source journeys. An unavailable source can still retain evaluated nested cold-visit receipts. With positional screen IDs, these lists contain only requested roots; requested unknown IDs remain unavailable. Unrelated configured journeys do not run or fail a scoped run. These gaps are not accepted behavior. |
 
 State hashes fingerprint the exact serialized worker snapshot captured at the dispatch
 boundary. `currentValuePresent` distinguishes an absent current value from null.
@@ -189,6 +189,69 @@ edge would hand it — so the journey boots the way a real tap into it would. Ke
 navigation in the ordinary edge pass, which boots the destination with real source
 parameters. Pair dynamic journeys with app-specific `dev/net-mocks.json` fixtures.
 
+### Prove a local mutation survives a cold visit
+
+A success message proves only the current screen's outcome. It does not prove that another
+screen can read the saved record. Add `coldVisits` to a typed journey when the approved flow
+requires another screen worker to read a created, edited or removed authoritative local record:
+
+```json
+{
+  "journeys": [{
+    "name": "create then read the same record",
+    "screen": "record_form",
+    "steps": [{
+      "action": "tier5.records.save",
+      "params": { "id": "probe-record", "title": "Field notebook", "notes": "Keep this note" }
+    }],
+    "expectText": ["Saved"],
+    "coldVisits": [
+      { "screen": "record_list", "expectText": ["Field notebook"] },
+      { "screen": "record_detail", "input": { "id": "probe-record" },
+        "expectText": ["Field notebook", "Keep this note"] },
+      { "screen": "record_list", "expectText": ["Field notebook"] }
+    ]
+  }]
+}
+```
+
+Use the app's actual screen/action names, field payloads and independently chosen expected
+values. Every visit boots a **new worker realm** with only that destination's descriptor and
+`input`; module variables and service state do not cross. Visits within one journey share a
+private hermetic `local_database`, `secure_storage` and app-scoped `himalaya.storage` store. Each journey starts with empty
+stores. Destination capability declarations and the app's local-entity schema still apply.
+The ordinary crawl's other axes keep their fresh stores.
+
+A visit can also have `steps`, using the same declared worker-action contract as the initial
+journey. For a destructive flow, request removal then cancel, cold-visit the list and require
+the selected row plus an unrelated row. In a separate sequence, confirm, then require the
+unrelated row and use `"absentText": ["unique removed title"]`. `absentText` works on the
+initial journey too. Both text checks use substrings of the resolved visible render tree;
+choose distinct values that cannot be satisfied by another row or a static heading. Assert
+all required fields and displayed totals, not just a generic success line. A missing screen,
+failed expectation or unexecuted visit fails the journey; JSON reports include a receipt for
+each cold visit.
+
+Authored work is admitted as a whole before any worker executes: at most 32 journeys,
+32 cold visits per journey,128 total worker segments (sources plus visits),512 total
+steps and2048 total positive/absent assertions. These shared limits apply to the CLI,
+`POST /v1/test` and direct crawl callers. Over-budget work is rejected with
+`test_journey_budget_exceeded`; visits or receipts are never silently truncated. Split a
+larger evaluation into separately identified runs. A bundleless source retains an
+explicit `worker-unavailable` receipt and every later visit's positional outcome.
+Validation-blocked destination workers do not execute, but their baked descriptor
+input and explicit visit overrides are retained in their unavailable receipt.
+
+A same-screen favorite may legitimately use a retained worker snapshot; this no-snapshot check does not test that contract.
+
+This is **headless local-store proof**, not a router drive or a real browser database
+relaunch. It does not hydrate worker snapshots, run app services, synchronize with a backend,
+or prove warm-screen refresh, native behavior, account switching or deployed-service
+acceptance. Keep the normal navigation edge checks and drive the actual UI through return
+and reload/relaunch on each required platform. Inspect storage separately when the row
+exists but the screen is stale. The state ownership choices remain in
+[tier-5-add-a-screen.md](tier-5-add-a-screen.md#state-does-not-cross-screens-automatically).
+
 Journeys run only the initialization the bundle and descriptor actually declare: module-scope
 calls and the root `onAppear`. Unlike the discovery crawl's convenience `load()` sweep, they do
 not call an otherwise uncalled loader. A declaration of `actions.load` alone does not initialize
@@ -575,7 +638,7 @@ behavior. This instruction does not add an automatic suppression or retry gate t
 | `--budget <ms>` | Per-action settle budget (default 2000). |
 | `--native` | Also decode every baked descriptor, and the release's `tokens.json`, with the real native decoders; bare `--native` runs whichever toolchains are present and names each one it could NOT check in a top-level `skippedPlatforms: [{ platform, reason }]` (never a pass), while `--native ios` or `--native android` selects one and exits 2 when it is unavailable. The Android SDK is found from `ANDROID_HOME`, then `ANDROID_SDK_ROOT`, then `sdk.dir` in the source checkout's Android test harness `local.properties`, then the default install path (`~/Library/Android/sdk` on macOS, `~/Android/Sdk` on Linux). **Source-checkout only** — the decoder oracles are that tree's own HimalayaCore Swift package and Gradle harness, which a published install does not ship, so it cannot run this at all (and its coverage ledger stays silent about native decoding rather than suggesting it). |
 | `--all-screens` | Crawl every templated instance instead of one representative per structure. |
-| `--browser` / `--no-open` / `--timeout <ms>` | Run the loop in your own browser tab (one screen per run; refuses record/net/offline/hostile/deep/budget/shots/native). |
+| `--browser` / `--no-open` / `--timeout <ms>` | Run the loop in your own browser tab (one screen per run; refuses all authored journeys, including root assertions and `coldVisits`, and record/net/offline/hostile/deep/budget/shots/native). |
 | `himi test <screenId>…` | Focus one or more screens — the record and shots passes scope with them. |
 
 **Screenshots** are on by default when a headless browser is installed: one PNG per screen

package/guides/one-app-to-himi-app.md

@@ -345,7 +345,7 @@ Apply these interpretation rules:
   typography tokens use the body family. Numeric metrics stay unchanged. Read each
   source heading/body family and check `himi fonts list`; use `himi fonts add <Family>`
   when it is available. A known source family that Himi does not ship (for example
-  `spaceGrotesk` → Space Grotesk) is still compared with the actual target family.
+  `sora` → Sora) is still compared with the actual target family.
   Choose an available replacement, such as `$system`, only with the owner's explicit
   instruction; this is an adaptation, never a font match. Sync the coverage ledger
   against the current source evidence, then mark the corresponding `design` requirement

package/guides/recipe-form-submit.md

@@ -233,3 +233,12 @@ shape (heading swap, `savedScreenId`, back-navigation).
 - `himi docs recipe-dynamic-list` — the list the created entity lands in.
 - `himi components Form` / `FormField` / `TextField` / `Toggle` / `Picker`.
 - `.agents/skills/himalaya/examples/form-submit.*` (written into the app by `himi init` / `himi agent-init`) — this recipe, runnable.
+
+## Verify the saved record outside this worker
+
+For a local create/edit flow, a saved banner alone is insufficient. Add a typed journey
+with [cold visits](../himi-test.md#prove-a-local-mutation-survives-a-cold-visit) that reads
+the same record from its list and detail, checks all entered fields and relevant totals,
+and preserves an unrelated record. Then drive return and reload in the actual UI. Choose
+the storage owner using [the cross-screen state contract](../tier-5-add-a-screen.md#state-does-not-cross-screens-automatically);
+a worker snapshot is not a shared record store.

package/guides/sdk-reference.json

@@ -5332,19 +5332,43 @@
         "name": "SnackbarOptions",
         "kind": "interface",
         "jsdoc": "",
-        "decl": "export interface SnackbarOptions {\n  message: string;\n  /** Default \"info\". */\n  tone?: SnackbarTone;\n  /** Auto-dismiss delay in ms, on every host. Default 3000; 0 or less also means 3000. */\n  durationMs?: number;\n  /** One action button (\"Undo\", \"View\"). Tapping it runs `actionId` with `args`, then dismisses the\n   *  snackbar. The id must be a worker action:\n   *  - one of this bundle's own `tier5.<svc>.<action>` ids — run on THIS worker, never another\n   *    screen's or the app-level worker's;\n   *  - an app service's `app.<svc>.<action>` — needs `app_services` and an exported action (an app\n   *    service's own id needs neither). The web host refuses it until it hosts app services.\n   *  Any other id (`capability.*`, `himi.*`, a registered handler) is refused when the snackbar is\n   *  requested: the call rejects and nothing is shown. A host that cannot tell which worker asked\n   *  (React Native, an embedded web region) refuses every `action` the same way. */\n  action?: SnackbarAction;\n}"
+        "decl": "export interface SnackbarOptions {\n  /** At most two lines on screen; a longer message is ellipsised. */\n  message: string;\n  /** Default \"info\". */\n  tone?: SnackbarTone;\n  /** Auto-dismiss delay in ms, clamped on every host to {@link SNACKBAR_LIMITS} (2–10 s, at least\n   *  4 s with an `action` so it can be reached by VoiceOver / TalkBack before it goes). Absent, 0 or\n   *  less: the default, 3000 (4000 with an `action`). */\n  durationMs?: number;\n  /** A thumbnail of the thing the toast is about: a 40 pt square at the leading edge. `https:` on\n   *  every host; a local `file:` URL on iOS and macOS only, whose image pipeline already reads local\n   *  files. Any other URL is ignored (the toast shows without it), and an image that fails to load\n   *  just hides. */\n  imageUrl?: string;\n  /** One action button (\"Undo\", \"View\"). Tapping it dismisses the snackbar and resolves the call\n   *  `{ actionTapped: true }`. With an `actionId` the tap also runs that action with `args`. The id\n   *  must be a worker action:\n   *  - one of this bundle's own `tier5.<svc>.<action>` ids — run on THIS worker, never another\n   *    screen's or the app-level worker's;\n   *  - an app service's `app.<svc>.<action>` — needs `app_services` and an exported action (an app\n   *    service's own id needs neither). The web host refuses it until it hosts app services.\n   *  Any other id (`capability.*`, `himi.*`, a registered handler) is refused when the snackbar is\n   *  requested: the call rejects and nothing is shown. A host that cannot tell which worker asked\n   *  (React Native, an embedded web reg\n/* … */"
       },
       {
         "name": "SnackbarAction",
         "kind": "interface",
         "jsdoc": "",
-        "decl": "export interface SnackbarAction {\n  /** The button's text — also its VoiceOver / TalkBack / screen-reader label. */\n  label: string;\n  /** What the tap runs: one of this bundle's own `tier5.<svc>.<action>` ids, or `app.<svc>.<action>`. */\n  actionId: string;\n  /** The action's arguments, which the reducer receives as typed JSON. */\n  args?: Record<string, unknown>;\n}"
+        "decl": "export interface SnackbarAction {\n  /** The button's text — also its VoiceOver / TalkBack / screen-reader label. At most 24\n   *  characters; a longer label is ellipsised. */\n  label: string;\n  /** What the tap runs, if anything: one of this bundle's own `tier5.<svc>.<action>` ids, or\n   *  `app.<svc>.<action>`. A screen worker may leave it out and branch on `actionTapped` instead\n   *  (\"Undo\"); an app service may not. */\n  actionId?: string;\n  /** The action's arguments, which the reducer receives as typed JSON. */\n  args?: Record<string, unknown>;\n}"
+      },
+      {
+        "name": "SnackbarResult",
+        "kind": "interface",
+        "jsdoc": "/** What a snackbar call resolves with. */",
+        "decl": "export interface SnackbarResult {\n  /** The user tapped the action. Always false for a snackbar without one (resolved on\n   *  presentation); with one, false when it was dismissed any other way — timed out, swiped, closed,\n   *  or replaced by a newer snackbar. */\n  actionTapped: boolean;\n}"
+      },
+      {
+        "name": "SNACKBAR_LIMITS",
+        "kind": "const",
+        "jsdoc": "/** #4661 — the constraints that keep a snackbar a toast, enforced here and again by every host. */",
+        "decl": "export const SNACKBAR_LIMITS = {\n  messageLines: 2,\n  labelChars: 24,\n  minDurationMs: 2000,\n  /** The floor with an action: long enough to reach it with a screen reader. */\n  minActionDurationMs: 4000,\n  maxDurationMs: 10_000,\n  /** The thumbnail's side, in pt / dp / CSS px. */\n  imageSize: 40,\n} as const;"
+      },
+      {
+        "name": "snackbarDurationMs",
+        "kind": "function",
+        "jsdoc": "/** The duration a host shows a snackbar for: absent / non-finite / 0 or less → undefined (the host\n *  default applies), else clamped to {@link SNACKBAR_LIMITS}. */",
+        "decl": "export function snackbarDurationMs(durationMs: number | undefined, hasAction: boolean): number | undefined;"
+      },
+      {
+        "name": "snackbarLabel",
+        "kind": "function",
+        "jsdoc": "/** An action label as every host draws it: at most {@link SNACKBAR_LIMITS}.labelChars characters\n *  (by code point, so an emoji is never cut in half), the last one an ellipsis when it was cut. */",
+        "decl": "export function snackbarLabel(label: string): string;"
       },
       {
         "name": "snackbar",
         "kind": "function",
-        "jsdoc": "/** Show a transient snackbar toast: it floats above the tab bar, slides and fades in and out\n *  (fades only under reduced motion), queues behind one that is already showing, and is read\n *  by VoiceOver / TalkBack. Resolves once it is PRESENTED (not after it auto-dismisses).\n *  Rejects with `no_ui_host` if no presenter is attached; with an `action`, also with\n *  `invalid_action` (empty label or id), `action_not_allowed` (not one of this bundle's\n *  actions), or, for an `app.*` id, `undeclared` (no `app_services`), `not_exported`, `no_service`,\n *  `no_action`, `not_booted` or `unavailable`. */",
-        "decl": "export async function snackbar(options: SnackbarOptions): Promise<void>;"
+        "jsdoc": "/** Show a transient snackbar toast: it floats above the tab bar, slides and fades in and out\n *  (fades only under reduced motion), queues behind one that is already showing, and is announced\n *  by VoiceOver / TalkBack / the screen reader. Without an `action` it resolves\n *  `{ actionTapped: false }` once it is queued, as before; with one it resolves when the snackbar\n *  goes, `{ actionTapped: true }` only if the action was tapped (see {@link SnackbarResult}).\n *  Rejects with `no_ui_host` if no presenter is attached; with an `action`, also with\n *  `invalid_action` (empty label), `action_id_required` (an app service with no `actionId`),\n *  `action_not_allowed` (not one of this bundle's actions), or, for an `app.*` id, `undeclared` (no\n *  `app_services`), `not_exported`, `no_service`, `no_action`, `not_booted` or `unavailable`. */",
+        "decl": "export async function snackbar(options: SnackbarOptions): Promise<SnackbarResult>;"
       },
       {
         "name": "version",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1612.0",
+  "version": "0.1614.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -72,5 +72,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "ce8fd7a735a426892fa25365dcc0599b1c137be31ce634d59245ef55"
+  "falconPackageHash": "5d96af6574de509f64d0dfcd8cb4660e4a7d81a0deb73b852e474acd"
 }

package/stdlib/fonts/catalog.json

@@ -210,6 +210,32 @@
         }
       ]
     },
+    "DM Serif Display": {
+      "category": "serif",
+      "dir": "ofl/dmserifdisplay",
+      "webFallback": "serif",
+      "aliases": [
+        "dmserifdisplay",
+        "dm serif display",
+        "dm serif"
+      ],
+      "license": {
+        "id": "OFL-1.1",
+        "url": "https://raw.githubusercontent.com/google/fonts/8e44913e4ff26fc997e6856c1ec40ff4791c98c5/ofl/dmserifdisplay/OFL.txt",
+        "copyright": "Copyright 2014-2018 Adobe (http://www.adobe.com/), with Reserved Font Name 'Source'. All Rights Reserved. Source is a trademark of Adobe in the United States and/or other countries. Copyright 2019 Google LLC."
+      },
+      "faces": [
+        {
+          "weight": 400,
+          "style": "normal",
+          "postScriptName": "DMSerifDisplay-Regular",
+          "file": "DMSerifDisplay-Regular.ttf",
+          "sha256": "8cc3643535edf039aa5d95440a8542735e9197e4f4b8d9303e980fefbf5ab616",
+          "sri": "sha256-jMNkNTXt8DmqXZVECoVCc16Rl+T0uNkwPpgP779athY=",
+          "bytes": 76580
+        }
+      ]
+    },
     "Dancing Script": {
       "category": "handwriting",
       "dir": "ofl/dancingscript",
@@ -279,6 +305,54 @@
         }
       ]
     },
+    "Fraunces": {
+      "category": "serif",
+      "dir": "ofl/fraunces",
+      "webFallback": "serif",
+      "aliases": [
+        "fraunces"
+      ],
+      "license": {
+        "id": "OFL-1.1",
+        "url": "https://raw.githubusercontent.com/google/fonts/8e44913e4ff26fc997e6856c1ec40ff4791c98c5/ofl/fraunces/OFL.txt",
+        "copyright": "Copyright 2018 The Fraunces Project Authors (https://github.com/undercasetype/Fraunces)"
+      },
+      "variable": {
+        "axes": {
+          "opsz": {
+            "min": 9,
+            "default": 9,
+            "max": 144
+          },
+          "wght": {
+            "min": 100,
+            "default": 900,
+            "max": 900
+          },
+          "SOFT": {
+            "min": 0,
+            "default": 0,
+            "max": 100
+          },
+          "WONK": {
+            "min": 0,
+            "default": 1,
+            "max": 1
+          }
+        }
+      },
+      "faces": [
+        {
+          "weight": 900,
+          "style": "normal",
+          "postScriptName": "Fraunces-9ptBlack",
+          "file": "Fraunces[SOFT,WONK,opsz,wght].ttf",
+          "sha256": "177ff6c0f14e5550a3c624247cd1189611d4eb65d000b14944c63d967958abbb",
+          "sri": "sha256-F3/2wPFOVVCjxiQkfNEYlhHU62XQALFJRMY9lnlYq7s=",
+          "bytes": 360440
+        }
+      ]
+    },
     "IBM Plex Mono": {
       "category": "mono",
       "dir": "ofl/ibmplexmono",
@@ -863,6 +937,40 @@
         }
       ]
     },
+    "Space Grotesk": {
+      "category": "sans",
+      "dir": "ofl/spacegrotesk",
+      "webFallback": "sans-serif",
+      "aliases": [
+        "spacegrotesk",
+        "space grotesk"
+      ],
+      "license": {
+        "id": "OFL-1.1",
+        "url": "https://raw.githubusercontent.com/google/fonts/8e44913e4ff26fc997e6856c1ec40ff4791c98c5/ofl/spacegrotesk/OFL.txt",
+        "copyright": "Copyright 2020 The Space Grotesk Project Authors (https://github.com/floriankarsten/space-grotesk)"
+      },
+      "variable": {
+        "axes": {
+          "wght": {
+            "min": 300,
+            "default": 300,
+            "max": 700
+          }
+        }
+      },
+      "faces": [
+        {
+          "weight": 300,
+          "style": "normal",
+          "postScriptName": "SpaceGrotesk-Light",
+          "file": "SpaceGrotesk[wght].ttf",
+          "sha256": "acad6de1fc93436f5c0f1f4137751ef04f1aea3063e7036535970ffcfbd79f72",
+          "sri": "sha256-rK1t4fyTQ29cDx9BN3Ue8E8a6jBj5wNlNZcP/PvXn3I=",
+          "bytes": 136676
+        }
+      ]
+    },
     "Space Mono": {
       "category": "mono",
       "dir": "ofl/spacemono",
@@ -897,6 +1005,39 @@
         }
       ]
     },
+    "Vollkorn": {
+      "category": "serif",
+      "dir": "ofl/vollkorn",
+      "webFallback": "serif",
+      "aliases": [
+        "vollkorn"
+      ],
+      "license": {
+        "id": "OFL-1.1",
+        "url": "https://raw.githubusercontent.com/google/fonts/8e44913e4ff26fc997e6856c1ec40ff4791c98c5/ofl/vollkorn/OFL.txt",
+        "copyright": "Copyright 2017 The Vollkorn Project Authors (https://github.com/FAlthausen/Vollkorn-Typeface)"
+      },
+      "variable": {
+        "axes": {
+          "wght": {
+            "min": 400,
+            "default": 400,
+            "max": 900
+          }
+        }
+      },
+      "faces": [
+        {
+          "weight": 400,
+          "style": "normal",
+          "postScriptName": "Vollkorn-Regular",
+          "file": "Vollkorn[wght].ttf",
+          "sha256": "4ebef434f76f80286204840354a84db79a0dc3c87deeeb791e015b70b2ade49d",
+          "sri": "sha256-Tr70NPdvgChiBIQDVKhNt5oNw8h97ut5HgFbcLKt5J0=",
+          "bytes": 577864
+        }
+      ]
+    },
     "Work Sans": {
       "category": "sans",
       "dir": "ofl/worksans",