@wix/himalaya-cli 0.843.0 → 0.845.0

package/dist/cli.mjs

@@ -18609,6 +18609,81 @@ var init_token_colors = __esm({
   }
 });
 
+// src/token-lint.ts
+import { existsSync as existsSync13, readFileSync as readFileSync16 } from "node:fs";
+import { join as join17 } from "node:path";
+function configuredTokensPath(dir) {
+  for (const name of ["config.ts", "config.js", "himi.config.ts"]) {
+    const f = join17(dir, name);
+    if (!existsSync13(f)) continue;
+    const src = readFileSync16(f, "utf8");
+    const m = /designTokensPath\s*:\s*["'`]([^"'`]+)["'`]/.exec(src);
+    if (m) return { path: m[1].replace(/^\.\//, "") };
+    if (/designTokensPath\s*:/.test(src)) return { computed: true };
+  }
+  return {};
+}
+function tokenColorIssues(dir, tokensPathOverride) {
+  const issues = [];
+  const error = (message) => issues.push({ screen: null, pass: "tokens", severity: "error", message });
+  const warn = (message) => issues.push({ screen: null, pass: "tokens", severity: "warning", message });
+  const configured = tokensPathOverride ? { path: tokensPathOverride } : configuredTokensPath(dir);
+  if (configured.computed) {
+    warn(
+      "config designTokensPath is a computed expression, so this pass cannot tell which file holds the palette -- only tokens.json was checked"
+    );
+  }
+  const tokensPath = configured.path ?? "tokens.json";
+  const p = join17(dir, tokensPath);
+  if (!existsSync13(p)) {
+    if (tokensPath !== "tokens.json") {
+      warn(`config designTokensPath points at ${tokensPath}, which does not exist -- colour tokens were not checked`);
+    }
+    return issues;
+  }
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync16(p, "utf8"));
+  } catch (e) {
+    error(`${tokensPath}: unparsable JSON \u2014 ${e.message}`);
+    return issues;
+  }
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    error(`${tokensPath}: must be an object`);
+    return issues;
+  }
+  const shadows = raw.shadows;
+  if (shadows !== null && typeof shadows === "object" && !Array.isArray(shadows)) {
+    for (const [name, token] of Object.entries(shadows)) {
+      const value = token?.color;
+      if (value === void 0) continue;
+      if (typeof value === "string" && isCanonicalHex(value)) continue;
+      const suggestion = typeof value === "string" ? canonicalHex(value) : void 0;
+      const shown2 = typeof value === "string" ? value : JSON.stringify(value) ?? String(value);
+      error(
+        `${tokensPath}: shadows.${name}.color is ${shown2} \u2014 the native runtimes parse only #RRGGBB or #RRGGBBAA` + (suggestion ? `. Write ${suggestion}.` : `, and this value names no colour that can be converted for you. Write the hex it should be.`)
+      );
+    }
+  }
+  const colors = raw.colors;
+  if (colors === void 0) return issues;
+  if (colors === null || typeof colors !== "object" || Array.isArray(colors)) {
+    error(`${tokensPath}: "colors" must be an object of { "<token>": "#RRGGBB" | { "<variant>": "#RRGGBB" } }`);
+    return issues;
+  }
+  for (const problem of tokenColorProblems(colors)) {
+    error(
+      `${tokensPath}: colors.${problem.path} is ${problem.value} \u2014 the native runtimes parse only #RRGGBB or #RRGGBBAA` + (problem.suggestion ? `. Write ${problem.suggestion}.` : `, and this value names no colour that can be converted for you. Write the hex it should be.`)
+    );
+  }
+  return issues;
+}
+var init_token_lint = __esm({
+  "src/token-lint.ts"() {
+    init_token_colors();
+  }
+});
+
 // ../app-icons/glyphs.ts
 function shade(hex2, f) {
   const n = parseInt(hex2.slice(1), 16);
@@ -20014,7 +20089,7 @@ function listReport(opts = {}) {
   return { ok: true, count: families.length, totalBytes, families };
 }
 function fontFindings(appDir2) {
-  const tokensPath = join23(appDir2, "tokens.json");
+  const tokensPath = join23(appDir2, configuredTokensPath(appDir2).path ?? "tokens.json");
   if (!existsSync19(tokensPath)) return null;
   const catalog = loadCatalog();
   const tokens = readJson(tokensPath, {});
@@ -20049,7 +20124,8 @@ function fontFindings(appDir2) {
 function checkReport(appDir2) {
   const result = fontFindings(appDir2);
   if (!result) {
-    return { ok: false, count: 0, totalBytes: 0, problems: [`${appDir2}: no tokens.json`], hint: "run inside an app directory" };
+    const looked = configuredTokensPath(appDir2).path ?? "tokens.json";
+    return { ok: false, count: 0, totalBytes: 0, problems: [`${appDir2}: no ${looked}`], hint: "run inside an app directory" };
   }
   const { plan, findings } = result;
   const catalog = loadCatalog();
@@ -20113,6 +20189,7 @@ var init_fonts = __esm({
     init_catalog();
     init_plan_fonts();
     init_face_source();
+    init_token_lint();
     DEFAULT_ASSET_BUDGET_BYTES = 32 * 1024 * 1024;
   }
 });
@@ -41086,6 +41163,15 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
             baked.push({
               screenId,
               descriptor: JSON.parse(json5),
+              // The EXACT baked bytes, exactly as the exact-screen path hands
+              // them over. Omitting them did not degrade the crawl quietly — it
+              // took out the native-decode oracle for the whole app, which
+              // refuses to judge a screen whose baked bytes it was not given
+              // ("the release builder did not return its exact baked JSON
+              // bytes") and throws rather than skipping. So one templated route
+              // anywhere in an app meant `himi test --native` reported nothing
+              // for ANY of its screens.
+              descriptorJson: json5,
               bundleName,
               bundleJs: bundleName ? readBuiltBundle(tier5Dir, bundleName) ?? null : null,
               ...bundleMapFor(tier5Dir, bundleName ?? void 0)
@@ -59814,76 +59900,8 @@ function readLocalPlatforms(dir) {
   }
 }
 
-// src/token-lint.ts
-init_token_colors();
-import { existsSync as existsSync13, readFileSync as readFileSync16 } from "node:fs";
-import { join as join17 } from "node:path";
-function configuredTokensPath(dir) {
-  for (const name of ["config.ts", "config.js", "himi.config.ts"]) {
-    const f = join17(dir, name);
-    if (!existsSync13(f)) continue;
-    const src = readFileSync16(f, "utf8");
-    const m = /designTokensPath\s*:\s*["'`]([^"'`]+)["'`]/.exec(src);
-    if (m) return { path: m[1].replace(/^\.\//, "") };
-    if (/designTokensPath\s*:/.test(src)) return { computed: true };
-  }
-  return {};
-}
-function tokenColorIssues(dir, tokensPathOverride) {
-  const issues = [];
-  const error = (message) => issues.push({ screen: null, pass: "tokens", severity: "error", message });
-  const warn = (message) => issues.push({ screen: null, pass: "tokens", severity: "warning", message });
-  const configured = tokensPathOverride ? { path: tokensPathOverride } : configuredTokensPath(dir);
-  if (configured.computed) {
-    warn(
-      "config designTokensPath is a computed expression, so this pass cannot tell which file holds the palette -- only tokens.json was checked"
-    );
-  }
-  const tokensPath = configured.path ?? "tokens.json";
-  const p = join17(dir, tokensPath);
-  if (!existsSync13(p)) {
-    if (tokensPath !== "tokens.json") {
-      warn(`config designTokensPath points at ${tokensPath}, which does not exist -- colour tokens were not checked`);
-    }
-    return issues;
-  }
-  let raw;
-  try {
-    raw = JSON.parse(readFileSync16(p, "utf8"));
-  } catch (e) {
-    error(`${tokensPath}: unparsable JSON \u2014 ${e.message}`);
-    return issues;
-  }
-  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
-    error(`${tokensPath}: must be an object`);
-    return issues;
-  }
-  const shadows = raw.shadows;
-  if (shadows !== null && typeof shadows === "object" && !Array.isArray(shadows)) {
-    for (const [name, token] of Object.entries(shadows)) {
-      const value = token?.color;
-      if (value === void 0) continue;
-      if (typeof value === "string" && isCanonicalHex(value)) continue;
-      const suggestion = typeof value === "string" ? canonicalHex(value) : void 0;
-      const shown2 = typeof value === "string" ? value : JSON.stringify(value) ?? String(value);
-      error(
-        `${tokensPath}: shadows.${name}.color is ${shown2} \u2014 the native runtimes parse only #RRGGBB or #RRGGBBAA` + (suggestion ? `. Write ${suggestion}.` : `, and this value names no colour that can be converted for you. Write the hex it should be.`)
-      );
-    }
-  }
-  const colors = raw.colors;
-  if (colors === void 0) return issues;
-  if (colors === null || typeof colors !== "object" || Array.isArray(colors)) {
-    error(`${tokensPath}: "colors" must be an object of { "<token>": "#RRGGBB" | { "<variant>": "#RRGGBB" } }`);
-    return issues;
-  }
-  for (const problem of tokenColorProblems(colors)) {
-    error(
-      `${tokensPath}: colors.${problem.path} is ${problem.value} \u2014 the native runtimes parse only #RRGGBB or #RRGGBBAA` + (problem.suggestion ? `. Write ${problem.suggestion}.` : `, and this value names no colour that can be converted for you. Write the hex it should be.`)
-    );
-  }
-  return issues;
-}
+// src/cli.ts
+init_token_lint();
 
 // src/icon-lint.ts
 init_icon();
@@ -61806,7 +61824,25 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
             ...hasWorkers ? { tier5Dir: bundleOutDir2(buildDir) } : {},
             collect: { lint: true, strict }
           });
-          const { report, hasErrors } = summarizeLint(app, bres, outcome, strict);
+          const scaffoldSourceFindings = resolve40(sourceDir) === resolve40(appDir2) ? [] : [
+            ...tokenColorIssues(sourceDir),
+            ...surfaceIssues(sourceDir, void 0, strict),
+            ...fontIssues(sourceDir, strict),
+            ...storesV1Issues(sourceDir, strict)
+          ].map((issue2) => ({
+            ...issue2,
+            // Say WHICH tree. The same message against two trees means two different fixes,
+            // and the scaffold source is the one the author is least likely to be looking at.
+            message: `scaffold source (--source-dir ${sourceDir}): ${issue2.message}`
+          }));
+          const { report, hasErrors } = summarizeLint(app, bres, outcome, strict, [
+            ...await cmsIssues(buildDir, app, strict, { local: true }),
+            ...surfaceIssues(buildDir, outcome.surfaceNav, strict),
+            ...tokenColorIssues(buildDir),
+            ...fontIssues(buildDir, strict),
+            ...storesV1Issues(buildDir, strict),
+            ...scaffoldSourceFindings
+          ]);
           if (hasErrors && !force) {
             print({ ...report, published: false, hint: "lint found errors \u2014 fix them, or re-run with --force to publish anyway" });
             return 1;

package/guides/release-notes.md

@@ -27,6 +27,15 @@ areas, always in the same order, so you can skim for the one you care about.
   (`String(p?.value ?? p?.text ?? "")`) is still the safe way to read a payload. The divergence is
   documented and held from growing, not fixed — no renderer's behaviour changed. (#2462)
 
+### Validate & test
+
+- **`himi test --native ios` works again for any app with a detail route.** The release builder
+  handed the decode oracle every screen's exact baked bytes except for the screens it materializes
+  from a templated route, and the oracle refuses to judge a screen whose bytes it was not given —
+  so one detail route anywhere in an app took out native decode for the whole app. Owner Lite went
+  from reporting zero of its 99 descriptors to decoding all 99. If you have been seeing "the
+  release builder did not return its exact baked JSON bytes", that was this. (#2520)
+
 ### Preview, push & release
 
 - **A `.himi` package can carry your app's source, so the whole codebase travels as one file.**
@@ -36,6 +45,16 @@ areas, always in the same order, so you can skim for the one you care about.
   copy of the one it came from. Plain `himi pack` is unchanged and still ships built output only;
   a source-carrying package is always labelled, and the web host will not open one. (#2448)
 
+### Branded Lite & Owner Lite
+
+- **An Aria action link can no longer claim to go to Wix when it does not.** Owner Lite already
+  appended the destination host to a link leaving Wix, because both the label and the url in a
+  reply are model output and nothing makes them agree. Three url shapes defeated that check and
+  rendered with no host at all — most simply, a backslash, which the url standard treats as ending
+  the authority but the check did not. Those links now disclose where they go, and a url whose
+  destination cannot be established at all is labelled as unknown rather than trusted. Links are
+  still never rewritten or dropped. (#2520)
+
 ## 2026-09-17
 
 ### Getting started & the CLI

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.843.0",
+  "version": "0.845.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -63,5 +63,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "8b2f654400348b18a463a7765085ddd68af86fb362f28e1c926ee25a"
+  "falconPackageHash": "bdc0bc58bddca320ea203b35d6e99e38e85596fb173f88cac3404b38"
 }