@wix/himalaya-cli 0.844.0 → 0.846.0

package/dist/cli.mjs

@@ -26373,7 +26373,6 @@ function shouldRevealError(args) {
 var EMAIL_RE, URL_HOST_RE, INTEGER_RE, NUMBER_RE;
 var init_validation = __esm({
   "../../core/ts/src/validation.ts"() {
-    "use strict";
     EMAIL_RE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/;
     URL_HOST_RE = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(:[0-9]+)?$/;
     INTEGER_RE = /^[+-]?[0-9]+$/;
@@ -29769,7 +29768,6 @@ function validateWorkerSubtree(raw, slotId, policy, actionCatalog) {
 var WORKER_SUBTREE_CEILINGS, ID_PART, ACTION_ID;
 var init_worker_subtree = __esm({
   "../../core/ts/src/worker-subtree.ts"() {
-    "use strict";
     init_worker_subtree_safe_types_generated();
     WORKER_SUBTREE_CEILINGS = Object.freeze({
       maxEncodedBytes: 65536,
@@ -41165,6 +41163,15 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
             baked.push({
               screenId,
               descriptor: JSON.parse(json5),
+              // The EXACT baked bytes, exactly as the exact-screen path hands
+              // them over. Omitting them did not degrade the crawl quietly — it
+              // took out the native-decode oracle for the whole app, which
+              // refuses to judge a screen whose baked bytes it was not given
+              // ("the release builder did not return its exact baked JSON
+              // bytes") and throws rather than skipping. So one templated route
+              // anywhere in an app meant `himi test --native` reported nothing
+              // for ANY of its screens.
+              descriptorJson: json5,
               bundleName,
               bundleJs: bundleName ? readBuiltBundle(tier5Dir, bundleName) ?? null : null,
               ...bundleMapFor(tier5Dir, bundleName ?? void 0)
@@ -41857,7 +41864,7 @@ function stripVolatile(value, depth = 0) {
   if (Array.isArray(value)) return value.map((v) => stripVolatile(v, depth + 1));
   const out = {};
   for (const k of Object.keys(value).sort()) {
-    if (VOLATILE_KEY.test(k)) continue;
+    if (VOLATILE_KEY.test(k) || ANNOUNCEMENT_KEY.has(k)) continue;
     out[k] = stripVolatile(value[k], depth + 1);
   }
   return out;
@@ -41919,7 +41926,7 @@ function summarizeDiff(aSig, bSig, limit = 3) {
   walk2(a, b, "");
   return diffs.slice(0, limit).join("; ");
 }
-var PREFIX_PAIRS, upperFirst, lowerFirst, REFRESH_ACTION, LOAD_MORE_ACTION, FILTER_ACTION, VOLATILE_KEY;
+var PREFIX_PAIRS, upperFirst, lowerFirst, REFRESH_ACTION, LOAD_MORE_ACTION, FILTER_ACTION, ANNOUNCEMENT_KEY, VOLATILE_KEY;
 var init_crawl_relations = __esm({
   "../../core/dev-server/src/crawl-relations.ts"() {
     PREFIX_PAIRS = [
@@ -41943,6 +41950,7 @@ var init_crawl_relations = __esm({
     REFRESH_ACTION = /^(refresh|reload|retry|sync|pullToRefresh)/i;
     LOAD_MORE_ACTION = /^(loadMore|nextPage|fetchMore)|^more$|More$|NextPage$/;
     FILTER_ACTION = /^(filter|search|query|sort)|(Filter|Search|Query|Sort)/;
+    ANNOUNCEMENT_KEY = /* @__PURE__ */ new Set(["actionMessage", "liveNote"]);
     VOLATILE_KEY = /^_|^(id|uuid|guid|nonce|seed|token|timestamp|now|revision|etag)$|(Id|ID|Uuid|Guid|Nonce|Seed|Token|At|Timestamp|Ms|Revision|ETag)$/;
   }
 });

package/guides/release-notes.md

@@ -27,6 +27,15 @@ areas, always in the same order, so you can skim for the one you care about.
   (`String(p?.value ?? p?.text ?? "")`) is still the safe way to read a payload. The divergence is
   documented and held from growing, not fixed — no renderer's behaviour changed. (#2462)
 
+### Validate & test
+
+- **`himi test --native ios` works again for any app with a detail route.** The release builder
+  handed the decode oracle every screen's exact baked bytes except for the screens it materializes
+  from a templated route, and the oracle refuses to judge a screen whose bytes it was not given —
+  so one detail route anywhere in an app took out native decode for the whole app. Owner Lite went
+  from reporting zero of its 99 descriptors to decoding all 99. If you have been seeing "the
+  release builder did not return its exact baked JSON bytes", that was this. (#2520)
+
 ### Preview, push & release
 
 - **A `.himi` package can carry your app's source, so the whole codebase travels as one file.**
@@ -36,6 +45,16 @@ areas, always in the same order, so you can skim for the one you care about.
   copy of the one it came from. Plain `himi pack` is unchanged and still ships built output only;
   a source-carrying package is always labelled, and the web host will not open one. (#2448)
 
+### Branded Lite & Owner Lite
+
+- **An Aria action link can no longer claim to go to Wix when it does not.** Owner Lite already
+  appended the destination host to a link leaving Wix, because both the label and the url in a
+  reply are model output and nothing makes them agree. Three url shapes defeated that check and
+  rendered with no host at all — most simply, a backslash, which the url standard treats as ending
+  the authority but the check did not. Those links now disclose where they go, and a url whose
+  destination cannot be established at all is labelled as unknown rather than trusted. Links are
+  still never rewritten or dropped. (#2520)
+
 ## 2026-09-17
 
 ### Getting started & the CLI

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.844.0",
+  "version": "0.846.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -63,5 +63,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "8835cc4b62bf41497a590d6558191fd77398f79e776d75eb0d554eaf"
+  "falconPackageHash": "f866cda55443a260fd03611ccc44fbe195f500d8ef1f1bf7f78e32e5"
 }