@wix/himalaya-cli 0.872.0 → 0.873.0

package/dist/cli.mjs

@@ -5241,7 +5241,6 @@ function resolveTranslation(value, catalog, sourceCatalog) {
 var BINDING_SIGILS, BINDING_SIGIL_RE, TRANSLATION_PREFIX, TRANSLATION_KEY_RE;
 var init_bindings = __esm({
   "../../core/ts/src/bindings.ts"() {
-    "use strict";
     BINDING_SIGILS = ["service", "flag", "item", "t"];
     BINDING_SIGIL_RE = new RegExp(
       `^\\$(?:${BINDING_SIGILS.filter((s) => s !== "t").join("|")})\\b|^\\$t:`
@@ -37657,17 +37656,204 @@ var init_kits = __esm({
 // ../../core/dev-server/src/widgets.ts
 var widgets_exports = {};
 __export(widgets_exports, {
+  WIDGET_BUDGET_MS: () => WIDGET_BUDGET_MS,
   buildViewSnapshot: () => buildViewSnapshot,
   buildWidgetSnapshot: () => buildWidgetSnapshot,
   describeThrown: () => describeThrown,
   extractWidgets: () => extractWidgets,
   freezeOverrideSnapshot: () => freezeOverrideSnapshot,
   frozenViewManifestEntries: () => frozenViewManifestEntries,
-  viewWidgetId: () => viewWidgetId
+  resetWidgetRealm: () => resetWidgetRealm,
+  viewWidgetId: () => viewWidgetId,
+  widgetRealm: () => widgetRealm
 });
 import { createHash as createHash14 } from "node:crypto";
 import { inspect } from "node:util";
-import { runInNewContext } from "node:vm";
+async function widgetRealm() {
+  if (!realmPromise) {
+    const started = (async () => {
+      const { createQuickJsEvaluator: createQuickJsEvaluator2 } = await Promise.resolve().then(() => (init_quickjs_evaluator(), quickjs_evaluator_exports));
+      return createQuickJsEvaluator2({ intl: true });
+    })();
+    realmPromise = started;
+    started.catch(() => {
+      if (realmPromise === started) realmPromise = null;
+    });
+  }
+  try {
+    return await realmPromise;
+  } catch (err) {
+    throw new Error(
+      "the widget producer's isolated realm (QuickJS-in-WASM) could not be loaded, so widget bundles would have been evaluated in node:vm (which is not a security boundary): " + (err instanceof Error ? err.message : String(err))
+    );
+  }
+}
+function resetWidgetRealm() {
+  realmPromise = null;
+}
+function viewRenderModes() {
+  const out = {};
+  for (const target of [...SURFACE_GROUPS, ...PREVIEW_SURFACES.map((s) => s.id)]) {
+    const mode = viewTargetRenderMode(target);
+    if (mode) out[target] = mode;
+  }
+  return out;
+}
+function widgetProgram(bundleJs, clock) {
+  const slot = JSON.stringify(CAPTURE_SLOT);
+  const readbackName = JSON.stringify(READBACK_SERVICE);
+  const modes = JSON.stringify(JSON.stringify(viewRenderModes()));
+  const pinClock = clock === void 0 ? "" : `  globalThis.Date.now = function () { return ${Math.trunc(clock)}; };
+`;
+  return `
+(function () {
+${pinClock}
+  // Captured BEFORE any bundle code runs, for the reason quickjs-evaluator.ts's readback
+  // channel documents at length: anything the emit path looks up AFTER untrusted code has run
+  // is reachable BY it, and every instance of that bug presented as registrations silently
+  // vanishing rather than as an error.
+  var S = {
+    stringify: JSON.stringify,
+    str: String,
+    modes: JSON.parse(${modes}),
+    services: Object.create(null),
+    widgets: [],
+    views: [],
+  };
+  Object.defineProperty(globalThis, ${slot}, {
+    value: S, writable: false, enumerable: false, configurable: false,
+  });
+
+  var host = globalThis.himalaya;
+  var hostDefineService = host.defineService;
+  var defineService = function (name, def) {
+    // Mirrored locally so render() is called with the same service-state map the host used to
+    // hand it, and FORWARDED so the realm's own readback still reports the service.
+    var key;
+    try { key = S.str(name); } catch (e) { key = "<unnameable service>"; }
+    // Explicit undefined/null test, not a truthiness fallback: a service whose declared state
+    // is 0, false or the empty string is valid JSON-serializable state, and "|| {}" would hand
+    // render() an empty object instead of it. No nullish coalescing here on purpose - this
+    // text is inside the realm PROGRAM string and the sandbox JS targets ES6, so ES2020 syntax
+    // would raise the parse floor for every engine that evaluates it. (codebot on #2652.)
+    // NO BACKTICKS IN THIS COMMENT EITHER: it lives inside a template literal, so one would
+    // end the program string. That is how this comment broke the build the first time.
+    S.services[key] = def && def.state !== undefined && def.state !== null ? def.state : {};
+    return hostDefineService(name, def);
+  };
+  var defineWidget = function (id, def) { S.widgets.push([id, def]); };
+  var defineView = function (id, def) { S.views.push([id, def]); };
+
+  // A Proxy OVER the realm's own \`himalaya\`, not a replacement: \`input\`, the capability
+  // chaining and the inert fall-through all still come from the realm's own sandbox.
+  globalThis.himalaya = new Proxy(host, {
+    get: function (t, p) {
+      if (p === "defineService") return defineService;
+      if (p === "defineWidget") return defineWidget;
+      if (p === "defineView") return defineView;
+      return t[p];
+    },
+  });
+})();
+${bundleJs}
+;(function () {
+  var S = globalThis[${slot}];
+  var stringify = S.stringify, str = S.str;
+
+  function why(e) {
+    try { return (e && e.message) ? str(e.message) : str(e); } catch (x) { return "unprintable error"; }
+  }
+  /** A field the bundle owns, reduced to something that cannot break the envelope. */
+  function scalar(v) { return typeof v === "string" ? v : null; }
+  /** Did the registration DECLARE this field? Guarded: a bundle can define a throwing
+   *  getter, and a gate that crashes on hostile input is a gate that fails open. */
+  function declared(o, k) { try { return o[k] !== undefined; } catch (e) { return true; } }
+  function json(v) {
+    try { return stringify(v === undefined ? null : v); } catch (e) { return null; }
+  }
+  /** Run one render/timeline callback and serialize its result, isolating both failures. */
+  function call(fn, arg) {
+    var out = { json: undefined, error: undefined, absent: false };
+    if (typeof fn !== "function") { out.absent = true; return out; }
+    var v;
+    try { v = fn(arg); } catch (e) { out.error = why(e); return out; }
+    var s = json(v);
+    if (s === null) {
+      out.error = "the value it returned is not representable as JSON, so it could not be frozen";
+    } else {
+      out.json = s;
+    }
+    return out;
+  }
+
+  function entry(id, def, renderArg, wantTimeline) {
+    // Every field below is a string, boolean or null that THIS code produced, on a
+    // null-prototype object \u2014 so serializing the entry cannot reach a bundle's \`toJSON\`,
+    // cannot throw, and cannot be blanked by poisoning \`Object.prototype\`. The bundle's own
+    // values ride inside the pre-serialized \`payload\`/\`frames\` strings, where a failure costs
+    // that one registration and nothing else.
+    var e = Object.create(null);
+    try { e.id = str(id); } catch (x) { e.id = null; }
+    e.surface = scalar(def.surface);
+    e.family = scalar(def.family);
+    e.size = scalar(def.size);
+    e.deepLink = scalar(def.deepLink);
+    e.refresh = json(def.refresh);
+    e.hasTimeline = typeof def.timeline === "function";
+    // WAS THE FIELD DECLARED AT ALL, separate from what it normalised to. The frozen-only
+    // check on an interactive surface used to reject any field that was not undefined; deriving
+    // it from the normalised value silently narrowed that, because scalar() turns a non-string
+    // into null, json() turns undefined into "null", and hasTimeline only counts a FUNCTION.
+    // So size: 123, refresh: null and timeline: {} all became "not declared" and passed a gate
+    // whose whole job is to catch a widget aimed at the wrong target. (Both reviewers, #2652.)
+    // Booleans only, produced by this code, so the entry stays safe to serialize.
+    e.declSize = declared(def, "size");
+    e.declDeepLink = declared(def, "deepLink");
+    e.declRefresh = declared(def, "refresh");
+    e.declTimeline = declared(def, "timeline");
+    var r = renderArg === null ? { json: undefined, error: undefined, absent: true } : call(def.render, renderArg);
+    e.payload = r.json === undefined ? null : r.json;
+    e.renderError = r.error === undefined ? null : r.error;
+    e.renderAbsent = r.absent === true;
+    e.frames = null;
+    e.timelineError = null;
+    if (wantTimeline && e.hasTimeline) {
+      var t = call(def.timeline, renderArg);
+      e.frames = t.json === undefined ? null : t.json;
+      e.timelineError = t.error === undefined ? null : t.error;
+    }
+    return e;
+  }
+
+  // Hand-concatenated rather than \`[\u2026].join(",")\`: a bundle can poison
+  // \`Array.prototype.join\`, and an envelope that a bundle can empty is the silent-drop
+  // failure this whole channel exists to avoid.
+  var widgetBody = "";
+  for (var i = 0; i < S.widgets.length; i++) {
+    var w = S.widgets[i];
+    widgetBody += (widgetBody ? "," : "") + stringify(entry(w[0], w[1] || {}, S.services, true));
+  }
+  var viewBody = "";
+  for (var j = 0; j < S.views.length; j++) {
+    var v = S.views[j], vdef = v[1] || {};
+    var target = scalar(vdef.surface);
+    var mode = target === null ? undefined : S.modes[target];
+    // An unknown target renders NOTHING \u2014 the host rejects it by name below, and running a
+    // typo'd registration's code is work spent on a bundle that is already failing.
+    var arg = mode === "interactive" ? {} : mode === "frozen" ? S.services : null;
+    var e2 = entry(v[0], vdef, arg, mode === "frozen");
+    e2.mode = mode === undefined ? null : mode;
+    viewBody += (viewBody ? "," : "") + stringify(e2);
+  }
+
+  // Home through the realm's own service channel \u2014 see READBACK_SERVICE. A STRING, so the
+  // envelope survives a poisoned \`Object.prototype.toJSON\`.
+  globalThis.himalaya.defineService(${readbackName}, {
+    state: '{"widgets":[' + widgetBody + '],"views":[' + viewBody + ']}',
+  });
+})();
+`;
+}
 function makeInert2() {
   const fn = () => inert;
   const inert = new Proxy(fn, {
@@ -37677,56 +37863,58 @@ function makeInert2() {
   });
   return inert;
 }
-function extractWidgets(bundleJs) {
+function parseTree(raw) {
+  if (raw.renderError) return { error: raw.renderError };
+  if (raw.renderAbsent) return { error: "def.render is not a function" };
+  if (raw.payload === null) return { error: "render() produced nothing" };
+  try {
+    return { payload: JSON.parse(raw.payload) };
+  } catch {
+    return { error: "the frozen tree did not survive the realm boundary as JSON" };
+  }
+}
+function parseTimeline(raw) {
+  if (!raw.hasTimeline) return void 0;
+  if (raw.timelineError) return { error: raw.timelineError };
+  if (raw.frames === null) return { error: "timeline() produced nothing" };
+  try {
+    return { frames: JSON.parse(raw.frames) };
+  } catch {
+    return { error: "the timeline did not survive the realm boundary as JSON" };
+  }
+}
+function parseJsonField(value) {
+  if (value === null) return void 0;
+  try {
+    const parsed = JSON.parse(value);
+    return parsed === null ? void 0 : parsed;
+  } catch {
+    return void 0;
+  }
+}
+async function extractWidgets(bundleJs, opts = {}) {
   const services = {};
-  const widgets = {};
-  const views = {};
+  let envelope;
   const inert = makeInert2();
   const himalayaTarget = {
+    input: {},
     defineService: (name, def) => {
-      services[String(name)] = def?.state ?? {};
+      const key2 = String(name);
+      if (key2 === READBACK_SERVICE) {
+        envelope = typeof def?.state === "string" ? def.state : void 0;
+        return;
+      }
+      services[key2] = def?.state ?? {};
       return new Proxy(
         { getState: () => def?.state },
-        { get: (t, k) => t[k] ?? (() => Promise.resolve(def?.state)) }
-      );
-    },
-    defineWidget: (id, def) => {
-      widgets[String(id)] = def;
-    },
-    // RFC 0051. Rejected HERE rather than at resolve time: an unknown target is
-    // almost always a typo (`"watchos"` for `"watch"`, `"ios_lock"` without the
-    // `widget:` prefix), and resolving it later would present as the surface
-    // silently falling back to `default` — a wrong screen instead of an error.
-    defineView: (id, def) => {
-      const target = String(def?.surface ?? "");
-      if (!isViewTarget(target)) {
-        const ids = PREVIEW_SURFACES.map((s) => s.id).join(", ");
-        throw new Error(
-          `defineView("${id}") targets unknown surface "${target}". Use a surface id (${ids}) or a group (${SURFACE_GROUPS.join(", ")}).`
-        );
-      }
-      if (viewTargetRenderMode(target) === "interactive") {
-        const frozenOnly = ["size", "deepLink", "refresh", "timeline"].filter(
-          (k) => def?.[k] !== void 0
-        );
-        if (frozenOnly.length) {
-          throw new Error(
-            `defineView("${id}") targets the interactive surface "${target}" but sets frozen-only field(s): ${frozenOnly.join(", ")}. Those belong on a widget:<family> or "frozen" registration.`
-          );
+        {
+          get: (t, k) => t[k] ?? (() => Promise.resolve(def?.state))
         }
-      }
-      const bucket2 = views[String(id)] ??= {};
-      if (bucket2[target]) {
-        throw new Error(`defineView("${id}") registers surface "${target}" twice`);
-      }
-      bucket2[target] = def;
+      );
     }
   };
-  const himalaya = new Proxy(himalayaTarget, {
-    get: (t, prop) => prop in t ? t[prop] : inert
-  });
   const sandbox = {
-    himalaya,
+    himalaya: new Proxy(himalayaTarget, { get: (t, prop) => prop in t ? t[prop] : inert }),
     globalThis: void 0,
     console: { log() {
     }, warn() {
@@ -37747,7 +37935,78 @@ function extractWidgets(bundleJs) {
     }
   };
   sandbox.globalThis = sandbox;
-  runInNewContext(bundleJs, sandbox, { timeout: 2e3 });
+  const evaluator = opts.evaluator ?? await widgetRealm();
+  evaluator.run(widgetProgram(bundleJs, opts.clock), sandbox, {
+    timeoutMs: opts.timeoutMs ?? WIDGET_BUDGET_MS,
+    filename: "widget-bundle.js",
+    captureConsole: false
+  });
+  if (envelope === void 0) {
+    throw new Error("the widget producer's realm returned no registrations envelope");
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(envelope);
+  } catch (err) {
+    throw new Error(`the widget producer's realm returned a malformed envelope: ${describeThrown(err)}`);
+  }
+  const widgets = {};
+  for (const raw of parsed.widgets ?? []) {
+    widgets[String(raw.id)] = {
+      family: raw.family,
+      size: raw.size,
+      deepLink: raw.deepLink,
+      refresh: parseJsonField(raw.refresh),
+      rendered: parseTree(raw),
+      timeline: parseTimeline(raw)
+    };
+  }
+  const views = {};
+  for (const raw of parsed.views ?? []) {
+    const id = String(raw.id);
+    const target = raw.surface ?? "";
+    if (!isViewTarget(target)) {
+      const ids = PREVIEW_SURFACES.map((s) => s.id).join(", ");
+      throw new Error(
+        `defineView("${id}") targets unknown surface "${target}". Use a surface id (${ids}) or a group (${SURFACE_GROUPS.join(", ")}).`
+      );
+    }
+    const size = raw.size ?? void 0;
+    const deepLink = raw.deepLink ?? void 0;
+    const refresh = parseJsonField(raw.refresh);
+    if (viewTargetRenderMode(target) === "interactive") {
+      const frozenOnly = [
+        // The DECLARATION bits, not the normalised values — see `declared()` in the realm
+        // program. `raw.hasTimeline` still means "is a function"; `declTimeline` means "the
+        // author wrote a timeline field", which is what makes a wrong-target registration
+        // loud instead of silently accepted.
+        ["size", raw.declSize === true || size !== void 0],
+        ["deepLink", raw.declDeepLink === true || deepLink !== void 0],
+        ["refresh", raw.declRefresh === true || refresh !== void 0],
+        ["timeline", raw.declTimeline === true || raw.hasTimeline]
+      ].filter(([, declared]) => declared).map(([k]) => k);
+      if (frozenOnly.length) {
+        throw new Error(
+          `defineView("${id}") targets the interactive surface "${target}" but sets frozen-only field(s): ${frozenOnly.join(", ")}. Those belong on a widget:<family> or "frozen" registration.`
+        );
+      }
+    }
+    const bucket2 = views[id] ??= {};
+    if (bucket2[target]) {
+      throw new Error(`defineView("${id}") registers surface "${target}" twice`);
+    }
+    const tree = parseTree(raw);
+    bucket2[target] = {
+      surface: target,
+      size,
+      deepLink,
+      refresh,
+      rendered: raw.mode === "frozen" ? tree : {},
+      interactive: raw.mode === "interactive" ? tree : {},
+      timeline: parseTimeline(raw),
+      hasTimeline: raw.hasTimeline
+    };
+  }
   return { services, widgets, views };
 }
 function contentEtag(snapshot2) {
@@ -37762,30 +38021,26 @@ function contentEtag(snapshot2) {
   });
   return "sha256-" + createHash14("sha256").update(canonical3).digest("base64");
 }
-function buildWidgetSnapshot(bundleJs, widgetId, opts = {}) {
-  const { services, widgets } = extractWidgets(bundleJs);
+async function buildWidgetSnapshot(bundleJs, widgetId, opts = {}) {
+  const { widgets } = await extractWidgets(bundleJs, opts);
   const def = widgets[widgetId];
   if (!def) {
     const known = Object.keys(widgets).join(", ") || "none";
     throw new Error(`widget "${widgetId}" is not defined by the bundle (defines: ${known})`);
   }
-  return freezeCaptured(def, services, widgetId, opts);
+  return freezeCaptured(def, widgetId, opts);
 }
-function freezeCaptured(def, services, widgetId, opts = {}) {
-  let payload;
-  try {
-    payload = def.render(services);
-  } catch (err) {
-    throw new Error(`widget "${widgetId}" render() threw: ${err.message}`);
+function freezeCaptured(def, widgetId, opts = {}) {
+  if (def.rendered.error !== void 0 || def.rendered.payload === void 0) {
+    throw new Error(`widget "${widgetId}" render() threw: ${def.rendered.error ?? "it produced no tree"}`);
   }
+  let payload = def.rendered.payload;
   let frames;
   if (def.timeline) {
-    let raw;
-    try {
-      raw = def.timeline(services);
-    } catch (err) {
-      throw new Error(`widget "${widgetId}" timeline() threw: ${err.message}`);
+    if (def.timeline.error !== void 0) {
+      throw new Error(`widget "${widgetId}" timeline() threw: ${def.timeline.error}`);
     }
+    const raw = def.timeline.frames;
     if (Array.isArray(raw) && raw.length) {
       const sorted = [...raw].filter((f) => f && typeof f.startsAt === "number" && f.component).sort((a, b) => a.startsAt - b.startsAt).slice(0, MAX_TIMELINE_FRAMES);
       if (sorted.length) {
@@ -37874,7 +38129,7 @@ function frozenViewManifestEntries(views, emitted = /* @__PURE__ */ new Set(), o
   }
   return out;
 }
-function buildViewSnapshot(bundleJs, viewId, surfaceId, opts = {}) {
+async function buildViewSnapshot(bundleJs, viewId, surfaceId, opts = {}) {
   const surface = surfaceById(surfaceId);
   if (!surface) throw new Error(`unknown surface "${surfaceId}"`);
   if (surfaceRenderMode(surface) !== "frozen") {
@@ -37886,7 +38141,7 @@ function buildViewSnapshot(bundleJs, viewId, surfaceId, opts = {}) {
   if (!family) {
     throw new Error(`frozen surface "${surfaceId}" has no WidgetSnapshot family to ship under`);
   }
-  const { services, views } = extractWidgets(bundleJs);
+  const { views } = await extractWidgets(bundleJs, opts);
   const bucket2 = views[viewId];
   if (!bucket2) return void 0;
   const key2 = resolveSurfaceViewKey(surfaceId, Object.keys(bucket2));
@@ -37906,10 +38161,11 @@ function buildViewSnapshot(bundleJs, viewId, surfaceId, opts = {}) {
       size: def.size ?? (isProjection ? PROJECTION_SNAPSHOT_SIZE : void 0),
       deepLink: def.deepLink,
       refresh: def.refresh,
-      render: def.render,
+      // The frozen tree the realm produced for THIS registration — rendered over the captured
+      // service state, because the target resolved to a frozen mode.
+      rendered: def.rendered,
       ...def.timeline ? { timeline: def.timeline } : {}
     },
-    services,
     viewWidgetId(viewId, family),
     opts
   );
@@ -37952,12 +38208,16 @@ function freezeOverrideSnapshot(input, opts = {}) {
   }
   return snapshot2;
 }
-var MAX_TIMELINE_FRAMES;
+var MAX_TIMELINE_FRAMES, WIDGET_BUDGET_MS, realmPromise, CAPTURE_SLOT, READBACK_SERVICE;
 var init_widgets = __esm({
   "../../core/dev-server/src/widgets.ts"() {
     init_validator();
     init_preview_surfaces();
     MAX_TIMELINE_FRAMES = 48;
+    WIDGET_BUDGET_MS = 5e3;
+    realmPromise = null;
+    CAPTURE_SLOT = "himi.widget.capture";
+    READBACK_SERVICE = "himi.widget.readback";
   }
 });
 
@@ -38020,7 +38280,7 @@ __export(validate_descriptor_exports, {
 });
 import { readFileSync as readFileSync38, existsSync as existsSync34, readdirSync as readdirSync18 } from "node:fs";
 import { resolve as resolve28 } from "node:path";
-import { runInNewContext as runInNewContext2 } from "node:vm";
+import { runInNewContext } from "node:vm";
 async function loadAllowedComponents(appDir2) {
   const modPath = resolve28(appDir2, "components.ts");
   if (!existsSync34(modPath)) return void 0;
@@ -38111,7 +38371,7 @@ var init_validate_descriptor = __esm({
     init_validate_descriptor_core();
     nodeVmEvaluator = {
       run(code, sandbox, opts) {
-        runInNewContext2(code, sandbox, { timeout: opts.timeoutMs, filename: opts.filename });
+        runInNewContext(code, sandbox, { timeout: opts.timeoutMs, filename: opts.filename });
       }
     };
     setDefaultEvaluator(nodeVmEvaluator);
@@ -40372,7 +40632,7 @@ async function scanWidgets(dir) {
     if (!loaded) continue;
     try {
       const js = loaded.bytes.toString("utf8");
-      const { widgets, views } = extractWidgets(js);
+      const { widgets, views } = await extractWidgets(js);
       for (const [widgetId, def] of Object.entries(widgets)) {
         out.push({ widgetId, bundle: name, family: def.family, size: def.size, refresh: def.refresh });
       }
@@ -40398,11 +40658,11 @@ async function buildSnapshotForId(widgetId, dir) {
   try {
     const js = loaded.bytes.toString("utf8");
     if (entry.view) {
-      const snapshot2 = buildViewSnapshot(js, entry.view.viewId, entry.view.surfaceId);
+      const snapshot2 = await buildViewSnapshot(js, entry.view.viewId, entry.view.surfaceId);
       if (!snapshot2) return { ok: false, status: 404, error: "widget_not_found" };
       return { ok: true, snapshot: snapshot2 };
     }
-    return { ok: true, snapshot: buildWidgetSnapshot(js, widgetId) };
+    return { ok: true, snapshot: await buildWidgetSnapshot(js, widgetId) };
   } catch (err) {
     return { ok: false, status: 422, error: "widget_invalid", message: err.message };
   }
@@ -63961,20 +64221,20 @@ async function producedWidgetFamilies(dir) {
     if (js === void 0) continue;
     let extracted;
     try {
-      extracted = widgetsModule.extractWidgets(js);
+      extracted = await widgetsModule.extractWidgets(js);
     } catch {
       continue;
     }
     for (const [widgetId, def] of Object.entries(extracted.widgets)) {
       try {
-        widgetsModule.buildWidgetSnapshot(js, widgetId);
+        await widgetsModule.buildWidgetSnapshot(js, widgetId);
         families.add(def.family);
       } catch {
       }
     }
     for (const entry of widgetsModule.frozenViewManifestEntries(extracted.views, emitted)) {
       try {
-        if (widgetsModule.buildViewSnapshot(js, entry.view.viewId, entry.view.surfaceId)) families.add(entry.family);
+        if (await widgetsModule.buildViewSnapshot(js, entry.view.viewId, entry.view.surfaceId)) families.add(entry.family);
       } catch {
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.872.0",
+  "version": "0.873.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -63,5 +63,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "53223d28b61c0ec2e262bb248021fde32e2cb3af1109391ccb229c80"
+  "falconPackageHash": "e317363609876f9814b32d6a6ca7319bdd4527bfba2889d9027735e6"
 }