@wix/himalaya-cli 0.930.0 → 0.931.0

package/dist/cli.mjs

@@ -765,13 +765,17 @@ import { sep } from "node:path";
 function isDeniedSourcePath(relPath) {
   const segments = relPath.split(/[\\/]/).filter(Boolean);
   if (segments.length === 0) return false;
-  if (segments.slice(0, -1).some((seg) => DENY_DIRS.has(seg))) return true;
+  const dirs = segments.slice(0, -1);
+  if (dirs.some((seg) => DENY_DIRS.has(seg))) return true;
+  if (dirs.length > 0 && DENY_ROOT_DIRS.has(dirs[0])) return true;
   return DENY_FILES.some((re) => re.test(segments[segments.length - 1]));
 }
-function isDeniedSourceDir(name) {
-  return DENY_DIRS.has(name.split(sep).pop() ?? name);
+function isDeniedSourceDir(name, parentRel) {
+  const base = name.split(sep).pop() ?? name;
+  if (DENY_DIRS.has(base)) return true;
+  return parentRel === "" && DENY_ROOT_DIRS.has(base);
 }
-var DENY_DIRS, DENY_FILES, PACKAGE_DIR_MARKER;
+var DENY_DIRS, DENY_ROOT_DIRS, DENY_FILES, PACKAGE_DIR_MARKER;
 var init_source_deny = __esm({
   "src/source-deny.ts"() {
     DENY_DIRS = /* @__PURE__ */ new Set([
@@ -802,6 +806,7 @@ var init_source_deny = __esm({
       "build",
       "__Snapshots__"
     ]);
+    DENY_ROOT_DIRS = /* @__PURE__ */ new Set(["shots", "evidence"]);
     DENY_FILES = [
       /^\.env$/,
       /^\.env\./,
@@ -1349,7 +1354,7 @@ function readTemplateFiles(srcRoot) {
       const st = lstatSync(src);
       if (st.isSymbolicLink()) continue;
       if (st.isDirectory()) {
-        if (!isDeniedSourceDir(entry)) walk2(rel);
+        if (!isDeniedSourceDir(entry, relDir)) walk2(rel);
         continue;
       }
       if (isDeniedSourcePath(rel)) continue;
@@ -18526,6 +18531,7 @@ function shouldRevealError(args) {
 var EMAIL_RE, URL_HOST_RE, INTEGER_RE, NUMBER_RE;
 var init_validation = __esm({
   "../../core/ts/src/validation.ts"() {
+    "use strict";
     EMAIL_RE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/;
     URL_HOST_RE = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(:[0-9]+)?$/;
     INTEGER_RE = /^[+-]?[0-9]+$/;
@@ -21949,6 +21955,7 @@ function validateWorkerSubtree(raw, slotId, policy, actionCatalog) {
 var WORKER_SUBTREE_CEILINGS, ID_PART, ACTION_ID;
 var init_worker_subtree = __esm({
   "../../core/ts/src/worker-subtree.ts"() {
+    "use strict";
     init_worker_subtree_safe_types_generated();
     WORKER_SUBTREE_CEILINGS = Object.freeze({
       maxEncodedBytes: 65536,
@@ -38076,6 +38083,7 @@ __export(app_source_exports, {
   collectAppSource: () => collectAppSource,
   deniedArchivePaths: () => deniedArchivePaths,
   isDeniedSourcePath: () => isDeniedSourcePath,
+  largestEntries: () => largestEntries,
   readAppSource: () => readAppSource,
   removeStaleSource: () => removeStaleSource,
   secretFindings: () => secretFindings,
@@ -38086,6 +38094,7 @@ __export(app_source_exports, {
 });
 import { readdirSync as readdirSync21, lstatSync as lstatSync5, readFileSync as readFileSync44, mkdirSync as mkdirSync18, writeFileSync as writeFileSync14, existsSync as existsSync38, rmSync as rmSync6, rmdirSync, unlinkSync as unlinkSync3 } from "node:fs";
 import { join as join37, resolve as resolve34, sep as sep7 } from "node:path";
+import { deflateRawSync as deflateRawSync2 } from "node:zlib";
 function walkSourceTree(dir, file, skip) {
   const walk2 = (relDir) => {
     for (const name of readdirSync21(join37(dir, relDir))) {
@@ -38096,7 +38105,7 @@ function walkSourceTree(dir, file, skip) {
         continue;
       }
       if (st.isDirectory()) {
-        if (isDeniedSourceDir(name) || existsSync38(join37(dir, rel, PACKAGE_DIR_MARKER))) skip(rel);
+        if (isDeniedSourceDir(name, relDir) || existsSync38(join37(dir, rel, PACKAGE_DIR_MARKER))) skip(rel);
         else walk2(rel);
         continue;
       }
@@ -38121,6 +38130,17 @@ function collectAppSource(dir) {
   skipped.sort();
   return { entries, skipped };
 }
+function largestEntries(entries, limit = 5) {
+  return entries.map((e) => ({
+    path: e.path,
+    bytes: e.bytes.length,
+    // MIRRORS THE WRITER EXACTLY, because an estimate that disagrees can reorder this list and
+    // name the wrong file. `writeZip` (release-build/pack.ts) deflates at LEVEL 9 and STORES
+    // the raw bytes whenever deflate did not actually help — tiny and incompressible entries
+    // routinely come out bigger. Default-level deflate over-reports both cases.
+    compressed: Math.min(deflateRawSync2(e.bytes, { level: 9 }).length, e.bytes.length)
+  })).sort((a, b) => b.compressed - a.compressed).slice(0, limit);
+}
 function secretFindings(entries) {
   const out = [];
   for (const entry of entries) {
@@ -38236,7 +38256,7 @@ function pruneEmptyDirs(root, rel, needed, removed) {
     const childRel = rel ? join37(rel, name) : name;
     const posix3 = childRel.split(sep7).join("/");
     const kind = lstatSync5(join37(root, childRel));
-    if (kind.isSymbolicLink() || !kind.isDirectory() || isDeniedSourceDir(name)) {
+    if (kind.isSymbolicLink() || !kind.isDirectory() || isDeniedSourceDir(name, rel)) {
       empty = false;
       continue;
     }
@@ -54356,16 +54376,20 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
                                              without it a multi-account caller is told to name one.
                                            --no-source: do NOT archive the content package with the release.
                                              On by default, so himi pull can restore an editable copy.
-                                             Never archives .himi/, .env*, node_modules/, dist/ or key
-                                             material, and REFUSES the push if a file it would archive
-                                             looks like it holds a credential.
+                                             Never archives .himi/, .env*, node_modules/, dist/, the
+                                             native shells (ios/, android/, macos/, \u2026) or key material,
+                                             and REFUSES the push if a file it would archive looks like it
+                                             holds a credential. Tooling output at the PACKAGE ROOT \u2014
+                                             shots/ and evidence/ \u2014 is excluded too; the same names NESTED
+                                             (assets/shots/) are app content and ARE archived.
                                              EVERYTHING ELSE under the content directory IS archived,
-                                             at any depth \u2014 screenshots, notes, fixtures, tests, l10n.
+                                             at any depth \u2014 notes, fixtures, tests, l10n.
                                              The archive is capped at ${MAX_APP_SOURCE_BYTES_HELP}, measured
                                              base64-encoded (~1.33x the zip's own size); over it the
-                                             push refuses, naming archivedBytes/encodedBytes/files \u2014
-                                             trim the directory or push with --no-source. Not the
-                                             same limit as the whole publish body.
+                                             push refuses, naming archivedBytes/encodedBytes/files and
+                                             the LARGEST entries by name \u2014 move those out, or push with
+                                             --no-source (which costs you himi pull for that release).
+                                             Not the same limit as the whole publish body.
   himi push --only <selector>[,<selector>\u2026] (--draft|--live) [--from-release <id>]
             [--accept-regressions] [--accept-partial] [--app <slug>]
                                            publish ONLY the named items, derived from the app's live
@@ -56174,7 +56198,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
             return 1;
           }
           payload.source = { files, meta };
-          const { collectAppSource: collectAppSource2, secretFindings: secretFindings2, zipAppSource: zipAppSource2, MAX_APP_SOURCE_BYTES: MAX_APP_SOURCE_BYTES2 } = await Promise.resolve().then(() => (init_app_source(), app_source_exports));
+          const { collectAppSource: collectAppSource2, secretFindings: secretFindings2, zipAppSource: zipAppSource2, largestEntries: largestEntries2, MAX_APP_SOURCE_BYTES: MAX_APP_SOURCE_BYTES2 } = await Promise.resolve().then(() => (init_app_source(), app_source_exports));
           const templateArchive = collectAppSource2(sourceDir);
           const templateSecrets = secretFindings2(templateArchive.entries);
           if (templateSecrets.length > 0) {
@@ -56188,6 +56212,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           const templateZip = zipAppSource2(templateArchive.entries);
           const templateSourceB64 = templateZip.toString("base64");
           if (templateSourceB64.length > MAX_APP_SOURCE_BYTES2) {
+            const templateLargest = largestEntries2(templateArchive.entries);
             io.error(JSON.stringify({
               ok: false,
               template: name,
@@ -56198,10 +56223,11 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
               encodedBytes: templateSourceB64.length,
               limit: MAX_APP_SOURCE_BYTES2,
               files: templateArchive.entries.length,
+              largest: templateLargest,
               // No `--no-source` here, deliberately: a template's archive is not optional the way
               // a push's is. `himi pull` restores templates through it, so a flag that dropped it
               // would publish a template nobody can restore — the failure #2423 exists to prevent.
-              hint: "trim the template's source tree (build output and dependencies are already excluded) \u2014 a template's archive is not optional, so there is no flag that publishes without it"
+              hint: `trim the template's source tree \u2014 the largest entries are ${templateLargest.map((e) => `${e.path} (${Math.round(e.compressed / 1024)} KB compressed)`).join(", ")}. Build output and dependencies are already excluded, and a template's archive is not optional, so there is no flag that publishes without it`
             }));
             return 1;
           }
@@ -57630,7 +57656,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
         let sourceSummary;
         let appSourceB64;
         if (flags["no-source"] !== true) {
-          const { collectAppSource: collectAppSource2, secretFindings: secretFindings2, zipAppSource: zipAppSource2, MAX_APP_SOURCE_BYTES: MAX_APP_SOURCE_BYTES2 } = await Promise.resolve().then(() => (init_app_source(), app_source_exports));
+          const { collectAppSource: collectAppSource2, secretFindings: secretFindings2, zipAppSource: zipAppSource2, largestEntries: largestEntries2, MAX_APP_SOURCE_BYTES: MAX_APP_SOURCE_BYTES2 } = await Promise.resolve().then(() => (init_app_source(), app_source_exports));
           const collected = collectAppSource2(dir);
           const findings = secretFindings2(collected.entries);
           if (findings.length > 0) {
@@ -57647,6 +57673,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           const zip = zipAppSource2(collected.entries);
           const encoded = zip.toString("base64");
           if (encoded.length > MAX_APP_SOURCE_BYTES2) {
+            const largest = largestEntries2(collected.entries);
             io.error(JSON.stringify({
               ok: false,
               pushed: false,
@@ -57655,12 +57682,17 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
               encodedBytes: encoded.length,
               limit: MAX_APP_SOURCE_BYTES2,
               files: collected.entries.length,
-              hint: "trim the content package (build output and dependencies are already excluded), or push with --no-source"
+              largest,
+              hint: `trim the content package \u2014 the largest entries are ${largest.map((e) => `${e.path} (${Math.round(e.compressed / 1024)} KB compressed)`).join(", ")}. Sizes are COMPRESSED, because the cap is measured on the deflated archive \u2014 a big but compressible source file is rarely what costs you it. Build output, dependencies, native shells and tooling output (.himi/, and shots/ + evidence/ at the package root) are already excluded. \`--no-source\` publishes without the archive, but then \`himi pull\` cannot restore this release.`
             }));
             return 1;
           }
           appSourceB64 = encoded;
-          sourceSummary = { files: collected.entries.length, compressed: zip.length };
+          sourceSummary = {
+            files: collected.entries.length,
+            compressed: zip.length,
+            ...collected.skipped.length ? { skipped: collected.skipped } : {}
+          };
         }
         const evidence = pushEvidence(dir, manifest.releaseId, (candidate) => verifyAttestation(candidate, dir, payload.screens, declared, payload, { requireLatest: false }).ok);
         const staleEvidence = evidence.staleRuns > 0 ? `${evidence.staleRuns} retained attestation(s) carry this release id, but none describes the content being published` : null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.930.0",
+  "version": "0.931.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -64,5 +64,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "4aa36a3ff0999cd423ab13c46f38df173f2468df2b52718520fafcb5"
+  "falconPackageHash": "f298d0d8711b0afa65d1a4408c19b4d9733bed36e21eac217c908684"
 }