@wix/himalaya-cli 0.1003.0 → 0.1004.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/wix-sdk/bookings-v2/src/extensions.d.ts

@@ -263,8 +263,22 @@ export interface WixBookSlotOptions {
  *  for an OFFLINE booking, so do not read one as "charge now" and send a
  *  pay-in-person customer into the cashier.
  *
- *  Wix documents `selectedPaymentOption` as REQUIRED whenever the booking is paid
- *  through an eCommerce checkout, and it must be an option the service offers.
+ *  Wix's Create Booking reference says to specify `selectedPaymentOption` when the
+ *  customer pays through a Wix eCommerce checkout, and that the call fails
+ *  otherwise. That failure has not been observed. The member paid flow in the
+ *  `himi-booking-time` worker calls `bookSlot` with no option and then checks
+ *  out, and a live run of it created the booking, the checkout and the order.
+ *  That run never completed payment, though, so whether a booking made without
+ *  an option confirms once its order is paid is still unverified, and Wix does
+ *  not document what an omitted option defaults to. Pass it when you know how
+ *  the customer means to pay.
+ *
+ *  Any value you pass must be one the service offers. Wix exposes that on the
+ *  Services V2 service as `payment.options` (booleans `online`, `inPerson`,
+ *  `deposit`, `pricingPlan`). The `WixService` type here does not declare it
+ *  yet, so read it from the service response with a cast.
+ *  Do not hard-code `ONLINE`: a service can be set up for in-person payment
+ *  only, and then `ONLINE` is not one of its options.
  *  Leave `options` out and the request is the one this function always sent. */
 export declare function bookSlot(slot: WixBookingSlotFull, firstName: string, lastName: string, email: string, options?: WixBookSlotOptions): Promise<WixCreateBookingResponse>;
 export interface WixBookingAdditionalField {

package/dist/cli.mjs

@@ -5318,6 +5318,7 @@ function walk(node, registry, path2, out) {
 var SYSTEM_FONT_FAMILY;
 var init_tokens = __esm({
   "../../core/ts/src/tokens.ts"() {
+    "use strict";
     SYSTEM_FONT_FAMILY = "$system";
   }
 });
@@ -19460,7 +19461,6 @@ function shouldRevealError(args) {
 var EMAIL_RE, URL_HOST_RE, INTEGER_RE, NUMBER_RE;
 var init_validation = __esm({
   "../../core/ts/src/validation.ts"() {
-    "use strict";
     EMAIL_RE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/;
     URL_HOST_RE = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(:[0-9]+)?$/;
     INTEGER_RE = /^[+-]?[0-9]+$/;
@@ -22885,7 +22885,6 @@ function validateWorkerSubtree(raw, slotId, policy, actionCatalog) {
 var WORKER_SUBTREE_CEILINGS, ID_PART, ACTION_ID;
 var init_worker_subtree = __esm({
   "../../core/ts/src/worker-subtree.ts"() {
-    "use strict";
     init_worker_subtree_safe_types_generated();
     WORKER_SUBTREE_CEILINGS = Object.freeze({
       maxEncodedBytes: 65536,
@@ -41107,6 +41106,15 @@ var init_mobile_ux_lint = __esm({
   }
 });
 
+// ../../core/serve-runtime/src/site-lease.ts
+var SITE_CONTROL_TTL_SECONDS, SITE_AUTHORIZATION_TTL_SECONDS;
+var init_site_lease = __esm({
+  "../../core/serve-runtime/src/site-lease.ts"() {
+    SITE_CONTROL_TTL_SECONDS = 15 * 60;
+    SITE_AUTHORIZATION_TTL_SECONDS = SITE_CONTROL_TTL_SECONDS + 45 * 60;
+  }
+});
+
 // ../../core/serve-runtime/src/preview-token.ts
 async function hmacKey(secret) {
   return crypto.subtle.importKey("raw", new TextEncoder().encode(secret), SUBTLE_ALGO, false, ["sign"]);
@@ -41147,6 +41155,7 @@ async function verifyPreviewToken(input) {
 var SUBTLE_ALGO, PREVIEW_TOKEN_VERSION, DEFAULT_PREVIEW_TOKEN_TTL_SECONDS, WEB_PREVIEW_TOKEN_TTL_SECONDS;
 var init_preview_token = __esm({
   "../../core/serve-runtime/src/preview-token.ts"() {
+    init_site_lease();
     init_base64();
     SUBTLE_ALGO = { name: "HMAC", hash: "SHA-256" };
     PREVIEW_TOKEN_VERSION = 1;
@@ -42496,6 +42505,7 @@ function makeFunctionsHandler(options) {
       const token = request.headers.get("x-himalaya-preview-token") || new URL(request.url).searchParams.get("pvt");
       const verified = token ? await verifyPreviewToken({ token, secret: options.previewTokenSecret, app: target.app, releaseId: pin, nowSeconds: options.nowSeconds }) : { ok: false, error: "malformed" };
       if (!verified.ok || verified.claims.source !== "functions") return errorResponse(401, `preview_token_${verified.ok ? "scope_mismatch" : verified.error}`, "a valid function preview token is required", id);
+      if (options.authorizePreview ? !await options.authorizePreview(verified.claims) : !!verified.claims.siteLease) return errorResponse(403, "site_preview_forbidden", "site authorization expired or changed", id);
       previewClaims = verified.claims;
     }
     if (pin) selected = options.store.getManifestById ? await options.store.getManifestById(target.app, pin) : null;
@@ -44242,13 +44252,16 @@ ${releaseId}`;
   }
   async function authorizePinnedRead(request, url, app, releaseId, screenId) {
     const secret = opts.previewTokenSecret;
-    if (!secret) return null;
+    if (!secret) return opts.authorizePreview ? json3(503, { error: "preview_token_unavailable" }) : null;
     const token = resolvePreviewToken(request, url);
     const live2 = await manifest(app);
     const isLive = live2?.releaseId === releaseId;
     if (!token) return isLive ? null : json3(401, { error: "preview_token_required", app, releaseId });
     const verified = await verifyPreviewToken({ token, secret, app, releaseId, screenId });
-    if (verified.ok) return null;
+    if (verified.ok) {
+      if (opts.authorizePreview ? !await opts.authorizePreview(verified.claims) : !!verified.claims.siteLease) return json3(403, { error: "site_preview_forbidden" });
+      return null;
+    }
     return json3(verified.error === "scope_mismatch" ? 403 : 401, {
       error: `preview_token_${verified.error}`,
       app,
@@ -44681,7 +44694,8 @@ ${releaseId}`;
         templates.sort((a, b) => String(a.name).localeCompare(String(b.name)));
         return json3(200, { templates });
       }
-      const app = resolveApp(request, url);
+      const cfgMatch = /^\/v1\/app-config\/([^/]+)$/.exec(path2);
+      const app = cfgMatch?.[1] ?? resolveApp(request, url);
       const pin = resolvePin(request, url);
       if (path2 === "/v1/template-source") {
         if (!app) return json3(400, { error: "missing_app" });
@@ -44919,7 +44933,6 @@ ${releaseId}`;
         }));
         return json3(200, { handlers });
       }
-      const cfgMatch = /^\/v1\/app-config\/([^/]+)$/.exec(path2);
       if (cfgMatch) {
         const cfgApp = cfgMatch[1];
         if (pin) {
@@ -45008,7 +45021,12 @@ ${releaseId}`;
     if (request.method === "OPTIONS") {
       return new Response(null, { status: 204, headers: { ...corsHeaders(request), "content-length": "0" } });
     }
-    return withCors(request, await handle(request));
+    const response = await handle(request);
+    if (resolvePreviewToken(request, new URL(request.url))) {
+      response.headers.set("cache-control", "private, no-store");
+      response.headers.set("vary", "x-himalaya-preview-token, x-himalaya-release");
+    }
+    return withCors(request, response);
   };
 }
 var JSON_CT;
@@ -56859,7 +56877,7 @@ var init_context = __esm({
 
 // src/cli.ts
 import { mkdtempSync as mkdtempSync4, readFileSync as readFileSync67, mkdirSync as mkdirSync27, writeFileSync as writeFileSync25, existsSync as existsSync56, rmSync as rmSync10, readdirSync as readdirSync25, statSync as statSync13, lstatSync as lstatSync6, accessSync, constants } from "node:fs";
-import { execFileSync as execFileSync7, spawnSync as spawnSync5, spawn as spawn5 } from "node:child_process";
+import { execFile as execFile4, execFileSync as execFileSync7, spawnSync as spawnSync5, spawn as spawn5 } from "node:child_process";
 import { createHash as createHash24, randomUUID as randomUUID3 } from "node:crypto";
 import { tmpdir as tmpdir5, homedir as homedir7, hostname } from "node:os";
 import { join as join52, resolve as resolve44, relative as relative8, basename as basename12, dirname as dirname31 } from "node:path";
@@ -60813,30 +60831,48 @@ function trustedConfiguredRegistry(env) {
   const configured = normalizeRegistry(env.npm_config_registry ?? env.NPM_CONFIG_REGISTRY);
   return isTrustedRegistry(configured) ? configured : void 0;
 }
-function createScopedRegistryResolver(exec = execFileSync7) {
+function createScopedRegistryResolver(exec = execNpmConfig) {
   let resolved2;
-  return () => {
+  return async (budgetMs = SCOPED_REGISTRY_TIMEOUT_MS) => {
     if (resolved2) return resolved2.value;
-    let value;
+    const deadline = Date.now() + Math.min(budgetMs, SCOPED_REGISTRY_TIMEOUT_MS);
     try {
-      const configured = (key2) => {
-        const raw = exec("npm", ["config", "get", key2], {
-          cwd: homedir7(),
-          timeout: 5e3,
-          stdio: ["ignore", "pipe", "ignore"]
-        }).toString().trim();
+      const configured = async (key2) => {
+        const timeout = deadline - Date.now();
+        if (timeout <= 0) throw new Error("npm config: out of budget");
+        const raw = String(await exec("npm", ["config", "get", key2], { cwd: homedir7(), timeout })).trim();
         return raw && raw !== "undefined" ? raw : void 0;
       };
-      const effective = normalizeRegistry(configured("@wix:registry") ?? configured("registry"));
-      value = isTrustedRegistry(effective) ? effective : void 0;
+      const effective = normalizeRegistry(await configured("@wix:registry") ?? await configured("registry"));
+      resolved2 = { value: isTrustedRegistry(effective) ? effective : void 0 };
+      return resolved2.value;
     } catch {
-      value = void 0;
+      return void 0;
     }
-    resolved2 = { value };
-    return value;
   };
 }
+var SCOPED_REGISTRY_TIMEOUT_MS = 5e3;
+function execNpmConfig(file, args, options) {
+  return new Promise((resolve45, reject) => {
+    execFile4(file, args, { ...options, windowsHide: true }, (error, stdout) => error ? reject(error) : resolve45(String(stdout)));
+  });
+}
 var npmScopedWixRegistry = createScopedRegistryResolver();
+async function scopedRegistryBefore(lookup2, deadline) {
+  let cancel = () => {
+  };
+  const expired = new Promise((resolve45) => {
+    const timer = setTimeout(() => resolve45(void 0), Math.max(0, deadline - Date.now()));
+    cancel = () => clearTimeout(timer);
+  });
+  try {
+    return await Promise.race([Promise.resolve().then(() => lookup2(Math.max(0, deadline - Date.now()))), expired]);
+  } catch {
+    return void 0;
+  } finally {
+    cancel();
+  }
+}
 function registryCandidates(env, scoped) {
   const ordered = [isTrustedRegistry(scoped) ? normalizeRegistry(scoped) : void 0, trustedConfiguredRegistry(env), PUBLIC_NPM_REGISTRY];
   return [...new Set(ordered.filter((r) => r !== void 0))];
@@ -60863,7 +60899,8 @@ async function fetchPackumentFrom(registry, fetchImpl, timeoutMs) {
 }
 async function fetchCliPackument(fetchImpl = fetch, timeoutMs = DOCTOR_TIMEOUT_MS, env = process.env, scopedRegistry = npmScopedWixRegistry) {
   const deadline = Date.now() + timeoutMs;
-  for (const registry of registryCandidates(env, scopedRegistry())) {
+  const scoped = await scopedRegistryBefore(scopedRegistry, deadline);
+  for (const registry of registryCandidates(env, scoped)) {
     const remaining = deadline - Date.now();
     if (remaining <= 0) break;
     const packument = await fetchPackumentFrom(registry, fetchImpl, remaining);
@@ -61161,8 +61198,10 @@ async function refreshUpdateCache(opts = {}) {
   const packument = await fetchCliPackument(opts.fetchImpl ?? fetch, UPDATE_BACKGROUND_BUDGET_MS, env, opts.scopedRegistry);
   if (!packument) return false;
   const now = opts.now ?? Date.now();
+  const current = readUpdateCache(cachePath);
+  if (supersededInCache(current, packument.latest, now)) return true;
   writeUpdateCache(cachePath, {
-    ...readUpdateCache(cachePath),
+    ...current,
     running,
     latest: packument.latest,
     runningPublishedAt: packument.time[running],
@@ -61170,6 +61209,11 @@ async function refreshUpdateCache(opts = {}) {
   });
   return true;
 }
+function supersededInCache(current, latest, now) {
+  if (!current.latest || !latest || compareVersions2(latest, current.latest) >= 0) return false;
+  const checkedAt = current.checkedAt ? Date.parse(current.checkedAt) : Number.NaN;
+  return Number.isFinite(checkedAt) && now - checkedAt < UPDATE_CHECK_INTERVAL_MS;
+}
 function createUpdateRefreshSpawner(spawnFn = spawn5, execArgv = process.execArgv) {
   return () => {
     try {
@@ -65990,7 +66034,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
         const { iosProjectYml: iosYmlPath, hasRepoCheckout: hasRepoCheckout2 } = await Promise.resolve().then(() => (init_paths(), paths_exports));
         const { ascStatus: ascStatus2 } = await Promise.resolve().then(() => (init_asc_status(), asc_status_exports));
         const { readFileSync: rf, readdirSync: rd, existsSync: ex, statSync: st } = await import("node:fs");
-        const { execFile: execFile4 } = await import("node:child_process");
+        const { execFile: execFile5 } = await import("node:child_process");
         const { homedir: hd } = await import("node:os");
         const { join: pj, dirname: pd } = await import("node:path");
         const { fileURLToPath: f2p } = await import("node:url");
@@ -66005,7 +66049,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           return ipas[0];
         };
         const sh = (cmd, args, opts) => new Promise((res) => {
-          const child = execFile4(
+          const child = execFile5(
             cmd,
             args,
             { cwd: opts.cwd, env: { ...process.env, ...opts.env }, maxBuffer: 64 * 1024 * 1024 },
@@ -66776,7 +66820,7 @@ ${label2}`);
         try {
           const scoped = up.scopedRegistry ?? npmScopedWixRegistry;
           const answered = await fetchCliPackument(up.fetchImpl ?? fetch, UPDATE_EXPLICIT_BUDGET_MS, env, scoped);
-          const registry = answered?.registry ?? registryCandidates(env, scoped())[0];
+          const registry = answered?.registry ?? registryCandidates(env, await scoped(UPDATE_EXPLICIT_BUDGET_MS))[0];
           if (answered?.latest && compareVersions2(answered.latest, before) <= 0) {
             if (flags.json) print({ ok: true, running: before, installed: before, changed: false, registry, latest: answered.latest });
             else io.log(`himi ${before} (unchanged \u2014 ${registry} has nothing newer; its latest is ${answered.latest})`);

package/guides/sdk-reference.json

@@ -7311,7 +7311,7 @@
       {
         "name": "bookSlot",
         "kind": "function",
-        "jsdoc": "/** Book a specific availability slot — POST /bookings/v2/bookings. Pass the FULL\n *  slot from queryServiceAvailability + the booker's contact. The v1 createBooking\n *  above rejects a bare slot; the v2 route with bookedEntity.slot is the one that\n *  works. Verified live (status CREATED).\n *\n *  A visitor booking a PAID service to pay in person (no on-device payment) is a\n *  three-call chain:\n *\n *    1. `bookSlot(slot, first, last, email, { selectedPaymentOption: \"OFFLINE\" })`\n *       → the booking, status CREATED.\n *    2. `createCheckout([{ quantity: 1, catalogReference: { appId: <Wix Bookings\n *       appDefId 13d21c63-b5ec-5912-8397-c3a5ddb27a97>, catalogItemId: booking.id } }])`\n *       from `@himalaya/wix-ecom` → the checkout id.\n *    3. `createOrder(checkoutId)` from `@himalaya/wix-ecom` → the order, with the\n *       balance left for the venue to collect.\n *\n *  This chain was verified with raw Wix calls, not through these wrappers.\n *  It is not verified whether `createOrder` still returns a `paymentGatewayOrderId`\n *  for an OFFLINE booking, so do not read one as \"charge now\" and send a\n *  pay-in-person customer into the cashier.\n *\n *  Wix documents `selectedPaymentOption` as REQUIRED whenever the booking is paid\n *  through an eCommerce checkout, and it must be an option the service offers.\n *  Leave `options` out and the request is the one this function always sent. */",
+        "jsdoc": "/** Book a specific availability slot — POST /bookings/v2/bookings. Pass the FULL\n *  slot from queryServiceAvailability + the booker's contact. The v1 createBooking\n *  above rejects a bare slot; the v2 route with bookedEntity.slot is the one that\n *  works. Verified live (status CREATED).\n *\n *  A visitor booking a PAID service to pay in person (no on-device payment) is a\n *  three-call chain:\n *\n *    1. `bookSlot(slot, first, last, email, { selectedPaymentOption: \"OFFLINE\" })`\n *       → the booking, status CREATED.\n *    2. `createCheckout([{ quantity: 1, catalogReference: { appId: <Wix Bookings\n *       appDefId 13d21c63-b5ec-5912-8397-c3a5ddb27a97>, catalogItemId: booking.id } }])`\n *       from `@himalaya/wix-ecom` → the checkout id.\n *    3. `createOrder(checkoutId)` from `@himalaya/wix-ecom` → the order, with the\n *       balance left for the venue to collect.\n *\n *  This chain was verified with raw Wix calls, not through these wrappers.\n *  It is not verified whether `createOrder` still returns a `paymentGatewayOrderId`\n *  for an OFFLINE booking, so do not read one as \"charge now\" and send a\n *  pay-in-person customer into the cashier.\n *\n *  Wix's Create Booking reference says to specify `selectedPaymentOption` when the\n *  customer pays through a Wix eCommerce checkout, and that the call fails\n *  otherwise. That failure has not been observed. The member paid flow in the\n *  `himi-booking-time` worker calls `bookSlot` with no option and then checks\n *  out, and a live run of it created the booking, the checkout and the order.\n *  That run never completed payment, though, so whether a booking made without\n *  an option confirms once its order is paid is still unverified, and Wix does\n *  not document what an omitted option defaults to. Pass it when you know how\n *  the customer means to pay.\n *\n *  Any value you pass must be one the service offers. Wix exposes that on the\n *  Services V2 service as `payment.options` (booleans `online`, `inPerson`,\n *  `deposit`, `pricingPlan`). The `WixService` type here does not declare it\n *  yet, so read it from the service response with a cast.\n *  Do not hard-code `ONLINE`: a service can be set up for in-person payment\n *  only, and then `ONLINE` is not one of its options.\n *  Leave `options` out and the request is the one this function always sent. */",
         "decl": "export function bookSlot(\n  slot: WixBookingSlotFull,\n  firstName: string,\n  lastName: string,\n  email: string,\n  options?: WixBookSlotOptions,\n): Promise<WixCreateBookingResponse>;",
         "http": "POST /bookings/v2/bookings"
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1003.0",
+  "version": "0.1004.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -65,5 +65,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "7d08a874d8457e2d68a6d9861b88e3002a6892614e9554b006e2f8da"
+  "falconPackageHash": "11e1d994023f0d1e2b935c467bbaffa63805b7b7888b09e3f5d280b1"
 }