@wix/himalaya-cli 0.1012.0 → 0.1013.0

package/dist/cli.mjs

@@ -46193,10 +46193,13 @@ ${releaseId}`;
       }
     );
   }
-  async function appConfigFor(app, pin) {
+  async function appConfigFor(request, url, app) {
     const store = await getStore();
+    const pin = resolvePin(request, url);
     let bytes2 = null;
     if (pin) {
+      const denied = await authorizePinnedRead(request, url, app, pin);
+      if (denied) return { ok: false, response: denied };
       const m = await pinnedManifest(app, pin);
       if (!m) return { ok: false, response: json3(404, { error: "release_not_found", app, releaseId: pin }) };
       bytes2 = m.appConfigHash ? await pinnedBody(app, m.appConfigHash, () => store.getAppConfig(app)) : null;
@@ -46350,7 +46353,7 @@ ${releaseId}`;
           });
         }
         if (request.method !== "GET") return json3(405, { error: "method_not_allowed" });
-        const cfg = await appConfigFor(app2, resolvePin(request, url));
+        const cfg = await appConfigFor(request, url, app2);
         if (!cfg.ok) return cfg.response;
         const resolved2 = wixMemberAuthOf(utf8Decode(cfg.bytes), callbackUrlFor(url));
         if (!resolved2.ok) return json3(501, { error: `member_auth_${resolved2.error}`, app: app2 });
@@ -46408,7 +46411,7 @@ ${releaseId}`;
         }
         const app2 = resolveApp(request, url);
         if (!app2) return json3(400, { error: "app_required" });
-        const resolvedCfg = await appConfigFor(app2, resolvePin(request, url));
+        const resolvedCfg = await appConfigFor(request, url, app2);
         if (!resolvedCfg.ok) return resolvedCfg.response;
         const cfgBytes = resolvedCfg.bytes;
         let call;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1012.0",
+  "version": "0.1013.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -65,5 +65,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "e35f79cf127f1c7cbedf8abdcd5b92c12f3d7456c71abc3b741b08fb"
+  "falconPackageHash": "997481e9652da3d8aedd016c711987997556982fd0ac900d13dbc194"
 }