@wix/himalaya-cli 0.1013.0 → 0.1014.0

package/dist/cli.mjs

@@ -45887,6 +45887,29 @@ var init_assets = __esm({
   }
 });
 
+// ../../core/serve-runtime/src/pinned-read.ts
+async function checkPinnedRead(input) {
+  const { secret, token, app, releaseId, screenId, authorizePreview } = input;
+  if (!secret) return authorizePreview ? { status: 503, body: { error: "preview_token_unavailable" } } : null;
+  if (!token) return await input.isLive() ? null : { status: 401, body: { error: "preview_token_required", app, releaseId } };
+  const verified = await verifyPreviewToken({ token, secret, app, releaseId, screenId });
+  if (verified.ok) {
+    if (authorizePreview ? !await authorizePreview(verified.claims) : !!verified.claims.siteLease) {
+      return { status: 403, body: { error: "site_preview_forbidden" } };
+    }
+    return null;
+  }
+  return {
+    status: verified.error === "scope_mismatch" ? 403 : 401,
+    body: { error: `preview_token_${verified.error}`, app, releaseId, ...screenId ? { screenId } : {} }
+  };
+}
+var init_pinned_read = __esm({
+  "../../core/serve-runtime/src/pinned-read.ts"() {
+    init_preview_token();
+  }
+});
+
 // ../../core/serve-runtime/package-share.ts
 function parseStored(bytes2, id) {
   if (!bytes2) return null;
@@ -46222,23 +46245,16 @@ ${releaseId}`;
     return new Response(body, { status: 200, headers: { "content-type": JSON_CT, etag, "cache-control": cache, ...vary } });
   }
   async function authorizePinnedRead(request, url, app, releaseId, screenId) {
-    const secret = opts.previewTokenSecret;
-    if (!secret) return opts.authorizePreview ? json3(503, { error: "preview_token_unavailable" }) : null;
-    const token = resolvePreviewToken(request, url);
-    const live2 = await manifest(app);
-    const isLive = live2?.releaseId === releaseId;
-    if (!token) return isLive ? null : json3(401, { error: "preview_token_required", app, releaseId });
-    const verified = await verifyPreviewToken({ token, secret, app, releaseId, screenId });
-    if (verified.ok) {
-      if (opts.authorizePreview ? !await opts.authorizePreview(verified.claims) : !!verified.claims.siteLease) return json3(403, { error: "site_preview_forbidden" });
-      return null;
-    }
-    return json3(verified.error === "scope_mismatch" ? 403 : 401, {
-      error: `preview_token_${verified.error}`,
+    const denied = await checkPinnedRead({
+      secret: opts.previewTokenSecret,
+      token: resolvePreviewToken(request, url),
       app,
       releaseId,
-      ...screenId ? { screenId } : {}
+      screenId,
+      isLive: async () => (await manifest(app))?.releaseId === releaseId,
+      authorizePreview: opts.authorizePreview
     });
+    return denied && json3(denied.status, denied.body);
   }
   const corsHeaders = (request) => {
     const origin = request.headers.get("origin");
@@ -46669,6 +46685,10 @@ ${releaseId}`;
       const cfgMatch = /^\/v1\/app-config\/([^/]+)$/.exec(path2);
       const app = cfgMatch?.[1] ?? resolveApp(request, url);
       const pin = resolvePin(request, url);
+      if (app && pin) {
+        const denied = await authorizePinnedRead(request, url, app, pin);
+        if (denied) return denied;
+      }
       if (path2 === "/v1/template-source") {
         if (!app) return json3(400, { error: "missing_app" });
         if (!store.getSource) return json3(501, { error: "templates_unsupported" });
@@ -46685,10 +46705,6 @@ ${releaseId}`;
           headers: { "content-type": JSON_CT, etag, "cache-control": DOC_CACHE_CONTROL, "x-himalaya-app": app }
         });
       }
-      if (app && pin) {
-        const denied = await authorizePinnedRead(request, url, app, pin);
-        if (denied) return denied;
-      }
       if (path2 === "/v1/authoring-docs" || /^\/v1\/authoring-docs\/(spec|mobile-ux)$/.test(path2)) {
         if (!app) return json3(400, { error: "missing_app" });
         const m = pin ? await pinnedManifest(app, pin) : await manifest(app);
@@ -47008,7 +47024,7 @@ var init_server = __esm({
     init_store();
     init_base64();
     init_contract();
-    init_preview_token();
+    init_pinned_read();
     init_package_share();
     init_wix_bridge();
     init_wix_member_auth();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1013.0",
+  "version": "0.1014.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -65,5 +65,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "997481e9652da3d8aedd016c711987997556982fd0ac900d13dbc194"
+  "falconPackageHash": "18405dc60f540308524da075bbb12c054da8e06b44e0fcdabaf2e2b0"
 }