@wix/himalaya-cli 0.1027.0 → 0.1028.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/cli.mjs CHANGED
@@ -5351,7 +5351,6 @@ function walk(node, registry, path2, out) {
5351
5351
  var SYSTEM_FONT_FAMILY, TONAL_ELEVATION_ALPHA;
5352
5352
  var init_tokens = __esm({
5353
5353
  "../../core/ts/src/tokens.ts"() {
5354
- "use strict";
5355
5354
  SYSTEM_FONT_FAMILY = "$system";
5356
5355
  TONAL_ELEVATION_ALPHA = [0, 0.05, 0.08, 0.11, 0.12, 0.14];
5357
5356
  }
@@ -22579,6 +22578,40 @@ var init_icons = __esm({
22579
22578
  }
22580
22579
  });
22581
22580
 
22581
+ // ../../core/web-renderer/src/webviewFrame.ts
22582
+ function currentOrigin() {
22583
+ try {
22584
+ const origin = typeof window !== "undefined" ? window.location?.origin : void 0;
22585
+ return origin && origin !== "null" ? origin : null;
22586
+ } catch {
22587
+ return null;
22588
+ }
22589
+ }
22590
+ function webviewFrameSandbox(url, grants2 = [], pageOrigin = currentOrigin()) {
22591
+ const parsed = url.replace(/^[\u0000-\u0020]+|[\u0000-\u0020]+$/g, "").replace(/[\t\n\r]/g, "");
22592
+ const absolute = /^[a-z][a-z0-9+.-]*:/i.test(parsed);
22593
+ let target;
22594
+ try {
22595
+ target = new URL(parsed, pageOrigin ?? "http://relative.invalid");
22596
+ } catch {
22597
+ return null;
22598
+ }
22599
+ if (!NETWORK_SCHEMES.has(target.protocol)) return null;
22600
+ const crossOrigin = pageOrigin !== null && absolute && target.origin !== pageOrigin;
22601
+ const tokens = ["allow-scripts", ...grants2.filter((g) => g !== "allow-scripts" && g !== "allow-same-origin")];
22602
+ if (crossOrigin) tokens.splice(1, 0, "allow-same-origin");
22603
+ return { src: crossOrigin ? target.href : url, sandbox: tokens.join(" ") };
22604
+ }
22605
+ function isWebviewUrlAllowed(url) {
22606
+ return webviewFrameSandbox(url, [], null) !== null;
22607
+ }
22608
+ var NETWORK_SCHEMES;
22609
+ var init_webviewFrame = __esm({
22610
+ "../../core/web-renderer/src/webviewFrame.ts"() {
22611
+ NETWORK_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:"]);
22612
+ }
22613
+ });
22614
+
22582
22615
  // ../../core/web-renderer/src/a11y/controls.tsx
22583
22616
  import React3 from "react";
22584
22617
  import { jsx as jsx4, jsxs } from "react/jsx-runtime";
@@ -24321,9 +24354,10 @@ function withExtras(name, render) {
24321
24354
  const additive = addIntrinsicPadding(el.props.style, wrap ?? {});
24322
24355
  const inferredDecorative = el.props[INFERRED_DECORATIVE] === true;
24323
24356
  const iconGlyph2 = el.props[ICON_GLYPH] === true;
24357
+ const roleWhenNamed = el.props[ROLE_WHEN_NAMED];
24324
24358
  if (!Object.keys(pass).length) {
24325
- if (inferredDecorative || iconGlyph2) {
24326
- return React5.cloneElement(el, { [INFERRED_DECORATIVE]: void 0, [ICON_GLYPH]: void 0, ...additive ? { style: additive } : {} });
24359
+ if (inferredDecorative || iconGlyph2 || roleWhenNamed != null) {
24360
+ return React5.cloneElement(el, { [INFERRED_DECORATIVE]: void 0, [ICON_GLYPH]: void 0, [ROLE_WHEN_NAMED]: void 0, ...additive ? { style: additive } : {} });
24327
24361
  }
24328
24362
  return additive ? React5.cloneElement(el, { style: additive }) : /* @__PURE__ */ jsx6(Fragment3, { children: el });
24329
24363
  }
@@ -24335,6 +24369,14 @@ function withExtras(name, render) {
24335
24369
  const nodeSpeaksForItself = pass["aria-label"] != null || passRole != null && passRole !== "presentation" && passRole !== "none" || typeof pass.onClick === "function" || typeof pass.onDoubleClick === "function";
24336
24370
  if (pass["aria-hidden"] == null && nodeSpeaksForItself) next["aria-hidden"] = void 0;
24337
24371
  }
24372
+ if (roleWhenNamed != null) {
24373
+ next[ROLE_WHEN_NAMED] = void 0;
24374
+ const isControl = typeof pass.onClick === "function" || typeof pass.onDoubleClick === "function";
24375
+ const roleAuthored = pass[AUTHORED_ROLE] === true;
24376
+ if (typeof roleWhenNamed === "string" && pass["aria-label"] != null && pass.role == null && prev.role == null && !isControl && !roleAuthored) {
24377
+ next.role = roleWhenNamed;
24378
+ }
24379
+ }
24338
24380
  if (iconGlyph2) {
24339
24381
  next[ICON_GLYPH] = void 0;
24340
24382
  if (pass.role === "presentation" && typeof pass.onClick !== "function" && typeof pass.onDoubleClick !== "function") {
@@ -24348,6 +24390,7 @@ function withExtras(name, render) {
24348
24390
  delete next[SYNTHETIC_TAP_ROLE];
24349
24391
  const tabIndexIsSynthetic = next[SYNTHETIC_TABINDEX] === true;
24350
24392
  delete next[SYNTHETIC_TABINDEX];
24393
+ delete next[AUTHORED_ROLE];
24351
24394
  if (additive) next.style = additive;
24352
24395
  const ownsInteractiveSemantics = isNativeInteractiveElement(el) || hasInteractiveReactDescendant(el);
24353
24396
  if (ownsInteractiveSemantics) {
@@ -24896,6 +24939,7 @@ function applyA11ySemantics(node, ctx, extra) {
24896
24939
  if (typeof headingLevel === "number" && headingLevel >= 1 && headingLevel <= 6) {
24897
24940
  extra["aria-level"] = String(headingLevel);
24898
24941
  }
24942
+ if (role != null && Object.prototype.hasOwnProperty.call(ARIA_ROLE, role)) extra[AUTHORED_ROLE] = true;
24899
24943
  const hint = str7(m.accessibilityHint ?? m.accessibility_hint);
24900
24944
  const value = str7(m.accessibilityValue ?? m.accessibility_value);
24901
24945
  if (value) extra["aria-valuetext"] = value;
@@ -25091,7 +25135,10 @@ function renderNodeInner(node, ctx) {
25091
25135
  if (composed) extra.style = composed;
25092
25136
  }
25093
25137
  }
25094
- if (typeof el.type === "string") delete extra[SYNTHETIC_TABINDEX];
25138
+ if (typeof el.type === "string") {
25139
+ delete extra[SYNTHETIC_TABINDEX];
25140
+ delete extra[AUTHORED_ROLE];
25141
+ }
25095
25142
  let out = Object.keys(extra).length ? React5.cloneElement(el, extra) : el;
25096
25143
  if (a11yHint) {
25097
25144
  out = /* @__PURE__ */ jsx6(A11yHintDescription, { hint: a11yHint, idBase: componentId, children: out });
@@ -25812,7 +25859,7 @@ function renderInner(node, ctx) {
25812
25859
  }
25813
25860
  }
25814
25861
  }
25815
- var useIsomorphicLayoutEffect, ResponsiveGrid, SPLIT_EXPANDED_MIN_WIDTH, SPLIT_COLUMN_GAP, ResponsiveSplitView, ABSOLUTE_URL_RE, appearKeyframesInjected, pressStylesInjected, FOCUS_RING_CSS, focusStylesInjected, HLIST_CHILD_CSS, hListStylesInjected, listAnimateRuntimeInstalled, transitionKeyframesInjected, countUpRuntimeInjected, MEASURE_PREFIX, measureRuntimeInjected, revealRuntimeInjected, vectorAnimStylesInjected, scrollProgressRuntimeInjected, confettiRuntimeInjected, lottieRuntimeInjected, riveRuntimeInjected, gradientKeyframesInjected, parallaxRuntimeInjected, spinKeyframesInjected, marqueeKeyframesInjected, alignItems, zJustifyItems, hAlignItems, bodyFont, kids, rowKids, staggeredKids, asTextL10n, asBoundText, useBoundString, InterpolatedTextView, txt, selectFragmentCase, fragmentValueHash, fragmentSlotContent, FragmentSlotNode, WorkerSubtreeNode, resolveItemDeep2, resolveSwipeActions, resolveModBindings, resolvedComponentId, directServiceBindings, ReactiveDirectScalars, HiddenGate, KEYBOARD_INPUT_MODES, AUTOCAPITALIZE_VALUES, ENTER_KEY_HINTS, AUTOGROW_CEILING, EditableField, MenuNode, LoadMoreSentinel, FieldErrorNode, FormView, MediaSlotProvider, MEDIA_ITEM_BINDABLE, MediaPlayerView, VideoNode, PdfViewNode, WebViewNode, InteractivePicker, InteractiveDatePicker, InteractiveSearchField, InteractiveStepper, SYNTHETIC_TAP_ROLE, SYNTHETIC_TABINDEX, INFERRED_DECORATIVE, ICON_GLYPH, INTERACTIVE_ROLES, ALWAYS_INTERACTIVE_COMPONENT_TYPES, controlNode, ToggleNode, SliderNode, SelectionControlNode, TabsNode, SegmentedControlNode, DisclosureGroupNode, GridNode, SplitViewNode, TextNode, ImageNode, AvatarNode, IconNode, ButtonNode, OtpInputNode, ProgressBarNode, ActivityIndicatorNode, BottomSheetNode, ChipsInputNode, ChipNode, TableNode, GaugeRing, GaugeNode, RATING_METRICS, ratingMetrics, RatingNode, AvatarStripNode, CHART_STROKE_CYCLE, chartStrokeAt, chartBarCenter, ChartNode, donutSliceOpacity, DonutChartNode, LegendMarker, LegendNode, cellAlign, DataTableNode, voiceNoteState, voiceNoteDelivery, VOICE_NOTE_DEFAULT_BARS, clampBarCount, VoiceNoteNode, TimelineNode, WheelPickerNode, ColorPickerNode, FilterChipsNode, TILE_PX, MAX_MERCATOR_LAT, DEFAULT_TILE_MAX_ZOOM, CIRCLE_SEGMENTS, METRES_PER_DEG_LAT, MARKER_HIT_RADIUS, SHAPE_HIT_RADIUS, MapNode, CollapsingHeaderNode, UnsupportedOnSurface, CALENDAR_DATE_ONLY_RE, CAL_DEFAULT_MAX_DOTS, CAL_AGENDA_INITIAL_DAYS, CAL_AGENDA_PAGE_DAYS, CAL_DEFAULT_SNAP_MINUTES, CAL_UNASSIGNED_LANE_ID, MonthCalendarNode, TimeGridNode, AgendaNode, ARIA_ROLE, initialFocusScheduled, initialFocusSeen, PRESENTED_SCOPE, presentedOpeners, presentedObserver, A11yHintDescription, WebRenderer;
25862
+ var useIsomorphicLayoutEffect, ResponsiveGrid, SPLIT_EXPANDED_MIN_WIDTH, SPLIT_COLUMN_GAP, ResponsiveSplitView, ABSOLUTE_URL_RE, appearKeyframesInjected, pressStylesInjected, FOCUS_RING_CSS, focusStylesInjected, HLIST_CHILD_CSS, hListStylesInjected, listAnimateRuntimeInstalled, transitionKeyframesInjected, countUpRuntimeInjected, MEASURE_PREFIX, measureRuntimeInjected, revealRuntimeInjected, vectorAnimStylesInjected, scrollProgressRuntimeInjected, confettiRuntimeInjected, lottieRuntimeInjected, riveRuntimeInjected, gradientKeyframesInjected, parallaxRuntimeInjected, spinKeyframesInjected, marqueeKeyframesInjected, alignItems, zJustifyItems, hAlignItems, bodyFont, kids, rowKids, staggeredKids, asTextL10n, asBoundText, useBoundString, InterpolatedTextView, txt, selectFragmentCase, fragmentValueHash, fragmentSlotContent, FragmentSlotNode, WorkerSubtreeNode, resolveItemDeep2, resolveSwipeActions, resolveModBindings, resolvedComponentId, directServiceBindings, ReactiveDirectScalars, HiddenGate, KEYBOARD_INPUT_MODES, AUTOCAPITALIZE_VALUES, ENTER_KEY_HINTS, AUTOGROW_CEILING, EditableField, MenuNode, LoadMoreSentinel, FieldErrorNode, FormView, MediaSlotProvider, MEDIA_ITEM_BINDABLE, MediaPlayerView, VideoNode, PdfViewNode, WebViewNode, InteractivePicker, InteractiveDatePicker, InteractiveSearchField, InteractiveStepper, SYNTHETIC_TAP_ROLE, SYNTHETIC_TABINDEX, INFERRED_DECORATIVE, ICON_GLYPH, ROLE_WHEN_NAMED, AUTHORED_ROLE, INTERACTIVE_ROLES, ALWAYS_INTERACTIVE_COMPONENT_TYPES, controlNode, ToggleNode, SliderNode, SelectionControlNode, TabsNode, SegmentedControlNode, DisclosureGroupNode, GridNode, SplitViewNode, TextNode, ImageNode, AvatarNode, IconNode, ButtonNode, OtpInputNode, ProgressBarNode, ActivityIndicatorNode, BottomSheetNode, ChipsInputNode, ChipNode, TableNode, GaugeRing, GaugeNode, RATING_METRICS, ratingMetrics, RatingNode, AvatarStripNode, CHART_STROKE_CYCLE, chartStrokeAt, chartBarCenter, ChartNode, donutSliceOpacity, DonutChartNode, LegendMarker, LegendNode, cellAlign, DataTableNode, voiceNoteState, voiceNoteDelivery, VOICE_NOTE_DEFAULT_BARS, clampBarCount, VoiceNoteNode, TimelineNode, WheelPickerNode, ColorPickerNode, FilterChipsNode, TILE_PX, MAX_MERCATOR_LAT, DEFAULT_TILE_MAX_ZOOM, CIRCLE_SEGMENTS, METRES_PER_DEG_LAT, MARKER_HIT_RADIUS, SHAPE_HIT_RADIUS, MapNode, CollapsingHeaderNode, UnsupportedOnSurface, CALENDAR_DATE_ONLY_RE, CAL_DEFAULT_MAX_DOTS, CAL_AGENDA_INITIAL_DAYS, CAL_AGENDA_PAGE_DAYS, CAL_DEFAULT_SNAP_MINUTES, CAL_UNASSIGNED_LANE_ID, MonthCalendarNode, TimeGridNode, AgendaNode, ARIA_ROLE, initialFocusScheduled, initialFocusSeen, PRESENTED_SCOPE, presentedOpeners, presentedObserver, A11yHintDescription, WebRenderer;
25816
25863
  var init_renderNode = __esm({
25817
25864
  "../../core/web-renderer/src/renderNode.tsx"() {
25818
25865
  "use strict";
@@ -25829,6 +25876,7 @@ var init_renderNode = __esm({
25829
25876
  init_env();
25830
25877
  init_actionParams();
25831
25878
  init_icons();
25879
+ init_webviewFrame();
25832
25880
  init_icon_catalog_generated();
25833
25881
  init_controls();
25834
25882
  init_modalStack();
@@ -27048,13 +27096,14 @@ var init_renderNode = __esm({
27048
27096
  const inlineHtml = props.inlineHtml != null && isBinding(props.inlineHtml) ? boundHtml : props.inlineHtml;
27049
27097
  const urlStr = typeof url === "string" && url.length > 0 && !isBinding(url) ? url : void 0;
27050
27098
  const htmlStr = typeof inlineHtml === "string" && inlineHtml.length > 0 && !isBinding(inlineHtml) ? inlineHtml : void 0;
27099
+ const urlFrame = urlStr ? webviewFrameSandbox(urlStr) : null;
27051
27100
  const h = typeof props.height === "number" && props.height > 0 ? props.height : void 0;
27052
27101
  const ar = typeof props.aspectRatio === "number" && props.aspectRatio > 0 ? props.aspectRatio : void 0;
27053
27102
  const frameStyle = { width: "100%", boxSizing: "border-box", border: "none", borderRadius: ctx.radius("md", 8), background: "#fff", ...h ? { height: h } : ar ? { aspectRatio: String(ar) } : { height: 200 } };
27054
27103
  const bandColor = typeof props.coverBandColor === "string" && props.coverBandColor.length > 0 ? props.coverBandColor : void 0;
27055
27104
  return /* @__PURE__ */ jsxs3("div", { style: { width: "100%", position: "relative", ...bandColor ? { background: bandColor, borderRadius: ctx.radius("md", 8), overflow: "hidden" } : {}, ...wrap }, children: [
27056
27105
  bandColor ? /* @__PURE__ */ jsx6("div", { "data-testid": "webview-cover-band", style: { height: 8, background: bandColor } }) : null,
27057
- htmlStr ? /* @__PURE__ */ jsx6("iframe", { title: "webview", srcDoc: htmlStr, sandbox: "allow-scripts", style: frameStyle }) : urlStr ? /* @__PURE__ */ jsx6("iframe", { title: "webview", src: urlStr, sandbox: "allow-scripts allow-same-origin", style: frameStyle }) : /* @__PURE__ */ jsx6("div", { style: { ...frameStyle, display: "grid", placeItems: "center", color: "#999", fontFamily: "ui-monospace, monospace", fontSize: 11, border: "1px dashed #ccc" }, children: "WebView (no url)" })
27106
+ htmlStr ? /* @__PURE__ */ jsx6("iframe", { title: "webview", srcDoc: htmlStr, sandbox: "allow-scripts", style: frameStyle }) : urlFrame ? /* @__PURE__ */ jsx6("iframe", { title: "webview", src: urlFrame.src, sandbox: urlFrame.sandbox, style: frameStyle }) : /* @__PURE__ */ jsx6("div", { style: { ...frameStyle, display: "grid", placeItems: "center", color: "#999", fontFamily: "ui-monospace, monospace", fontSize: 11, border: "1px dashed #ccc" }, children: urlStr ? "WebView (url not allowed)" : "WebView (no url)" })
27058
27107
  ] });
27059
27108
  });
27060
27109
  InteractivePicker = withExtras("InteractivePicker", ({ props, ctx, wrap }) => {
@@ -27332,6 +27381,8 @@ var init_renderNode = __esm({
27332
27381
  SYNTHETIC_TABINDEX = "data-hm-synthetic-tabindex";
27333
27382
  INFERRED_DECORATIVE = "data-hm-inferred-decorative";
27334
27383
  ICON_GLYPH = "data-hm-icon-glyph";
27384
+ ROLE_WHEN_NAMED = "data-hm-role-when-named";
27385
+ AUTHORED_ROLE = "data-hm-authored-role";
27335
27386
  INTERACTIVE_ROLES = /* @__PURE__ */ new Set([
27336
27387
  "button",
27337
27388
  "checkbox",
@@ -27539,7 +27590,7 @@ var init_renderNode = __esm({
27539
27590
  const iconName = isBinding(props.name) ? String(bound ?? "") : props.name;
27540
27591
  const contentDescription = useResolvedScalar(props.contentDescription, ctx);
27541
27592
  const described = contentDescription != null && String(contentDescription).trim() !== "";
27542
- const a11y = described ? { role: "img", "aria-label": String(contentDescription), [ICON_GLYPH]: true } : { "aria-hidden": "true", [INFERRED_DECORATIVE]: true, [ICON_GLYPH]: true };
27593
+ const a11y = described ? { role: "img", "aria-label": String(contentDescription), [ICON_GLYPH]: true } : { "aria-hidden": "true", [INFERRED_DECORATIVE]: true, [ICON_GLYPH]: true, [ROLE_WHEN_NAMED]: "img" };
27543
27594
  return /* @__PURE__ */ jsx6("span", { ...a11y, style: { display: "inline-grid", placeItems: "center", width: size + 6, height: size + 6, lineHeight: 1, flex: "none", ...wrap }, children: iconSvg(iconName, { size, color: C(resolveScalarStatic(props.tint, ctx) ?? "textPrimary", "#636b78") }) });
27544
27595
  });
27545
27596
  ButtonNode = withExtras("ButtonNode", ({ props, ctx, wrap }) => {
@@ -27675,11 +27726,13 @@ var init_renderNode = __esm({
27675
27726
  const thick = Math.max(3, Math.round(size / 8));
27676
27727
  const bound = useResolvedScalar(props.valuePath, ctx);
27677
27728
  const aiRaw = props.valuePath != null ? bound : props.value;
27678
- const determinate = !props.indeterminate && typeof aiRaw === "number";
27729
+ const aiNum = typeof aiRaw === "number" ? aiRaw : typeof aiRaw === "string" && aiRaw.trim() !== "" ? Number(aiRaw) : void 0;
27730
+ const determinate = !props.indeterminate && aiNum !== void 0 && Number.isFinite(aiNum);
27679
27731
  if (determinate) {
27680
- const pct = Math.max(0, Math.min(1, aiRaw));
27732
+ const pct = Math.max(0, Math.min(1, aiNum));
27681
27733
  const ringMask = `radial-gradient(farthest-side, transparent calc(100% - ${thick}px), #000 calc(100% - ${thick}px))`;
27682
- return /* @__PURE__ */ jsx6("div", { role: "progressbar", style: { width: size, height: size, borderRadius: "50%", flex: "none", background: `conic-gradient(${tint} ${pct * 360}deg, ${track} 0deg)`, WebkitMask: ringMask, mask: ringMask, ...wrap } });
27734
+ const a11y = { "aria-valuemin": 0, "aria-valuemax": 100, "aria-valuenow": Math.round(pct * 100) };
27735
+ return /* @__PURE__ */ jsx6("div", { role: "progressbar", ...a11y, style: { width: size, height: size, borderRadius: "50%", flex: "none", background: `conic-gradient(${tint} ${pct * 360}deg, ${track} 0deg)`, WebkitMask: ringMask, mask: ringMask, ...wrap } });
27683
27736
  }
27684
27737
  ensureSpinKeyframes();
27685
27738
  return /* @__PURE__ */ jsx6("div", { role: "progressbar", style: { width: size, height: size, borderRadius: "50%", border: `${thick}px solid ${track}`, borderTopColor: tint, boxSizing: "border-box", flex: "none", animation: ctx.empty ? void 0 : "himalaya-spin 0.8s linear infinite", ...wrap } });
@@ -29374,6 +29427,7 @@ __export(src_exports, {
29374
29427
  isBinding: () => isBinding,
29375
29428
  isNodeLike: () => isNodeLike,
29376
29429
  isSerifFamily: () => isSerifFamily,
29430
+ isWebviewUrlAllowed: () => isWebviewUrlAllowed,
29377
29431
  makeCtx: () => makeCtx,
29378
29432
  makeModStyle: () => makeModStyle,
29379
29433
  makeTokenResolvers: () => makeTokenResolvers,
@@ -29382,7 +29436,8 @@ __export(src_exports, {
29382
29436
  renderDescriptorToHtml: () => renderDescriptorToHtml,
29383
29437
  renderNode: () => renderNode,
29384
29438
  servicePath: () => servicePath,
29385
- useBoundValue: () => useBoundValue
29439
+ useBoundValue: () => useBoundValue,
29440
+ webviewFrameSandbox: () => webviewFrameSandbox
29386
29441
  });
29387
29442
  var init_src3 = __esm({
29388
29443
  "../../core/web-renderer/src/index.ts"() {
@@ -29396,6 +29451,7 @@ var init_src3 = __esm({
29396
29451
  init_AppRegistry();
29397
29452
  init_helpers();
29398
29453
  init_icons();
29454
+ init_webviewFrame();
29399
29455
  }
29400
29456
  });
29401
29457
 
@@ -48891,7 +48947,14 @@ function indexHtml(asset, pathname, creds, handoverAttempted = false) {
48891
48947
  headers: {
48892
48948
  "content-type": asset.contentType || "text/html; charset=utf-8",
48893
48949
  "cache-control": creds || handoverAttempted ? "no-store" : "public, max-age=60, stale-while-revalidate=600",
48894
- "content-security-policy": previewCsp(nonce)
48950
+ "content-security-policy": previewCsp(nonce),
48951
+ // This document's URL can name a credential: `?pvt=` (still accepted from an embedder such
48952
+ // as the dashboard frame) or a `?h=` code before the inline script strips it. The browser
48953
+ // default sends the FULL URL as `Referer` on same-origin requests, so every `/v1/*` read,
48954
+ // the gateway's request log and the Tier-5 frame's `document.referrer` would carry it.
48955
+ // `strict-origin` sends the origin alone. Not `no-referrer`: that also turns a same-origin
48956
+ // POST's `Origin` header into `null`, and `/v1/telemetry/ingest` is one (#2386).
48957
+ "referrer-policy": "strict-origin"
48895
48958
  }
48896
48959
  });
48897
48960
  }
@@ -48925,7 +48988,7 @@ function previewResponse(pathname, assets, mount = "/preview", creds, handoverAt
48925
48988
  var T5_FRAME_CSP, PREVIEW_BASE_JS, PREVIEW_ENTRY_RECOVERY_JS, MOUNT_STRIP;
48926
48989
  var init_preview2 = __esm({
48927
48990
  "../../packages/serve/src/preview.ts"() {
48928
- T5_FRAME_CSP = "default-src 'none'; script-src 'unsafe-inline' 'unsafe-eval'; connect-src 'none'; img-src 'none'; media-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'";
48991
+ T5_FRAME_CSP = "default-src 'none'; script-src 'unsafe-inline' 'unsafe-eval'; connect-src 'none'; img-src 'none'; media-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'; sandbox allow-scripts";
48929
48992
  PREVIEW_BASE_JS = // Both serve mounts (/preview framed + /app unframed — RFC 0051 track D) serve the SAME
48930
48993
  // embedded artifact, so one shim derives whichever mount the browser is on. Non-greedy:
48931
48994
  // the EARLIEST mount segment wins, mirroring the SPA's own deployBase (an app literally
@@ -49178,21 +49241,21 @@ var init_preview_assets_generated = __esm({
49178
49241
  "../../packages/serve/src/preview-assets.generated.ts"() {
49179
49242
  init_preview_assets_format();
49180
49243
  PREVIEW_ASSET_MANIFEST = [
49181
- { key: "assets/index-BvsDhZYW.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1043409, sha256: "98882914dcb360867c5f265e3d6542774f18c0b0c8f18813b66b304a122c1b01" },
49182
- { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 1043417, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
49183
- { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 1048027, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
49184
- { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 1536611, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
49185
- { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1627535, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
49186
- { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1718519, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
49187
- { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1809499, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
49188
- { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1900371, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
49189
- { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 1991351, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
49190
- { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 2099987, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
49191
- { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 2209071, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
49192
- { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 2318119, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
49193
- { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 2425819, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
49194
- { key: "index.html", contentType: "text/html; charset=utf-8", offset: 2513927, length: 4947, sha256: "3dd02534fef5e0c2bb40b6c6a6c994641728fde306921e66ffab3e9a7dfa6bbe" },
49195
- { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 2518874, length: 17209, sha256: "dffc9718e2faa63ae2cc919e0a842f585ed565aaaa7c53778e90379442c731b6" }
49244
+ { key: "assets/index-Dn3oPAne.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1044844, sha256: "7b781f264f2aac500b00ea4def7cb6f3c19e46dd4ebb3b797de5da8386056543" },
49245
+ { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 1044852, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
49246
+ { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 1049462, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
49247
+ { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 1538046, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
49248
+ { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1628970, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
49249
+ { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1719954, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
49250
+ { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1810934, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
49251
+ { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1901806, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
49252
+ { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 1992786, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
49253
+ { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 2101422, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
49254
+ { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 2210506, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
49255
+ { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 2319554, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
49256
+ { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 2427254, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
49257
+ { key: "index.html", contentType: "text/html; charset=utf-8", offset: 2515362, length: 4947, sha256: "25d01e5f772c7b782ca7c68f997765d3838295369054c0855ba63320d071ec22" },
49258
+ { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 2520309, length: 17209, sha256: "dffc9718e2faa63ae2cc919e0a842f585ed565aaaa7c53778e90379442c731b6" }
49196
49259
  ];
49197
49260
  }
49198
49261
  });
Binary file
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@wix/himalaya-cli",
3
- "version": "0.1027.0",
3
+ "version": "0.1028.0",
4
4
  "type": "module",
5
5
  "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
6
6
  "keywords": [
@@ -65,5 +65,5 @@
65
65
  "artifactId": "himalaya-cli"
66
66
  }
67
67
  },
68
- "falconPackageHash": "9ce64db92bfef4391297f6111f02ad23a382a5e206bd732aae1df4b1"
68
+ "falconPackageHash": "59c5cc0524f87f37cc078c95033304d90d56388bf25c7622625cbe9c"
69
69
  }