@wix/himalaya-cli 0.1030.0 → 0.1031.0

package/dist/cli.mjs

@@ -16806,16 +16806,33 @@ function redactBodyString(body) {
 function createWixGatewayState() {
   return { mode: "record", rules: [], traffic: [], clients: /* @__PURE__ */ new Set(), seq: 0, ruleSeq: 0 };
 }
+function failsClosed(gw) {
+  return gw.mode === "mock" && gw.unmatched === "fail";
+}
+function hermeticRefusal(method, path2) {
+  return {
+    status: 404,
+    headers: { "content-type": "application/json; charset=utf-8" },
+    body: JSON.stringify({
+      message: `No hermetic fixture for ${method} ${path2}. The dev gateway is sealed (mode: mock, unmatched: fail), so this call was not sent to Wix. Add a rule to the app's net mocks.`,
+      details: { applicationError: { code: "HIMI_HERMETIC_NO_FIXTURE", description: `${method} ${path2}` } }
+    })
+  };
+}
+function parseUnmatched(value) {
+  return value === "fail" || value === "passthrough" ? value : void 0;
+}
 function applyNetMocks(gw, mocks) {
   const rules = Array.isArray(mocks.rules) ? mocks.rules : [];
   gw.rules = rules.map((r) => ({ ...r, id: r.id || ++gw.ruleSeq }));
   gw.mode = mocks.mode ?? (gw.rules.length > 0 ? "mock" : gw.mode);
+  gw.unmatched = parseUnmatched(mocks.unmatched) ?? "passthrough";
   return { rules: gw.rules.length, mode: gw.mode };
 }
 function resolveNetMocks(fileMocks, appDeclared) {
   if (fileMocks) return { mocks: fileMocks, source: "file" };
   const declared = Array.isArray(appDeclared?.rules) ? appDeclared.rules : [];
-  if (declared.length > 0) return { mocks: { mode: appDeclared?.mode, rules: declared }, source: "app" };
+  if (declared.length > 0) return { mocks: { mode: appDeclared?.mode, rules: declared, unmatched: appDeclared?.unmatched }, source: "app" };
   return null;
 }
 function readNetMocksFile(path2) {
@@ -16826,7 +16843,7 @@ function readNetMocksFile(path2) {
     if (raw && typeof raw === "object") {
       const o = raw;
       if (!Array.isArray(o.rules) || wixMockRuleErrors(o.rules).length) return null;
-      return { mode: o.mode, rules: o.rules };
+      return { mode: o.mode, rules: o.rules, unmatched: parseUnmatched(o.unmatched) };
     }
     return null;
   } catch {
@@ -16984,17 +17001,22 @@ data: ${JSON.stringify({ mode: gw.mode })}
   }
   if (suffix === "mode" && method === "POST") {
     try {
-      const { mode } = JSON.parse(await readBody(req));
+      const { mode, unmatched } = JSON.parse(await readBody(req));
       if (mode === "record" || mode === "mock") {
         gw.mode = mode;
         gw.operatorOverride = true;
       }
+      const policy = parseUnmatched(unmatched);
+      if (policy) {
+        gw.unmatched = policy;
+        gw.operatorOverride = true;
+      }
     } catch {
     }
-    return json(res, 200, { ok: true, mode: gw.mode }), true;
+    return json(res, 200, { ok: true, mode: gw.mode, unmatched: gw.unmatched ?? "passthrough" }), true;
   }
   if (suffix === "rules" && method === "GET") {
-    return json(res, 200, { mode: gw.mode, rules: gw.rules }), true;
+    return json(res, 200, { mode: gw.mode, unmatched: gw.unmatched ?? "passthrough", rules: gw.rules }), true;
   }
   if (suffix === "rules" && method === "PUT") {
     try {
@@ -17048,8 +17070,38 @@ data: ${JSON.stringify({ mode: gw.mode })}
       return true;
     }
     if (!target) {
+      recordWixTraffic(gw, app, adminUrl, {
+        ts: started,
+        source: "proxy",
+        capability,
+        host,
+        method: upstreamMethod,
+        url: "",
+        path: targetPath,
+        status: 400,
+        durationMs: Date.now() - started
+      });
       return json(res, 400, { error: "missing_target" }), true;
     }
+    if (!match && failsClosed(gw)) {
+      const refusal = hermeticRefusal(upstreamMethod, targetPath);
+      recordWixTraffic(gw, app, adminUrl, {
+        ts: started,
+        source: "mock",
+        capability,
+        host,
+        method: upstreamMethod,
+        url: target,
+        path: targetPath,
+        status: refusal.status,
+        durationMs: Date.now() - started,
+        mockRuleId: UNMATCHED_FAIL_CLOSED_ID
+      });
+      res.statusCode = refusal.status;
+      for (const [k, v] of Object.entries(refusal.headers)) res.setHeader(k, v);
+      res.end(refusal.body);
+      return true;
+    }
     const fwdHeaders = {};
     for (const [k, v] of Object.entries(req.headers)) {
       const lk = k.toLowerCase();
@@ -17129,7 +17181,7 @@ data: ${JSON.stringify({ mode: gw.mode })}
   }
   return false;
 }
-var WIX_DEV_CLIENT_ID, TRAFFIC_CAP, BODY_CAP, SECRET_HEADERS, SECRET_BODY_KEYS, REDACTED, normKey, FORM_ASSIGNMENT_RE, JSON_FIELD_RE, JSON_FIELD_UNTERMINATED_RE, BEARER_RE;
+var WIX_DEV_CLIENT_ID, TRAFFIC_CAP, BODY_CAP, SECRET_HEADERS, SECRET_BODY_KEYS, REDACTED, normKey, FORM_ASSIGNMENT_RE, JSON_FIELD_RE, JSON_FIELD_UNTERMINATED_RE, BEARER_RE, UNMATCHED_FAIL_CLOSED_ID;
 var init_wix_gateway = __esm({
   "../../core/dev-server/src/wix-gateway.ts"() {
     init_wix_gateway_rules();
@@ -17177,6 +17229,7 @@ var init_wix_gateway = __esm({
     JSON_FIELD_RE = /"([^"\\]+)"(\s*:\s*)"((?:\\.|[^"\\])*)"/g;
     JSON_FIELD_UNTERMINATED_RE = /"([^"\\]+)"(\s*:\s*)"(?:\\.|[^"\\])*$/;
     BEARER_RE = /\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi;
+    UNMATCHED_FAIL_CLOSED_ID = "unmatched:fail-closed";
   }
 });
 
@@ -18781,21 +18834,22 @@ async function reseedIfDayChanged(host, today = todayYmd()) {
   if (host.wix.operatorOverride) return { reseeded: false, reason: "operator-override" };
   const declared = host.declaredRules();
   if (!declared?.rules?.length) {
-    const before = { mode: host.wix.mode, rules: [...host.wix.rules] };
-    host.seed({ mode: declared ? declared.mode : "record", rules: [] });
-    if (scenarioChanged(before, { mode: host.wix.mode, rules: host.wix.rules })) {
+    const before = { mode: host.wix.mode, rules: [...host.wix.rules], unmatched: host.wix.unmatched };
+    host.seed({ mode: declared ? declared.mode : "record", rules: [], ...declared?.unmatched ? { unmatched: declared.unmatched } : {} });
+    if (scenarioChanged(before, { mode: host.wix.mode, rules: host.wix.rules, unmatched: host.wix.unmatched })) {
       host.publishConfigInvalidated("net-mocks scenario removed");
     }
     host.seededOn = today;
     return { reseeded: false, reason: "no-rules" };
   }
-  host.seed({ mode: declared.mode, rules: declared.rules });
+  host.seed({ mode: declared.mode, rules: declared.rules, ...declared.unmatched ? { unmatched: declared.unmatched } : {} });
   host.seededOn = today;
   host.publishConfigInvalidated("net-mocks date rollover");
   return { reseeded: true, rules: declared.rules.length, from, to: today };
 }
 function scenarioChanged(before, after) {
   if (before.mode !== after.mode) return true;
+  if ((before.unmatched ?? "passthrough") !== (after.unmatched ?? "passthrough")) return true;
   if (before.rules.length !== after.rules.length) return true;
   return serialise(before.rules) !== serialise(after.rules);
 }
@@ -20046,7 +20100,6 @@ function shouldRevealError(args) {
 var EMAIL_RE, URL_HOST_RE, INTEGER_RE, NUMBER_RE;
 var init_validation = __esm({
   "../../core/ts/src/validation.ts"() {
-    "use strict";
     EMAIL_RE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/;
     URL_HOST_RE = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(:[0-9]+)?$/;
     INTEGER_RE = /^[+-]?[0-9]+$/;
@@ -23633,7 +23686,6 @@ function validateWorkerSubtree(raw, slotId, policy, actionCatalog) {
 var WORKER_SUBTREE_CEILINGS, ID_PART, ACTION_ID;
 var init_worker_subtree = __esm({
   "../../core/ts/src/worker-subtree.ts"() {
-    "use strict";
     init_worker_subtree_safe_types_generated();
     WORKER_SUBTREE_CEILINGS = Object.freeze({
       maxEncodedBytes: 65536,
@@ -25589,14 +25641,43 @@ function renderInner(node, ctx) {
       const titleF = ctx.font(props.titleStyle ?? "body");
       const subF = ctx.font(props.subtitleStyle ?? "caption");
       const accessoryGlyph = props.accessory === "chevron" ? "\u203A" : props.accessory === "checkmark" ? "\u2713" : null;
-      const onClick = ctx.onAction && props.onTap ? () => ctx.onAction(resolveItemDeep2(props.onTap, ctx)) : void 0;
-      const ell = { whiteSpace: "nowrap", overflow: "hidden", textOverflow: "ellipsis" };
-      return /* @__PURE__ */ jsxs3("div", { onClick, style: { display: "flex", alignItems: "center", gap: 12, width: "100%", padding: "10px 4px", boxSizing: "border-box", cursor: onClick ? "pointer" : void 0, ...wrap }, children: [
-        props.leading && /* @__PURE__ */ jsx6("div", { style: { flex: "none", display: "flex" }, children: renderNode(props.leading, ctx) }),
-        /* @__PURE__ */ jsxs3("div", { style: { flex: 1, minWidth: 0, display: "flex", flexDirection: "column", gap: 2 }, children: [
-          props.overline != null && /* @__PURE__ */ jsx6("span", { style: { fontFamily: bodyFont(ctx), fontSize: 11, fontWeight: 600, letterSpacing: 0.4, textTransform: "uppercase", color: C(props.overlineColor ?? "textSecondary", "#888"), ...ell }, children: txt(props.overline, ctx) }),
-          /* @__PURE__ */ jsx6("span", { style: { fontFamily: fontStack(titleF.family, ctx.idiom), fontSize: titleF.remSize, fontWeight: titleF.weight, color: C(props.titleColor ?? "textPrimary", "#13171e"), ...ell }, children: txt(props.title, ctx) ?? (ctx.empty ? "" : "") }),
-          props.subtitle != null && /* @__PURE__ */ jsx6("span", { style: { fontFamily: fontStack(subF.family, ctx.idiom), fontSize: subF.remSize, color: C(props.subtitleColor ?? "textSecondary", "#888"), ...ell }, children: txt(props.subtitle, ctx) })
+      const rowDisabled = props.disabled === true || modifiers?.disabled === true || modifiers?.hitTestable === false || modifiers?.hit_testable === false;
+      const onClick = ctx.onAction && props.onTap && !rowDisabled ? () => ctx.onAction(resolveItemDeep2(props.onTap, ctx)) : void 0;
+      const ell = { display: "block", whiteSpace: "nowrap", overflow: "hidden", textOverflow: "ellipsis" };
+      const modifierTap = modifiers?.onTap ?? modifiers?.on_tap;
+      const keyboardOperable = !!ctx.onAction && !rowDisabled && !!(props.onTap || modifierTap);
+      const slotInteractive = (slot) => keyboardOperable && slot != null && hasInteractiveDescendant({ type: "ListItem", props: { slot } });
+      const leadingInteractive = slotInteractive(props.leading);
+      const trailingInteractive = slotInteractive(props.trailing);
+      const splitButton = leadingInteractive || trailingInteractive;
+      const authoredLabel = splitButton ? resolveScalarStatic(modifiers?.accessibilityLabel ?? modifiers?.accessibility_label, ctx) : void 0;
+      const buttonA11y = keyboardOperable ? {
+        role: "button",
+        tabIndex: 0,
+        ...authoredLabel != null && String(authoredLabel).trim() ? { "aria-label": String(authoredLabel) } : {},
+        onKeyDown: (e) => {
+          if (e.defaultPrevented || e.target !== e.currentTarget || e.repeat) return;
+          if (e.key !== "Enter" && e.key !== " ") return;
+          e.preventDefault();
+          e.currentTarget.click();
+        }
+      } : void 0;
+      const leadingEl = props.leading && /* @__PURE__ */ jsx6("div", { style: { flex: "none", display: "flex" }, children: renderNode(props.leading, ctx) });
+      const textEl = /* @__PURE__ */ jsxs3("div", { style: { flex: 1, minWidth: 0, display: "flex", flexDirection: "column", gap: 2 }, children: [
+        props.overline != null && /* @__PURE__ */ jsx6("span", { style: { fontFamily: bodyFont(ctx), fontSize: 11, fontWeight: 600, letterSpacing: 0.4, textTransform: "uppercase", color: C(props.overlineColor ?? "textSecondary", "#888"), ...ell }, children: txt(props.overline, ctx) }),
+        /* @__PURE__ */ jsx6("span", { style: { fontFamily: fontStack(titleF.family, ctx.idiom), fontSize: titleF.remSize, fontWeight: titleF.weight, color: C(props.titleColor ?? "textPrimary", "#13171e"), ...ell }, children: txt(props.title, ctx) ?? (ctx.empty ? "" : "") }),
+        props.subtitle != null && /* @__PURE__ */ jsx6("span", { style: { fontFamily: fontStack(subF.family, ctx.idiom), fontSize: subF.remSize, color: C(props.subtitleColor ?? "textSecondary", "#888"), ...ell }, children: txt(props.subtitle, ctx) })
+      ] });
+      return /* @__PURE__ */ jsxs3("div", { onClick, ...splitButton ? void 0 : buttonA11y, style: { display: "flex", alignItems: "center", gap: 12, width: "100%", padding: "10px 4px", boxSizing: "border-box", cursor: onClick ? "pointer" : void 0, ...wrap }, children: [
+        splitButton ? /* @__PURE__ */ jsxs3(Fragment3, { children: [
+          leadingInteractive && /* @__PURE__ */ jsx6("div", { onClick: (e) => e.stopPropagation(), style: { flex: "none", display: "flex" }, children: leadingEl }),
+          /* @__PURE__ */ jsxs3("div", { ...buttonA11y, style: { flex: 1, minWidth: 0, display: "flex", alignItems: "center", gap: 12 }, children: [
+            !leadingInteractive && leadingEl,
+            textEl
+          ] })
+        ] }) : /* @__PURE__ */ jsxs3(Fragment3, { children: [
+          leadingEl,
+          textEl
         ] }),
         props.trailing ? (
           // #1010 — the row's `onTap` lives on the outer flex div, and the trailing
@@ -25607,7 +25688,7 @@ function renderInner(node, ctx) {
           // Menu popup renders inside this slot, menu-item clicks don't double-fire
           // the row either. Mirrors the Button node, which stops for the same reason.
           /* @__PURE__ */ jsx6("div", { onClick: (e) => e.stopPropagation(), style: { flex: "none", display: "flex", alignItems: "center" }, children: renderNode(props.trailing, ctx) })
-        ) : accessoryGlyph && /* @__PURE__ */ jsx6("span", { style: { flex: "none", color: C("textTertiary", "#c0c4cc"), fontSize: 20, lineHeight: 1 }, children: accessoryGlyph })
+        ) : accessoryGlyph && /* @__PURE__ */ jsx6("span", { "aria-hidden": props.accessory === "chevron" ? true : void 0, style: { flex: "none", color: C("textTertiary", "#c0c4cc"), fontSize: 20, lineHeight: 1 }, children: accessoryGlyph })
       ] });
     }
     case "Slider":
@@ -33125,11 +33206,11 @@ function syncNetMocksWithApp(state) {
   const declared = state.app?.meta.devGateway;
   const next = declared?.rules ?? [];
   const before = { mode: state.wix.mode, rules: state.wix.rules };
-  const beforeSnapshot = { mode: before.mode, rules: JSON.parse(JSON.stringify(before.rules)) };
-  applyNetMocks(state.wix, { mode: declared?.mode, rules: next });
+  const beforeSnapshot = { mode: before.mode, rules: JSON.parse(JSON.stringify(before.rules)), unmatched: state.wix.unmatched };
+  applyNetMocks(state.wix, { mode: declared?.mode, rules: next, unmatched: declared?.unmatched });
   state.wixSeededOn = todayYmd();
   state.wixReseedBackoffUntil = 0;
-  if (scenarioChanged(beforeSnapshot, { mode: state.wix.mode, rules: state.wix.rules })) {
+  if (scenarioChanged(beforeSnapshot, { mode: state.wix.mode, rules: state.wix.rules, unmatched: state.wix.unmatched })) {
     publishSSE(state, "config.invalidated", { reason: "net-mocks scenario changed", at: Date.now() });
     console.error(`[himalaya-dev] net-mocks: re-synced ${next.length} rule(s) after an app reload`);
   }
@@ -33420,69 +33501,106 @@ async function handleWebWix(req, res, state) {
   }
   if (path2 === "/v1/__webwix/call" && req.method === "POST") {
     const b = await readJson5();
-    if (b.ownerMsid !== void 0 || b.checkOwnerSession === true) {
-      const msid = String(b.ownerMsid ?? "");
-      if (!isSafeMsid(msid)) return reply(400, { error: "webwix_owner_bad_msid" });
-      const cookie = req.headers.cookie ?? "";
-      if (!/wixSession2=/.test(cookie)) return reply(501, { error: "webwix_owner_no_session" });
-      try {
-        if (b.checkOwnerSession !== true && String(b.method ?? "GET").toUpperCase() === "POST" && isOwnerSitesPath(String(b.path ?? ""))) {
-          const body3 = b.body === void 0 ? void 0 : typeof b.body === "string" ? b.body : JSON.stringify(b.body);
-          return reply(200, await wixOwnerSitesCall(String(b.path), cookie, body3, fetch));
-        }
-        let instance = await webOwnerPreviewInstances.instance(msid, cookie);
-        res.setHeader("cache-control", "no-store");
-        if (b.checkOwnerSession === true) return reply(200, { status: 200, body: JSON.stringify({ ready: true }) });
-        const method2 = String(b.method ?? "GET").toUpperCase();
-        const requestPath = String(b.path ?? "/");
-        const body2 = b.body === void 0 ? void 0 : typeof b.body === "string" ? b.body : JSON.stringify(b.body);
-        const headers2 = normalizeWixForwardedHeaders(b.headers);
-        let result = await wixVisitorCall(method2, requestPath, body2, instance, fetch, headers2);
-        if (result.status === 401) {
-          webOwnerPreviewInstances.invalidate(msid, cookie);
-          instance = await webOwnerPreviewInstances.instance(msid, cookie);
-          result = await wixVisitorCall(method2, requestPath, body2, instance, fetch, headers2);
-        }
-        return reply(200, result);
-      } catch (e) {
-        if (String(e).includes("absolute URLs")) return reply(400, { error: "absolute_urls_not_allowed" });
-        const auth2 = /owner mint failed \(40[13]\)/.test(String(e?.message ?? e));
-        return reply(auth2 ? 501 : 502, { error: auth2 ? "webwix_owner_mint_failed" : "webwix_bridge_upstream_failed" });
-      }
-    }
+    const ownerRung = b.ownerMsid !== void 0 || b.checkOwnerSession === true;
+    const msid = String(b.ownerMsid ?? "");
+    const cookie = req.headers.cookie ?? "";
     const method = String(b.method ?? "GET").toUpperCase();
     const requestedPath = String(b.path ?? "/");
-    const body = b.body === void 0 ? void 0 : typeof b.body === "string" ? b.body : JSON.stringify(b.body);
-    const forwardedHeaders = normalizeWixForwardedHeaders(b.headers, requestedPath);
-    const target = new URL(requestedPath, "https://www.wixapis.com");
-    const query = Object.fromEntries(target.searchParams.entries());
     const started = Date.now();
-    const matchCtx = { host: target.host, query, headers: forwardedHeaders, body };
-    let match = state.wix.mode === "mock" ? matchRuleEx(state.wix.rules, method, target.pathname, matchCtx) : void 0;
-    if (match && (match.rule.kind ?? "mock") !== "mock") {
-      console.error(`[himalaya-dev] net-mocks: rule "${match.rule.id}" is kind:"${match.rule.kind}", which the web bridge cannot apply \u2014 ignoring it for ${method} ${target.pathname}`);
-      match = matchRuleEx(state.wix.rules.filter((r) => (r.kind ?? "mock") === "mock"), method, target.pathname, matchCtx);
+    const capability = ownerRung ? "wix_api.web.owner" : "wix_api.web";
+    const refuseEarly = (status, error, parsed) => {
+      recordWixTraffic(state.wix, state.appName, state.adminUrl, {
+        ts: started,
+        source: "proxy",
+        capability,
+        host: parsed?.host ?? "www.wixapis.com",
+        method,
+        url: parsed?.toString() ?? requestedPath.slice(0, 200),
+        path: parsed?.pathname ?? requestedPath.slice(0, 200),
+        status,
+        durationMs: Date.now() - started
+      });
+      return reply(status, { error });
+    };
+    let target;
+    try {
+      target = new URL(requestedPath, "https://www.wixapis.com");
+    } catch {
+      return refuseEarly(400, "webwix_bad_path");
     }
-    if (match && (match.rule.kind ?? "mock") === "mock") {
-      const mocked = match.rule.response;
-      if (mocked.delayMs) await new Promise((resolve48) => setTimeout(resolve48, mocked.delayMs));
-      const responseBody = mocked.template ? renderTemplate(mocked.body, match.captures) : mocked.body;
+    if (ownerRung) {
+      if (!isSafeMsid(msid)) return refuseEarly(400, "webwix_owner_bad_msid", target);
+      if (!/wixSession2=/.test(cookie)) return refuseEarly(501, "webwix_owner_no_session", target);
+    }
+    const body = b.body === void 0 ? void 0 : typeof b.body === "string" ? b.body : JSON.stringify(b.body);
+    const forwardedHeaders = normalizeWixForwardedHeaders(b.headers, requestedPath);
+    const record2 = (source, status, respBody, mockRuleId, respHeaders) => {
+      const redactBodies = source === "proxy" || mockRuleId === UNMATCHED_FAIL_CLOSED_ID;
       recordWixTraffic(state.wix, state.appName, state.adminUrl, {
         ts: started,
-        source: "mock",
-        capability: "wix_api.web",
+        source,
+        capability,
         host: target.host,
         method,
         url: target.toString(),
         path: target.pathname,
-        status: mocked.status,
+        status,
         durationMs: Date.now() - started,
-        reqBody: body,
-        respHeaders: mocked.headers,
-        respBody: responseBody,
-        mockRuleId: match.rule.id
+        reqBody: redactBodies ? void 0 : body,
+        respHeaders: redactBodies ? void 0 : respHeaders,
+        respBody: redactBodies ? void 0 : respBody,
+        mockRuleId
       });
-      return reply(200, { status: mocked.status, body: responseBody ?? "" });
+    };
+    if (b.checkOwnerSession !== true && state.wix.mode === "mock" && (!ownerRung || failsClosed(state.wix))) {
+      const matchCtx = { host: target.host, query: Object.fromEntries(target.searchParams.entries()), headers: forwardedHeaders, body };
+      let match = matchRuleEx(state.wix.rules, method, target.pathname, matchCtx);
+      if (match && (match.rule.kind ?? "mock") !== "mock") {
+        console.error(`[himalaya-dev] net-mocks: rule "${match.rule.id}" is kind:"${match.rule.kind}", which the web bridge cannot apply \u2014 ignoring it for ${method} ${target.pathname}`);
+        match = matchRuleEx(state.wix.rules.filter((r) => (r.kind ?? "mock") === "mock"), method, target.pathname, matchCtx);
+      }
+      if (match) {
+        const mocked = match.rule.response;
+        if (mocked.delayMs) await new Promise((resolve48) => setTimeout(resolve48, mocked.delayMs));
+        const responseBody = mocked.template ? renderTemplate(mocked.body, match.captures) : mocked.body;
+        record2("mock", mocked.status, responseBody, match.rule.id, mocked.headers);
+        return reply(200, { status: mocked.status, body: responseBody ?? "" });
+      }
+      if (failsClosed(state.wix)) {
+        const refusal = hermeticRefusal(method, target.pathname);
+        record2("mock", refusal.status, refusal.body, UNMATCHED_FAIL_CLOSED_ID, refusal.headers);
+        return reply(200, { status: refusal.status, body: refusal.body });
+      }
+    }
+    if (ownerRung) {
+      try {
+        if (b.checkOwnerSession !== true && method === "POST" && isOwnerSitesPath(requestedPath)) {
+          const result2 = await wixOwnerSitesCall(requestedPath, cookie, body, fetch);
+          record2("proxy", result2.status, result2.body);
+          return reply(200, result2);
+        }
+        let instance = await webOwnerPreviewInstances.instance(msid, cookie);
+        res.setHeader("cache-control", "no-store");
+        if (b.checkOwnerSession === true) {
+          record2("proxy", 200, void 0);
+          return reply(200, { status: 200, body: JSON.stringify({ ready: true }) });
+        }
+        let result = await wixVisitorCall(method, requestedPath, body, instance, fetch, forwardedHeaders);
+        if (result.status === 401) {
+          webOwnerPreviewInstances.invalidate(msid, cookie);
+          instance = await webOwnerPreviewInstances.instance(msid, cookie);
+          result = await wixVisitorCall(method, requestedPath, body, instance, fetch, forwardedHeaders);
+        }
+        record2("proxy", result.status, result.body);
+        return reply(200, result);
+      } catch (e) {
+        const absolute = String(e).includes("absolute URLs");
+        const auth2 = /owner mint failed \(40[13]\)/.test(String(e?.message ?? e));
+        const status = absolute ? 400 : auth2 ? 501 : 502;
+        record2("proxy", status, void 0);
+        if (absolute) return reply(400, { error: "absolute_urls_not_allowed" });
+        return reply(status, { error: auth2 ? "webwix_owner_mint_failed" : "webwix_bridge_upstream_failed" });
+      }
     }
     if (!session.visitorToken && !session.memberToken) {
       try {
@@ -33500,9 +33618,12 @@ async function handleWebWix(req, res, state) {
         } catch {
         }
       }
+      record2("proxy", r.status, r.body);
       return reply(200, { status: r.status, body: r.body });
     } catch (e) {
-      return reply(200, { status: 0, body: JSON.stringify({ error: String(e?.message ?? e) }) });
+      const message = JSON.stringify({ error: String(e?.message ?? e) });
+      record2("proxy", 0, message);
+      return reply(200, { status: 0, body: message });
     }
   }
   if (path2 === "/v1/__webwix/logout" && req.method === "POST") {
@@ -34664,7 +34785,7 @@ function createDevServer(opts = {}) {
   }
   const appScenario = state.app?.meta.devGateway;
   if (!netMocksDisabled && appScenario?.rules?.length && state.wix.rules.length === 0) {
-    const seeded = applyNetMocks(state.wix, { mode: appScenario.mode, rules: appScenario.rules });
+    const seeded = applyNetMocks(state.wix, { mode: appScenario.mode, rules: appScenario.rules, unmatched: appScenario.unmatched });
     state.wixSeededOn = todayYmd();
     state.wixSeededFromApp = true;
     console.error(`[himalaya-dev] net-mocks: seeded ${seeded.rules} rule(s), mode=${seeded.mode} from the app's devGateway scenario`);
@@ -48365,7 +48486,7 @@ ${releaseId}`;
       if ((request.method === "GET" || request.method === "HEAD") && path2 === "/v1/__webwix/identity") {
         const headers2 = { "content-type": JSON_CT, "cache-control": "no-store" };
         if (request.method === "HEAD") return new Response(null, { status: 200, headers: headers2 });
-        const webwixDirect = opts.webwixBridge !== false;
+        const webwixDirect = opts.webwixDirect ? await opts.webwixDirect() === true : opts.webwixBridge !== false;
         if (memberAuthOn()) {
           const app2 = memberApp(request);
           const store2 = memberSessions();
@@ -49310,6 +49431,32 @@ var init_node_adapter = __esm({
   }
 });
 
+// src/wix-client-id.ts
+function authConfigOf(appConfig) {
+  if (!appConfig) return void 0;
+  try {
+    const text5 = typeof appConfig === "string" ? appConfig : new TextDecoder().decode(appConfig);
+    return JSON.parse(text5)?.authConfig ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
+function appConfigWixClientId(appConfig) {
+  const clientId = authConfigOf(appConfig)?.config?.clientId;
+  return typeof clientId === "string" && clientId ? clientId : void 0;
+}
+function liveWixClientId(appConfig) {
+  const auth = authConfigOf(appConfig);
+  if (typeof auth?.providerId !== "string" || !auth.providerId.startsWith("wix")) return void 0;
+  const clientId = appConfigWixClientId(appConfig);
+  return clientId && clientId !== PLACEHOLDER_CLIENT_ID ? clientId : void 0;
+}
+var init_wix_client_id = __esm({
+  "src/wix-client-id.ts"() {
+    init_wix_placeholders();
+  }
+});
+
 // ../../packages/serve/src/preview-assets-format.ts
 function hasPreviewBlobMagic(blob) {
   if (blob.length < PREVIEW_BLOB_MAGIC.length) return false;
@@ -49351,21 +49498,21 @@ var init_preview_assets_generated = __esm({
   "../../packages/serve/src/preview-assets.generated.ts"() {
     init_preview_assets_format();
     PREVIEW_ASSET_MANIFEST = [
-      { key: "assets/index-BWTgWRYB.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1046928, sha256: "eded52b19e2f6c57d72a1206781cf42265d463761710cd36d3b9731e03702c79" },
-      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 1046936, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
-      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 1051546, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
-      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 1540130, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
-      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1631054, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
-      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1722038, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
-      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1813018, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
-      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1903890, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
-      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 1994870, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
-      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 2103506, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
-      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 2212590, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
-      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 2321638, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
-      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 2429338, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
-      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 2517446, length: 4947, sha256: "655f7d9b2d32c524443b698a25221375fdda4ea7d2cd91afa2aaec6f8922fdb0" },
-      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 2522393, length: 17209, sha256: "dffc9718e2faa63ae2cc919e0a842f585ed565aaaa7c53778e90379442c731b6" }
+      { key: "assets/index-VOdBPMHE.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1048280, sha256: "7351282bf52e78ef541a7dabe577e46b46daafe19a730aaff590c027ab919818" },
+      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 1048288, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
+      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 1052898, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
+      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 1541482, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
+      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1632406, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
+      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1723390, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
+      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1814370, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
+      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1905242, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
+      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 1996222, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
+      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 2104858, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
+      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 2213942, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
+      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 2322990, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
+      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 2430690, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
+      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 2518798, length: 4947, sha256: "5bdaf36e319850247a522b19051ace779fb34d67f14211c3197761610d3a81e6" },
+      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 2523745, length: 17209, sha256: "dffc9718e2faa63ae2cc919e0a842f585ed565aaaa7c53778e90379442c731b6" }
     ];
   }
 });
@@ -49386,13 +49533,22 @@ import { tmpdir as tmpdir4 } from "node:os";
 import { dirname as dirname27, join as join51 } from "node:path";
 import { fileURLToPath as fileURLToPath22 } from "node:url";
 function makePackageRunHandler(opts) {
+  const store = new FileReleaseStore(opts.releaseRoot);
+  const webwixDirect = async () => {
+    try {
+      return liveWixClientId(await store.getAppConfig(opts.app)) !== void 0;
+    } catch {
+      return false;
+    }
+  };
   return makeRunHandler({
-    store: new FileReleaseStore(opts.releaseRoot),
+    store,
     app: opts.app,
     assets: opts.assets,
     ...opts.chrome ? { chrome: opts.chrome } : {},
     header: opts.header ?? null,
-    ...opts.screenEvents ? { screenEvents: opts.screenEvents } : {}
+    ...opts.screenEvents ? { screenEvents: opts.screenEvents } : {},
+    ...opts.liveWix ? { serve: { webwixDirect } } : {}
   });
 }
 async function fetchBytes(url) {
@@ -49493,7 +49649,8 @@ async function runPackage(source, opts = {}) {
     assets,
     chrome: opts.chrome,
     header: resolved2.header,
-    ...opts.screenEvents ? { screenEvents: opts.screenEvents } : {}
+    ...opts.screenEvents ? { screenEvents: opts.screenEvents } : {},
+    ...opts.liveWix ? { liveWix: true } : {}
   });
   const extra = opts.extraRoutes;
   const handler = extra ? (request) => extra(request) ?? plane(request) : plane;
@@ -49533,6 +49690,7 @@ var init_run = __esm({
     init_file_store();
     init_run_handler();
     init_node_adapter();
+    init_wix_client_id();
     init_pack();
     init_himi_package();
     init_himi_package();
@@ -49631,7 +49789,7 @@ function watchFlagConflict(opts) {
     return { error: "watch_needs_source", message: "--watch rebuilds a content package on every save, so it cannot watch a packaged release or a URL. Pass the app's directory (the one with himalaya.content.json), --content <dir>, or run it from there with no argument." };
   }
   if (opts.browser) {
-    return { error: "watch_with_browser", message: "--watch rebuilds and serves from this process; --browser runs the whole plane inside the tab. Pick one." };
+    return { error: "watch_with_browser", message: "--watch already opens the app in your browser, so drop --browser. (--browser is a different mode: it runs the whole serve plane inside the tab, leaving no process here to rebuild on save.) Under --watch a site-bound app shows the site's live data on its own." };
   }
   if (opts.spa) {
     return { error: "watch_with_spa", message: "--watch pushes each rebuild to the open tab over this server's own origin, and a hosted SPA (--spa) listens on its origin instead, so it would never repaint. Drop --spa to watch with the bundled web host, or drop --watch." };
@@ -49864,12 +50022,7 @@ async function releasePayloadFromDir(root, app, header) {
     if (w !== void 0) widgets[id] = w;
   }
   const appConfig = text5(await store.getAppConfig(app));
-  let wixClientId;
-  try {
-    const cfg = appConfig ? JSON.parse(appConfig) : null;
-    wixClientId = cfg?.authConfig?.config?.clientId;
-  } catch {
-  }
+  const wixClientId = appConfigWixClientId(appConfig);
   return {
     app,
     manifest,
@@ -49950,6 +50103,7 @@ var init_run_browser = __esm({
   "src/run-browser.ts"() {
     init_open_url();
     init_file_store();
+    init_wix_client_id();
     HERE = dirname28(fileURLToPath23(import.meta.url));
     REPO = resolve43(HERE, "..", "..", "..");
     SERVED = /* @__PURE__ */ new Set(["host.html", "sw.js", "package-reader.js"]);
@@ -69164,7 +69318,9 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             open: flags["no-open"] !== true,
             // The build board on the preview's own origin, for any run of this content package.
             ...recordKit ? { extraRoutes: (request) => recordKit.boardFile(dir, new URL(request.url).pathname) } : {},
-            ...watchKit && served && bus ? { workDir: served, screenEvents: bus } : {}
+            // `liveWix` only with --watch: that is the "click around while you work" window, and a
+            // site-bound app shows the site's data there (#3273). A packaged `himi run` stays offline.
+            ...watchKit && served && bus ? { workDir: served, screenEvents: bus, liveWix: true } : {}
           });
           let watcher2;
           let rebuild;