@wix/himalaya-cli 0.1052.0 → 0.1053.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/dev-server/src/app-module.d.ts

@@ -1,4 +1,4 @@
-import type { AppConfigLike } from "@wix/himalaya/core";
+import type { AppConfig, AppConfigLike, FunctionsAppConfig } from "@wix/himalaya/core";
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { ActionHandler } from "./actions/types.js";
 import type { ScreenDescriptor } from "./builder.js";
@@ -121,6 +121,15 @@ export type DataRouteHandler = (req: IncomingMessage, res: ServerResponse, ctx:
     store: AppStore;
     serverBaseUrl: string;
 }) => void | Promise<void>;
+/** A functions-only app (`defineApp({ kind: "functions", … })`): no screens, and none of a UI
+ *  app's config. The same test `defineApp` itself applies. */
+export declare function isFunctionsOnlyConfig(config: AppConfigLike): config is FunctionsAppConfig;
+/** An app's config seen as a UI app's, every field optional. `FunctionsAppConfig` declares none
+ *  of `AppConfig`'s UI fields, so on a functions-only app each one reads as absent, which is what
+ *  the `?.` / `??` at every call site already assumes. For code that handles both kinds; code
+ *  past an `isFunctionsOnlyConfig` return should narrow instead. No app at all reads the same way,
+ *  as `state.app?.module.config.x` did. */
+export declare function uiConfig(config: AppConfigLike | undefined): Partial<AppConfig>;
 /** The complete contract an app package exports for the dev-server to serve. */
 export interface AppDevModule {
     /** The `defineApp()` result from the app's config.ts — single source of identity. */

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/dev-server/src/wix-member-login.d.ts

@@ -15,3 +15,8 @@ export declare function webWixCall(method: string, path: string, body: string |
     status: number;
     body: string;
 }>;
+/** The signed-in member's Wix id, or null when the profile read fails (the identity route then
+ *  falls back to the login email). The token belongs in `webWixCall`'s TOKEN slot: the identity
+ *  route used to pass it third, where it became the GET's ignored body, so the read went out as
+ *  `Authorization: undefined`, always failed, and every member's id was reported as their email. */
+export declare function readMemberId(memberToken: string): Promise<string | null>;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/sdui.mjs

@@ -8549,6 +8549,12 @@ function agendaList(props, opts) {
 }
 
 // ../../core/dev-server/src/app-module.ts
+function isFunctionsOnlyConfig(config) {
+  return config.kind === "functions";
+}
+function uiConfig(config) {
+  return config ?? {};
+}
 function deriveAppMeta(name, m, platforms = {}) {
   const config = m.config;
   return {
@@ -8658,6 +8664,7 @@ export {
   icon,
   iconButton,
   image,
+  isFunctionsOnlyConfig,
   label,
   labeledContent,
   lazyList,
@@ -8703,6 +8710,7 @@ export {
   timeline,
   toggle,
   tooltip,
+  uiConfig,
   video,
   voiceNote,
   vstack,

package/dist/cli.mjs

@@ -4274,8 +4274,9 @@ function confinedHost(ts2, contentDir2, options) {
   host.writeFile = (fileName) => {
     throw new Error(`Tier-5 typecheck attempted to write ${fileName} under noEmit \u2014 refusing`);
   };
-  if (host.createDirectory) {
-    host.createDirectory = (dir) => {
+  const writable = host;
+  if (writable.createDirectory) {
+    writable.createDirectory = (dir) => {
       throw new Error(`Tier-5 typecheck attempted to create ${dir} under noEmit \u2014 refusing`);
     };
   }
@@ -5603,6 +5604,7 @@ function walk(node, registry, path2, out) {
 var SYSTEM_FONT_FAMILY, TONAL_ELEVATION_ALPHA;
 var init_tokens = __esm({
   "../../core/ts/src/tokens.ts"() {
+    "use strict";
     SYSTEM_FONT_FAMILY = "$system";
     TONAL_ELEVATION_ALPHA = [0, 0.05, 0.08, 0.11, 0.12, 0.14];
   }
@@ -5629,6 +5631,7 @@ function resolveTranslation(value, catalog, sourceCatalog) {
 var BINDING_SIGILS, BINDING_SIGIL_RE, TRANSLATION_PREFIX, TRANSLATION_KEY_RE;
 var init_bindings = __esm({
   "../../core/ts/src/bindings.ts"() {
+    "use strict";
     BINDING_SIGILS = ["service", "flag", "item", "t"];
     BINDING_SIGIL_RE = new RegExp(
       `^\\$(?:${BINDING_SIGILS.filter((s) => s !== "t").join("|")})\\b|^\\$t:`
@@ -13865,7 +13868,7 @@ function listReport(opts = {}) {
   for (const [name, sys] of Object.entries(catalog.system)) {
     families.push({ family: name, category: sys.category ?? "serif", variable: false, weights: "platform", kb: 0, license: "system" });
   }
-  return { ok: true, count: families.length, totalBytes, families };
+  return { ok: true, count: families.length, totalBytes, problems: [], families };
 }
 async function fontFindings(appDir2, opts = {}) {
   const tokensPath = join22(appDir2, configuredTokensPath(appDir2).path ?? "tokens.json");
@@ -16991,6 +16994,12 @@ var init_agent_context = __esm({
 });
 
 // ../../core/dev-server/src/app-module.ts
+function isFunctionsOnlyConfig(config) {
+  return config.kind === "functions";
+}
+function uiConfig(config) {
+  return config ?? {};
+}
 function deriveAppMeta(name, m, platforms = {}) {
   const config = m.config;
   return {
@@ -17272,7 +17281,10 @@ async function loadContainedDevModule(name, entry, dir) {
       "the contained dev-module realm is not installed, so the upload's dev/index.ts would have been imported into the host realm (which is not a security boundary)"
     );
   }
-  const { buildContainedDevModule: buildContainedDevModule2, CONTAINED_DEV_MODULE_SERVICE: CONTAINED_DEV_MODULE_SERVICE2, CONTAINED_DEV_MODULE_ACTION: CONTAINED_DEV_MODULE_ACTION2 } = await Promise.resolve().then(() => (init_build_lib(), build_lib_exports));
+  const { buildContainedDevModule: buildContainedDevModule2, CONTAINED_DEV_MODULE_SERVICE: CONTAINED_DEV_MODULE_SERVICE2, CONTAINED_DEV_MODULE_ACTION: CONTAINED_DEV_MODULE_ACTION2 } = (
+    // @ts-expect-error — .mjs sibling without types; the cast below states what this uses.
+    await Promise.resolve().then(() => (init_build_lib(), build_lib_exports))
+  );
   let js;
   try {
     js = await buildContainedDevModule2(entry, { absWorkingDir: dir, confineTo: dir });
@@ -18212,6 +18224,7 @@ __export(wix_member_login_exports, {
   memberDirectLogin: () => memberDirectLogin,
   memberDirectRegister: () => memberDirectRegister,
   mintVisitor: () => mintVisitor,
+  readMemberId: () => readMemberId,
   webWixCall: () => webWixCall
 });
 import { createHash as createHash10, randomBytes as randomBytes3 } from "node:crypto";
@@ -18345,6 +18358,16 @@ async function webWixCall(method, path2, body, token, cookie, forwardedHeaders =
   });
   return { status: res.status, body: await res.text() };
 }
+async function readMemberId(memberToken) {
+  try {
+    const identity = await webWixCall("GET", "/members/v1/members/my", void 0, memberToken);
+    if (identity.status < 200 || identity.status >= 300) return null;
+    const parsed = JSON.parse(identity.body);
+    return parsed.member?.id ?? parsed.id ?? null;
+  } catch {
+    return null;
+  }
+}
 var API;
 var init_wix_member_login = __esm({
   "../../core/dev-server/src/wix-member-login.ts"() {
@@ -21734,6 +21757,7 @@ function shouldRevealError(args) {
 var EMAIL_RE, URL_HOST_RE, INTEGER_RE, NUMBER_RE;
 var init_validation = __esm({
   "../../core/ts/src/validation.ts"() {
+    "use strict";
     EMAIL_RE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/;
     URL_HOST_RE = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(:[0-9]+)?$/;
     INTEGER_RE = /^[+-]?[0-9]+$/;
@@ -25334,6 +25358,7 @@ function validateWorkerSubtree(raw, slotId, policy, actionCatalog) {
 var WORKER_SUBTREE_CEILINGS, ID_PART, ACTION_ID;
 var init_worker_subtree = __esm({
   "../../core/ts/src/worker-subtree.ts"() {
+    "use strict";
     init_worker_subtree_safe_types_generated();
     WORKER_SUBTREE_CEILINGS = Object.freeze({
       maxEncodedBytes: 65536,
@@ -33950,7 +33975,7 @@ function makeEtag(body) {
   return `"${createHash16("sha256").update(body).digest("hex").slice(0, 32)}"`;
 }
 function servedTokensPath(app) {
-  return app.module.designTokensPath ?? resolve31(app.dir, app.module.config.designTokensPath ?? "tokens.json");
+  return app.module.designTokensPath ?? resolve31(app.dir, uiConfig(app.module.config).designTokensPath ?? "tokens.json");
 }
 function readAppTokens(state) {
   if (!state.app) return null;
@@ -34032,7 +34057,7 @@ function handleL10nRequest(req, res, state) {
     res.end();
     return;
   }
-  const sourceLocale = state.app.module.config.locale?.default ?? "en";
+  const sourceLocale = uiConfig(state.app.module.config).locale?.default ?? "en";
   let messages;
   try {
     messages = Object.fromEntries(
@@ -34070,9 +34095,9 @@ async function runScreenDiagnostics(state, screenId, descriptor) {
     nativeActions,
     appWorkerActions,
     strict: false,
-    workerSubtreeScreens: new Set(state.app?.module.config.workerSubtreeScreens ?? []),
+    workerSubtreeScreens: new Set(uiConfig(state.app?.module.config).workerSubtreeScreens ?? []),
     // Same a11y rung the build lint applies (RFC 0058 §5) — diagnostics must not disagree.
-    a11y: state.app?.module.config.a11y
+    a11y: uiConfig(state.app?.module.config).a11y
   });
   const telemetry = state.telemetryEvents.filter((e) => e.screenId === screenId && (/^worker_/.test(e.type) || e.type === "bundle_load_revoked")).slice(-20);
   const lastError = [...telemetry].reverse().find((e) => /crash|revoked|error|fail/i.test(e.type)) ?? null;
@@ -34423,7 +34448,7 @@ async function buildDescriptorForScreenId(state, screenId, query = new URLSearch
       }
       return null;
     })();
-    return built ? ensureTransportCapability(applyTopBarDefault(attachAssignments(built, state, evalCtx, cfg?.overrides), state.app.module.config), state.tier5Dir ?? TIER5_ROOT2) : null;
+    return built ? ensureTransportCapability(applyTopBarDefault(attachAssignments(built, state, evalCtx, cfg?.overrides), uiConfig(state.app.module.config)), state.tier5Dir ?? TIER5_ROOT2) : null;
   }
   return null;
 }
@@ -35261,15 +35286,7 @@ async function handleWebWix(req, res, state) {
   }
   if (path2 === "/v1/__webwix/identity" && (req.method === "GET" || req.method === "POST")) {
     if (!session.memberToken) return reply(200, { authenticated: false, userId: null, email: "" });
-    let userId = null;
-    try {
-      const identity = await webWixCall("GET", "/members/v1/members/my", session.memberToken);
-      if (identity.status >= 200 && identity.status < 300) {
-        const parsed = JSON.parse(identity.body);
-        userId = parsed.member?.id ?? parsed.id ?? null;
-      }
-    } catch {
-    }
+    const userId = await readMemberId(session.memberToken);
     const preferenceIdentity = session.email?.trim().toLowerCase() || userId;
     return reply(200, {
       authenticated: true,
@@ -35844,8 +35861,8 @@ async function handleAdminPlayground(req, res, state) {
       nativeActions,
       appWorkerActions,
       strict,
-      workerSubtreeScreens: new Set(state.app?.module.config.workerSubtreeScreens ?? []),
-      a11y: state.app?.module.config.a11y
+      workerSubtreeScreens: new Set(uiConfig(state.app?.module.config).workerSubtreeScreens ?? []),
+      a11y: uiConfig(state.app?.module.config).a11y
     });
     return sendJson(res, report2.ok ? 200 : 422, report2);
   }
@@ -40192,7 +40209,7 @@ async function buildReleaseFromContent(contentDir2, dest, opts = {}) {
 }
 function readTokensForLint(preloaded) {
   try {
-    const tokenPath = preloaded.module.designTokensPath ?? resolve32(preloaded.dir, preloaded.module.config.designTokensPath ?? "tokens.json");
+    const tokenPath = preloaded.module.designTokensPath ?? resolve32(preloaded.dir, uiConfig(preloaded.module.config).designTokensPath ?? "tokens.json");
     const parsed = JSON.parse(readFileSync42(tokenPath, "utf8"));
     delete parsed._meta;
     return parsed;
@@ -40204,7 +40221,8 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
   const app = preloaded.name;
   const tier5Dir = opts.tier5Dir ?? TIER5_DIR;
   const collect2 = opts.collect;
-  if (preloaded.module.config.kind === "functions") {
+  const config = preloaded.module.config;
+  if (isFunctionsOnlyConfig(config)) {
     return buildFunctionsOnlyRelease(preloaded, dest);
   }
   const store = typeof dest === "string" ? new FileReleaseStore(dest) : dest;
@@ -40230,14 +40248,14 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
   };
   const LIVE_LOAD_BUDGET_MS = 3e4;
   const appLocalDbSchema = (() => {
-    const entities = preloaded.module.config.dataSchema?.entities ?? [];
+    const entities = config.dataSchema?.entities ?? [];
     const names = entities.map((e) => e?.name).filter((n) => typeof n === "string" && n.length > 0);
     return names.length ? names.map((name) => ({ name })) : null;
   })();
   let liveWixCall = null;
   const ensureLiveWixCall = async () => {
     if (liveWixCall) return liveWixCall;
-    const auth = preloaded.module.config.auth;
+    const auth = config.auth;
     const clientId = auth?.config?.clientId;
     if (auth?.providerId !== "wix-consumer" || typeof clientId !== "string" || !clientId) {
       throw new Error(
@@ -40322,7 +40340,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
   };
   let handlers;
   let minBinaryVersion = null;
-  const requiredCapabilities = new Set(preloaded.module.config.capabilities ?? []);
+  const requiredCapabilities = new Set(config.capabilities ?? []);
   const requiredNativeComponents = /* @__PURE__ */ new Set();
   const tierScreens = [];
   const tierBundles = /* @__PURE__ */ new Map();
@@ -40568,11 +40586,11 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
           nativeActions,
           appWorkerActions,
           strict: collect2.strict,
-          workerSubtreeScreens: new Set(preloaded.module.config.workerSubtreeScreens ?? []),
-          l10n: l10nLintOptions(preloaded.module.config.locale, preloaded.dir),
+          workerSubtreeScreens: new Set(config.workerSubtreeScreens ?? []),
+          l10n: l10nLintOptions(config.locale, preloaded.dir),
           // RFC 0058 §5 — the app's own rung of the a11y ladder. Omitted ⇒ the validator's
           // default, "error"; an in-repo app with ratcheted debt declares "warn".
-          a11y: preloaded.module.config.a11y
+          a11y: config.a11y
         });
         lint.push({ screenId, ok: report2.ok, issues: report2.issues });
       }
@@ -40600,8 +40618,8 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
             nativeActions,
             appWorkerActions,
             strict: collect2.strict,
-            workerSubtreeScreens: new Set(preloaded.module.config.workerSubtreeScreens ?? []),
-            a11y: preloaded.module.config.a11y
+            workerSubtreeScreens: new Set(config.workerSubtreeScreens ?? []),
+            a11y: config.a11y
           });
           lint.push({ screenId: wantedRender, ok: report2.ok, issues: report2.issues });
         }
@@ -40635,6 +40653,10 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
         store: preloaded.module.createStore(app),
         toggles: {},
         query: new URLSearchParams(),
+        // A bake has no requesting member: the anonymous caller the dev-server also defaults to.
+        // `ScreenBuildContext.caller` is documented never-absent, so a `seedIds` may read
+        // `ctx.caller.entitled` unguarded, and would have thrown here without it.
+        caller: { entitled: false },
         serverBaseUrl: base,
         bundleIntegrity: () => null,
         // Resolve for real: a baked templated route whose descriptor references an asset must
@@ -40744,7 +40766,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     }
     Object.assign(catalogs, await bakeCatalogs(
       app,
-      preloaded.module.config.locale,
+      config.locale,
       async (tag) => {
         const res = await devFetch(
           `${base}/v1/l10n?app=${encodeURIComponent(app)}&tag=${encodeURIComponent(tag)}`,
@@ -40759,7 +40781,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
       const served = await cfgRes.text();
       const prodText = withProdServeAppConfig(
         opts.keepDevOnlyAppConfig ? served : withoutDevOnlyAppConfig(served),
-        preloaded.module.config.environments?.prod
+        config.environments?.prod
       );
       const streamPolicyErrors = validateReleaseStreamPolicyConfig(prodText);
       if (streamPolicyErrors.length) {
@@ -40831,7 +40853,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     playerRequirements: {
       capabilities: [...requiredCapabilities].sort(),
       nativeComponents: [...requiredNativeComponents].sort(),
-      authProviders: [preloaded.module.config.auth.providerId].filter(Boolean).sort()
+      authProviders: [config.auth.providerId].filter(Boolean).sort()
     },
     iconHash,
     ...brandFonts.length ? { brandFonts } : {},
@@ -40887,7 +40909,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     // core identifies an oversized bundle by SRI, which is unactionable on its own, so the
     // name is resolved back in here (most-specific match: `integrity` is a full SRI, but a
     // descriptor carrying none would fall back to a bare name, and names nest).
-    tierCapViolations: checkTierCaps(preloaded.module.config, tierScreens, [...tierBundles.values()]).map((v) => {
+    tierCapViolations: checkTierCaps(config, tierScreens, [...tierBundles.values()]).map((v) => {
       const named = [...tierBundles.values()].filter((b) => v.message.includes(b.integrity)).sort((a, b) => b.integrity.length - a.integrity.length)[0];
       return named ? { ...v, message: `${v.message} \u2014 bundle "${named.name}"` } : v;
     }),
@@ -40900,7 +40922,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     ...renderTokens !== void 0 ? { tokens: renderTokens } : {},
     ...preloaded.meta.surfaces ? { surfaceNav: preloaded.meta.surfaces } : {},
     auth: (() => {
-      const a = preloaded.module.config.auth;
+      const a = config.auth;
       const cid = a?.config?.clientId;
       return { ...a?.providerId ? { providerId: a.providerId } : {}, ...typeof cid === "string" && cid ? { clientId: cid } : {} };
     })()
@@ -40944,7 +40966,7 @@ async function buildFunctionsOnlyRelease(preloaded, dest) {
   const sha = gitSha();
   const manifest = { releaseId: contentReleaseId(content), gitSha: sha, ...content };
   await store.putManifest(app, manifest);
-  return { manifest, failedToBuild: [], missingBundles: [], auth: {} };
+  return { manifest, failedToBuild: [], missingBundles: [], auth: {}, tierCapViolations: [] };
 }
 function listBuildableApps() {
   const appsDir = join37(REPO_ROOT7, "apps");
@@ -40957,6 +40979,7 @@ var init_build3 = __esm({
     init_contained_dev_module();
     init_tier5_dir();
     init_build_sha();
+    init_app_module();
     init_app_icon();
     init_app_assets();
     init_plan_fonts();
@@ -48346,6 +48369,14 @@ function memoryStore(manifest, built) {
     },
     async getAppConfig() {
       return null;
+    },
+    // The two members the cast used to paper over. Serve-relative, as FileReleaseStore's is; and
+    // nothing to prune, since this store only ever holds the one release it was built with.
+    bundleUrl(_app, sha2565) {
+      return `/v1/bundles/${sha2565}.bundle.js`;
+    },
+    async prune() {
+      return 0;
     }
   };
 }
@@ -69726,7 +69757,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           const { detectAndroidNativeDecode: detectAndroidNativeDecode2, detectNativeDecode: detectNativeDecode2, nativeDecodePlatforms: nativeDecodePlatforms2 } = await Promise.resolve().then(() => (init_native_decode(), native_decode_exports));
           let platforms;
           try {
-            platforms = nativeDecodePlatforms2(flags.native === true ? true : str6(flags.native));
+            platforms = nativeDecodePlatforms2(flags.native === true ? true : str6(flags.native) ?? String(flags.native));
           } catch (error) {
             io.error(JSON.stringify({ error: error.message }));
             return 2;
@@ -71726,10 +71757,11 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           // right below says how (or whether) the narrowing was measured.
           enabled: (() => {
             const envelope = resolveSurfaceEnvelope(platforms).enabled;
-            if (!produced.families) return envelope;
+            const families = produced.families;
+            if (!families) return envelope;
             return envelope.filter((id) => {
               const surface = surfaceById(id);
-              return !surface || !isWidgetFamilySurface(surface) || produced.families.has(surfaceFrozenFamily(surface));
+              return !surface || !isWidgetFamilySurface(surface) || families.has(surfaceFrozenFamily(surface));
             });
           })(),
           // Says which question the `produced` column answered, and — when it could not
@@ -73598,7 +73630,8 @@ ${report2.ok ? "OK \u2014 data + serve plane reachable." : typeof report2.hint =
           return 2;
         }
         const environment2 = str6(flags.environment) ?? "preview";
-        if (environment2 !== "preview" && environment2 !== "production") {
+        const isResourceEnvironment = (v) => v === "preview" || v === "production";
+        if (!isResourceEnvironment(environment2)) {
           io.error(JSON.stringify({ error: "--environment must be preview or production" }));
           return 2;
         }
@@ -73881,7 +73914,7 @@ ${report2.ok ? "OK \u2014 data + serve plane reachable." : typeof report2.hint =
             redirectUri: redirectFlag,
             cwd: str6(flags.content) ?? process.cwd()
           });
-          print({ ok: true, ...r });
+          print(r);
           return 0;
         } catch (e) {
           io.error(JSON.stringify({ error: e.message }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1052.0",
+  "version": "0.1053.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -65,5 +65,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "418916efab2e1d4bc74db7d4eeb30ad2b9c0d20534c7d5757fcec730"
+  "falconPackageHash": "09a8cfb09738de91c22097314d5bb642195d40f284ccec170bb75968"
 }