@wix/himalaya-cli 0.1250.0 → 0.1252.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/dev-server/src/wix-member-login.d.ts

@@ -15,6 +15,12 @@ export declare function webWixCall(method: string, path: string, body: string |
     status: number;
     body: string;
 }>;
+/** Open a Wix response without buffering it, for the authorized SSE bridge.
+ *  Credentials stay server-side and the host lock is identical to webWixCall. */
+export declare function webWixStream(method: string, path: string, body: string | undefined, token: string, cookie?: string, forwardedHeaders?: Record<string, string>, signal?: AbortSignal): Promise<Response>;
+/** Keep the credential-bearing stream bridge on the same narrow endpoint policy as native
+ *  Wix consumer auth. General member calls have broader Wix-host routing through webWixCall. */
+export { isAllowedConsumerStreamTarget } from "../../serve-runtime/src/wix-bridge.js";
 /** The signed-in member's Wix id, or null when the profile read fails (the identity route then
  *  falls back to the login email). The token belongs in `webWixCall`'s TOKEN slot: the identity
  *  route used to pass it third, where it became the GET's ignored body, so the read went out as

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/sdk/state/src/index.d.ts

@@ -38,6 +38,8 @@ export interface StreamDirective {
         url: string;
         headers?: Record<string, string>;
         body?: unknown;
+        /** Apply the host's Wix authorization to this request before opening the stream. */
+        authorize?: boolean;
     };
     /** Reducer action name dispatched once per parsed `data:` event. */
     onEvent: string;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/serve-runtime/src/wix-bridge.d.ts

@@ -0,0 +1,144 @@
+/** The narrow Wix consumer endpoints allowed to receive credentials for SSE. */
+export declare function isAllowedConsumerStreamTarget(raw: string): boolean;
+/** Classify an absolute-URL rejection: an off-gateway Wix account host is a
+ *  native-only endpoint (`owner-only`), anything else is an open-proxy attempt. */
+export declare function absoluteUrlRejection(path: string): "owner-only" | "open-proxy";
+/** The bridge envelope the web host's `wixCallOverBridge` expects on a 2xx. */
+export interface WixBridgeEnvelope {
+    status: number;
+    body: string;
+}
+/** One anonymous visitor token for `clientId`. #3123 Stage B: the proxy no longer serves visitor
+ *  calls (each browser mints its own, core/web-host/src/wix/directWixCall.ts), so nothing caches
+ *  one per pod any more — the one server-side use left is the member-login redirect, which needs a
+ *  visitor token to build Wix's hosted-login URL once per login. */
+export declare function mintAnonymousVisitor(clientId: string, fetchImpl?: typeof fetch): Promise<string>;
+/**
+ * Proxy one REST call to wixapis.com with the given token. `path` must be
+ * origin-relative — an absolute URL is the caller trying to use the bridge as an
+ * open proxy, which the read-only origin must never be (throws).
+ */
+export declare function wixVisitorCall(method: string, path: string, body: string | undefined, token: string, fetchImpl?: typeof fetch, forwardedHeaders?: Record<string, string>): Promise<WixBridgeEnvelope>;
+/**
+ * The caller-supplied headers a proxied call may carry to Wix (#3190): the Wix ASPECT headers
+ * (locale, currency, consistency, BI, brand, consent, revisions) and the per-call site selector
+ * `wix-site-id` — native sends it on every call and the dev-server's per-business net-mock rules key
+ * on it. (`ChatToken` is the one destination-bound exception: see `normalizeWixForwardedHeaders`.)
+ * An ALLOWLIST, lower-case: anything else is dropped — above all a second credential or an
+ * identity header (`x-wix-authorization`, `x-wix-clientid`, `x-xsrf-token`, `wix-account-id`,
+ * signed instances), which would otherwise ride along with the rung's own `Authorization` and leave
+ * which identity the call runs as to the gateway. Also hop-by-hop and framing headers.
+ *
+ * The aspect headers are exactly the ones the web host's browser-direct transports forward
+ * (`DIRECT_FORWARDABLE_HEADERS`, core/web-host/src/wix/directWixCall.ts — the gateway's CORS answer
+ * minus credentials); `BRIDGE_ONLY_FORWARDABLE_HEADERS` is the one addition, and
+ * core/web-host/tests/direct-wix-call.test.ts holds the lists together, so a call cannot behave
+ * differently depending on which path served it.
+ */
+export declare const WIX_FORWARDABLE_HEADERS: ReadonlySet<string>;
+/** What the bridge forwards beyond the browser-direct transports' aspect headers: the site selector
+ *  (direct owner calls pick their instance by it instead). */
+export declare const BRIDGE_ONLY_FORWARDABLE_HEADERS: ReadonlySet<string>;
+/** The headers of an untrusted web bridge envelope that may reach Wix (`WIX_FORWARDABLE_HEADERS`, plus
+ *  `ChatToken` when `path` is chat-web itself), in the caller's spelling. The bridge always owns
+ *  Authorization, cookies, Host and content framing. */
+export declare function normalizeWixForwardedHeaders(input: unknown, path?: string): Record<string, string>;
+/** Guard the msid before it is interpolated into the mint URL (uuid-ish only). */
+export declare function isSafeMsid(msid: string): boolean;
+/** A `renew` never re-mints an instance younger than this, whichever mint made it (another tab's
+ *  renewal, a first ask, the envelope's own 401 retry). An instance that new is the fresh one: a 401
+ *  on it is Wix's answer about the endpoint, not a stale credential, and re-minting would only buy
+ *  the same answer. It also means the route can't be driven to mint on every request. Once an entry
+ *  is dropped (`invalidate`, a failed mint) there is nothing to hand back, and a renewal mints once,
+ *  like any ask.
+ *  No longer than the web host's `OWNER_RENEW_COOLDOWN_MS` (core/web-host/src/wix/directWixCall.ts,
+ *  #3140): the host never sends `renew=1` sooner than that after its own re-mint, so each renewal it
+ *  makes is honoured. A longer window here would hand it back the instance Wix just refused.
+ *  core/serve/tests/owner-instance.test.ts pins the two together. */
+export declare const OWNER_RENEW_MIN_AGE_MS = 5000;
+type OwnerInstanceEntry = {
+    instance: string;
+    expiresAt: number;
+};
+export declare class OwnerInstanceCache {
+    private fetchImpl;
+    /** Signed instances are long-lived, but the SESSION behind them may not be —
+     *  keep the window short so a logout is honored quickly. */
+    private ttlMs;
+    private mintTimeoutMs;
+    /** A monotonic clock for how long a mint TOOK (injectable for tests). */
+    private elapsedClock;
+    private cache;
+    /** The one mint on its way per (business, session). Every caller, plain or renewing, joins it:
+     *  it started after whatever is cached was minted, so it is the fresh instance. */
+    private inflight;
+    constructor(fetchImpl?: typeof fetch, 
+    /** Signed instances are long-lived, but the SESSION behind them may not be —
+     *  keep the window short so a logout is honored quickly. */
+    ttlMs?: number, mintTimeoutMs?: number, 
+    /** A monotonic clock for how long a mint TOOK (injectable for tests). */
+    elapsedClock?: () => number);
+    /** Keyed on the SESSION (`wixSession2`), not the whole cookie header: manage.wix.com's jar churns
+     *  (analytics, experiments), and keying on all of it re-minted on nearly every call (#3044). A
+     *  header with no session cookie falls back to itself — callers refuse that case before here. */
+    private key;
+    instance(msid: string, cookieHeader: string, now?: number): Promise<string>;
+    /** The instance and the time this cache stops trusting it (#3044: the web host caches until then).
+     *  `renew`: Wix refused the instance this cache handed out (the route's `renew=1`, #3140) — mint a
+     *  new one, unless the cached one is younger than OWNER_RENEW_MIN_AGE_MS or a mint is already on
+     *  its way, in which case that IS the new one. */
+    entry(msid: string, cookieHeader: string, now?: number, opts?: {
+        renew?: boolean;
+    }): Promise<OwnerInstanceEntry>;
+    private mint;
+    /** Drop a cached instance so the next call re-mints. The envelope owner branch's own 401 retry;
+     *  the route's `renew=1` goes through `entry(…, { renew: true })` instead. */
+    invalidate(msid: string, cookieHeader: string): void;
+}
+export declare const OWNER_SITES_QUERY_PATH = "/site-list/v2/sites/query";
+export declare const OWNER_SITES_COUNT_PATH = "/site-list/v2/sites/count";
+/** True for the ONLY two paths the account-level owner-sites rung may reach. */
+export declare function isOwnerSitesPath(path: string): boolean;
+/**
+ * POST one site-list call to wixapis.com, authorized by the FORWARDED caller
+ * cookies (never an Authorization header, never stored). Host-locked AND
+ * path-locked: anything but the two owner-sites paths throws.
+ */
+export declare function wixOwnerSitesCall(path: string, cookieHeader: string, body: string | undefined, fetchImpl?: typeof fetch): Promise<WixBridgeEnvelope>;
+/** One trimmed row of `GET /v1/owner/sites` — `id` IS the site's metaSiteId. */
+export interface OwnerSiteRow {
+    id: string;
+    displayName: string;
+    namespace?: string;
+}
+/**
+ * RFC 0050 extension — the trimmed "my sites" listing per session, cached
+ * briefly. The cache key is a DIGEST of the cookie header (never the cookies
+ * themselves — same posture as OwnerInstanceCache); the limit rides the digest
+ * so differently-sized listings don't cross-serve. TTL mirrors OwnerInstanceCache
+ * (and wix-cache-policy's ttl:300 for this API): sites are stable, but the
+ * SESSION behind the listing may not be — keep the window short so a logout
+ * stops listing quickly.
+ */
+export declare class OwnerSitesCache {
+    private fetchImpl;
+    private ttlMs;
+    private cache;
+    constructor(fetchImpl?: typeof fetch, ttlMs?: number);
+    private key;
+    sites(cookieHeader: string, limit: number, now?: number): Promise<OwnerSiteRow[]>;
+    /** Drop a cached listing (e.g. after an upstream 401) so the next call re-fetches. */
+    invalidate(cookieHeader: string, limit: number): void;
+}
+/**
+ * Resolve the Wix OAuth clientId for a published app-config, or a typed refusal.
+ * Only `wix-*` auth providers carry a REAL Wix clientId — a generic-oauth app's
+ * clientId is some other issuer's, and minting against it would just burn a
+ * round-trip to wixapis for a guaranteed failure.
+ */
+export declare function wixClientIdOf(appConfigJson: string): {
+    clientId: string;
+} | {
+    error: "unsupported_auth" | "no_client_id";
+};
+export {};

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/serve-storage/src/sha256.d.ts

@@ -0,0 +1,13 @@
+/** SHA-256 of `input`, as 32 bytes. Identical to `createHash("sha256").update(input).digest()`. */
+export declare function sha256(input: string | Uint8Array): Uint8Array;
+/** Lowercase hex of `sha256(input)` — what `createHash("sha256").digest("hex")` produces. */
+export declare function sha256Hex(input: string | Uint8Array): string;
+/**
+ * The same hex digest as `sha256Hex`, via the platform's native implementation.
+ *
+ * Identical output — `sha256-parity.test.ts` proves the two agree with each other and with node —
+ * but ~40x faster, because it is not JavaScript. Use it wherever the caller is already async AND
+ * the input can be large: a package archive, an asset. It is not a drop-in for the sync one, which
+ * is what lets `strongEtag` stay a plain function.
+ */
+export declare function sha256HexAsync(input: string | Uint8Array): Promise<string>;