@wix/himalaya-cli 0.1250.0 → 0.1252.0

package/dist/cli.mjs

@@ -6911,7 +6911,6 @@ function resolveTranslation(value, catalog, sourceCatalog) {
 var BINDING_SIGILS, BINDING_SIGIL_RE, TRANSLATION_PREFIX, TRANSLATION_KEY_RE;
 var init_bindings = __esm({
   "../../core/ts/src/bindings.ts"() {
-    "use strict";
     BINDING_SIGILS = ["service", "flag", "item", "t"];
     BINDING_SIGIL_RE = new RegExp(
       `^\\$(?:${BINDING_SIGILS.filter((s2) => s2 !== "t").join("|")})\\b|^\\$t:`
@@ -13465,6 +13464,7 @@ function resolveIdiom(tokens2, ctx = {}) {
 var IDIOM_CONTEXTS, UNSAFE_KEYS;
 var init_idiom = __esm({
   "../../core/ts/src/idiom.ts"() {
+    "use strict";
     IDIOM_CONTEXTS = {
       ios: { native: ["ios"] },
       android: { native: ["material"] },
@@ -28920,6 +28920,269 @@ var init_derive_transport_capability = __esm({
   }
 });
 
+// ../../core/serve-runtime/src/wix-bridge.ts
+function isAllowedConsumerStreamTarget(raw) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "https:" || url.port !== "" && url.port !== "443" || url.username || url.password) return false;
+  if (url.hostname.toLowerCase() === "www.wixapis.com") return true;
+  return url.hostname.toLowerCase() === "apps.wix.com" && url.pathname === "/_api/nano-brain/v1/llm-sdk/generate-text";
+}
+function absoluteUrlRejection(path2) {
+  let host = "";
+  try {
+    host = new URL(path2).host;
+  } catch {
+  }
+  return OWNER_SCOPED_WIX_HOST.test(host) ? "owner-only" : "open-proxy";
+}
+async function mintAnonymousVisitor(clientId, fetchImpl = fetch) {
+  const res = await fetchImpl(`${WIX_API}/oauth2/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ clientId, grantType: "anonymous" })
+  });
+  const text8 = await res.text();
+  let j2 = {};
+  try {
+    j2 = text8 ? JSON.parse(text8) : {};
+  } catch {
+  }
+  if (res.status !== 200 || !j2.access_token) throw new Error(`visitor mint failed (${res.status})`);
+  return j2.access_token;
+}
+async function wixVisitorCall(method, path2, body, token, fetchImpl = fetch, forwardedHeaders = {}) {
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(path2)) throw new Error("absolute URLs are not allowed");
+  const url = `${WIX_API}${path2.startsWith("/") ? path2 : `/${path2}`}`;
+  const res = await fetchImpl(url, {
+    method,
+    // Same header shape the dev-server bridge has always sent (wixapis accepts the
+    // raw access token as the Authorization value).
+    headers: { ...forwardedHeaders, Authorization: token, ...body ? { "Content-Type": "application/json" } : {} },
+    body: method === "GET" || method === "HEAD" ? void 0 : body
+  });
+  return { status: res.status, body: await res.text() };
+}
+function isChatWebTarget(path2) {
+  if (!path2 || !/^https:\/\//i.test(path2)) return false;
+  try {
+    const url = new URL(path2);
+    return url.host === "manage.wix.com" && url.pathname.startsWith("/_api/chat-web/");
+  } catch {
+    return false;
+  }
+}
+function normalizeWixForwardedHeaders(input, path2) {
+  const chatWeb = isChatWebTarget(path2);
+  let value = input;
+  if (typeof value === "string") {
+    try {
+      value = JSON.parse(value);
+    } catch {
+      return {};
+    }
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const out2 = {};
+  for (const [name, headerValue] of Object.entries(value)) {
+    const lower = name.toLowerCase();
+    const allowed2 = WIX_FORWARDABLE_HEADERS.has(lower) || chatWeb && lower === "chattoken";
+    if (!/^[a-z0-9-]+$/i.test(name) || !allowed2 || typeof headerValue !== "string") continue;
+    if (/[\r\n\0]/.test(headerValue)) continue;
+    out2[name] = headerValue;
+  }
+  return out2;
+}
+function isSafeMsid(msid) {
+  return /^[0-9a-fA-F-]{10,64}$/.test(msid);
+}
+function isOwnerSitesPath(path2) {
+  return path2 === OWNER_SITES_QUERY_PATH || path2 === OWNER_SITES_COUNT_PATH;
+}
+async function wixOwnerSitesCall(path2, cookieHeader, body, fetchImpl = fetch) {
+  if (!isOwnerSitesPath(path2)) throw new Error("not an owner-sites path");
+  const xsrf = /(?:^|;\s*)XSRF-TOKEN=([^;]+)/.exec(cookieHeader)?.[1];
+  const res = await fetchImpl(`${WIX_API}${path2}`, {
+    method: "POST",
+    headers: {
+      Cookie: cookieHeader,
+      "Content-Type": "application/json",
+      Accept: "application/json",
+      ...xsrf ? { "x-xsrf-token": xsrf } : {}
+    },
+    body: body ?? "{}"
+  });
+  return { status: res.status, body: await res.text() };
+}
+function wixClientIdOf(appConfigJson) {
+  let cfg;
+  try {
+    cfg = JSON.parse(appConfigJson);
+  } catch {
+    return { error: "no_client_id" };
+  }
+  const providerId = cfg.authConfig?.providerId ?? "";
+  if (!providerId.startsWith("wix")) return { error: "unsupported_auth" };
+  const clientId = cfg.authConfig?.config?.clientId;
+  if (typeof clientId !== "string" || !clientId) return { error: "no_client_id" };
+  return { clientId };
+}
+var WIX_API, ONE_APP_SESSION, OWNER_SCOPED_WIX_HOST, WIX_FORWARDABLE_HEADERS, OWNER_REFRESH_MARGIN_MS, OWNER_RENEW_MIN_AGE_MS, OWNER_MINT_TIMEOUT_MS, OwnerInstanceCache, OWNER_SITES_QUERY_PATH, OWNER_SITES_COUNT_PATH, OwnerSitesCache;
+var init_wix_bridge = __esm({
+  "../../core/serve-runtime/src/wix-bridge.ts"() {
+    init_sha256();
+    WIX_API = "https://www.wixapis.com";
+    ONE_APP_SESSION = "https://apps.wix.com/_api/one-app-session-web/v3/businesses";
+    OWNER_SCOPED_WIX_HOST = /(^|\.)wix\.com$/i;
+    WIX_FORWARDABLE_HEADERS = /* @__PURE__ */ new Set([
+      "x-wix-language",
+      "x-wix-linguist",
+      "wixlanguage",
+      "accept-language",
+      "x-wix-currency",
+      "x-wix-consistent",
+      "x-wix-client-api-revision",
+      "x-wix-site-revision",
+      "x-wix-bi-gateway",
+      "x-wix-brand",
+      "consent-policy",
+      "commonconfig",
+      "x-wix-client-artifact-id",
+      "wix-site-id"
+    ]);
+    OWNER_REFRESH_MARGIN_MS = 6e4;
+    OWNER_RENEW_MIN_AGE_MS = 5e3;
+    OWNER_MINT_TIMEOUT_MS = 8e3;
+    OwnerInstanceCache = class {
+      constructor(fetchImpl = fetch, ttlMs = 5 * 6e4, mintTimeoutMs = OWNER_MINT_TIMEOUT_MS, elapsedClock = () => performance.now()) {
+        this.fetchImpl = fetchImpl;
+        this.ttlMs = ttlMs;
+        this.mintTimeoutMs = mintTimeoutMs;
+        this.elapsedClock = elapsedClock;
+      }
+      cache = /* @__PURE__ */ new Map();
+      /** The one mint on its way per (business, session). Every caller, plain or renewing, joins it:
+       *  it started after whatever is cached was minted, so it is the fresh instance. */
+      inflight = /* @__PURE__ */ new Map();
+      /** Keyed on the SESSION (`wixSession2`), not the whole cookie header: manage.wix.com's jar churns
+       *  (analytics, experiments), and keying on all of it re-minted on nearly every call (#3044). A
+       *  header with no session cookie falls back to itself — callers refuse that case before here. */
+      key(msid, cookieHeader) {
+        const session = /(?:^|;\s*)wixSession2=([^;]*)/.exec(cookieHeader)?.[1] ?? cookieHeader;
+        return sha256Hex(`${msid}
+${session}`);
+      }
+      async instance(msid, cookieHeader, now = Date.now()) {
+        return (await this.entry(msid, cookieHeader, now)).instance;
+      }
+      /** The instance and the time this cache stops trusting it (#3044: the web host caches until then).
+       *  `renew`: Wix refused the instance this cache handed out (the route's `renew=1`, #3140) — mint a
+       *  new one, unless the cached one is younger than OWNER_RENEW_MIN_AGE_MS or a mint is already on
+       *  its way, in which case that IS the new one. */
+      async entry(msid, cookieHeader, now = Date.now(), opts = {}) {
+        const key2 = this.key(msid, cookieHeader);
+        const pending = this.inflight.get(key2);
+        if (pending) return { ...await pending };
+        let hit = this.cache.get(key2);
+        if (opts.renew && hit && now - hit.mintedAt >= OWNER_RENEW_MIN_AGE_MS) hit = void 0;
+        if (hit && hit.expiresAt - OWNER_REFRESH_MARGIN_MS > now) return { instance: hit.instance, expiresAt: hit.expiresAt };
+        const mint = this.mint(key2, msid, cookieHeader, now).finally(() => this.inflight.delete(key2));
+        this.inflight.set(key2, mint);
+        return { ...await mint };
+      }
+      async mint(key2, msid, cookieHeader, now) {
+        const startedAt = this.elapsedClock();
+        const abort = new AbortController();
+        let timer;
+        const timedOut = new Promise((_2, reject) => {
+          timer = setTimeout(() => {
+            abort.abort();
+            reject(new Error(`owner mint timed out after ${this.mintTimeoutMs}ms`));
+          }, this.mintTimeoutMs);
+        });
+        try {
+          const res = await Promise.race([
+            this.fetchImpl(`${ONE_APP_SESSION}/${msid}/signed-instance?signed_instance_type=User`, {
+              method: "GET",
+              headers: { Cookie: cookieHeader },
+              signal: abort.signal
+            }),
+            timedOut
+          ]);
+          const text8 = await Promise.race([res.text(), timedOut]);
+          let j2 = {};
+          try {
+            j2 = text8 ? JSON.parse(text8) : {};
+          } catch {
+          }
+          if (res.status < 200 || res.status >= 300 || !j2.signedInstance)
+            throw new Error(`owner mint failed (${res.status})`);
+          const elapsed = Math.max(0, this.elapsedClock() - startedAt);
+          const mintedAt = now + elapsed;
+          const entry = { instance: j2.signedInstance, expiresAt: now + Math.floor(elapsed / 1e3) * 1e3 + this.ttlMs };
+          this.cache.set(key2, { ...entry, mintedAt });
+          return entry;
+        } catch (e2) {
+          this.cache.delete(key2);
+          throw e2;
+        } finally {
+          clearTimeout(timer);
+        }
+      }
+      /** Drop a cached instance so the next call re-mints. The envelope owner branch's own 401 retry;
+       *  the route's `renew=1` goes through `entry(…, { renew: true })` instead. */
+      invalidate(msid, cookieHeader) {
+        this.cache.delete(this.key(msid, cookieHeader));
+      }
+    };
+    OWNER_SITES_QUERY_PATH = "/site-list/v2/sites/query";
+    OWNER_SITES_COUNT_PATH = "/site-list/v2/sites/count";
+    OwnerSitesCache = class {
+      constructor(fetchImpl = fetch, ttlMs = 5 * 6e4) {
+        this.fetchImpl = fetchImpl;
+        this.ttlMs = ttlMs;
+      }
+      cache = /* @__PURE__ */ new Map();
+      key(cookieHeader, limit) {
+        return sha256Hex(`${limit}
+${cookieHeader}`);
+      }
+      async sites(cookieHeader, limit, now = Date.now()) {
+        const key2 = this.key(cookieHeader, limit);
+        const hit = this.cache.get(key2);
+        if (hit && hit.expiresAt > now) return hit.sites;
+        const env = await wixOwnerSitesCall(
+          OWNER_SITES_QUERY_PATH,
+          cookieHeader,
+          JSON.stringify({ query: { cursorPaging: { limit } } }),
+          this.fetchImpl
+        );
+        if (env.status < 200 || env.status >= 300) throw new Error(`owner sites failed (${env.status})`);
+        let parsed = {};
+        try {
+          parsed = env.body ? JSON.parse(env.body) : {};
+        } catch {
+        }
+        const sites = (Array.isArray(parsed.sites) ? parsed.sites : []).filter((s2) => typeof s2?.id === "string" && !!s2.id).map((s2) => ({
+          id: s2.id,
+          displayName: typeof s2.displayName === "string" && s2.displayName ? s2.displayName : typeof s2.name === "string" && s2.name ? s2.name : s2.id,
+          ...typeof s2.namespace === "string" && s2.namespace ? { namespace: s2.namespace } : {}
+        }));
+        this.cache.set(key2, { sites, expiresAt: now + this.ttlMs });
+        return sites;
+      }
+      /** Drop a cached listing (e.g. after an upstream 401) so the next call re-fetches. */
+      invalidate(cookieHeader, limit) {
+        this.cache.delete(this.key(cookieHeader, limit));
+      }
+    };
+  }
+});
+
 // ../../core/dev-server/src/wix-hosts.ts
 function targetHost(raw) {
   try {
@@ -28950,11 +29213,13 @@ var init_wix_hosts = __esm({
 // ../../core/dev-server/src/wix-member-login.ts
 var wix_member_login_exports = {};
 __export(wix_member_login_exports, {
+  isAllowedConsumerStreamTarget: () => isAllowedConsumerStreamTarget,
   memberDirectLogin: () => memberDirectLogin,
   memberDirectRegister: () => memberDirectRegister,
   mintVisitor: () => mintVisitor,
   readMemberId: () => readMemberId,
-  webWixCall: () => webWixCall
+  webWixCall: () => webWixCall,
+  webWixStream: () => webWixStream
 });
 import { createHash as createHash12, randomBytes as randomBytes3 } from "node:crypto";
 function b64url(buf) {
@@ -29087,6 +29352,25 @@ async function webWixCall(method, path2, body, token, cookie, forwardedHeaders =
   });
   return { status: res.status, body: await res.text() };
 }
+async function webWixStream(method, path2, body, token, cookie, forwardedHeaders = {}, signal) {
+  const url = /^https?:\/\//i.test(path2) ? path2 : `${API}${path2.startsWith("/") ? path2 : "/" + path2}`;
+  if (!isAllowedConsumerStreamTarget(url)) {
+    throw new Error(`refusing to send Wix credentials to an unapproved consumer endpoint (${targetHost(url) || "no host"})`);
+  }
+  return fetch(url, {
+    method,
+    headers: {
+      ...forwardedHeaders,
+      Accept: "text/event-stream",
+      Authorization: token,
+      ...cookie ? { Cookie: cookie } : {},
+      ...body ? { "Content-Type": "application/json" } : {}
+    },
+    body: method === "GET" || method === "HEAD" ? void 0 : body,
+    redirect: "manual",
+    signal
+  });
+}
 async function readMemberId(memberToken) {
   try {
     const identity = await webWixCall("GET", "/members/v1/members/my", void 0, memberToken);
@@ -29100,7 +29384,9 @@ async function readMemberId(memberToken) {
 var API;
 var init_wix_member_login = __esm({
   "../../core/dev-server/src/wix-member-login.ts"() {
+    init_wix_bridge();
     init_wix_hosts();
+    init_wix_bridge();
     API = "https://www.wixapis.com";
   }
 });
@@ -29569,258 +29855,6 @@ var init_wix_gateway = __esm({
   }
 });
 
-// ../../core/serve-runtime/src/wix-bridge.ts
-function absoluteUrlRejection(path2) {
-  let host = "";
-  try {
-    host = new URL(path2).host;
-  } catch {
-  }
-  return OWNER_SCOPED_WIX_HOST.test(host) ? "owner-only" : "open-proxy";
-}
-async function mintAnonymousVisitor(clientId, fetchImpl = fetch) {
-  const res = await fetchImpl(`${WIX_API}/oauth2/token`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ clientId, grantType: "anonymous" })
-  });
-  const text8 = await res.text();
-  let j2 = {};
-  try {
-    j2 = text8 ? JSON.parse(text8) : {};
-  } catch {
-  }
-  if (res.status !== 200 || !j2.access_token) throw new Error(`visitor mint failed (${res.status})`);
-  return j2.access_token;
-}
-async function wixVisitorCall(method, path2, body, token, fetchImpl = fetch, forwardedHeaders = {}) {
-  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(path2)) throw new Error("absolute URLs are not allowed");
-  const url = `${WIX_API}${path2.startsWith("/") ? path2 : `/${path2}`}`;
-  const res = await fetchImpl(url, {
-    method,
-    // Same header shape the dev-server bridge has always sent (wixapis accepts the
-    // raw access token as the Authorization value).
-    headers: { ...forwardedHeaders, Authorization: token, ...body ? { "Content-Type": "application/json" } : {} },
-    body: method === "GET" || method === "HEAD" ? void 0 : body
-  });
-  return { status: res.status, body: await res.text() };
-}
-function isChatWebTarget(path2) {
-  if (!path2 || !/^https:\/\//i.test(path2)) return false;
-  try {
-    const url = new URL(path2);
-    return url.host === "manage.wix.com" && url.pathname.startsWith("/_api/chat-web/");
-  } catch {
-    return false;
-  }
-}
-function normalizeWixForwardedHeaders(input, path2) {
-  const chatWeb = isChatWebTarget(path2);
-  let value = input;
-  if (typeof value === "string") {
-    try {
-      value = JSON.parse(value);
-    } catch {
-      return {};
-    }
-  }
-  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
-  const out2 = {};
-  for (const [name, headerValue] of Object.entries(value)) {
-    const lower = name.toLowerCase();
-    const allowed2 = WIX_FORWARDABLE_HEADERS.has(lower) || chatWeb && lower === "chattoken";
-    if (!/^[a-z0-9-]+$/i.test(name) || !allowed2 || typeof headerValue !== "string") continue;
-    if (/[\r\n\0]/.test(headerValue)) continue;
-    out2[name] = headerValue;
-  }
-  return out2;
-}
-function isSafeMsid(msid) {
-  return /^[0-9a-fA-F-]{10,64}$/.test(msid);
-}
-function isOwnerSitesPath(path2) {
-  return path2 === OWNER_SITES_QUERY_PATH || path2 === OWNER_SITES_COUNT_PATH;
-}
-async function wixOwnerSitesCall(path2, cookieHeader, body, fetchImpl = fetch) {
-  if (!isOwnerSitesPath(path2)) throw new Error("not an owner-sites path");
-  const xsrf = /(?:^|;\s*)XSRF-TOKEN=([^;]+)/.exec(cookieHeader)?.[1];
-  const res = await fetchImpl(`${WIX_API}${path2}`, {
-    method: "POST",
-    headers: {
-      Cookie: cookieHeader,
-      "Content-Type": "application/json",
-      Accept: "application/json",
-      ...xsrf ? { "x-xsrf-token": xsrf } : {}
-    },
-    body: body ?? "{}"
-  });
-  return { status: res.status, body: await res.text() };
-}
-function wixClientIdOf(appConfigJson) {
-  let cfg;
-  try {
-    cfg = JSON.parse(appConfigJson);
-  } catch {
-    return { error: "no_client_id" };
-  }
-  const providerId = cfg.authConfig?.providerId ?? "";
-  if (!providerId.startsWith("wix")) return { error: "unsupported_auth" };
-  const clientId = cfg.authConfig?.config?.clientId;
-  if (typeof clientId !== "string" || !clientId) return { error: "no_client_id" };
-  return { clientId };
-}
-var WIX_API, ONE_APP_SESSION, OWNER_SCOPED_WIX_HOST, WIX_FORWARDABLE_HEADERS, OWNER_REFRESH_MARGIN_MS, OWNER_RENEW_MIN_AGE_MS, OWNER_MINT_TIMEOUT_MS, OwnerInstanceCache, OWNER_SITES_QUERY_PATH, OWNER_SITES_COUNT_PATH, OwnerSitesCache;
-var init_wix_bridge = __esm({
-  "../../core/serve-runtime/src/wix-bridge.ts"() {
-    init_sha256();
-    WIX_API = "https://www.wixapis.com";
-    ONE_APP_SESSION = "https://apps.wix.com/_api/one-app-session-web/v3/businesses";
-    OWNER_SCOPED_WIX_HOST = /(^|\.)wix\.com$/i;
-    WIX_FORWARDABLE_HEADERS = /* @__PURE__ */ new Set([
-      "x-wix-language",
-      "x-wix-linguist",
-      "wixlanguage",
-      "accept-language",
-      "x-wix-currency",
-      "x-wix-consistent",
-      "x-wix-client-api-revision",
-      "x-wix-site-revision",
-      "x-wix-bi-gateway",
-      "x-wix-brand",
-      "consent-policy",
-      "commonconfig",
-      "x-wix-client-artifact-id",
-      "wix-site-id"
-    ]);
-    OWNER_REFRESH_MARGIN_MS = 6e4;
-    OWNER_RENEW_MIN_AGE_MS = 5e3;
-    OWNER_MINT_TIMEOUT_MS = 8e3;
-    OwnerInstanceCache = class {
-      constructor(fetchImpl = fetch, ttlMs = 5 * 6e4, mintTimeoutMs = OWNER_MINT_TIMEOUT_MS, elapsedClock = () => performance.now()) {
-        this.fetchImpl = fetchImpl;
-        this.ttlMs = ttlMs;
-        this.mintTimeoutMs = mintTimeoutMs;
-        this.elapsedClock = elapsedClock;
-      }
-      cache = /* @__PURE__ */ new Map();
-      /** The one mint on its way per (business, session). Every caller, plain or renewing, joins it:
-       *  it started after whatever is cached was minted, so it is the fresh instance. */
-      inflight = /* @__PURE__ */ new Map();
-      /** Keyed on the SESSION (`wixSession2`), not the whole cookie header: manage.wix.com's jar churns
-       *  (analytics, experiments), and keying on all of it re-minted on nearly every call (#3044). A
-       *  header with no session cookie falls back to itself — callers refuse that case before here. */
-      key(msid, cookieHeader) {
-        const session = /(?:^|;\s*)wixSession2=([^;]*)/.exec(cookieHeader)?.[1] ?? cookieHeader;
-        return sha256Hex(`${msid}
-${session}`);
-      }
-      async instance(msid, cookieHeader, now = Date.now()) {
-        return (await this.entry(msid, cookieHeader, now)).instance;
-      }
-      /** The instance and the time this cache stops trusting it (#3044: the web host caches until then).
-       *  `renew`: Wix refused the instance this cache handed out (the route's `renew=1`, #3140) — mint a
-       *  new one, unless the cached one is younger than OWNER_RENEW_MIN_AGE_MS or a mint is already on
-       *  its way, in which case that IS the new one. */
-      async entry(msid, cookieHeader, now = Date.now(), opts = {}) {
-        const key2 = this.key(msid, cookieHeader);
-        const pending = this.inflight.get(key2);
-        if (pending) return { ...await pending };
-        let hit = this.cache.get(key2);
-        if (opts.renew && hit && now - hit.mintedAt >= OWNER_RENEW_MIN_AGE_MS) hit = void 0;
-        if (hit && hit.expiresAt - OWNER_REFRESH_MARGIN_MS > now) return { instance: hit.instance, expiresAt: hit.expiresAt };
-        const mint = this.mint(key2, msid, cookieHeader, now).finally(() => this.inflight.delete(key2));
-        this.inflight.set(key2, mint);
-        return { ...await mint };
-      }
-      async mint(key2, msid, cookieHeader, now) {
-        const startedAt = this.elapsedClock();
-        const abort = new AbortController();
-        let timer;
-        const timedOut = new Promise((_2, reject) => {
-          timer = setTimeout(() => {
-            abort.abort();
-            reject(new Error(`owner mint timed out after ${this.mintTimeoutMs}ms`));
-          }, this.mintTimeoutMs);
-        });
-        try {
-          const res = await Promise.race([
-            this.fetchImpl(`${ONE_APP_SESSION}/${msid}/signed-instance?signed_instance_type=User`, {
-              method: "GET",
-              headers: { Cookie: cookieHeader },
-              signal: abort.signal
-            }),
-            timedOut
-          ]);
-          const text8 = await Promise.race([res.text(), timedOut]);
-          let j2 = {};
-          try {
-            j2 = text8 ? JSON.parse(text8) : {};
-          } catch {
-          }
-          if (res.status < 200 || res.status >= 300 || !j2.signedInstance)
-            throw new Error(`owner mint failed (${res.status})`);
-          const elapsed = Math.max(0, this.elapsedClock() - startedAt);
-          const mintedAt = now + elapsed;
-          const entry = { instance: j2.signedInstance, expiresAt: now + Math.floor(elapsed / 1e3) * 1e3 + this.ttlMs };
-          this.cache.set(key2, { ...entry, mintedAt });
-          return entry;
-        } catch (e2) {
-          this.cache.delete(key2);
-          throw e2;
-        } finally {
-          clearTimeout(timer);
-        }
-      }
-      /** Drop a cached instance so the next call re-mints. The envelope owner branch's own 401 retry;
-       *  the route's `renew=1` goes through `entry(…, { renew: true })` instead. */
-      invalidate(msid, cookieHeader) {
-        this.cache.delete(this.key(msid, cookieHeader));
-      }
-    };
-    OWNER_SITES_QUERY_PATH = "/site-list/v2/sites/query";
-    OWNER_SITES_COUNT_PATH = "/site-list/v2/sites/count";
-    OwnerSitesCache = class {
-      constructor(fetchImpl = fetch, ttlMs = 5 * 6e4) {
-        this.fetchImpl = fetchImpl;
-        this.ttlMs = ttlMs;
-      }
-      cache = /* @__PURE__ */ new Map();
-      key(cookieHeader, limit) {
-        return sha256Hex(`${limit}
-${cookieHeader}`);
-      }
-      async sites(cookieHeader, limit, now = Date.now()) {
-        const key2 = this.key(cookieHeader, limit);
-        const hit = this.cache.get(key2);
-        if (hit && hit.expiresAt > now) return hit.sites;
-        const env = await wixOwnerSitesCall(
-          OWNER_SITES_QUERY_PATH,
-          cookieHeader,
-          JSON.stringify({ query: { cursorPaging: { limit } } }),
-          this.fetchImpl
-        );
-        if (env.status < 200 || env.status >= 300) throw new Error(`owner sites failed (${env.status})`);
-        let parsed = {};
-        try {
-          parsed = env.body ? JSON.parse(env.body) : {};
-        } catch {
-        }
-        const sites = (Array.isArray(parsed.sites) ? parsed.sites : []).filter((s2) => typeof s2?.id === "string" && !!s2.id).map((s2) => ({
-          id: s2.id,
-          displayName: typeof s2.displayName === "string" && s2.displayName ? s2.displayName : typeof s2.name === "string" && s2.name ? s2.name : s2.id,
-          ...typeof s2.namespace === "string" && s2.namespace ? { namespace: s2.namespace } : {}
-        }));
-        this.cache.set(key2, { sites, expiresAt: now + this.ttlMs });
-        return sites;
-      }
-      /** Drop a cached listing (e.g. after an upstream 401) so the next call re-fetches. */
-      invalidate(cookieHeader, limit) {
-        this.cache.delete(this.key(cookieHeader, limit));
-      }
-    };
-  }
-});
-
 // ../../core/serve-runtime/src/flag-assignments.ts
 function bad(error) {
   return new Response(JSON.stringify({ error }), { status: 400, headers: { "content-type": JSON_CT, "cache-control": "no-store" } });
@@ -32482,6 +32516,8 @@ function createRicosHostSession(o2) {
   let seq = 0;
   const newId = o2.newId ?? (() => `rq${Date.now().toString(36)}${++seq}`);
   const state = { ready: false, unavailable: null, dirty: false, toolbar: EMPTY_TOOLBAR, focused: false };
+  let locale = o2.locale;
+  let rtl = o2.rtl;
   let seed2 = "";
   let committed = o2.seedMode === "none";
   let initSent = false, awaitingBaseline = false, disposed = false;
@@ -32513,8 +32549,8 @@ function createRicosHostSession(o2) {
       type: "init",
       contentJson: seed2,
       ...o2.placeholder ? { placeholder: o2.placeholder } : {},
-      ...o2.locale ? { locale: o2.locale } : {},
-      ...o2.rtl !== void 0 ? { rtl: o2.rtl } : {},
+      ...locale ? { locale } : {},
+      ...rtl !== void 0 ? { rtl } : {},
       ...o2.palette ? { palette: o2.palette } : {}
     });
   };
@@ -32607,6 +32643,13 @@ function createRicosHostSession(o2) {
         else sendInit();
       }
     },
+    updateLocale(nextLocale, nextRtl) {
+      if (locale === nextLocale && rtl === nextRtl) return;
+      locale = nextLocale;
+      rtl = nextRtl;
+      if (!initSent || state.unavailable || disposed) return;
+      o2.send({ v: 1, type: "updateLocale", locale: nextLocale ?? "en", rtl: nextRtl ?? false });
+    },
     currentContent() {
       return !state.unavailable && !disposed && writes() ? lastContent : null;
     },
@@ -32983,6 +33026,9 @@ function RichContentEditorView({ props, ctx, wrap, nodeId, renderChild, ...dom }
       sessionRef.current = null;
     };
   }, [live3, src]);
+  React3.useEffect(() => {
+    sessionRef.current?.updateLocale(ctx.localeTag ?? "en", ctx.isRTL ?? document.documentElement.dir === "rtl");
+  }, [ctx.localeTag, ctx.isRTL]);
   React3.useEffect(() => {
     sessionRef.current?.setSeed(seedMode === "literal" ? props.documentJson : seedMode === "binding" ? boundSeed : "");
   }, [seedMode, props.documentJson, boundSeed, src]);
@@ -118339,7 +118385,7 @@ function renderInner(node, ctx) {
     }
   }
 }
-var useIsomorphicLayoutEffect, ResponsiveGrid, SPLIT_EXPANDED_MIN_WIDTH, SPLIT_COLUMN_GAP, ResponsiveSplitView, ABSOLUTE_URL_RE, appearKeyframesInjected, pressStylesInjected, REVEAL_ON_FOCUS_ATTR, FOCUS_RING_CSS, focusStylesInjected, HLIST_CHILD_CSS, hListStylesInjected, listAnimateRuntimeInstalled, transitionKeyframesInjected, countUpRuntimeInjected, MEASURE_PREFIX, measureRuntimeInjected, revealRuntimeInjected, vectorAnimStylesInjected, scrollProgressRuntimeInjected, confettiRuntimeInjected, lottieRuntimeInjected, riveRuntimeInjected, gradientKeyframesInjected, parallaxRuntimeInjected, spinKeyframesInjected, marqueeKeyframesInjected, alignItems, zJustifyItems, hAlignItems, bodyFont, kids2, rowKidCtx, rowKids, staggeredKids, asTextL10n, asFinalTextL10n, asBoundText, useBoundString, InterpolatedTextView, txt, selectFragmentCase, fragmentValueHash, fragmentSlotContent, FragmentSlotNode, RichContentEditorNode, MediaFieldNode, WorkerSubtreeNode, RichContentNode, resolveItemDeep2, resolveSwipeActions, resolveModBindings, resolvedComponentId, directServiceBindings, withRootStyle, ReactiveDirectScalars, HiddenGate, KEYBOARD_INPUT_MODES, AUTOCAPITALIZE_VALUES, ENTER_KEY_HINTS, AUTOGROW_CEILING, EditableField, MenuNode, LoadMoreSentinel, FieldErrorNode, FormView, MediaSlotProvider, MEDIA_ITEM_BINDABLE, MediaPlayerView, VideoNode, PdfDocumentCanvas, PdfViewNode, WebViewNode, InteractivePicker, InteractiveDatePicker, InteractiveSearchField, InteractiveStepper, SYNTHETIC_TAP_ROLE, SYNTHETIC_TABINDEX, INFERRED_DECORATIVE, SELF_RENDERED_LEAF, ROLE_WHEN_NAMED, AUTHORED_ROLE, PENDING_RANGE, RANGE_ROLES, NODE_A11Y_ATTRS, INTERACTIVE_ROLES, ALWAYS_INTERACTIVE_COMPONENT_TYPES, TAP_ACTIVATOR_ATTR, TAP_GROUP_ATTR, VISUALLY_HIDDEN, NAME_SKIP_SELECTOR, activatorNameObservers, ACTIVATOR_STATE_ATTRS, controlNode, ToggleNode, SliderNode, SelectionControlNode, TabsNode, SegmentedControlNode, DisclosureGroupNode, GridNode, SplitViewNode, TextNode, ImageNode, ANIMATION_LEAF, LottieNode, RiveNode, AvatarNode, IconNode, EMPTY_STATE_SPACING, EmptyStateNode, ButtonNode, OtpInputNode, ProgressBarNode, ACTIVITY_DEFAULT_NAME, ActivityIndicatorNode, NATIVELY_TABBABLE, BottomSheetNode, PRESENTED_OVERLAY_ATTR, PopoverNode, ChipsInputNode, ChipNode, TableNode, GaugeRing, GaugeNode, RATING_METRICS, ratingMetrics, RatingNode, AvatarStripNode, CHART_STROKE_CYCLE, chartStrokeAt, chartBarCenter, ChartNode, donutSliceOpacity, DonutChartNode, LegendMarker, LegendNode, cellAlign, DataTableNode, voiceNoteState, voiceNoteDelivery, VOICE_NOTE_DEFAULT_BARS, clampBarCount, VoiceNoteNode, TimelineNode, WheelPickerNode, ColorPickerNode, FilterChipsNode, TILE_PX, MAX_MERCATOR_LAT, DEFAULT_TILE_MAX_ZOOM, CIRCLE_SEGMENTS, METRES_PER_DEG_LAT, MARKER_HIT_RADIUS, SHAPE_HIT_RADIUS, MapNode, CollapsingHeaderNode, UnsupportedOnSurface, CALENDAR_DATE_ONLY_RE, CAL_DEFAULT_MAX_DOTS, CAL_AGENDA_INITIAL_DAYS, CAL_AGENDA_PAGE_DAYS, CAL_DEFAULT_SNAP_MINUTES, CAL_UNASSIGNED_LANE_ID, MonthCalendarNode, TimeGridNode, AgendaNode, ARIA_ROLE, initialFocusScheduled, PRESENTED_SCOPE, focusRoots, A11yHintDescription, WebRenderer;
+var useIsomorphicLayoutEffect, ResponsiveGrid, SPLIT_EXPANDED_MIN_WIDTH, SPLIT_COLUMN_GAP, ResponsiveSplitView, ABSOLUTE_URL_RE, appearKeyframesInjected, pressStylesInjected, REVEAL_ON_FOCUS_ATTR, FOCUS_RING_CSS, focusStylesInjected, HLIST_CHILD_CSS, hListStylesInjected, listAnimateRuntimeInstalled, transitionKeyframesInjected, countUpRuntimeInjected, MEASURE_PREFIX, measureRuntimeInjected, revealRuntimeInjected, vectorAnimStylesInjected, scrollProgressRuntimeInjected, confettiRuntimeInjected, lottieRuntimeInjected, riveRuntimeInjected, gradientKeyframesInjected, parallaxRuntimeInjected, spinKeyframesInjected, marqueeKeyframesInjected, alignItems, zJustifyItems, hAlignItems, bodyFont, kids2, rowKidCtx, rowKids, staggeredKids, asTextL10n, asFinalTextL10n, asBoundText, useBoundString, InterpolatedTextView, txt, selectFragmentCase, fragmentValueHash, fragmentSlotContent, FragmentSlotNode, RichContentEditorNode, MediaFieldNode, WorkerSubtreeNode, RichContentNode, resolveItemDeep2, resolveRowAction2, resolveSwipeActions, resolveModBindings, resolvedComponentId, directServiceBindings, withRootStyle, ReactiveDirectScalars, HiddenGate, KEYBOARD_INPUT_MODES, AUTOCAPITALIZE_VALUES, ENTER_KEY_HINTS, AUTOGROW_CEILING, EditableField, MenuNode, LoadMoreSentinel, FieldErrorNode, FormView, MediaSlotProvider, MEDIA_ITEM_BINDABLE, MediaPlayerView, VideoNode, PdfDocumentCanvas, PdfViewNode, WebViewNode, InteractivePicker, InteractiveDatePicker, InteractiveSearchField, InteractiveStepper, SYNTHETIC_TAP_ROLE, SYNTHETIC_TABINDEX, INFERRED_DECORATIVE, SELF_RENDERED_LEAF, ROLE_WHEN_NAMED, AUTHORED_ROLE, PENDING_RANGE, RANGE_ROLES, NODE_A11Y_ATTRS, INTERACTIVE_ROLES, ALWAYS_INTERACTIVE_COMPONENT_TYPES, TAP_ACTIVATOR_ATTR, TAP_GROUP_ATTR, VISUALLY_HIDDEN, NAME_SKIP_SELECTOR, activatorNameObservers, ACTIVATOR_STATE_ATTRS, controlNode, ToggleNode, SliderNode, SelectionControlNode, TabsNode, SegmentedControlNode, DisclosureGroupNode, GridNode, SplitViewNode, TextNode, ImageNode, ANIMATION_LEAF, LottieNode, RiveNode, AvatarNode, IconNode, EMPTY_STATE_SPACING, EmptyStateNode, ButtonNode, OtpInputNode, ProgressBarNode, ACTIVITY_DEFAULT_NAME, ActivityIndicatorNode, NATIVELY_TABBABLE, BottomSheetNode, PRESENTED_OVERLAY_ATTR, PopoverNode, ChipsInputNode, ChipNode, TableNode, GaugeRing, GaugeNode, RATING_METRICS, ratingMetrics, RatingNode, AvatarStripNode, CHART_STROKE_CYCLE, chartStrokeAt, chartBarCenter, ChartNode, donutSliceOpacity, DonutChartNode, LegendMarker, LegendNode, cellAlign, DataTableNode, voiceNoteState, voiceNoteDelivery, VOICE_NOTE_DEFAULT_BARS, clampBarCount, VoiceNoteNode, TimelineNode, WheelPickerNode, ColorPickerNode, FilterChipsNode, TILE_PX, MAX_MERCATOR_LAT, DEFAULT_TILE_MAX_ZOOM, CIRCLE_SEGMENTS, METRES_PER_DEG_LAT, MARKER_HIT_RADIUS, SHAPE_HIT_RADIUS, MapNode, CollapsingHeaderNode, UnsupportedOnSurface, CALENDAR_DATE_ONLY_RE, CAL_DEFAULT_MAX_DOTS, CAL_AGENDA_INITIAL_DAYS, CAL_AGENDA_PAGE_DAYS, CAL_DEFAULT_SNAP_MINUTES, CAL_UNASSIGNED_LANE_ID, MonthCalendarNode, TimeGridNode, AgendaNode, ARIA_ROLE, initialFocusScheduled, PRESENTED_SCOPE, focusRoots, A11yHintDescription, WebRenderer;
 var init_renderNode = __esm({
   "../../core/web-renderer/src/renderNode.tsx"() {
     "use strict";
@@ -118748,6 +118794,16 @@ var init_renderNode = __esm({
       }
       return v2;
     };
+    resolveRowAction2 = (action, ctx) => {
+      const resolved2 = resolveItemDeep2(action, ctx);
+      if (!resolved2 || typeof resolved2 !== "object" || Array.isArray(resolved2)) return resolved2;
+      const params = resolved2.params;
+      if (!params || typeof params !== "object" || Array.isArray(params)) return resolved2;
+      return {
+        ...resolved2,
+        params: Object.fromEntries(Object.entries(params).map(([key2, value]) => [key2, typeof value === "number" || typeof value === "boolean" ? String(value) : value]))
+      };
+    };
     resolveSwipeActions = (arr, ctx) => (arr ?? []).map((a2) => resolveItemDeep2(a2, ctx));
     resolveModBindings = (mods, ctx) => {
       if (!mods || typeof mods !== "object") return mods;
@@ -118848,7 +118904,7 @@ var init_renderNode = __esm({
       const prefixText = useBoundString(props.prefix, ctx);
       const suffixText = useBoundString(props.suffix, ctx);
       const valueBinding = typeof ctrl === "string" ? ctrl : cfg.value;
-      const onChangeAction = props.onChange ?? cfg.onChange;
+      const onChangeAction = resolveRowAction2(props.onChange ?? cfg.onChange, ctx);
       const borderless = props.borderless === true || cfg.borderless === true;
       const secure = props.secure === true || cfg.secure === true;
       const erroredProp = props.error === true || cfg.error === true;
@@ -118856,7 +118912,9 @@ var init_renderNode = __esm({
       const pathProp = typeof props.valuePath === "string" ? props.valuePath : typeof cfg.valuePath === "string" ? cfg.valuePath : void 0;
       const binding2 = pathProp !== void 0 && isBinding(pathProp) ? pathProp : typeof valueBinding === "string" && isBinding(valueBinding) ? valueBinding : void 0;
       const isBound = binding2 !== void 0;
-      const boundVal = useBoundValue(ctx, binding2 ?? "");
+      const rowBinding = binding2 !== void 0 && binding2.startsWith("$item.") ? binding2 : void 0;
+      const liveVal = useBoundValue(ctx, rowBinding ? "" : binding2 ?? "");
+      const boundVal = rowBinding ? resolveScalarStatic(rowBinding, ctx) : liveVal;
       const boundRawText = typeof boundVal === "string" ? boundVal : typeof boundVal === "number" ? String(boundVal) : void 0;
       const boundText = serializeRichText && boundRawText !== void 0 ? richTextHtmlToPlainText(boundRawText) : boundRawText;
       const literalText = typeof valueBinding === "string" ? serializeRichText ? richTextHtmlToPlainText(valueBinding) : valueBinding : "";
@@ -125491,6 +125549,155 @@ async function handleWebWix(req, res, state) {
     res.setHeader("access-control-allow-origin", "*");
     res.end(JSON.stringify(obj3));
   };
+  if (path2 === "/v1/__webwix/stream" && req.method === "POST") {
+    const b2 = await readJson8();
+    const method = String(b2.method ?? "GET").toUpperCase();
+    const requestedUrl = String(b2.url ?? "");
+    const body = b2.body === void 0 ? void 0 : typeof b2.body === "string" ? b2.body : JSON.stringify(b2.body);
+    const forwardedHeaders = normalizeWixForwardedHeaders(b2.headers, requestedUrl);
+    const target = (() => {
+      try {
+        return new URL(requestedUrl, "https://www.wixapis.com");
+      } catch {
+        return void 0;
+      }
+    })();
+    const started = Date.now();
+    const recordStream = (source, status, mockRuleId, headers2) => {
+      const redactBodies = source === "proxy" || mockRuleId === UNMATCHED_FAIL_CLOSED_ID;
+      recordWixTraffic(state.wix, state.appName, state.adminUrl, {
+        ts: started,
+        source,
+        capability: "wix_api.web",
+        host: target?.host ?? "unknown",
+        method,
+        // Traffic is retained and broadcast to the devtools/admin log. Keep only
+        // the origin and path: rejected URLs may contain userinfo, and valid Wix
+        // endpoints can carry credential-like query parameters.
+        url: target ? `${target.origin}${target.pathname}` : "[unparseable URL]",
+        path: target?.pathname ?? "[unparseable URL]",
+        status,
+        durationMs: Date.now() - started,
+        reqBody: redactBodies ? void 0 : body,
+        respHeaders: redactBodies ? void 0 : headers2,
+        mockRuleId
+      });
+    };
+    if (!target || !isAllowedConsumerStreamTarget(target.toString()) || !["GET", "POST"].includes(method)) {
+      recordStream("proxy", 400);
+      res.statusCode = 400;
+      res.setHeader("content-type", "application/json; charset=utf-8");
+      res.end(JSON.stringify({ error: "webwix_stream_bad_request" }));
+      return;
+    }
+    if (state.wix.mode === "mock") {
+      const matchCtx = { host: target.host, query: Object.fromEntries(target.searchParams.entries()), headers: forwardedHeaders, body };
+      let match = matchRuleEx(state.wix.rules, method, target.pathname, matchCtx);
+      if (match && (match.rule.kind ?? "mock") !== "mock") {
+        console.error(`[himalaya-dev] net-mocks: rule "${match.rule.id}" is kind:"${match.rule.kind}", which the web bridge cannot apply \u2014 ignoring it for ${method} ${target.pathname}`);
+        match = matchRuleEx(state.wix.rules.filter((r2) => (r2.kind ?? "mock") === "mock"), method, target.pathname, matchCtx);
+      }
+      if (match) {
+        const mocked = match.rule.response;
+        if (mocked.delayMs) await new Promise((resolve57) => setTimeout(resolve57, mocked.delayMs));
+        const payload = mocked.template ? renderTemplate(mocked.body, match.captures) : mocked.body;
+        recordStream("mock", mocked.status, match.rule.id, mocked.headers);
+        res.statusCode = mocked.status;
+        res.setHeader("content-type", mocked.headers?.["content-type"] ?? "text/event-stream; charset=utf-8");
+        res.setHeader("cache-control", "no-cache");
+        res.end(payload ?? "");
+        return;
+      }
+      if (failsClosed(state.wix)) {
+        const refusal = hermeticRefusal(method, target.pathname);
+        recordStream("mock", refusal.status, UNMATCHED_FAIL_CLOSED_ID, refusal.headers);
+        res.statusCode = refusal.status;
+        res.setHeader("content-type", "application/json; charset=utf-8");
+        res.end(refusal.body);
+        return;
+      }
+    }
+    const abort = new AbortController();
+    const onResponseClose = () => {
+      if (!res.writableFinished) abort.abort();
+    };
+    res.once("close", onResponseClose);
+    try {
+      if (!session.visitorToken && !session.memberToken) {
+        try {
+          session.visitorToken = await mintVisitor(resolveWixClientId(state.app) ?? WEBWIX_CLIENT_ID);
+        } catch {
+        }
+      }
+      const isMember = !!session.memberToken;
+      let token = session.memberToken ?? session.visitorToken ?? "";
+      let upstream = await webWixStream(method, target.toString(), body, token, void 0, forwardedHeaders, abort.signal);
+      if ((upstream.status === 401 || upstream.status === 403) && !isMember && !abort.signal.aborted) {
+        try {
+          await upstream.body?.cancel();
+        } catch {
+        }
+        try {
+          token = session.visitorToken = await mintVisitor(resolveWixClientId(state.app) ?? WEBWIX_CLIENT_ID);
+          upstream = await webWixStream(method, target.toString(), body, token, void 0, forwardedHeaders, abort.signal);
+        } catch {
+        }
+      }
+      res.statusCode = upstream.status;
+      for (const name of ["content-type", "cache-control", "retry-after"]) {
+        const value = upstream.headers.get(name);
+        if (value) res.setHeader(name, value);
+      }
+      res.setHeader("access-control-allow-origin", "*");
+      res.setHeader("cache-control", res.getHeader("cache-control") ?? "no-cache");
+      recordStream("proxy", upstream.status);
+      if (!upstream.body) {
+        res.end();
+        return;
+      }
+      const reader = upstream.body.getReader();
+      for (; ; ) {
+        if (abort.signal.aborted) {
+          await reader.cancel();
+          break;
+        }
+        const chunk = await reader.read();
+        if (chunk.done) break;
+        if (chunk.value && !res.write(chunk.value)) {
+          await new Promise((resolve57) => {
+            let settled = false;
+            const finish2 = () => {
+              if (settled) return;
+              settled = true;
+              res.off("drain", finish2);
+              res.off("close", finish2);
+              resolve57();
+            };
+            if (res.destroyed || !res.writable) finish2();
+            else {
+              res.once("drain", finish2);
+              res.once("close", finish2);
+            }
+          });
+        }
+      }
+      if (!res.destroyed) res.end();
+    } catch {
+      if (!abort.signal.aborted) {
+        recordStream("proxy", 502);
+        if (!res.headersSent) {
+          res.statusCode = 502;
+          res.setHeader("content-type", "application/json; charset=utf-8");
+          res.end(JSON.stringify({ error: "webwix_stream_failed" }));
+        } else if (!res.destroyed) {
+          res.destroy(new Error("webwix_stream_failed"));
+        }
+      }
+    } finally {
+      res.off("close", onResponseClose);
+    }
+    return;
+  }
   if (path2 === "/v1/__webwix/login" && req.method === "POST") {
     const b2 = await readJson8();
     try {
@@ -142389,7 +142596,7 @@ function json4(status, body, headers2 = {}) {
   return new Response(JSON.stringify(body), { status, headers: { "content-type": JSON_CT2, ...headers2 } });
 }
 function isCookieAuthorizedPath(path2) {
-  return path2 === "/v1/__webwix/call" || path2 === "/v1/owner" || path2.startsWith("/v1/owner/") || path2 === "/v1/__webwix/identity" || path2 === "/v1/__webwix/login" || path2 === "/v1/__webwix/register" || path2 === "/v1/__webwix/logout" || path2 === MEMBER_CALLBACK_PATH;
+  return path2 === "/v1/__webwix/call" || path2 === "/v1/__webwix/stream" || path2 === "/v1/owner" || path2.startsWith("/v1/owner/") || path2 === "/v1/__webwix/identity" || path2 === "/v1/__webwix/login" || path2 === "/v1/__webwix/register" || path2 === "/v1/__webwix/logout" || path2 === MEMBER_CALLBACK_PATH;
 }
 function webwixCallLog(served, status) {
   const directRung = served.rung === "visitor" || served.rung === "owner";
@@ -142755,6 +142962,48 @@ ${releaseId}`;
         }
         return json4(200, { authenticated: false, userId: null, email: null, webwixDirect }, { "cache-control": "no-store" });
       }
+      if (request.method === "POST" && path2 === "/v1/__webwix/stream") {
+        if (opts.webwixBridge === false) return json4(503, { error: "webwix_bridge_disabled" }, { "cache-control": "no-store" });
+        const app2 = resolveApp(request, url);
+        const hostApp = memberApp(request);
+        if (!app2) return json4(400, { error: "app_required" }, { "cache-control": "no-store" });
+        if (!hostApp || app2 !== hostApp) return json4(403, { error: "webwix_stream_host_mismatch" }, { "cache-control": "no-store" });
+        const resolvedCfg = await appConfigFor(request, url, app2);
+        if (!resolvedCfg.ok) return resolvedCfg.response;
+        let call;
+        try {
+          call = await request.json();
+        } catch {
+          return json4(400, { error: "invalid_json" }, { "cache-control": "no-store" });
+        }
+        const method = String(call.method ?? "GET").toUpperCase();
+        if (method !== "GET" && method !== "POST") return json4(400, { error: "invalid_stream_method" }, { "cache-control": "no-store" });
+        const rawTarget = String(call.url ?? "");
+        const target = /^https:\/\//i.test(rawTarget) ? rawTarget : `https://www.wixapis.com${rawTarget.startsWith("/") ? rawTarget : `/${rawTarget}`}`;
+        if (!isAllowedConsumerStreamTarget(target)) return json4(400, { error: "invalid_stream_target" }, { "cache-control": "no-store" });
+        const cfg = wixMemberAuthOf(utf8Decode(resolvedCfg.bytes), callbackUrlFor(url));
+        if (!cfg.ok) return json4(501, { error: "webwix_visitor_direct_only", app: app2 }, { "cache-control": "no-store" });
+        const store2 = memberSessions();
+        const token = memberAuthOn() && store2 ? await memberTokenFor(store2, readSessionCookie(request.headers.get("cookie")), hostApp, cfg.config.clientId) : null;
+        if (!token) return json4(501, { error: "webwix_visitor_direct_only", app: app2 }, { "cache-control": "no-store" });
+        const headers2 = normalizeWixForwardedHeaders(call.headers);
+        headers2.Accept = "text/event-stream";
+        headers2.Authorization = token;
+        const body = call.body === void 0 ? void 0 : typeof call.body === "string" ? call.body : JSON.stringify(call.body);
+        if (body !== void 0) headers2["Content-Type"] ??= "application/json";
+        let upstream;
+        try {
+          upstream = await webwixFetch(target, { method, headers: headers2, body: method === "GET" ? void 0 : body, redirect: "manual", signal: request.signal });
+        } catch {
+          return json4(502, { error: "webwix_stream_upstream_failed" }, { "cache-control": "no-store" });
+        }
+        const responseHeaders = new Headers({ "cache-control": "no-store, no-transform" });
+        for (const name of ["content-type", "retry-after"]) {
+          const value = upstream.headers.get(name);
+          if (value) responseHeaders.set(name, value);
+        }
+        return new Response(upstream.body, { status: upstream.status, headers: responseHeaders });
+      }
       if (request.method === "POST" && path2 === "/v1/__webwix/call") {
         const served = { rung: "none" };
         let status = 500;
@@ -143678,7 +143927,7 @@ var init_run_handler = __esm({
 
 // ../../core/serve-runtime/src/node-adapter.ts
 import { createServer as createServer6 } from "node:http";
-async function toRequest(req) {
+async function toRequest(req, signal) {
   const method = (req.method ?? "GET").toUpperCase();
   const host = typeof req.headers.host === "string" && req.headers.host || "serve.local";
   const url = new URL(req.url ?? "/", `http://${host}`);
@@ -143694,7 +143943,7 @@ async function toRequest(req) {
     for await (const chunk of req) chunks.push(chunk);
     if (chunks.length) body = Buffer.concat(chunks);
   }
-  return new Request(url, { method, headers: headers2, body });
+  return new Request(url, { method, headers: headers2, body, signal });
 }
 async function writeResponse(res, response) {
   res.statusCode = response.status;
@@ -143702,10 +143951,15 @@ async function writeResponse(res, response) {
   if (response.body && /^text\/event-stream\b/i.test(response.headers.get("content-type") ?? "")) {
     res.flushHeaders();
     const reader = response.body.getReader();
-    res.on("close", () => {
-      void reader.cancel().catch(() => {
-      });
-    });
+    let clientDisconnected = false;
+    const onClose = () => {
+      if (!res.writableEnded) {
+        clientDisconnected = true;
+        void reader.cancel().catch(() => {
+        });
+      }
+    };
+    res.on("close", onClose);
     try {
       for (; ; ) {
         const { done, value } = await reader.read();
@@ -143713,7 +143967,10 @@ async function writeResponse(res, response) {
         res.write(value);
       }
     } catch {
+      if (!clientDisconnected && !res.destroyed) res.destroy();
+      return;
     }
+    res.off("close", onClose);
     res.end();
     return;
   }
@@ -143722,10 +143979,23 @@ async function writeResponse(res, response) {
 }
 function nodeAdapter(handler) {
   return createServer6(async (req, res) => {
+    const controller = new AbortController();
+    const abortForDisconnect = () => {
+      if (!res.writableEnded) controller.abort();
+    };
+    req.once("aborted", abortForDisconnect);
+    res.once("close", abortForDisconnect);
     try {
-      const response = await handler(await toRequest(req));
+      const request = await toRequest(req, controller.signal);
+      const response = await handler(request);
+      if (controller.signal.aborted || res.destroyed) {
+        await response.body?.cancel().catch(() => {
+        });
+        return;
+      }
       await writeResponse(res, response);
     } catch (err) {
+      if (controller.signal.aborted || res.destroyed) return;
       if (!res.headersSent) res.writeHead(500, { "content-type": "application/json; charset=utf-8" });
       res.end(JSON.stringify({ error: "internal", message: err.message }));
     }
@@ -143805,23 +144075,23 @@ var init_preview_assets_generated = __esm({
   "../../packages/serve/src/preview-assets.generated.ts"() {
     init_preview_assets_format();
     PREVIEW_ASSET_MANIFEST = [
-      { key: "assets/index-C_dUZJT0.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1194463, sha256: "6640d516f6b59bacd5f71dbcb264dbdc9aeef5502fb284d0680d91ae40ea141a" },
-      { key: "assets/pdf.worker.min-BmVo14Nb.mjs", contentType: "application/octet-stream", offset: 1194471, length: 1317034, sha256: "a33cfe728c584fdba4fcc1fd54bcdc2f9f2f13889ddbb5b2bd1d0f8cbe49b84e" },
-      { key: "assets/pdfDocument-sHOpLp0o.js", contentType: "application/javascript; charset=utf-8", offset: 2511505, length: 489166, sha256: "57445251df98761d808381a823b3f01c948f41faeae9e61d1bcd9ab8ef1eadc3" },
-      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 3000671, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
-      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 3005281, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
-      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 3493865, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
-      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 3584789, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
-      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 3675773, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
-      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 3766753, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
-      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 3857625, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
-      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 3948605, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
-      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 4057241, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
-      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 4166325, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
-      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 4275373, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
-      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 4383073, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
-      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 4471181, length: 4947, sha256: "cecdf774237e111e8306c71e372f32f6fdad1f8ac7c0d7736723bf79fea24503" },
-      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 4476128, length: 17344, sha256: "d057298d75e7373e5e2c4d11b7d1bcbea88e03af555ba63d97641c78509c58e4" }
+      { key: "assets/index-BASyrUOE.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1199331, sha256: "61bbacb882f499d8de973edf6cd283e953dad24fbe362d909e1d66b97aaea7af" },
+      { key: "assets/pdf.worker.min-BmVo14Nb.mjs", contentType: "application/octet-stream", offset: 1199339, length: 1317034, sha256: "a33cfe728c584fdba4fcc1fd54bcdc2f9f2f13889ddbb5b2bd1d0f8cbe49b84e" },
+      { key: "assets/pdfDocument-93Ito3np.js", contentType: "application/javascript; charset=utf-8", offset: 2516373, length: 489166, sha256: "1241febb4b04acb0b3b5341d29b16488d606d7a070e96b45872392309579817e" },
+      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 3005539, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
+      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 3010149, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
+      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 3498733, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
+      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 3589657, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
+      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 3680641, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
+      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 3771621, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
+      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 3862493, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
+      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 3953473, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
+      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 4062109, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
+      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 4171193, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
+      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 4280241, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
+      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 4387941, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
+      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 4476049, length: 4947, sha256: "14ea64c15439ccc29ea7030d38ef2212a342b8e443445a4e4e3179c0ee3e9c66" },
+      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 4480996, length: 17344, sha256: "d057298d75e7373e5e2c4d11b7d1bcbea88e03af555ba63d97641c78509c58e4" }
     ];
   }
 });