@wix/himalaya-cli 0.1251.0 → 0.1252.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/dev-server/src/wix-member-login.d.ts

@@ -15,6 +15,12 @@ export declare function webWixCall(method: string, path: string, body: string |
     status: number;
     body: string;
 }>;
+/** Open a Wix response without buffering it, for the authorized SSE bridge.
+ *  Credentials stay server-side and the host lock is identical to webWixCall. */
+export declare function webWixStream(method: string, path: string, body: string | undefined, token: string, cookie?: string, forwardedHeaders?: Record<string, string>, signal?: AbortSignal): Promise<Response>;
+/** Keep the credential-bearing stream bridge on the same narrow endpoint policy as native
+ *  Wix consumer auth. General member calls have broader Wix-host routing through webWixCall. */
+export { isAllowedConsumerStreamTarget } from "../../serve-runtime/src/wix-bridge.js";
 /** The signed-in member's Wix id, or null when the profile read fails (the identity route then
  *  falls back to the login email). The token belongs in `webWixCall`'s TOKEN slot: the identity
  *  route used to pass it third, where it became the GET's ignored body, so the read went out as

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/sdk/state/src/index.d.ts

@@ -38,6 +38,8 @@ export interface StreamDirective {
         url: string;
         headers?: Record<string, string>;
         body?: unknown;
+        /** Apply the host's Wix authorization to this request before opening the stream. */
+        authorize?: boolean;
     };
     /** Reducer action name dispatched once per parsed `data:` event. */
     onEvent: string;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/serve-runtime/src/wix-bridge.d.ts

@@ -0,0 +1,144 @@
+/** The narrow Wix consumer endpoints allowed to receive credentials for SSE. */
+export declare function isAllowedConsumerStreamTarget(raw: string): boolean;
+/** Classify an absolute-URL rejection: an off-gateway Wix account host is a
+ *  native-only endpoint (`owner-only`), anything else is an open-proxy attempt. */
+export declare function absoluteUrlRejection(path: string): "owner-only" | "open-proxy";
+/** The bridge envelope the web host's `wixCallOverBridge` expects on a 2xx. */
+export interface WixBridgeEnvelope {
+    status: number;
+    body: string;
+}
+/** One anonymous visitor token for `clientId`. #3123 Stage B: the proxy no longer serves visitor
+ *  calls (each browser mints its own, core/web-host/src/wix/directWixCall.ts), so nothing caches
+ *  one per pod any more — the one server-side use left is the member-login redirect, which needs a
+ *  visitor token to build Wix's hosted-login URL once per login. */
+export declare function mintAnonymousVisitor(clientId: string, fetchImpl?: typeof fetch): Promise<string>;
+/**
+ * Proxy one REST call to wixapis.com with the given token. `path` must be
+ * origin-relative — an absolute URL is the caller trying to use the bridge as an
+ * open proxy, which the read-only origin must never be (throws).
+ */
+export declare function wixVisitorCall(method: string, path: string, body: string | undefined, token: string, fetchImpl?: typeof fetch, forwardedHeaders?: Record<string, string>): Promise<WixBridgeEnvelope>;
+/**
+ * The caller-supplied headers a proxied call may carry to Wix (#3190): the Wix ASPECT headers
+ * (locale, currency, consistency, BI, brand, consent, revisions) and the per-call site selector
+ * `wix-site-id` — native sends it on every call and the dev-server's per-business net-mock rules key
+ * on it. (`ChatToken` is the one destination-bound exception: see `normalizeWixForwardedHeaders`.)
+ * An ALLOWLIST, lower-case: anything else is dropped — above all a second credential or an
+ * identity header (`x-wix-authorization`, `x-wix-clientid`, `x-xsrf-token`, `wix-account-id`,
+ * signed instances), which would otherwise ride along with the rung's own `Authorization` and leave
+ * which identity the call runs as to the gateway. Also hop-by-hop and framing headers.
+ *
+ * The aspect headers are exactly the ones the web host's browser-direct transports forward
+ * (`DIRECT_FORWARDABLE_HEADERS`, core/web-host/src/wix/directWixCall.ts — the gateway's CORS answer
+ * minus credentials); `BRIDGE_ONLY_FORWARDABLE_HEADERS` is the one addition, and
+ * core/web-host/tests/direct-wix-call.test.ts holds the lists together, so a call cannot behave
+ * differently depending on which path served it.
+ */
+export declare const WIX_FORWARDABLE_HEADERS: ReadonlySet<string>;
+/** What the bridge forwards beyond the browser-direct transports' aspect headers: the site selector
+ *  (direct owner calls pick their instance by it instead). */
+export declare const BRIDGE_ONLY_FORWARDABLE_HEADERS: ReadonlySet<string>;
+/** The headers of an untrusted web bridge envelope that may reach Wix (`WIX_FORWARDABLE_HEADERS`, plus
+ *  `ChatToken` when `path` is chat-web itself), in the caller's spelling. The bridge always owns
+ *  Authorization, cookies, Host and content framing. */
+export declare function normalizeWixForwardedHeaders(input: unknown, path?: string): Record<string, string>;
+/** Guard the msid before it is interpolated into the mint URL (uuid-ish only). */
+export declare function isSafeMsid(msid: string): boolean;
+/** A `renew` never re-mints an instance younger than this, whichever mint made it (another tab's
+ *  renewal, a first ask, the envelope's own 401 retry). An instance that new is the fresh one: a 401
+ *  on it is Wix's answer about the endpoint, not a stale credential, and re-minting would only buy
+ *  the same answer. It also means the route can't be driven to mint on every request. Once an entry
+ *  is dropped (`invalidate`, a failed mint) there is nothing to hand back, and a renewal mints once,
+ *  like any ask.
+ *  No longer than the web host's `OWNER_RENEW_COOLDOWN_MS` (core/web-host/src/wix/directWixCall.ts,
+ *  #3140): the host never sends `renew=1` sooner than that after its own re-mint, so each renewal it
+ *  makes is honoured. A longer window here would hand it back the instance Wix just refused.
+ *  core/serve/tests/owner-instance.test.ts pins the two together. */
+export declare const OWNER_RENEW_MIN_AGE_MS = 5000;
+type OwnerInstanceEntry = {
+    instance: string;
+    expiresAt: number;
+};
+export declare class OwnerInstanceCache {
+    private fetchImpl;
+    /** Signed instances are long-lived, but the SESSION behind them may not be —
+     *  keep the window short so a logout is honored quickly. */
+    private ttlMs;
+    private mintTimeoutMs;
+    /** A monotonic clock for how long a mint TOOK (injectable for tests). */
+    private elapsedClock;
+    private cache;
+    /** The one mint on its way per (business, session). Every caller, plain or renewing, joins it:
+     *  it started after whatever is cached was minted, so it is the fresh instance. */
+    private inflight;
+    constructor(fetchImpl?: typeof fetch, 
+    /** Signed instances are long-lived, but the SESSION behind them may not be —
+     *  keep the window short so a logout is honored quickly. */
+    ttlMs?: number, mintTimeoutMs?: number, 
+    /** A monotonic clock for how long a mint TOOK (injectable for tests). */
+    elapsedClock?: () => number);
+    /** Keyed on the SESSION (`wixSession2`), not the whole cookie header: manage.wix.com's jar churns
+     *  (analytics, experiments), and keying on all of it re-minted on nearly every call (#3044). A
+     *  header with no session cookie falls back to itself — callers refuse that case before here. */
+    private key;
+    instance(msid: string, cookieHeader: string, now?: number): Promise<string>;
+    /** The instance and the time this cache stops trusting it (#3044: the web host caches until then).
+     *  `renew`: Wix refused the instance this cache handed out (the route's `renew=1`, #3140) — mint a
+     *  new one, unless the cached one is younger than OWNER_RENEW_MIN_AGE_MS or a mint is already on
+     *  its way, in which case that IS the new one. */
+    entry(msid: string, cookieHeader: string, now?: number, opts?: {
+        renew?: boolean;
+    }): Promise<OwnerInstanceEntry>;
+    private mint;
+    /** Drop a cached instance so the next call re-mints. The envelope owner branch's own 401 retry;
+     *  the route's `renew=1` goes through `entry(…, { renew: true })` instead. */
+    invalidate(msid: string, cookieHeader: string): void;
+}
+export declare const OWNER_SITES_QUERY_PATH = "/site-list/v2/sites/query";
+export declare const OWNER_SITES_COUNT_PATH = "/site-list/v2/sites/count";
+/** True for the ONLY two paths the account-level owner-sites rung may reach. */
+export declare function isOwnerSitesPath(path: string): boolean;
+/**
+ * POST one site-list call to wixapis.com, authorized by the FORWARDED caller
+ * cookies (never an Authorization header, never stored). Host-locked AND
+ * path-locked: anything but the two owner-sites paths throws.
+ */
+export declare function wixOwnerSitesCall(path: string, cookieHeader: string, body: string | undefined, fetchImpl?: typeof fetch): Promise<WixBridgeEnvelope>;
+/** One trimmed row of `GET /v1/owner/sites` — `id` IS the site's metaSiteId. */
+export interface OwnerSiteRow {
+    id: string;
+    displayName: string;
+    namespace?: string;
+}
+/**
+ * RFC 0050 extension — the trimmed "my sites" listing per session, cached
+ * briefly. The cache key is a DIGEST of the cookie header (never the cookies
+ * themselves — same posture as OwnerInstanceCache); the limit rides the digest
+ * so differently-sized listings don't cross-serve. TTL mirrors OwnerInstanceCache
+ * (and wix-cache-policy's ttl:300 for this API): sites are stable, but the
+ * SESSION behind the listing may not be — keep the window short so a logout
+ * stops listing quickly.
+ */
+export declare class OwnerSitesCache {
+    private fetchImpl;
+    private ttlMs;
+    private cache;
+    constructor(fetchImpl?: typeof fetch, ttlMs?: number);
+    private key;
+    sites(cookieHeader: string, limit: number, now?: number): Promise<OwnerSiteRow[]>;
+    /** Drop a cached listing (e.g. after an upstream 401) so the next call re-fetches. */
+    invalidate(cookieHeader: string, limit: number): void;
+}
+/**
+ * Resolve the Wix OAuth clientId for a published app-config, or a typed refusal.
+ * Only `wix-*` auth providers carry a REAL Wix clientId — a generic-oauth app's
+ * clientId is some other issuer's, and minting against it would just burn a
+ * round-trip to wixapis for a guaranteed failure.
+ */
+export declare function wixClientIdOf(appConfigJson: string): {
+    clientId: string;
+} | {
+    error: "unsupported_auth" | "no_client_id";
+};
+export {};

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/serve-storage/src/sha256.d.ts

@@ -0,0 +1,13 @@
+/** SHA-256 of `input`, as 32 bytes. Identical to `createHash("sha256").update(input).digest()`. */
+export declare function sha256(input: string | Uint8Array): Uint8Array;
+/** Lowercase hex of `sha256(input)` — what `createHash("sha256").digest("hex")` produces. */
+export declare function sha256Hex(input: string | Uint8Array): string;
+/**
+ * The same hex digest as `sha256Hex`, via the platform's native implementation.
+ *
+ * Identical output — `sha256-parity.test.ts` proves the two agree with each other and with node —
+ * but ~40x faster, because it is not JavaScript. Use it wherever the caller is already async AND
+ * the input can be large: a package archive, an asset. It is not a drop-in for the sync one, which
+ * is what lets `strongEtag` stay a plain function.
+ */
+export declare function sha256HexAsync(input: string | Uint8Array): Promise<string>;

package/dist/cli.mjs

@@ -6911,7 +6911,6 @@ function resolveTranslation(value, catalog, sourceCatalog) {
 var BINDING_SIGILS, BINDING_SIGIL_RE, TRANSLATION_PREFIX, TRANSLATION_KEY_RE;
 var init_bindings = __esm({
   "../../core/ts/src/bindings.ts"() {
-    "use strict";
     BINDING_SIGILS = ["service", "flag", "item", "t"];
     BINDING_SIGIL_RE = new RegExp(
       `^\\$(?:${BINDING_SIGILS.filter((s2) => s2 !== "t").join("|")})\\b|^\\$t:`
@@ -13465,6 +13464,7 @@ function resolveIdiom(tokens2, ctx = {}) {
 var IDIOM_CONTEXTS, UNSAFE_KEYS;
 var init_idiom = __esm({
   "../../core/ts/src/idiom.ts"() {
+    "use strict";
     IDIOM_CONTEXTS = {
       ios: { native: ["ios"] },
       android: { native: ["material"] },
@@ -28920,6 +28920,269 @@ var init_derive_transport_capability = __esm({
   }
 });
 
+// ../../core/serve-runtime/src/wix-bridge.ts
+function isAllowedConsumerStreamTarget(raw) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "https:" || url.port !== "" && url.port !== "443" || url.username || url.password) return false;
+  if (url.hostname.toLowerCase() === "www.wixapis.com") return true;
+  return url.hostname.toLowerCase() === "apps.wix.com" && url.pathname === "/_api/nano-brain/v1/llm-sdk/generate-text";
+}
+function absoluteUrlRejection(path2) {
+  let host = "";
+  try {
+    host = new URL(path2).host;
+  } catch {
+  }
+  return OWNER_SCOPED_WIX_HOST.test(host) ? "owner-only" : "open-proxy";
+}
+async function mintAnonymousVisitor(clientId, fetchImpl = fetch) {
+  const res = await fetchImpl(`${WIX_API}/oauth2/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ clientId, grantType: "anonymous" })
+  });
+  const text8 = await res.text();
+  let j2 = {};
+  try {
+    j2 = text8 ? JSON.parse(text8) : {};
+  } catch {
+  }
+  if (res.status !== 200 || !j2.access_token) throw new Error(`visitor mint failed (${res.status})`);
+  return j2.access_token;
+}
+async function wixVisitorCall(method, path2, body, token, fetchImpl = fetch, forwardedHeaders = {}) {
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(path2)) throw new Error("absolute URLs are not allowed");
+  const url = `${WIX_API}${path2.startsWith("/") ? path2 : `/${path2}`}`;
+  const res = await fetchImpl(url, {
+    method,
+    // Same header shape the dev-server bridge has always sent (wixapis accepts the
+    // raw access token as the Authorization value).
+    headers: { ...forwardedHeaders, Authorization: token, ...body ? { "Content-Type": "application/json" } : {} },
+    body: method === "GET" || method === "HEAD" ? void 0 : body
+  });
+  return { status: res.status, body: await res.text() };
+}
+function isChatWebTarget(path2) {
+  if (!path2 || !/^https:\/\//i.test(path2)) return false;
+  try {
+    const url = new URL(path2);
+    return url.host === "manage.wix.com" && url.pathname.startsWith("/_api/chat-web/");
+  } catch {
+    return false;
+  }
+}
+function normalizeWixForwardedHeaders(input, path2) {
+  const chatWeb = isChatWebTarget(path2);
+  let value = input;
+  if (typeof value === "string") {
+    try {
+      value = JSON.parse(value);
+    } catch {
+      return {};
+    }
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const out2 = {};
+  for (const [name, headerValue] of Object.entries(value)) {
+    const lower = name.toLowerCase();
+    const allowed2 = WIX_FORWARDABLE_HEADERS.has(lower) || chatWeb && lower === "chattoken";
+    if (!/^[a-z0-9-]+$/i.test(name) || !allowed2 || typeof headerValue !== "string") continue;
+    if (/[\r\n\0]/.test(headerValue)) continue;
+    out2[name] = headerValue;
+  }
+  return out2;
+}
+function isSafeMsid(msid) {
+  return /^[0-9a-fA-F-]{10,64}$/.test(msid);
+}
+function isOwnerSitesPath(path2) {
+  return path2 === OWNER_SITES_QUERY_PATH || path2 === OWNER_SITES_COUNT_PATH;
+}
+async function wixOwnerSitesCall(path2, cookieHeader, body, fetchImpl = fetch) {
+  if (!isOwnerSitesPath(path2)) throw new Error("not an owner-sites path");
+  const xsrf = /(?:^|;\s*)XSRF-TOKEN=([^;]+)/.exec(cookieHeader)?.[1];
+  const res = await fetchImpl(`${WIX_API}${path2}`, {
+    method: "POST",
+    headers: {
+      Cookie: cookieHeader,
+      "Content-Type": "application/json",
+      Accept: "application/json",
+      ...xsrf ? { "x-xsrf-token": xsrf } : {}
+    },
+    body: body ?? "{}"
+  });
+  return { status: res.status, body: await res.text() };
+}
+function wixClientIdOf(appConfigJson) {
+  let cfg;
+  try {
+    cfg = JSON.parse(appConfigJson);
+  } catch {
+    return { error: "no_client_id" };
+  }
+  const providerId = cfg.authConfig?.providerId ?? "";
+  if (!providerId.startsWith("wix")) return { error: "unsupported_auth" };
+  const clientId = cfg.authConfig?.config?.clientId;
+  if (typeof clientId !== "string" || !clientId) return { error: "no_client_id" };
+  return { clientId };
+}
+var WIX_API, ONE_APP_SESSION, OWNER_SCOPED_WIX_HOST, WIX_FORWARDABLE_HEADERS, OWNER_REFRESH_MARGIN_MS, OWNER_RENEW_MIN_AGE_MS, OWNER_MINT_TIMEOUT_MS, OwnerInstanceCache, OWNER_SITES_QUERY_PATH, OWNER_SITES_COUNT_PATH, OwnerSitesCache;
+var init_wix_bridge = __esm({
+  "../../core/serve-runtime/src/wix-bridge.ts"() {
+    init_sha256();
+    WIX_API = "https://www.wixapis.com";
+    ONE_APP_SESSION = "https://apps.wix.com/_api/one-app-session-web/v3/businesses";
+    OWNER_SCOPED_WIX_HOST = /(^|\.)wix\.com$/i;
+    WIX_FORWARDABLE_HEADERS = /* @__PURE__ */ new Set([
+      "x-wix-language",
+      "x-wix-linguist",
+      "wixlanguage",
+      "accept-language",
+      "x-wix-currency",
+      "x-wix-consistent",
+      "x-wix-client-api-revision",
+      "x-wix-site-revision",
+      "x-wix-bi-gateway",
+      "x-wix-brand",
+      "consent-policy",
+      "commonconfig",
+      "x-wix-client-artifact-id",
+      "wix-site-id"
+    ]);
+    OWNER_REFRESH_MARGIN_MS = 6e4;
+    OWNER_RENEW_MIN_AGE_MS = 5e3;
+    OWNER_MINT_TIMEOUT_MS = 8e3;
+    OwnerInstanceCache = class {
+      constructor(fetchImpl = fetch, ttlMs = 5 * 6e4, mintTimeoutMs = OWNER_MINT_TIMEOUT_MS, elapsedClock = () => performance.now()) {
+        this.fetchImpl = fetchImpl;
+        this.ttlMs = ttlMs;
+        this.mintTimeoutMs = mintTimeoutMs;
+        this.elapsedClock = elapsedClock;
+      }
+      cache = /* @__PURE__ */ new Map();
+      /** The one mint on its way per (business, session). Every caller, plain or renewing, joins it:
+       *  it started after whatever is cached was minted, so it is the fresh instance. */
+      inflight = /* @__PURE__ */ new Map();
+      /** Keyed on the SESSION (`wixSession2`), not the whole cookie header: manage.wix.com's jar churns
+       *  (analytics, experiments), and keying on all of it re-minted on nearly every call (#3044). A
+       *  header with no session cookie falls back to itself — callers refuse that case before here. */
+      key(msid, cookieHeader) {
+        const session = /(?:^|;\s*)wixSession2=([^;]*)/.exec(cookieHeader)?.[1] ?? cookieHeader;
+        return sha256Hex(`${msid}
+${session}`);
+      }
+      async instance(msid, cookieHeader, now = Date.now()) {
+        return (await this.entry(msid, cookieHeader, now)).instance;
+      }
+      /** The instance and the time this cache stops trusting it (#3044: the web host caches until then).
+       *  `renew`: Wix refused the instance this cache handed out (the route's `renew=1`, #3140) — mint a
+       *  new one, unless the cached one is younger than OWNER_RENEW_MIN_AGE_MS or a mint is already on
+       *  its way, in which case that IS the new one. */
+      async entry(msid, cookieHeader, now = Date.now(), opts = {}) {
+        const key2 = this.key(msid, cookieHeader);
+        const pending = this.inflight.get(key2);
+        if (pending) return { ...await pending };
+        let hit = this.cache.get(key2);
+        if (opts.renew && hit && now - hit.mintedAt >= OWNER_RENEW_MIN_AGE_MS) hit = void 0;
+        if (hit && hit.expiresAt - OWNER_REFRESH_MARGIN_MS > now) return { instance: hit.instance, expiresAt: hit.expiresAt };
+        const mint = this.mint(key2, msid, cookieHeader, now).finally(() => this.inflight.delete(key2));
+        this.inflight.set(key2, mint);
+        return { ...await mint };
+      }
+      async mint(key2, msid, cookieHeader, now) {
+        const startedAt = this.elapsedClock();
+        const abort = new AbortController();
+        let timer;
+        const timedOut = new Promise((_2, reject) => {
+          timer = setTimeout(() => {
+            abort.abort();
+            reject(new Error(`owner mint timed out after ${this.mintTimeoutMs}ms`));
+          }, this.mintTimeoutMs);
+        });
+        try {
+          const res = await Promise.race([
+            this.fetchImpl(`${ONE_APP_SESSION}/${msid}/signed-instance?signed_instance_type=User`, {
+              method: "GET",
+              headers: { Cookie: cookieHeader },
+              signal: abort.signal
+            }),
+            timedOut
+          ]);
+          const text8 = await Promise.race([res.text(), timedOut]);
+          let j2 = {};
+          try {
+            j2 = text8 ? JSON.parse(text8) : {};
+          } catch {
+          }
+          if (res.status < 200 || res.status >= 300 || !j2.signedInstance)
+            throw new Error(`owner mint failed (${res.status})`);
+          const elapsed = Math.max(0, this.elapsedClock() - startedAt);
+          const mintedAt = now + elapsed;
+          const entry = { instance: j2.signedInstance, expiresAt: now + Math.floor(elapsed / 1e3) * 1e3 + this.ttlMs };
+          this.cache.set(key2, { ...entry, mintedAt });
+          return entry;
+        } catch (e2) {
+          this.cache.delete(key2);
+          throw e2;
+        } finally {
+          clearTimeout(timer);
+        }
+      }
+      /** Drop a cached instance so the next call re-mints. The envelope owner branch's own 401 retry;
+       *  the route's `renew=1` goes through `entry(…, { renew: true })` instead. */
+      invalidate(msid, cookieHeader) {
+        this.cache.delete(this.key(msid, cookieHeader));
+      }
+    };
+    OWNER_SITES_QUERY_PATH = "/site-list/v2/sites/query";
+    OWNER_SITES_COUNT_PATH = "/site-list/v2/sites/count";
+    OwnerSitesCache = class {
+      constructor(fetchImpl = fetch, ttlMs = 5 * 6e4) {
+        this.fetchImpl = fetchImpl;
+        this.ttlMs = ttlMs;
+      }
+      cache = /* @__PURE__ */ new Map();
+      key(cookieHeader, limit) {
+        return sha256Hex(`${limit}
+${cookieHeader}`);
+      }
+      async sites(cookieHeader, limit, now = Date.now()) {
+        const key2 = this.key(cookieHeader, limit);
+        const hit = this.cache.get(key2);
+        if (hit && hit.expiresAt > now) return hit.sites;
+        const env = await wixOwnerSitesCall(
+          OWNER_SITES_QUERY_PATH,
+          cookieHeader,
+          JSON.stringify({ query: { cursorPaging: { limit } } }),
+          this.fetchImpl
+        );
+        if (env.status < 200 || env.status >= 300) throw new Error(`owner sites failed (${env.status})`);
+        let parsed = {};
+        try {
+          parsed = env.body ? JSON.parse(env.body) : {};
+        } catch {
+        }
+        const sites = (Array.isArray(parsed.sites) ? parsed.sites : []).filter((s2) => typeof s2?.id === "string" && !!s2.id).map((s2) => ({
+          id: s2.id,
+          displayName: typeof s2.displayName === "string" && s2.displayName ? s2.displayName : typeof s2.name === "string" && s2.name ? s2.name : s2.id,
+          ...typeof s2.namespace === "string" && s2.namespace ? { namespace: s2.namespace } : {}
+        }));
+        this.cache.set(key2, { sites, expiresAt: now + this.ttlMs });
+        return sites;
+      }
+      /** Drop a cached listing (e.g. after an upstream 401) so the next call re-fetches. */
+      invalidate(cookieHeader, limit) {
+        this.cache.delete(this.key(cookieHeader, limit));
+      }
+    };
+  }
+});
+
 // ../../core/dev-server/src/wix-hosts.ts
 function targetHost(raw) {
   try {
@@ -28950,11 +29213,13 @@ var init_wix_hosts = __esm({
 // ../../core/dev-server/src/wix-member-login.ts
 var wix_member_login_exports = {};
 __export(wix_member_login_exports, {
+  isAllowedConsumerStreamTarget: () => isAllowedConsumerStreamTarget,
   memberDirectLogin: () => memberDirectLogin,
   memberDirectRegister: () => memberDirectRegister,
   mintVisitor: () => mintVisitor,
   readMemberId: () => readMemberId,
-  webWixCall: () => webWixCall
+  webWixCall: () => webWixCall,
+  webWixStream: () => webWixStream
 });
 import { createHash as createHash12, randomBytes as randomBytes3 } from "node:crypto";
 function b64url(buf) {
@@ -29087,6 +29352,25 @@ async function webWixCall(method, path2, body, token, cookie, forwardedHeaders =
   });
   return { status: res.status, body: await res.text() };
 }
+async function webWixStream(method, path2, body, token, cookie, forwardedHeaders = {}, signal) {
+  const url = /^https?:\/\//i.test(path2) ? path2 : `${API}${path2.startsWith("/") ? path2 : "/" + path2}`;
+  if (!isAllowedConsumerStreamTarget(url)) {
+    throw new Error(`refusing to send Wix credentials to an unapproved consumer endpoint (${targetHost(url) || "no host"})`);
+  }
+  return fetch(url, {
+    method,
+    headers: {
+      ...forwardedHeaders,
+      Accept: "text/event-stream",
+      Authorization: token,
+      ...cookie ? { Cookie: cookie } : {},
+      ...body ? { "Content-Type": "application/json" } : {}
+    },
+    body: method === "GET" || method === "HEAD" ? void 0 : body,
+    redirect: "manual",
+    signal
+  });
+}
 async function readMemberId(memberToken) {
   try {
     const identity = await webWixCall("GET", "/members/v1/members/my", void 0, memberToken);
@@ -29100,7 +29384,9 @@ async function readMemberId(memberToken) {
 var API;
 var init_wix_member_login = __esm({
   "../../core/dev-server/src/wix-member-login.ts"() {
+    init_wix_bridge();
     init_wix_hosts();
+    init_wix_bridge();
     API = "https://www.wixapis.com";
   }
 });
@@ -29569,258 +29855,6 @@ var init_wix_gateway = __esm({
   }
 });
 
-// ../../core/serve-runtime/src/wix-bridge.ts
-function absoluteUrlRejection(path2) {
-  let host = "";
-  try {
-    host = new URL(path2).host;
-  } catch {
-  }
-  return OWNER_SCOPED_WIX_HOST.test(host) ? "owner-only" : "open-proxy";
-}
-async function mintAnonymousVisitor(clientId, fetchImpl = fetch) {
-  const res = await fetchImpl(`${WIX_API}/oauth2/token`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ clientId, grantType: "anonymous" })
-  });
-  const text8 = await res.text();
-  let j2 = {};
-  try {
-    j2 = text8 ? JSON.parse(text8) : {};
-  } catch {
-  }
-  if (res.status !== 200 || !j2.access_token) throw new Error(`visitor mint failed (${res.status})`);
-  return j2.access_token;
-}
-async function wixVisitorCall(method, path2, body, token, fetchImpl = fetch, forwardedHeaders = {}) {
-  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(path2)) throw new Error("absolute URLs are not allowed");
-  const url = `${WIX_API}${path2.startsWith("/") ? path2 : `/${path2}`}`;
-  const res = await fetchImpl(url, {
-    method,
-    // Same header shape the dev-server bridge has always sent (wixapis accepts the
-    // raw access token as the Authorization value).
-    headers: { ...forwardedHeaders, Authorization: token, ...body ? { "Content-Type": "application/json" } : {} },
-    body: method === "GET" || method === "HEAD" ? void 0 : body
-  });
-  return { status: res.status, body: await res.text() };
-}
-function isChatWebTarget(path2) {
-  if (!path2 || !/^https:\/\//i.test(path2)) return false;
-  try {
-    const url = new URL(path2);
-    return url.host === "manage.wix.com" && url.pathname.startsWith("/_api/chat-web/");
-  } catch {
-    return false;
-  }
-}
-function normalizeWixForwardedHeaders(input, path2) {
-  const chatWeb = isChatWebTarget(path2);
-  let value = input;
-  if (typeof value === "string") {
-    try {
-      value = JSON.parse(value);
-    } catch {
-      return {};
-    }
-  }
-  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
-  const out2 = {};
-  for (const [name, headerValue] of Object.entries(value)) {
-    const lower = name.toLowerCase();
-    const allowed2 = WIX_FORWARDABLE_HEADERS.has(lower) || chatWeb && lower === "chattoken";
-    if (!/^[a-z0-9-]+$/i.test(name) || !allowed2 || typeof headerValue !== "string") continue;
-    if (/[\r\n\0]/.test(headerValue)) continue;
-    out2[name] = headerValue;
-  }
-  return out2;
-}
-function isSafeMsid(msid) {
-  return /^[0-9a-fA-F-]{10,64}$/.test(msid);
-}
-function isOwnerSitesPath(path2) {
-  return path2 === OWNER_SITES_QUERY_PATH || path2 === OWNER_SITES_COUNT_PATH;
-}
-async function wixOwnerSitesCall(path2, cookieHeader, body, fetchImpl = fetch) {
-  if (!isOwnerSitesPath(path2)) throw new Error("not an owner-sites path");
-  const xsrf = /(?:^|;\s*)XSRF-TOKEN=([^;]+)/.exec(cookieHeader)?.[1];
-  const res = await fetchImpl(`${WIX_API}${path2}`, {
-    method: "POST",
-    headers: {
-      Cookie: cookieHeader,
-      "Content-Type": "application/json",
-      Accept: "application/json",
-      ...xsrf ? { "x-xsrf-token": xsrf } : {}
-    },
-    body: body ?? "{}"
-  });
-  return { status: res.status, body: await res.text() };
-}
-function wixClientIdOf(appConfigJson) {
-  let cfg;
-  try {
-    cfg = JSON.parse(appConfigJson);
-  } catch {
-    return { error: "no_client_id" };
-  }
-  const providerId = cfg.authConfig?.providerId ?? "";
-  if (!providerId.startsWith("wix")) return { error: "unsupported_auth" };
-  const clientId = cfg.authConfig?.config?.clientId;
-  if (typeof clientId !== "string" || !clientId) return { error: "no_client_id" };
-  return { clientId };
-}
-var WIX_API, ONE_APP_SESSION, OWNER_SCOPED_WIX_HOST, WIX_FORWARDABLE_HEADERS, OWNER_REFRESH_MARGIN_MS, OWNER_RENEW_MIN_AGE_MS, OWNER_MINT_TIMEOUT_MS, OwnerInstanceCache, OWNER_SITES_QUERY_PATH, OWNER_SITES_COUNT_PATH, OwnerSitesCache;
-var init_wix_bridge = __esm({
-  "../../core/serve-runtime/src/wix-bridge.ts"() {
-    init_sha256();
-    WIX_API = "https://www.wixapis.com";
-    ONE_APP_SESSION = "https://apps.wix.com/_api/one-app-session-web/v3/businesses";
-    OWNER_SCOPED_WIX_HOST = /(^|\.)wix\.com$/i;
-    WIX_FORWARDABLE_HEADERS = /* @__PURE__ */ new Set([
-      "x-wix-language",
-      "x-wix-linguist",
-      "wixlanguage",
-      "accept-language",
-      "x-wix-currency",
-      "x-wix-consistent",
-      "x-wix-client-api-revision",
-      "x-wix-site-revision",
-      "x-wix-bi-gateway",
-      "x-wix-brand",
-      "consent-policy",
-      "commonconfig",
-      "x-wix-client-artifact-id",
-      "wix-site-id"
-    ]);
-    OWNER_REFRESH_MARGIN_MS = 6e4;
-    OWNER_RENEW_MIN_AGE_MS = 5e3;
-    OWNER_MINT_TIMEOUT_MS = 8e3;
-    OwnerInstanceCache = class {
-      constructor(fetchImpl = fetch, ttlMs = 5 * 6e4, mintTimeoutMs = OWNER_MINT_TIMEOUT_MS, elapsedClock = () => performance.now()) {
-        this.fetchImpl = fetchImpl;
-        this.ttlMs = ttlMs;
-        this.mintTimeoutMs = mintTimeoutMs;
-        this.elapsedClock = elapsedClock;
-      }
-      cache = /* @__PURE__ */ new Map();
-      /** The one mint on its way per (business, session). Every caller, plain or renewing, joins it:
-       *  it started after whatever is cached was minted, so it is the fresh instance. */
-      inflight = /* @__PURE__ */ new Map();
-      /** Keyed on the SESSION (`wixSession2`), not the whole cookie header: manage.wix.com's jar churns
-       *  (analytics, experiments), and keying on all of it re-minted on nearly every call (#3044). A
-       *  header with no session cookie falls back to itself — callers refuse that case before here. */
-      key(msid, cookieHeader) {
-        const session = /(?:^|;\s*)wixSession2=([^;]*)/.exec(cookieHeader)?.[1] ?? cookieHeader;
-        return sha256Hex(`${msid}
-${session}`);
-      }
-      async instance(msid, cookieHeader, now = Date.now()) {
-        return (await this.entry(msid, cookieHeader, now)).instance;
-      }
-      /** The instance and the time this cache stops trusting it (#3044: the web host caches until then).
-       *  `renew`: Wix refused the instance this cache handed out (the route's `renew=1`, #3140) — mint a
-       *  new one, unless the cached one is younger than OWNER_RENEW_MIN_AGE_MS or a mint is already on
-       *  its way, in which case that IS the new one. */
-      async entry(msid, cookieHeader, now = Date.now(), opts = {}) {
-        const key2 = this.key(msid, cookieHeader);
-        const pending = this.inflight.get(key2);
-        if (pending) return { ...await pending };
-        let hit = this.cache.get(key2);
-        if (opts.renew && hit && now - hit.mintedAt >= OWNER_RENEW_MIN_AGE_MS) hit = void 0;
-        if (hit && hit.expiresAt - OWNER_REFRESH_MARGIN_MS > now) return { instance: hit.instance, expiresAt: hit.expiresAt };
-        const mint = this.mint(key2, msid, cookieHeader, now).finally(() => this.inflight.delete(key2));
-        this.inflight.set(key2, mint);
-        return { ...await mint };
-      }
-      async mint(key2, msid, cookieHeader, now) {
-        const startedAt = this.elapsedClock();
-        const abort = new AbortController();
-        let timer;
-        const timedOut = new Promise((_2, reject) => {
-          timer = setTimeout(() => {
-            abort.abort();
-            reject(new Error(`owner mint timed out after ${this.mintTimeoutMs}ms`));
-          }, this.mintTimeoutMs);
-        });
-        try {
-          const res = await Promise.race([
-            this.fetchImpl(`${ONE_APP_SESSION}/${msid}/signed-instance?signed_instance_type=User`, {
-              method: "GET",
-              headers: { Cookie: cookieHeader },
-              signal: abort.signal
-            }),
-            timedOut
-          ]);
-          const text8 = await Promise.race([res.text(), timedOut]);
-          let j2 = {};
-          try {
-            j2 = text8 ? JSON.parse(text8) : {};
-          } catch {
-          }
-          if (res.status < 200 || res.status >= 300 || !j2.signedInstance)
-            throw new Error(`owner mint failed (${res.status})`);
-          const elapsed = Math.max(0, this.elapsedClock() - startedAt);
-          const mintedAt = now + elapsed;
-          const entry = { instance: j2.signedInstance, expiresAt: now + Math.floor(elapsed / 1e3) * 1e3 + this.ttlMs };
-          this.cache.set(key2, { ...entry, mintedAt });
-          return entry;
-        } catch (e2) {
-          this.cache.delete(key2);
-          throw e2;
-        } finally {
-          clearTimeout(timer);
-        }
-      }
-      /** Drop a cached instance so the next call re-mints. The envelope owner branch's own 401 retry;
-       *  the route's `renew=1` goes through `entry(…, { renew: true })` instead. */
-      invalidate(msid, cookieHeader) {
-        this.cache.delete(this.key(msid, cookieHeader));
-      }
-    };
-    OWNER_SITES_QUERY_PATH = "/site-list/v2/sites/query";
-    OWNER_SITES_COUNT_PATH = "/site-list/v2/sites/count";
-    OwnerSitesCache = class {
-      constructor(fetchImpl = fetch, ttlMs = 5 * 6e4) {
-        this.fetchImpl = fetchImpl;
-        this.ttlMs = ttlMs;
-      }
-      cache = /* @__PURE__ */ new Map();
-      key(cookieHeader, limit) {
-        return sha256Hex(`${limit}
-${cookieHeader}`);
-      }
-      async sites(cookieHeader, limit, now = Date.now()) {
-        const key2 = this.key(cookieHeader, limit);
-        const hit = this.cache.get(key2);
-        if (hit && hit.expiresAt > now) return hit.sites;
-        const env = await wixOwnerSitesCall(
-          OWNER_SITES_QUERY_PATH,
-          cookieHeader,
-          JSON.stringify({ query: { cursorPaging: { limit } } }),
-          this.fetchImpl
-        );
-        if (env.status < 200 || env.status >= 300) throw new Error(`owner sites failed (${env.status})`);
-        let parsed = {};
-        try {
-          parsed = env.body ? JSON.parse(env.body) : {};
-        } catch {
-        }
-        const sites = (Array.isArray(parsed.sites) ? parsed.sites : []).filter((s2) => typeof s2?.id === "string" && !!s2.id).map((s2) => ({
-          id: s2.id,
-          displayName: typeof s2.displayName === "string" && s2.displayName ? s2.displayName : typeof s2.name === "string" && s2.name ? s2.name : s2.id,
-          ...typeof s2.namespace === "string" && s2.namespace ? { namespace: s2.namespace } : {}
-        }));
-        this.cache.set(key2, { sites, expiresAt: now + this.ttlMs });
-        return sites;
-      }
-      /** Drop a cached listing (e.g. after an upstream 401) so the next call re-fetches. */
-      invalidate(cookieHeader, limit) {
-        this.cache.delete(this.key(cookieHeader, limit));
-      }
-    };
-  }
-});
-
 // ../../core/serve-runtime/src/flag-assignments.ts
 function bad(error) {
   return new Response(JSON.stringify({ error }), { status: 400, headers: { "content-type": JSON_CT, "cache-control": "no-store" } });
@@ -32482,6 +32516,8 @@ function createRicosHostSession(o2) {
   let seq = 0;
   const newId = o2.newId ?? (() => `rq${Date.now().toString(36)}${++seq}`);
   const state = { ready: false, unavailable: null, dirty: false, toolbar: EMPTY_TOOLBAR, focused: false };
+  let locale = o2.locale;
+  let rtl = o2.rtl;
   let seed2 = "";
   let committed = o2.seedMode === "none";
   let initSent = false, awaitingBaseline = false, disposed = false;
@@ -32513,8 +32549,8 @@ function createRicosHostSession(o2) {
       type: "init",
       contentJson: seed2,
       ...o2.placeholder ? { placeholder: o2.placeholder } : {},
-      ...o2.locale ? { locale: o2.locale } : {},
-      ...o2.rtl !== void 0 ? { rtl: o2.rtl } : {},
+      ...locale ? { locale } : {},
+      ...rtl !== void 0 ? { rtl } : {},
       ...o2.palette ? { palette: o2.palette } : {}
     });
   };
@@ -32607,6 +32643,13 @@ function createRicosHostSession(o2) {
         else sendInit();
       }
     },
+    updateLocale(nextLocale, nextRtl) {
+      if (locale === nextLocale && rtl === nextRtl) return;
+      locale = nextLocale;
+      rtl = nextRtl;
+      if (!initSent || state.unavailable || disposed) return;
+      o2.send({ v: 1, type: "updateLocale", locale: nextLocale ?? "en", rtl: nextRtl ?? false });
+    },
     currentContent() {
       return !state.unavailable && !disposed && writes() ? lastContent : null;
     },
@@ -32983,6 +33026,9 @@ function RichContentEditorView({ props, ctx, wrap, nodeId, renderChild, ...dom }
       sessionRef.current = null;
     };
   }, [live3, src]);
+  React3.useEffect(() => {
+    sessionRef.current?.updateLocale(ctx.localeTag ?? "en", ctx.isRTL ?? document.documentElement.dir === "rtl");
+  }, [ctx.localeTag, ctx.isRTL]);
   React3.useEffect(() => {
     sessionRef.current?.setSeed(seedMode === "literal" ? props.documentJson : seedMode === "binding" ? boundSeed : "");
   }, [seedMode, props.documentJson, boundSeed, src]);
@@ -125503,6 +125549,155 @@ async function handleWebWix(req, res, state) {
     res.setHeader("access-control-allow-origin", "*");
     res.end(JSON.stringify(obj3));
   };
+  if (path2 === "/v1/__webwix/stream" && req.method === "POST") {
+    const b2 = await readJson8();
+    const method = String(b2.method ?? "GET").toUpperCase();
+    const requestedUrl = String(b2.url ?? "");
+    const body = b2.body === void 0 ? void 0 : typeof b2.body === "string" ? b2.body : JSON.stringify(b2.body);
+    const forwardedHeaders = normalizeWixForwardedHeaders(b2.headers, requestedUrl);
+    const target = (() => {
+      try {
+        return new URL(requestedUrl, "https://www.wixapis.com");
+      } catch {
+        return void 0;
+      }
+    })();
+    const started = Date.now();
+    const recordStream = (source, status, mockRuleId, headers2) => {
+      const redactBodies = source === "proxy" || mockRuleId === UNMATCHED_FAIL_CLOSED_ID;
+      recordWixTraffic(state.wix, state.appName, state.adminUrl, {
+        ts: started,
+        source,
+        capability: "wix_api.web",
+        host: target?.host ?? "unknown",
+        method,
+        // Traffic is retained and broadcast to the devtools/admin log. Keep only
+        // the origin and path: rejected URLs may contain userinfo, and valid Wix
+        // endpoints can carry credential-like query parameters.
+        url: target ? `${target.origin}${target.pathname}` : "[unparseable URL]",
+        path: target?.pathname ?? "[unparseable URL]",
+        status,
+        durationMs: Date.now() - started,
+        reqBody: redactBodies ? void 0 : body,
+        respHeaders: redactBodies ? void 0 : headers2,
+        mockRuleId
+      });
+    };
+    if (!target || !isAllowedConsumerStreamTarget(target.toString()) || !["GET", "POST"].includes(method)) {
+      recordStream("proxy", 400);
+      res.statusCode = 400;
+      res.setHeader("content-type", "application/json; charset=utf-8");
+      res.end(JSON.stringify({ error: "webwix_stream_bad_request" }));
+      return;
+    }
+    if (state.wix.mode === "mock") {
+      const matchCtx = { host: target.host, query: Object.fromEntries(target.searchParams.entries()), headers: forwardedHeaders, body };
+      let match = matchRuleEx(state.wix.rules, method, target.pathname, matchCtx);
+      if (match && (match.rule.kind ?? "mock") !== "mock") {
+        console.error(`[himalaya-dev] net-mocks: rule "${match.rule.id}" is kind:"${match.rule.kind}", which the web bridge cannot apply \u2014 ignoring it for ${method} ${target.pathname}`);
+        match = matchRuleEx(state.wix.rules.filter((r2) => (r2.kind ?? "mock") === "mock"), method, target.pathname, matchCtx);
+      }
+      if (match) {
+        const mocked = match.rule.response;
+        if (mocked.delayMs) await new Promise((resolve57) => setTimeout(resolve57, mocked.delayMs));
+        const payload = mocked.template ? renderTemplate(mocked.body, match.captures) : mocked.body;
+        recordStream("mock", mocked.status, match.rule.id, mocked.headers);
+        res.statusCode = mocked.status;
+        res.setHeader("content-type", mocked.headers?.["content-type"] ?? "text/event-stream; charset=utf-8");
+        res.setHeader("cache-control", "no-cache");
+        res.end(payload ?? "");
+        return;
+      }
+      if (failsClosed(state.wix)) {
+        const refusal = hermeticRefusal(method, target.pathname);
+        recordStream("mock", refusal.status, UNMATCHED_FAIL_CLOSED_ID, refusal.headers);
+        res.statusCode = refusal.status;
+        res.setHeader("content-type", "application/json; charset=utf-8");
+        res.end(refusal.body);
+        return;
+      }
+    }
+    const abort = new AbortController();
+    const onResponseClose = () => {
+      if (!res.writableFinished) abort.abort();
+    };
+    res.once("close", onResponseClose);
+    try {
+      if (!session.visitorToken && !session.memberToken) {
+        try {
+          session.visitorToken = await mintVisitor(resolveWixClientId(state.app) ?? WEBWIX_CLIENT_ID);
+        } catch {
+        }
+      }
+      const isMember = !!session.memberToken;
+      let token = session.memberToken ?? session.visitorToken ?? "";
+      let upstream = await webWixStream(method, target.toString(), body, token, void 0, forwardedHeaders, abort.signal);
+      if ((upstream.status === 401 || upstream.status === 403) && !isMember && !abort.signal.aborted) {
+        try {
+          await upstream.body?.cancel();
+        } catch {
+        }
+        try {
+          token = session.visitorToken = await mintVisitor(resolveWixClientId(state.app) ?? WEBWIX_CLIENT_ID);
+          upstream = await webWixStream(method, target.toString(), body, token, void 0, forwardedHeaders, abort.signal);
+        } catch {
+        }
+      }
+      res.statusCode = upstream.status;
+      for (const name of ["content-type", "cache-control", "retry-after"]) {
+        const value = upstream.headers.get(name);
+        if (value) res.setHeader(name, value);
+      }
+      res.setHeader("access-control-allow-origin", "*");
+      res.setHeader("cache-control", res.getHeader("cache-control") ?? "no-cache");
+      recordStream("proxy", upstream.status);
+      if (!upstream.body) {
+        res.end();
+        return;
+      }
+      const reader = upstream.body.getReader();
+      for (; ; ) {
+        if (abort.signal.aborted) {
+          await reader.cancel();
+          break;
+        }
+        const chunk = await reader.read();
+        if (chunk.done) break;
+        if (chunk.value && !res.write(chunk.value)) {
+          await new Promise((resolve57) => {
+            let settled = false;
+            const finish2 = () => {
+              if (settled) return;
+              settled = true;
+              res.off("drain", finish2);
+              res.off("close", finish2);
+              resolve57();
+            };
+            if (res.destroyed || !res.writable) finish2();
+            else {
+              res.once("drain", finish2);
+              res.once("close", finish2);
+            }
+          });
+        }
+      }
+      if (!res.destroyed) res.end();
+    } catch {
+      if (!abort.signal.aborted) {
+        recordStream("proxy", 502);
+        if (!res.headersSent) {
+          res.statusCode = 502;
+          res.setHeader("content-type", "application/json; charset=utf-8");
+          res.end(JSON.stringify({ error: "webwix_stream_failed" }));
+        } else if (!res.destroyed) {
+          res.destroy(new Error("webwix_stream_failed"));
+        }
+      }
+    } finally {
+      res.off("close", onResponseClose);
+    }
+    return;
+  }
   if (path2 === "/v1/__webwix/login" && req.method === "POST") {
     const b2 = await readJson8();
     try {
@@ -142401,7 +142596,7 @@ function json4(status, body, headers2 = {}) {
   return new Response(JSON.stringify(body), { status, headers: { "content-type": JSON_CT2, ...headers2 } });
 }
 function isCookieAuthorizedPath(path2) {
-  return path2 === "/v1/__webwix/call" || path2 === "/v1/owner" || path2.startsWith("/v1/owner/") || path2 === "/v1/__webwix/identity" || path2 === "/v1/__webwix/login" || path2 === "/v1/__webwix/register" || path2 === "/v1/__webwix/logout" || path2 === MEMBER_CALLBACK_PATH;
+  return path2 === "/v1/__webwix/call" || path2 === "/v1/__webwix/stream" || path2 === "/v1/owner" || path2.startsWith("/v1/owner/") || path2 === "/v1/__webwix/identity" || path2 === "/v1/__webwix/login" || path2 === "/v1/__webwix/register" || path2 === "/v1/__webwix/logout" || path2 === MEMBER_CALLBACK_PATH;
 }
 function webwixCallLog(served, status) {
   const directRung = served.rung === "visitor" || served.rung === "owner";
@@ -142767,6 +142962,48 @@ ${releaseId}`;
         }
         return json4(200, { authenticated: false, userId: null, email: null, webwixDirect }, { "cache-control": "no-store" });
       }
+      if (request.method === "POST" && path2 === "/v1/__webwix/stream") {
+        if (opts.webwixBridge === false) return json4(503, { error: "webwix_bridge_disabled" }, { "cache-control": "no-store" });
+        const app2 = resolveApp(request, url);
+        const hostApp = memberApp(request);
+        if (!app2) return json4(400, { error: "app_required" }, { "cache-control": "no-store" });
+        if (!hostApp || app2 !== hostApp) return json4(403, { error: "webwix_stream_host_mismatch" }, { "cache-control": "no-store" });
+        const resolvedCfg = await appConfigFor(request, url, app2);
+        if (!resolvedCfg.ok) return resolvedCfg.response;
+        let call;
+        try {
+          call = await request.json();
+        } catch {
+          return json4(400, { error: "invalid_json" }, { "cache-control": "no-store" });
+        }
+        const method = String(call.method ?? "GET").toUpperCase();
+        if (method !== "GET" && method !== "POST") return json4(400, { error: "invalid_stream_method" }, { "cache-control": "no-store" });
+        const rawTarget = String(call.url ?? "");
+        const target = /^https:\/\//i.test(rawTarget) ? rawTarget : `https://www.wixapis.com${rawTarget.startsWith("/") ? rawTarget : `/${rawTarget}`}`;
+        if (!isAllowedConsumerStreamTarget(target)) return json4(400, { error: "invalid_stream_target" }, { "cache-control": "no-store" });
+        const cfg = wixMemberAuthOf(utf8Decode(resolvedCfg.bytes), callbackUrlFor(url));
+        if (!cfg.ok) return json4(501, { error: "webwix_visitor_direct_only", app: app2 }, { "cache-control": "no-store" });
+        const store2 = memberSessions();
+        const token = memberAuthOn() && store2 ? await memberTokenFor(store2, readSessionCookie(request.headers.get("cookie")), hostApp, cfg.config.clientId) : null;
+        if (!token) return json4(501, { error: "webwix_visitor_direct_only", app: app2 }, { "cache-control": "no-store" });
+        const headers2 = normalizeWixForwardedHeaders(call.headers);
+        headers2.Accept = "text/event-stream";
+        headers2.Authorization = token;
+        const body = call.body === void 0 ? void 0 : typeof call.body === "string" ? call.body : JSON.stringify(call.body);
+        if (body !== void 0) headers2["Content-Type"] ??= "application/json";
+        let upstream;
+        try {
+          upstream = await webwixFetch(target, { method, headers: headers2, body: method === "GET" ? void 0 : body, redirect: "manual", signal: request.signal });
+        } catch {
+          return json4(502, { error: "webwix_stream_upstream_failed" }, { "cache-control": "no-store" });
+        }
+        const responseHeaders = new Headers({ "cache-control": "no-store, no-transform" });
+        for (const name of ["content-type", "retry-after"]) {
+          const value = upstream.headers.get(name);
+          if (value) responseHeaders.set(name, value);
+        }
+        return new Response(upstream.body, { status: upstream.status, headers: responseHeaders });
+      }
       if (request.method === "POST" && path2 === "/v1/__webwix/call") {
         const served = { rung: "none" };
         let status = 500;
@@ -143690,7 +143927,7 @@ var init_run_handler = __esm({
 
 // ../../core/serve-runtime/src/node-adapter.ts
 import { createServer as createServer6 } from "node:http";
-async function toRequest(req) {
+async function toRequest(req, signal) {
   const method = (req.method ?? "GET").toUpperCase();
   const host = typeof req.headers.host === "string" && req.headers.host || "serve.local";
   const url = new URL(req.url ?? "/", `http://${host}`);
@@ -143706,7 +143943,7 @@ async function toRequest(req) {
     for await (const chunk of req) chunks.push(chunk);
     if (chunks.length) body = Buffer.concat(chunks);
   }
-  return new Request(url, { method, headers: headers2, body });
+  return new Request(url, { method, headers: headers2, body, signal });
 }
 async function writeResponse(res, response) {
   res.statusCode = response.status;
@@ -143714,10 +143951,15 @@ async function writeResponse(res, response) {
   if (response.body && /^text\/event-stream\b/i.test(response.headers.get("content-type") ?? "")) {
     res.flushHeaders();
     const reader = response.body.getReader();
-    res.on("close", () => {
-      void reader.cancel().catch(() => {
-      });
-    });
+    let clientDisconnected = false;
+    const onClose = () => {
+      if (!res.writableEnded) {
+        clientDisconnected = true;
+        void reader.cancel().catch(() => {
+        });
+      }
+    };
+    res.on("close", onClose);
     try {
       for (; ; ) {
         const { done, value } = await reader.read();
@@ -143725,7 +143967,10 @@ async function writeResponse(res, response) {
         res.write(value);
       }
     } catch {
+      if (!clientDisconnected && !res.destroyed) res.destroy();
+      return;
     }
+    res.off("close", onClose);
     res.end();
     return;
   }
@@ -143734,10 +143979,23 @@ async function writeResponse(res, response) {
 }
 function nodeAdapter(handler) {
   return createServer6(async (req, res) => {
+    const controller = new AbortController();
+    const abortForDisconnect = () => {
+      if (!res.writableEnded) controller.abort();
+    };
+    req.once("aborted", abortForDisconnect);
+    res.once("close", abortForDisconnect);
     try {
-      const response = await handler(await toRequest(req));
+      const request = await toRequest(req, controller.signal);
+      const response = await handler(request);
+      if (controller.signal.aborted || res.destroyed) {
+        await response.body?.cancel().catch(() => {
+        });
+        return;
+      }
       await writeResponse(res, response);
     } catch (err) {
+      if (controller.signal.aborted || res.destroyed) return;
       if (!res.headersSent) res.writeHead(500, { "content-type": "application/json; charset=utf-8" });
       res.end(JSON.stringify({ error: "internal", message: err.message }));
     }
@@ -143817,23 +144075,23 @@ var init_preview_assets_generated = __esm({
   "../../packages/serve/src/preview-assets.generated.ts"() {
     init_preview_assets_format();
     PREVIEW_ASSET_MANIFEST = [
-      { key: "assets/index-B3gStBoX.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1194813, sha256: "a8361f44552b20fad081eb4707f42209ab09ea01748a7b4196fa1c75a99ed1f3" },
-      { key: "assets/pdf.worker.min-BmVo14Nb.mjs", contentType: "application/octet-stream", offset: 1194821, length: 1317034, sha256: "a33cfe728c584fdba4fcc1fd54bcdc2f9f2f13889ddbb5b2bd1d0f8cbe49b84e" },
-      { key: "assets/pdfDocument-BvYBOu_9.js", contentType: "application/javascript; charset=utf-8", offset: 2511855, length: 489166, sha256: "af9c9fd16776cb30cb4ee0239446d24abd3014a29dd22149c4efe7e7b845c14e" },
-      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 3001021, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
-      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 3005631, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
-      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 3494215, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
-      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 3585139, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
-      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 3676123, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
-      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 3767103, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
-      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 3857975, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
-      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 3948955, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
-      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 4057591, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
-      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 4166675, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
-      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 4275723, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
-      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 4383423, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
-      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 4471531, length: 4947, sha256: "9336643c44e9f5510418c1013227cd7253cb997f4f2070693b2e53b9ce4422d4" },
-      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 4476478, length: 17344, sha256: "d057298d75e7373e5e2c4d11b7d1bcbea88e03af555ba63d97641c78509c58e4" }
+      { key: "assets/index-BASyrUOE.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1199331, sha256: "61bbacb882f499d8de973edf6cd283e953dad24fbe362d909e1d66b97aaea7af" },
+      { key: "assets/pdf.worker.min-BmVo14Nb.mjs", contentType: "application/octet-stream", offset: 1199339, length: 1317034, sha256: "a33cfe728c584fdba4fcc1fd54bcdc2f9f2f13889ddbb5b2bd1d0f8cbe49b84e" },
+      { key: "assets/pdfDocument-93Ito3np.js", contentType: "application/javascript; charset=utf-8", offset: 2516373, length: 489166, sha256: "1241febb4b04acb0b3b5341d29b16488d606d7a070e96b45872392309579817e" },
+      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 3005539, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
+      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 3010149, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
+      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 3498733, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
+      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 3589657, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
+      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 3680641, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
+      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 3771621, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
+      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 3862493, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
+      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 3953473, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
+      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 4062109, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
+      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 4171193, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
+      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 4280241, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
+      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 4387941, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
+      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 4476049, length: 4947, sha256: "14ea64c15439ccc29ea7030d38ef2212a342b8e443445a4e4e3179c0ee3e9c66" },
+      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 4480996, length: 17344, sha256: "d057298d75e7373e5e2c4d11b7d1bcbea88e03af555ba63d97641c78509c58e4" }
     ];
   }
 });

package/guides/sdk-reference.json

@@ -20,7 +20,7 @@
         "name": "StreamDirective",
         "kind": "interface",
         "jsdoc": "/**\n * Streaming directive (RFC 0040). An action may return its new state with a\n * transient `_stream` field; the runtime strips it from the stored state and\n * asks the native host to open the request as a Server-Sent-Events stream. For\n * every parsed `data:` event the host dispatches `onEvent(state, event)` back\n * through the normal reducer→render loop (the worker has no timers), then\n * `onDone(state)` / `onError(state, {message})` when the stream closes. Requires\n * the bundle to declare the `\"stream\"` capability; `request.url` is checked\n * against the same per-capability host allowlist as `wix_api`.\n */",
-        "decl": "export interface StreamDirective {\n  /** Stable id; a new directive with the same id cancels the prior stream. */\n  id: string;\n  request: {\n    method: \"POST\" | \"GET\";\n    url: string;\n    headers?: Record<string, string>;\n    body?: unknown;\n  };\n  /** Reducer action name dispatched once per parsed `data:` event. */\n  onEvent: string;\n  /** Reducer action name dispatched when the stream closes cleanly. */\n  onDone?: string;\n  /** Reducer action name dispatched on transport/parse error. */\n  onError?: string;\n}"
+        "decl": "export interface StreamDirective {\n  /** Stable id; a new directive with the same id cancels the prior stream. */\n  id: string;\n  request: {\n    method: \"POST\" | \"GET\";\n    url: string;\n    headers?: Record<string, string>;\n    body?: unknown;\n    /** Apply the host's Wix authorization to this request before opening the stream. */\n    authorize?: boolean;\n  };\n  /** Reducer action name dispatched once per parsed `data:` event. */\n  onEvent: string;\n  /** Reducer action name dispatched when the stream closes cleanly. */\n  onDone?: string;\n  /** Reducer action name dispatched on transport/parse error. */\n  onError?: string;\n}"
       },
       {
         "name": "StreamEvent",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1251.0",
+  "version": "0.1252.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -67,5 +67,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "2fb267af6593debfaa9fac6bdde663a5a54cbd0c533c577df322b5ca"
+  "falconPackageHash": "87f23d8f06f88ed92ac988ab724637b5633bcdaccfc2c23e791f1a71"
 }