@wix/himalaya-cli 0.1309.0 → 0.1311.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/sdk/iap/src/delivery-contract.d.ts

@@ -15,14 +15,14 @@ export interface SessionProvider {
 /** A catalog item resolved by the backend for the captured member. */
 export interface PurchaseContext {
     productId: string;
-    /** Canonical UUID the backend associates with this site/member. */
+    /** Canonical UUID for this one sale (D61: a per-payment purchase intent, not the member). */
     appAccountToken: string;
     /** Opaque site/member scope the acknowledgement must echo. */
     scopeKey: string;
 }
-/** The current member's association, used to recover purchases without a catalog item. */
+/** The current member's scope, used to recover purchases without a catalog item. It names no
+ *  token: each payment has its own, and the backend decides whose a transaction is. */
 export interface MemberContext {
-    appAccountToken: string;
     scopeKey: string;
 }
 export type ContextResult<T> = {

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/sdk/iap/src/delivery.d.ts

@@ -8,6 +8,9 @@ export interface PurchaseCoordinatorDependencies {
     jitter?: (baseDelayMs: number) => number;
     /** Receives a fresh safe snapshot after every change. */
     onState?: (state: DeliveryState) => void;
+    /** Called inside the purchase job when StoreKit defers for Ask to Buy, after the unfinished
+     *  queue has been listed and before the job returns. The next queued purchase has not started. */
+    onAwaitingApproval?: (productId: string) => void;
 }
 export interface PurchaseCoordinator {
     /** Reconciles unfinished purchases now and again after every later session change. */

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/sdk/iap/src/host-session.d.ts

@@ -0,0 +1,31 @@
+import type { SessionProvider, SessionSnapshot } from "./delivery-contract.js";
+import type { HostCallExpectation, MemberIdentitySource } from "./wix-payments-contract.js";
+export interface HostSessionView extends SessionSnapshot {
+    memberId: string | null;
+    siteId: string | null;
+    appId: string | null;
+    ready: boolean;
+    epoch: number;
+}
+/** A session provider that can also name the principal captured for one generation. */
+export interface HostIdentitySource {
+    readonly identityBound: boolean;
+    identity(session: SessionSnapshot): HostCallExpectation | null;
+}
+export interface HostSessionProvider extends SessionProvider, HostIdentitySource {
+}
+/** Wraps a host session clock as the session provider the delivery coordinator and the wix-iap
+ *  client share. Ignores a generation older than the last one read, and keeps the first member
+ *  expectation captured for each generation for `identity()`. */
+export declare function createHostSession(source: {
+    identityBound: boolean;
+    current(): unknown;
+    subscribe(listener: () => void): () => void;
+}): HostSessionProvider;
+/** The session on `globalThis.himalaya`. Web publishes `identityBound: false`. */
+export declare function hostSessionFromGlobal(): HostSessionProvider;
+/** The member a host session names for a captured generation, as the identity port the Apple-IAP
+ *  checkout and the wix-iap client take: null when that generation has no signed-in member. */
+export declare function memberIdentityOf(source: HostIdentitySource): MemberIdentitySource;
+/** Whether the host fences protected calls to the captured member (`identityBound`). Web does not. */
+export declare function readIdentityBound(): boolean;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/sdk/iap/src/index.d.ts

@@ -9,6 +9,7 @@ export * from "./catalog-price-fields.js";
 export * from "./catalog-adapters/online-programs.js";
 export * from "./wix-payments-contract.js";
 export * from "./wix-payments.js";
+export * from "./host-session.js";
 /** The three store product categories. */
 export type ProductType = "subscription" | "nonConsumable" | "consumable";
 export interface Product {

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/sdk/iap/src/wix-payments-contract.d.ts

@@ -10,7 +10,7 @@ export interface PurchasesAppBinding {
     siteId: string;
 }
 export interface AppBindingSource {
-    /** Null when the app was never registered. */
+    /** Null when the app was never registered; rejects when the host could not say. */
     current(): Promise<PurchasesAppBinding | null>;
 }
 /** The running app's own identity; a binding for anything else is refused. */
@@ -25,11 +25,39 @@ export interface WixIapRoute {
      *  was in the generated gateway metadata on 2026-10-08, so there is deliberately no default. */
     prefix: string;
 }
+/**
+ * Serve's Apple-IAP routes on the public gateway (`www.wixapis.com/himalaya-serve/v1/iap`), where the
+ * native bridge sends the member's or visitor's own token. One prefix for the wix-iap payment calls, the
+ * cashier charge and the mapping read; Serve forwards each to the internal service that owns it.
+ */
+export declare const HIMALAYA_SERVE_IAP_ROUTE: WixIapRoute;
+/** How the App Store sells one vertical's Wix item: the purchases catalog's `appProductId` for it, and
+ *  the only product type the purchase flow sells it as. */
+export interface AppleSaleRule {
+    appProductId(entityId: string): string;
+    productType: "NON_CONSUMABLE";
+}
+/**
+ * The one definition `himi store iap connect` writes mappings by and the mapping source reads them by,
+ * keyed by catalog kind. wix-iap StartPayment maps the cashier order's single item id, and Online
+ * Programs builds that order with the program id as the item id; programs are one-time unlocks.
+ * Other verticals' order item ids are not established yet, so their items keep their own commerce.
+ */
+export declare const APPLE_SALE_RULES: Readonly<Record<string, AppleSaleRule>>;
+/** Captured when a protected call starts. The native bridge checks it and never puts it on
+ *  the HTTP request. */
+export interface HostCallExpectation {
+    generation: number;
+    kind: "member";
+    memberId: string;
+    siteId: string;
+    appId: string;
+}
 /** The host's Wix REST bridge (`himalaya.wixApi`). Resolves the parsed body of a 2xx and
  *  rejects with `HTTP <status> [<code>]: <message>` otherwise. Credentials are attached
- *  natively, never in TypeScript. */
+ *  natively, never in TypeScript. `expectation` is bridge metadata, not a header. */
 export interface WixTransport {
-    call(method: "GET" | "POST", path: string, body?: unknown, headers?: Record<string, string>): Promise<unknown>;
+    call(method: "GET" | "POST", path: string, body?: unknown, headers?: Record<string, string>, expectation?: HostCallExpectation): Promise<unknown>;
 }
 /** Optional, from a trusted host only: the Wix member id signed in for a captured session. Used to
  *  refuse an answer about someone else, never sent: the server derives the member itself. */
@@ -55,10 +83,9 @@ export interface WixIapPayment {
     canceledDate?: string;
     refundedDate?: string;
 }
-export type WixIapOperation = "startPayment" | "completePayment" | "getCustomerId" | "getPayment";
+export type WixIapOperation = "startPayment" | "completePayment" | "getPayment";
 export type StartPaymentErrorCode = "NOT_PENDING" | "WRONG_PAYMENT_METHOD" | "NOT_ORDER_BUYER" | "UNSUPPORTED_ORDER" | "PRODUCT_NOT_AVAILABLE" | "ALREADY_OWNED";
-export type CompletePaymentErrorCode = "INVALID_PURCHASE" | "OWNED_BY_ANOTHER_CUSTOMER" | "PURCHASE_REVOKED" | "NOT_PURCHASED" | "ZERO_PRICE" | "NO_MATCHING_PAYMENT" | "APP_NOT_CONFIGURED";
-export type GetCustomerIdErrorCode = "APP_NOT_CONFIGURED";
+export type CompletePaymentErrorCode = "INVALID_PURCHASE" | "OWNED_BY_ANOTHER_CUSTOMER" | "PURCHASE_REVOKED" | "NOT_PURCHASED" | "ZERO_PRICE" | "NO_MATCHING_PAYMENT" | "PAYMENT_NOT_PENDING" | "APP_NOT_CONFIGURED";
 export type GetPaymentErrorCode = "NOT_FOUND";
 /** Why a call gave no usable answer, other than a named application error.
  *  `unavailable` and `sessionChanged` say nothing about whether the request took effect.
@@ -80,24 +107,21 @@ export type WixIapFailure<Code extends string> = {
     kind: WixIapFailureKind;
     httpStatus?: number;
 };
-/** `customerId` goes to StoreKit as `appAccountToken` (the customer id is the token, D59). Keep it
- *  out of screen state. */
+/** `appAccountToken` goes to StoreKit with the purchase. It is minted for this one payment (a
+ *  purchase intent, D61), not the member: StartPayment for the same Wix transaction again returns
+ *  the same payment and the same token. Keep it out of screen state. */
 export type StartPaymentResult = {
     status: "started";
     payment: WixIapPayment;
     storeProductId: string;
-    customerId: string;
+    appAccountToken: string;
 } | WixIapFailure<StartPaymentErrorCode>;
-/** `matched`: the server verified the proof and matched it to `payment`, which may not be the one
- *  this device started. Its status may still be `approving`. */
+/** `matched`: the server verified the proof and paid the payment whose token the Apple transaction
+ *  carries. Its status may still be `approving`. */
 export type CompletePaymentResult = {
     status: "matched";
     payment: WixIapPayment;
 } | WixIapFailure<CompletePaymentErrorCode>;
-export type CustomerIdResult = {
-    status: "found";
-    customerId: string;
-} | WixIapFailure<GetCustomerIdErrorCode>;
 export type GetPaymentResult = {
     status: "found";
     payment: WixIapPayment;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/sdk/iap/src/wix-payments-wire.d.ts

@@ -12,7 +12,6 @@ export interface CallScope {
 export declare function startPaymentCall(scope: CallScope, wixTransactionId: string): WixIapCall;
 /** The JWS goes byte-for-byte: the server derives the member, and the proof names the product. */
 export declare function completePaymentCall(scope: CallScope, signedTransaction: string): WixIapCall;
-export declare function customerIdCall(scope: CallScope): WixIapCall;
 export declare function paymentCall(scope: CallScope, paymentId: string): WixIapCall;
 /** A gateway path such as `/_api/<service>/v1`: absolute, no trailing slash, query or scheme. */
 export declare function isRoutePrefix(prefix: string): boolean;
@@ -26,13 +25,12 @@ export interface PaymentExpectation {
 export interface StartedPayment {
     payment: WixIapPayment;
     storeProductId: string;
-    customerId: string;
+    appAccountToken: string;
 }
+/** D61: the token is this payment's purchase intent; no other field may stand in for it. */
 export declare function decodeStarted(raw: unknown, expected: PaymentExpectation): StartedPayment | null;
 /** CompletePayment's and GetPayment's answer: `{payment}`. */
 export declare function decodePaymentAnswer(raw: unknown, expected: PaymentExpectation): WixIapPayment | null;
-/** D59: the customer's id is the StoreKit `appAccountToken`; no other field may stand in for it. */
-export declare function decodeCustomerId(raw: unknown): string | null;
 /** Maps a bridge rejection to a failure. The message itself is never kept: the bridge copies up
  *  to 300 characters of the response, which can echo the request. */
 export declare function classifyFailure<Code extends string>(error: unknown, operation: WixIapOperation, codes: readonly Code[]): WixIapFailure<Code>;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/sdk/iap/src/wix-payments.d.ts

@@ -1,6 +1,6 @@
 import type { AppleTransaction } from "./index.js";
 import type { SessionProvider } from "./delivery-contract.js";
-import type { AppBindingSource, CompletePaymentResult, CustomerIdResult, GetPaymentResult, IapAppHost, MemberIdentitySource, StartPaymentResult, WixIapRoute, WixTransport } from "./wix-payments-contract.js";
+import type { AppBindingSource, CompletePaymentResult, GetPaymentResult, IapAppHost, MemberIdentitySource, StartPaymentResult, WixIapRoute, WixTransport } from "./wix-payments-contract.js";
 export interface WixIapClientDependencies {
     /** The trusted host session; each call is bound to the generation current when it starts. */
     session: SessionProvider;
@@ -14,15 +14,13 @@ export interface WixIapClientDependencies {
 }
 export interface WixIapClient {
     /** StartPayment for a pending `appleIAP` Wix Payments transaction the member placed. Returns the
-     *  store product to sell and the customer id to pass to StoreKit as `appAccountToken`. */
+     *  store product to sell and this payment's `appAccountToken` to pass to StoreKit. */
     startPayment(input: {
         wixTransactionId: string;
     }): Promise<StartPaymentResult>;
-    /** CompletePayment with held Apple proof, sent unchanged. Success can still be `approving`. */
+    /** CompletePayment with held Apple proof, sent unchanged: the service pays the payment whose
+     *  token the transaction carries. Success can still be `approving`. */
     completePayment(transaction: AppleTransaction): Promise<CompletePaymentResult>;
-    /** GetCustomerId: the member's customer id, for recovering held purchases. Creates the customer
-     *  when there is none. */
-    getCustomerId(): Promise<CustomerIdResult>;
     /** GetPayment: one of the member's own Payments. */
     getPayment(input: {
         paymentId: string;
@@ -34,14 +32,15 @@ export interface WixIapClient {
  *
  * NOT ENABLED and not production-ready. No app wires it, and no call reaches the service: it has
  * no public gateway route yet, so `route` must be supplied and there is no default. It calls
- * StartPayment (`POST …/payments/start`), CompletePayment (`POST …/payments/complete`),
- * GetCustomerId (`GET …/customer-id`) and GetPayment (`GET …/payments/{id}`) through the
+ * StartPayment (`POST …/payments/start`), CompletePayment (`POST …/payments/complete`)
+ * and GetPayment (`GET …/payments/{id}`) through the
  * `wix_api` bridge. A matched or approved Payment is not durable access and never finishes the
  * store transaction.
  *
- * Production use is blocked on pending prerequisites: a public route and member authorization on
- * the service, the service's own app identity and permissions, a trusted provisioning flow for the
- * app binding, and a native bridge that binds each request to the session generation across
- * authorization, send and retry. Its checks here protect only this client's own flow.
+ * Production use stays blocked: there is no public route or member authorization on the service,
+ * no trusted app-binding source, and checkout stays disabled. When this client uses the host
+ * bridge, it also requires the host's identity clock and passes that captured expectation
+ * through the bridge. An injected transport keeps the previous call shape unless the session
+ * itself exposes an identity.
  */
 export declare function createWixIapClient(deps: WixIapClientDependencies): WixIapClient;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/define-app.d.ts

@@ -284,6 +284,14 @@ export interface AppConfig {
      * secret. Absent ⇒ no Base44 backend.
      */
     base44?: Base44Config;
+    /**
+     * The Wix purchases-service app (mobile-apps-iap-purchases RegisterApp `app.id`) this app sells
+     * digital Wix items through with Apple in-app purchase (`@himalaya/iap-checkout`; requires the
+     * `iap` capability). A build bakes it into the binary with the app's auth site — it is never read
+     * over the air or by a worker — and only the binding is baked: products, mappings and prices stay
+     * live. Absent ⇒ the app sells nothing through the App Store. See docs/iap-wix-checkout.md.
+     */
+    wixIap?: WixIapConfig;
     /** Unified app-owned KV and Wix Data declaration. */
     data?: DataResourcesConfig;
     /**
@@ -736,6 +744,11 @@ export declare const DEFAULT_ORIENTATION_ENVELOPE: Required<OrientationEnvelope>
 /** Fill in the absent families. Total, so callers never branch on `undefined`. */
 export declare function resolveOrientationEnvelope(env?: OrientationEnvelope): Required<OrientationEnvelope>;
 export type Capability = "camera" | "barcode_scanner" | "biometrics" | "secure_storage" | "share" | "push" | "file_picker" | "files" | "open_url" | "pdf" | "clipboard" | "photos" | "presigned_upload" | "ui" | "calendar" | "contacts" | "tasks" | "audio_record" | "audio_record_background" | "calls" | "location" | "location_background" | "motion" | "health" | "media_playback" | "webview" | "browser_auth" | "haptic" | "himi_apps" | "iap" | "keyboard" | "wix_cashier" | "live_activity" | "local_database" | "speech" | "speaker_diarization" | "system_intents" | "on_device_ai" | "app_info" | "release_control" | "godot" | "base44" | "animation";
+/** `defineApp({ wixIap })` — the purchases-service app a build binds this app to. */
+export interface WixIapConfig {
+    /** The purchases service's app UUID, registered on the app's own auth site. Not a secret. */
+    purchasesAppId: string;
+}
 /** `defineApp({ base44 })` — which Base44 app `@himalaya/base44` talks to. */
 export interface Base44Config {
     /** The Base44 app id (24 hex chars, e.g. `69725232345f461f64ad1623`). */

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/flows/iap-checkout/src/apple-iap-contract.d.ts

@@ -1,8 +1,10 @@
-import type { AppBindingSource, CatalogReference, Clock, DeliveryState, IapCatalogPricing, SessionProvider, TransactionStore, WixIapClient } from "@wix/himalaya/iap";
+import type { AppBindingSource, CatalogReference, Clock, DeliveryState, HostCallExpectation, IapCatalogPricing, MemberIdentitySource, SessionProvider, TransactionStore, WixIapClient } from "@wix/himalaya/iap";
 /** The host's Wix REST bridge (`himalaya.wixApi`). Resolves a 2xx body; rejects with
- *  `HTTP <status> [<code>]: <message>` otherwise. Credentials are attached natively. */
+ *  `HTTP <status> [<code>]: <message>` otherwise. Credentials are attached natively.
+ *  Same positional shape as the runtime's `wixApiCall`: `expectation` is bridge metadata for a
+ *  protected call, after `headers`, and never an HTTP header. */
 export interface WixBridge {
-    call(method: "GET" | "POST", path: string, body?: unknown): Promise<unknown>;
+    call(method: "GET" | "POST", path: string, body?: unknown, headers?: Record<string, string>, expectation?: HostCallExpectation): Promise<unknown>;
 }
 /** Why a bridge call gave no body. `sessionChanged`: the captured session is no longer current,
  *  before the send or after the answer; nothing from it may be used or stored. */
@@ -86,13 +88,13 @@ export interface IapOrderAdapter {
     /** The vertical's authoritative answer for the order's item and the signed-in member. */
     readAccess(verticalRef: VerticalRef, bridge: SessionBoundBridge): Promise<AccessRead>;
 }
-/** Durable, member-partitioned purchase references. Ids only: never a proof, an account token
- *  (the customer id is stored only as a one-way hash in the key), or a credential. */
+/** Durable, member-partitioned purchase references. Ids only: never a proof or a credential, and
+ *  the member id is stored only as a one-way hash in the key. */
 export interface OrderPartitionKey {
     purchasesAppId: string;
     siteId: string;
-    /** The member's wix-iap customer id: server-derived per member per app. */
-    customerId: string;
+    /** The signed-in member's Wix id, from the host session (wix-iap records purchases against it). */
+    memberId: string;
 }
 /** `held`: Apple charged, and CompletePayment refused the proof without recording it, so the
  *  transaction stays unfinished and is retried. `needsSupport`: recorded and refused for good. */
@@ -109,6 +111,8 @@ export interface OrderRef {
     storeProductId?: string;
     appProductId?: string;
     appleTransactionId?: string;
+    /** The StoreKit token StartPayment minted for this payment (D61): recovery finds the order by it. */
+    appAccountToken?: string;
     updatedAt: number;
 }
 export interface OrderRefPartition {
@@ -122,13 +126,13 @@ export interface OrderRefStore {
      *  unknown-version data. Never an empty stand-in. */
     open(key: OrderPartitionKey): OrderRefPartition | null;
     /** Whether any member holds references for this app and site; null when unreadable. Lets a
-     *  start-up skip GetCustomerId (which creates a customer) when nothing was ever handed over. */
+     *  start-up skip reading the member and tracking when nothing was ever handed over. */
     hasRefs(app: {
         purchasesAppId: string;
         siteId: string;
     }): boolean | null;
 }
-export type OrderFailureCode = "notEnabled" | "notConfigured" | "signInRequired" | "unsupportedItem" | "notAppleRoute" | "storageUnavailable" | "approvalRequired" | "orderClosed" | "orderRefused" | "chargeFailed" | "paymentRefused" | "paymentHeld" | "alreadyOwned" | "paymentInProgress" | "productChanged" | "matchedOtherOrder" | "invalidAssociation" | "needsSupport" | "unavailable" | "sessionChanged";
+export type OrderFailureCode = "notEnabled" | "notConfigured" | "signInRequired" | "unsupportedItem" | "notAppleRoute" | "storageUnavailable" | "approvalRequired" | "orderClosed" | "orderRefused" | "chargeFailed" | "paymentRefused" | "paymentHeld" | "alreadyOwned" | "paymentInProgress" | "productChanged" | "invalidAssociation" | "needsSupport" | "unavailable" | "sessionChanged";
 /** Progress of a payment this device handed to wix-iap, tracked from its durable reference. */
 export type PaymentAccess = "processing" | "granted" | "accessUnknown" | "needsSupport";
 export interface PaymentProgress {
@@ -151,6 +155,10 @@ export interface AppleIapCheckoutState {
 }
 export interface AppleIapCheckoutDependencies {
     wixIap: WixIapClient;
+    /** The member signed in for a captured session, from the trusted host (`memberIdentityOf` over the
+     *  host session). It partitions the references and scopes acknowledgements: wix-iap has no
+     *  customer ids any more (D61). */
+    identity: MemberIdentitySource;
     /** The same trusted binding the wix-iap client uses; it partitions the stored references. */
     binding: AppBindingSource;
     /** The same host provider the wix-iap client was given: every step compares generations. */

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/flows/iap-checkout/src/iap-order-backend.d.ts

@@ -1,4 +1,4 @@
-import type { AppBindingSource, Clock, DeliveryBackend, IapAppleProduct, SessionProvider, WixIapClient } from "@wix/himalaya/iap";
+import type { AppBindingSource, Clock, DeliveryBackend, IapAppleProduct, MemberIdentitySource, SessionProvider, WixIapClient } from "@wix/himalaya/iap";
 import type { CashierRoute, IapOrderAdapter, IapOrderItem, OrderFailureCode, OrderRefStore, PaymentAccess, WixBridge } from "./apple-iap-contract.js";
 /** What the backend tells the checkout about an item: why it stopped, or how its payment is. */
 export interface OrderEvent {
@@ -15,6 +15,8 @@ export interface SaleItem {
 }
 export interface WixOrderBackendDependencies {
     wixIap: WixIapClient;
+    /** The member signed in for a captured session; it partitions references and scopes acks. */
+    identity: MemberIdentitySource;
     binding: AppBindingSource;
     session: SessionProvider;
     clock: Clock;
@@ -24,6 +26,9 @@ export interface WixOrderBackendDependencies {
     bridge: WixBridge;
     /** The item a `buy` asked for, by the catalog ref the coordinator carries. */
     itemFor(catalogRef: string): SaleItem | undefined;
+    /** Whether Apple may already be charging for this product: an unfinished transaction, or an Ask
+     *  to Buy request awaiting approval. Asked inside the purchase job, after any reconcile. */
+    productBusy?(productId: string): boolean;
     report(event: OrderEvent): void;
 }
 export declare function createWixOrderBackend(deps: WixOrderBackendDependencies): DeliveryBackend;