@wix/himalaya-cli 0.1323.0 → 0.1325.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/flows/checkout/src/index.d.ts

@@ -11,6 +11,8 @@ export interface Entitlement {
      *  rather than offering to sell it to them again. "" when not entitled. */
     planId: string;
 }
+/** Active plan ids for one member-scoped catalog scan. An incomplete scan rejects so callers cannot offer a duplicate purchase. */
+export declare function activePlanIds(): Promise<string[]>;
 /**
  * Does the signed-in member hold a plan that grants access right now?
  *
@@ -23,16 +25,10 @@ export interface Entitlement {
  * the wrong (owner) endpoint is so dangerous: the 403 is indistinguishable from
  * an honest "no orders". Use this function and that cannot happen.
  *
- * The status filter is SERVER-SIDE, and that is load-bearing rather than tidy.
- * The endpoint answers with one page of at most 50 orders and no cursor, while a
- * member collects a `DRAFT` order every time they abandon a checkout. Asking for
- * everything and scanning it means the DRAFTs eventually crowd the single ACTIVE
- * order off the page — and because this function fails closed, that reads as
- * "never paid" and locks a paying member out with no error anywhere. Asking only
- * for ACTIVE makes the page hold nothing but access, so the count of abandoned
- * checkouts cannot decide whether someone gets what they bought.
+ * ACTIVE is filtered server-side so abandoned checkouts cannot crowd access
+ * off the page. When `planId` is supplied, page until that exact plan is found.
  */
-export declare function entitlement(): Promise<Entitlement>;
+export declare function entitlement(planId?: string): Promise<Entitlement>;
 /** Shorthand for the common gate. Fails closed, like `entitlement`. */
 export declare function isEntitled(): Promise<boolean>;
 export type PayOutcome = 
@@ -68,7 +64,7 @@ export interface PayRequest {
     cashierUrl?: () => Promise<string | undefined>;
     /** Re-read immediately before money moves (the wallet charge, the cashier opening). The caller's
      *  own route can change while a rail is being chosen; false stops the flow with nothing charged. */
-    mayCharge?: () => boolean;
+    mayCharge?: () => boolean | Promise<boolean>;
 }
 /**
  * Collect payment through the two sanctioned rails, in order.

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/flows/iap-checkout/src/order-refs.d.ts

@@ -14,4 +14,5 @@ export declare function pruneExpiredHolds(partition: OrderRefPartition, now: num
 /** References one member keeps at once. When full, the oldest reference from before Apple's sheet
  *  is evicted; a partition full of handed-over payments refuses new sales instead. */
 export declare const MAX_ORDER_REFS = 16;
+/** Persists unfinished orders per app and member, using the host KV unless storage is supplied. */
 export declare function createWorkerOrderRefStore(storage?: KeyValueStorage): OrderRefStore;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/flows/iap-checkout/src/purchase-fields.d.ts

@@ -1,4 +1,5 @@
 import type { IapItemView } from "@wix/himalaya/iap";
 import type { AppleIapCheckoutState } from "./apple-iap-contract.js";
 import type { IapPurchaseCopy, IapPurchaseFields, IapPurchaseReadiness } from "./commerce-contract.js";
+/** Projects a shared checkout into customer-facing action fields; a price alone never grants access. */
 export declare function iapPurchaseFields(view: IapItemView, state: AppleIapCheckoutState, readiness: IapPurchaseReadiness, copy: IapPurchaseCopy): IapPurchaseFields;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/flows/screens/src/index.d.ts

@@ -126,38 +126,9 @@ export interface PlanRow {
     joinedLabel: string;
     /** Per-row CTA, so the template needs no conditional of its own. */
     cta: string;
-}
-interface CheckoutState {
-    status: "loading" | "ready" | "error";
-    isLoading: boolean;
-    notLoading: boolean;
-    rows: PlanRow[];
-    hasRows: boolean;
-    noRows: boolean;
-    /** Ready, and the site sells nothing. Distinct from `noRows`, which is also
-     *  true while still loading — showing "no plans" during the first fetch would
-     *  flash the wrong answer. `hiddenPath` binds a single path, so this decision
-     *  is made HERE rather than by combining flags in the descriptor. */
-    emptyCatalog: boolean;
-    notEmptyCatalog: boolean;
-    headline: string;
-    subhead: string;
-    /** Result banner after a join attempt. */
-    notice: string;
-    noNotice: boolean;
-    error: string;
-    noError: boolean;
-    /** True once the member holds any access-granting plan. */
-    entitled: boolean;
-    notEntitled: boolean;
-    /** True ONLY when the current notice is "you must sign in". Distinct from
-     *  `noNotice`: a successful join, a cancellation, a handoff and a backend
-     *  failure all set a notice too, and routing any of those to a sign-in screen
-     *  sends the member somewhere that cannot help them. Every action sets this
-     *  explicitly rather than inheriting it, so a stale `true` cannot survive the
-     *  next attempt. */
-    needsSignIn: boolean;
-    notNeedsSignIn: boolean;
+    appleSupported: boolean;
+    joinDisabled: boolean;
+    joinNote: string;
 }
 /** Every user-facing string on the paywall. Override any subset. */
 export interface CheckoutCopy {
@@ -199,11 +170,14 @@ export interface CheckoutServiceOptions {
  *     const svc = createCheckoutService({ returnTo: "myapp://screen/library" });
  *     export default svc; export { svc };
  */
-export declare function createCheckoutService(opts?: CheckoutServiceOptions): import("@wix/himalaya/state", { with: { "resolution-mode": "import" } }).ServiceHandle<CheckoutState> & {
-    load: (...args: never[]) => Promise<CheckoutState>;
+export declare function createCheckoutService(opts?: CheckoutServiceOptions): import("@wix/himalaya/state", { with: { "resolution-mode": "import" } }).ServiceHandle<any> & {
+    pricingPublish: () => Promise<any>;
+    pricingRefresh: (...args: never[]) => Promise<any>;
+    iapPoll: (...args: never[]) => Promise<any>;
+    load: (...args: never[]) => Promise<any>;
     join: (input?: {
         id?: string;
-    }) => Promise<CheckoutState>;
+    }) => Promise<any>;
 };
 export interface CheckoutScreenOptions {
     /** Where the built worker bundle is served from. */

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/wix-sdk/comments-v1/src/extensions.d.ts

@@ -8,6 +8,15 @@ export type WixBlogCommentRow = {
     /** [rico] #3372 — the comment's Ricos document (`content.richContent`) as the API returned it, for a
      *  RichContent row; undefined when the comment has none. */
     richContent?: unknown;
+    /** Set only on a reply row `listGroupPostComments` flattens in from `commentReplies` —
+     *  absent on a top-level comment. */
+    parentCommentId?: string;
+    /** Set only on a TOP-LEVEL comment row, true when its reply thread had more replies than
+     *  `repliesLimit` returned. There is no confirmed endpoint in this SDK to fetch the rest —
+     *  `WixRepliesListResponse`'s own `pagingMetadata` carries a cursor, but nothing in the
+     *  ingested spec calls it by itself — so this is a signal to show "N more replies" rather
+     *  than silently truncating, not something a caller can page past yet. */
+    hasMoreReplies?: boolean;
 };
 type BlogCommentLike = {
     id?: string;
@@ -22,4 +31,74 @@ type BlogCommentLike = {
 export declare function blogCommentRow(comment: BlogCommentLike | undefined): WixBlogCommentRow;
 export declare function createBlogComment(postId: string, text: string): Promise<WixBlogCommentRow>;
 export declare function listBlogComments(postId: string): Promise<WixBlogCommentRow[]>;
+/** The appId Wix Groups registers as its comments provider. Same value as
+ *  GROUPS_APP_ID/GROUPS_APP_DEF_ID used elsewhere in this repo (social-feed's
+ *  reactions/create-post calls) — Groups is one of the apps where the comments
+ *  provider id and the app-def-id coincide. Source: comments-ng's own CONSUMERS.md. */
+export declare const GROUPS_COMMENTS_APP_ID = "148c2287-c669-d849-d153-463c7486a694";
+/**
+ * Posts a comment (or a reply, when `parentCommentId` is given) on a group feed post —
+ * POST /comments/v1/comments, body { comment: { appId, contextId: groupId, resourceId:
+ * feedItemId, content, parentComment? } }. Same underlying RPC as the generated
+ * `createComment`, scoped to a group feed item by the appId/contextId/resourceId
+ * convention in comments-ng's own CONSUMERS.md (source-verified; see the file header).
+ *
+ * verify-live: no round-trip against a real group post yet — the scoping comes from the
+ * comments-ng consumer table, not a live create+list.
+ *
+ * @scope member — requires a signed-in site member.
+ */
+export declare function createGroupPostComment(groupId: string, feedItemId: string, text: string, parentCommentId?: string): Promise<WixBlogCommentRow>;
+export interface WixListGroupPostCommentsResult {
+    comments: WixBlogCommentRow[];
+    /** `undefined` when the response carried none — a thread with more pages has one. */
+    pagingMetadata?: {
+        count?: number;
+        hasNext?: boolean;
+        cursors?: {
+            next?: string;
+            prev?: string;
+        };
+    };
+}
+export interface WixListGroupPostCommentsOptions {
+    /** From a prior call's `pagingMetadata.cursors.next` — fetches the next page. */
+    cursor?: string;
+    /** Top-level comments per page. Defaults to the server's own default (unset). */
+    limit?: number;
+    /** Replies to include inline PER parent comment. Defaults to 20 — unset, the
+     *  server's documented default is to include none at all (see below). */
+    repliesLimit?: number;
+}
+/**
+ * Lists a group feed post's comment thread — GET /comments/v1/comments/list-by-resource,
+ * scoped by appId/contextId=groupId/resourceId=feedItemId (query string, never a GET
+ * body — see the comment above). Same underlying RPC as the generated
+ * `listCommentsByResource`.
+ *
+ * Replies ride the SAME response, under `commentReplies` — keyed by parent comment id —
+ * but ONLY when the request's `cursorPaging.repliesLimit` asks for them; the field exists
+ * precisely because the server does not include replies by default. This function sends
+ * `cursorPaging.repliesLimit=20` unless `opts.repliesLimit` overrides it, and forwards
+ * `opts.cursor`/`opts.limit` into `cursorPaging.cursor`/`cursorPaging.limit` so a caller
+ * can actually page past `pagingMetadata.hasNext` instead of being stuck on page one. The
+ * generator could not resolve a precise shape for the `commentReplies` map
+ * (`Record<string, unknown>`), so its value is read as `{ replies?, pagingMetadata? }` here —
+ * inferred from the already-typed, structurally identical `WixRepliesListResponse`, not
+ * live-verified against a real multi-reply thread. Each reply is flattened into the SAME
+ * row list, tagged with `parentCommentId`, directly after its parent, oldest reply first.
+ * Top-level comments keep the SERVER's order: the request sends no sort (none is confirmed
+ * for this provider), so re-sorting a page on the client would break chronology at a page
+ * boundary whenever the server pages newest-first. Kept as-is, consecutive pages append
+ * consistently, whatever order the server uses. A thread with more replies than `repliesLimit` sets its PARENT row's
+ * `hasMoreReplies: true` instead of silently dropping them — there is no confirmed endpoint
+ * in this SDK to page a single thread's replies, so this is a signal, not a cursor.
+ *
+ * verify-live: no round-trip against a real group post yet — the appId/contextId/resourceId
+ * shape comes from the comments-ng consumer table, not a live call.
+ *
+ * @scope member — a signed-in site member reading a group they can see; whether an
+ * anonymous visitor can read a PUBLIC group's comments is unconfirmed — needsLiveProbe.
+ */
+export declare function listGroupPostComments(groupId: string, feedItemId: string, opts?: WixListGroupPostCommentsOptions): Promise<WixListGroupPostCommentsResult>;
 export {};

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/wix-sdk/groups/src/extensions.d.ts

@@ -1,4 +1,21 @@
-import type { WixGroup } from "./index.js";
+import type { WixGroup, WixGroupsQueryRequest, WixQueryGroupsResponse, WixCallOptions } from "./index.js";
+/**
+ * List/search groups — POST /social-groups-proxy/groups/v2/groups/query.
+ *
+ * @scope visitor — browsing public groups needs no sign-in; this is an
+ * already-working consumer-app feature (group discovery). Whether a
+ * private/secret group's existence is visible to a non-member is unconfirmed
+ * — needsLiveProbe.
+ */
+export declare function queryGroups(req?: WixGroupsQueryRequest, opts?: WixCallOptions): Promise<WixQueryGroupsResponse>;
+/**
+ * Get a single group by id — GET /social-groups-proxy/groups/v2/groups/{id}.
+ *
+ * @scope visitor — same reasoning as `queryGroups`: reading a group's detail is
+ * an already-working consumer-app feature with no sign-in required for a
+ * public group.
+ */
+export declare function getGroup(id: string, opts?: WixCallOptions): Promise<WixGroup>;
 export interface WixGroupCoverImage {
     /** A previously-uploaded Wix Media file id (from site-media generate-upload-url + PUT). */
     mediaId?: string;
@@ -9,8 +26,24 @@ export interface WixGroupAccessRestriction {
     /** UNKNOWN | ADMIN_APPROVAL | PAID_PLANS | EVENTS */
     type?: string;
 }
+/** The real `GroupSettings` shape, ingested from `@wix/auto_sdk_groups_groups`
+ *  (codegen/wix/auto/specs/groups_groups/types.d.ts) at its latest published version as of
+ *  2026-10-06 — re-ingestion confirmed no additional fields exist upstream. Do NOT add
+ *  fields beyond this list without re-ingesting or a live probe first. */
+export interface WixGroupSettings {
+    membersCanInvite?: boolean;
+    membersCanApprove?: boolean;
+    welcomeMemberPostEnabled?: boolean;
+    groupDetailsChangedPostEnabled?: boolean;
+    showMemberList?: boolean;
+    /** No enum is pinned anywhere in the ingested spec — needsLiveProbe. */
+    allowedToInviteMembers?: string;
+    /** No enum is pinned anywhere in the ingested spec — needsLiveProbe. */
+    allowedToApproveJoinRequests?: string;
+    aiSpamProtectionEnabled?: boolean;
+}
 /** Writable group fields for create/update. */
-export interface WixGroupWrite {
+export interface WixGroupWriteInput {
     /** Required on create. */
     name?: string;
     /** UNKNOWN | PUBLIC | PRIVATE | SECRET */
@@ -21,15 +54,16 @@ export interface WixGroupWrite {
     description?: string;
     coverImage?: WixGroupCoverImage | null;
     accessRestriction?: WixGroupAccessRestriction;
+    settings?: WixGroupSettings;
 }
 export interface WixCreateGroupRequest {
-    group: WixGroupWrite;
+    group: WixGroupWriteInput;
 }
 export interface WixCreateGroupResponse {
     group: WixGroup;
 }
 export interface WixUpdateGroupRequest {
-    group: WixGroupWrite & {
+    group: WixGroupWriteInput & {
         id: string;
     };
 }
@@ -38,11 +72,35 @@ export interface WixUpdateGroupResponse {
 }
 export interface WixDeleteGroupResponse {
 }
-/** Create a group — POST /social-groups-proxy/groups/v2/groups. `name` is required; the entity is wrapped as `{ group }`. */
-export declare function createGroup(group: WixGroupWrite): Promise<WixCreateGroupResponse>;
-/** Update a group — PATCH /social-groups-proxy/groups/v2/groups/{id} (field-mask style). Only the supplied fields change; the request carries `{ group: { id, ... } }`. */
-export declare function updateGroup(groupId: string, group: WixGroupWrite): Promise<WixUpdateGroupResponse>;
-/** Delete a group — DELETE /social-groups-proxy/groups/v2/groups/{id}. */
+/**
+ * Create a group — POST /social-groups-proxy/groups/v2/groups. `name` is required;
+ * the entity is wrapped as `{ group }`.
+ *
+ * @scope owner — CONFIRMED: requires a true owner/admin-scoped API token. Returns
+ * HTTP 403 for every member session, including the site owner's own account signed
+ * in via a normal member-login flow. There is NO member-side workaround — do not
+ * wire this to a consumer-facing "create group" action. See the section note above
+ * for the reproduction.
+ */
+export declare function createGroup(group: WixGroupWriteInput): Promise<WixCreateGroupResponse>;
+/**
+ * Update a group — PATCH /social-groups-proxy/groups/v2/groups/{id} (field-mask style).
+ * Only the supplied fields change; the request carries `{ group: { id, ... } }`.
+ *
+ * @scope owner — VERY LIKELY the same owner/admin-scoped-token requirement as
+ * `createGroup` (same entity, same write-class, originally verified together via
+ * "the real Owner Create/Edit-Group flow") — but NOT independently re-tested
+ * against a member session this round. needsLiveProbe to confirm directly rather
+ * than by inference.
+ */
+export declare function updateGroup(groupId: string, group: WixGroupWriteInput): Promise<WixUpdateGroupResponse>;
+/**
+ * Delete a group — DELETE /social-groups-proxy/groups/v2/groups/{id}.
+ *
+ * @scope owner — VERY LIKELY the same owner/admin-scoped-token requirement as
+ * `createGroup` (same reasoning as `updateGroup` above) — not independently
+ * re-tested against a member session this round. needsLiveProbe.
+ */
 export declare function deleteGroup(groupId: string): Promise<WixDeleteGroupResponse>;
 export interface WixGroupJoinResponse {
     member?: {
@@ -53,9 +111,18 @@ export interface WixGroupJoinResponse {
         };
     };
 }
-/** Join a group as the signed-in member — POST /social-groups/v2/groups/{id}/join. */
+/**
+ * Join a group as the signed-in member — POST /social-groups/v2/groups/{id}/join.
+ *
+ * @scope member — a self-service action any signed-in member session can reach
+ * (distinct REST base from group CRUD above, which is owner-only). Verified live.
+ */
 export declare function joinGroup(groupId: string): Promise<WixGroupJoinResponse>;
-/** Leave a group as the signed-in member — POST /social-groups/v2/groups/{id}/leave. */
+/**
+ * Leave a group as the signed-in member — POST /social-groups/v2/groups/{id}/leave.
+ *
+ * @scope member — same reasoning as `joinGroup`. Verified live.
+ */
 export declare function leaveGroup(groupId: string): Promise<Record<string, never>>;
 export interface WixGroupMember {
     /** Site member id (resolve to name/photo via the Members API). */
@@ -74,7 +141,147 @@ export interface WixQueryGroupMembersResponse {
         total?: number;
     };
 }
-/** Query a group's members — POST /social-groups-proxy/members/v2/groups/{groupId}/members/query.
- *  The members service lives behind the `members` proxy base (NOT `groups`);
- *  live-verified 2026-06-19 (the `groups` base 404s, this base returns 200). */
+/**
+ * Query a group's members — POST /social-groups-proxy/members/v2/groups/{groupId}/members/query.
+ * The members service lives behind the `members` proxy base (NOT `groups`);
+ * live-verified 2026-06-19 (the `groups` base 404s, this base returns 200).
+ *
+ * @scope member — reachable by a signed-in member session (listing a group's
+ * members is an already-working consumer-app feature); visitor/anonymous
+ * readability for a public group is unconfirmed — needsLiveProbe.
+ */
 export declare function queryMembers(groupId: string, limit?: number): Promise<WixQueryGroupMembersResponse>;
+export interface WixJoinGroupRequest {
+    siteMemberId?: string;
+    contactId?: string;
+    /** No enum is pinned anywhere in the ingested spec — needsLiveProbe. */
+    status?: string;
+    requestDetails?: {
+        rejectionReason?: string;
+    };
+}
+export interface WixListJoinGroupRequestsResponse {
+    joinGroupRequests?: WixJoinGroupRequest[];
+    metadata?: {
+        count?: number;
+        offset?: number;
+        total?: number;
+        tooManyToCount?: boolean;
+    };
+}
+/**
+ * List a group's pending join requests — GET /social-groups-proxy/join/v2/groups/{groupId}/join-requests.
+ *
+ * verify-live: not yet called against a real group — path and shape come from the
+ * ingested Social Groups spec.
+ *
+ * @scope member — documented as reachable by a signed-in member whose in-group
+ * role is admin/manager (not an owner-scoped API token — see the section's "OPEN
+ * QUESTION" note); a regular member gets 403. Not independently live-probed.
+ */
+export declare function listJoinGroupRequests(groupId: string, limit?: number, offset?: number): Promise<WixListJoinGroupRequestsResponse>;
+export interface WixApproveJoinGroupRequestsResponse {
+    joinGroupRequests?: WixJoinGroupRequest[];
+}
+/**
+ * Approve pending join requests — POST /social-groups-proxy/join/v2/groups/{groupId}/join-requests/approve,
+ * body { groupId, memberIds }.
+ *
+ * verify-live: not yet called against a real group — path and shape come from the
+ * ingested Social Groups spec.
+ *
+ * @scope member — same documented-but-unverified basis as `listJoinGroupRequests`
+ * (see the section's "OPEN QUESTION" note) — a regular member gets 403.
+ */
+export declare function approveJoinGroupRequests(groupId: string, memberIds: string[]): Promise<WixApproveJoinGroupRequestsResponse>;
+export interface WixJoinGroupRequestRejection {
+    memberId: string;
+    reason?: string;
+}
+export interface WixRejectJoinGroupRequestsResponse {
+    joinGroupRequests?: WixJoinGroupRequest[];
+}
+/**
+ * Reject pending join requests — POST /social-groups-proxy/join/v2/groups/{groupId}/join-requests/reject,
+ * body { groupId, rejections }.
+ *
+ * verify-live: not yet called against a real group — path and shape come from the
+ * ingested Social Groups spec.
+ *
+ * @scope member — same documented-but-unverified basis as `listJoinGroupRequests`
+ * (see the section's "OPEN QUESTION" note) — a regular member gets 403.
+ */
+export declare function rejectJoinGroupRequests(groupId: string, rejections: WixJoinGroupRequestRejection[]): Promise<WixRejectJoinGroupRequestsResponse>;
+export interface WixGroupRole {
+    value?: string;
+}
+export interface WixAssignRoleResponse {
+    groupId?: string;
+    memberIds?: string[];
+    role?: WixGroupRole;
+}
+/**
+ * Assign a role to group members — POST /social-groups-proxy/roles/v2/groups/{groupId}/roles/assign,
+ * body { groupId, memberIds, role: { value } }. `role` is a loose string, not a union: no
+ * literal role value (e.g. "ADMIN"/"MEMBER") is pinned anywhere in the ingested spec —
+ * needsLiveProbe.
+ *
+ * verify-live: not yet called against a real group — path and shape come from the
+ * ingested Social Groups spec.
+ *
+ * @scope member — documented as reachable by a signed-in member whose in-group
+ * role is admin/manager, not an owner-scoped API token (see the join-request
+ * moderation section's "OPEN QUESTION" note above) — a regular member gets 403.
+ * Not independently live-probed.
+ */
+export declare function assignRole(groupId: string, memberIds: string[], role: string): Promise<WixAssignRoleResponse>;
+export interface WixUnassignRoleResponse {
+    groupId?: string;
+    siteMemberIds?: string[];
+    memberIds?: string[];
+    role?: WixGroupRole;
+}
+/**
+ * Remove a role from group members — POST /social-groups-proxy/roles/v2/groups/{groupId}/roles/unassign,
+ * body { groupId, memberIds, role: { value } }. Same unconfirmed-enum caveat as `assignRole`.
+ *
+ * verify-live: not yet called against a real group — path and shape come from the
+ * ingested Social Groups spec.
+ *
+ * @scope member — same documented-but-unverified basis as `assignRole` — a regular
+ * member gets 403.
+ */
+export declare function unassignRole(groupId: string, memberIds: string[], role: string): Promise<WixUnassignRoleResponse>;
+export interface WixRemoveGroupMembersResponse {
+}
+/**
+ * Remove members from a group — DELETE /social-groups-proxy/members/v2/groups/{groupId}/members,
+ * `memberIds` repeated in the QUERY STRING (`?memberIds=a&memberIds=b`), no body — every
+ * no-path-param DELETE this repo has confirmed against Wix's own generated clients sends its
+ * request that way (codegen/wix/tests/delete-query-string.test.ts); unlike a GET/HEAD body,
+ * which the gateway drops unconditionally, a DELETE body is NOT dropped — this is a convention
+ * match with Wix's own generated clients, not a gateway constraint. Same `members` proxy base
+ * `queryMembers` already live-verified (2026-06-19) uses; this specific verb+path combination
+ * is not yet live-probed.
+ *
+ * verify-live: not yet called against a real group — path and shape come from the
+ * ingested Social Groups spec.
+ *
+ * @scope member — same documented-but-unverified basis as `assignRole` — a regular
+ * member gets 403.
+ */
+export declare function removeGroupMembers(groupId: string, memberIds: string[]): Promise<WixRemoveGroupMembersResponse>;
+/**
+ * Update a group's settings — PATCH /social-groups-proxy/groups/v2/groups/{id} (field-mask),
+ * via the existing `updateGroup` RPC, body { group: { id, settings } }. No separate settings
+ * endpoint exists.
+ *
+ * verify-live: not yet called against a real group — path and shape come from the
+ * ingested Social Groups spec.
+ *
+ * @scope owner — rides the SAME `updateGroup` RPC that is very likely owner-token-only
+ * (see `updateGroup`'s own doc above) — reclassified from an earlier "group-admin
+ * member" assumption once `createGroup`'s owner-only finding showed group CRUD writes
+ * are gated by API-token tier, not in-group role. Not independently live-probed.
+ */
+export declare function updateGroupSettings(groupId: string, settings: WixGroupSettings): Promise<WixUpdateGroupResponse>;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/wix-sdk/groups/src/index.d.ts

@@ -86,6 +86,4 @@ export interface WixUpdateGroupResponse {
 }
 export interface WixDeleteGroupResponse {
 }
-export declare function queryGroups(req?: WixGroupsQueryRequest, opts?: WixCallOptions): Promise<WixQueryGroupsResponse>;
-export declare function getGroup(id: string, opts?: WixCallOptions): Promise<WixGroup>;
 export * from "./extensions.js";

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/wix-sdk/social-feed/src/index.d.ts

@@ -62,17 +62,26 @@ export interface WixListFeedItemsResponse {
     profiles?: WixFeedProfile[];
     nextPageCursor?: string;
 }
-/** List a group's activity feed — GET
- *  https://social.wix.com/serverless/mobile/feed/v4/feedPosts (the ENRICHED read the
- *  real mobile app uses). Each item carries content (Ricos blocks), commentsCount, and
- *  reactionsList (count = length); the response's top-level `profiles[]` resolves each
- *  item's author.id → userName + profileImage. Verified live (200). Replaces the lean
- *  GET /api/v1/feed/items read, which omitted counts + author. */
+/**
+ * List a group's activity feed — GET
+ * https://social.wix.com/serverless/mobile/feed/v4/feedPosts (the ENRICHED read the
+ * real mobile app uses). Each item carries content (Ricos blocks), commentsCount, and
+ * reactionsList (count = length); the response's top-level `profiles[]` resolves each
+ * item's author.id → userName + profileImage. Verified live (200). Replaces the lean
+ * GET /api/v1/feed/items read, which omitted counts + author.
+ *
+ * @scope member — verified live with a signed-in member session; visitor/anonymous
+ * readability of a public group's feed is unconfirmed.
+ */
 export declare function listFeedItems(groupId: string, limit?: number): Promise<WixListFeedItemsResponse>;
-/** Create a feed post in a group as the signed-in member — POST
- *  https://social.wix.com/api/v1/feed/items. `content` is the post text (modern
- *  posts are Ricos rich-content serialized to a string; plain text also works with
- *  contentType PLAIN_TEXT). Verified live (returns the created FeedItem). */
+/**
+ * Create a feed post in a group as the signed-in member — POST
+ * https://social.wix.com/api/v1/feed/items. `content` is the post text (modern
+ * posts are Ricos rich-content serialized to a string; plain text also works with
+ * contentType PLAIN_TEXT). Verified live (returns the created FeedItem).
+ *
+ * @scope member — requires a signed-in site member. Verified live.
+ */
 export declare function createFeedItem(groupId: string, content: string): Promise<WixFeedItem>;
 export interface WixReactionsSummary {
     total?: number;
@@ -81,16 +90,24 @@ export interface WixReactionsSummary {
 /** The default "like" reaction is the THUMBS_UP emoji — NOT the literal "LIKE".
  *  The real client's DEFAULT_REACTION is ReactionCode.THUMBS_UP ('👍'). */
 export declare const DEFAULT_REACTION = "\uD83D\uDC4D";
-/** Like (react to) a feed item as the signed-in member. Verified live (200 →
- *  { total, reactionCodeCounts }). The real mobile app posts to the Groups
- *  mobile-serverless wrapper (NOT the raw /api/v1/reactions REST route, which
- *  404s for the member): POST /serverless/mobile/feed/v3/addReaction with
- *  { containerId=groupId, appDefId(Groups), reactionCode(emoji), resourceId=feedItemId, mode }.
- *  Auth is the signed instance (the wixApi bridge attaches it). `mode:"APPEND"`
- *  adds without clearing other reactions. (RE'd from wix-one-app-feed
- *  feed-api.reactionPress + groups-mobile-serverless addReaction.) */
+/**
+ * Like (react to) a feed item as the signed-in member. Verified live (200 →
+ * { total, reactionCodeCounts }). The real mobile app posts to the Groups
+ * mobile-serverless wrapper (NOT the raw /api/v1/reactions REST route, which
+ * 404s for the member): POST /serverless/mobile/feed/v3/addReaction with
+ * { containerId=groupId, appDefId(Groups), reactionCode(emoji), resourceId=feedItemId, mode }.
+ * Auth is the signed instance (the wixApi bridge attaches it). `mode:"APPEND"`
+ * adds without clearing other reactions. (RE'd from wix-one-app-feed
+ * feed-api.reactionPress + groups-mobile-serverless addReaction.)
+ *
+ * @scope member — requires a signed-in site member. Verified live.
+ */
 export declare function reactToFeedItem(feedItemId: string, groupId: string, reactionCode?: string): Promise<WixReactionsSummary>;
-/** Remove the member's reaction from a feed item — POST
- *  /serverless/mobile/feed/v2/removeReaction (same body minus `mode`).
- *  Verified live (200 → total decremented). */
+/**
+ * Remove the member's reaction from a feed item — POST
+ * /serverless/mobile/feed/v2/removeReaction (same body minus `mode`).
+ * Verified live (200 → total decremented).
+ *
+ * @scope member — requires a signed-in site member. Verified live.
+ */
 export declare function unreactFeedItem(feedItemId: string, groupId: string, reactionCode?: string): Promise<WixReactionsSummary>;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/wix-sdk/stores-v1/src/display.d.ts

@@ -26,6 +26,7 @@ export type WixMediaSlot = string | {
 export declare function mediaSlotUrl(value: WixMediaSlot | undefined, size?: WixImageSize | null): string;
 export interface StoreProduct {
     id?: string;
+    productType?: string;
     name?: string;
     slug?: string;
     description?: string;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/checkout.mjs

@@ -104,20 +104,36 @@ function listMyPlanOrders(opts = {}) {
 
 // ../../stdlib/flows/checkout/src/index.ts
 var GRANTS_ACCESS = "ACTIVE";
-async function entitlement() {
+async function activePlanIds() {
+  const ids = /* @__PURE__ */ new Set();
+  const pages = /* @__PURE__ */ new Set();
+  for (let offset = 0; ; offset += 50) {
+    const response = await listMyPlanOrders({ statuses: [GRANTS_ACCESS], limit: 50, offset });
+    const orders = response.orders ?? [];
+    const signature = JSON.stringify(orders);
+    if (pages.has(signature)) throw new Error("Active plan order pagination did not advance.");
+    pages.add(signature);
+    for (const order of orders) if (order.status === GRANTS_ACCESS && order.planId) ids.add(order.planId);
+    if (orders.length < 50) break;
+  }
+  return [...ids];
+}
+async function entitlement(planId) {
   try {
-    const res = await listMyPlanOrders({ statuses: [GRANTS_ACCESS], limit: 50 });
-    const active = (res.orders ?? []).find(
-      (o) => (o.status ?? "").toUpperCase() === GRANTS_ACCESS
-    );
-    return {
-      entitled: !!active,
-      planName: active?.planName ?? "",
-      planId: active?.planId ?? ""
-    };
+    const pages = /* @__PURE__ */ new Set();
+    for (let offset = 0; ; offset += 50) {
+      const res = await listMyPlanOrders({ statuses: [GRANTS_ACCESS], limit: 50, offset });
+      const orders = res.orders ?? [];
+      const page = JSON.stringify(orders.map((order) => [order.id, order.planId, order.status]));
+      if (orders.length === 50 && pages.has(page)) break;
+      pages.add(page);
+      const active = orders.find((order) => order.status === GRANTS_ACCESS && (!planId || order.planId === planId));
+      if (active) return { entitled: true, planName: active.planName ?? "", planId: active.planId ?? "" };
+      if (orders.length < 50) break;
+    }
   } catch {
-    return { entitled: false, planName: "", planId: "" };
   }
+  return { entitled: false, planName: "", planId: "" };
 }
 async function isEntitled() {
   return (await entitlement()).entitled;
@@ -129,7 +145,7 @@ async function payOrder(req) {
   }
   const availability = await isAvailable().catch(() => "unavailable");
   if (availability === "full" && req.snapshotId) {
-    if (req.mayCharge?.() === false) return WITHDRAWN;
+    if (await req.mayCharge?.() === false) return WITHDRAWN;
     const r = await proceedToPayment({
       appId: req.appId,
       snapshotId: req.snapshotId,
@@ -150,7 +166,7 @@ async function payOrder(req) {
   if (req.cashierUrl) {
     const url = await req.cashierUrl().catch(() => void 0);
     if (url) {
-      if (req.mayCharge?.() === false) return WITHDRAWN;
+      if (await req.mayCharge?.() === false) return WITHDRAWN;
       const opened = await open(url, "in_app_browser").catch(() => ({ opened: false }));
       if (opened.opened) return { kind: "handoff" };
     }
@@ -162,6 +178,7 @@ async function payOrder(req) {
 }
 export {
   GRANTS_ACCESS,
+  activePlanIds,
   entitlement,
   isEntitled,
   payOrder as payCashierOrder,