@wix/himalaya-cli 0.1353.0 → 0.1354.0

package/dist/cli.mjs

@@ -22017,7 +22017,7 @@ function usageStringCopyFor(permissionCopy) {
   }
   return out2;
 }
-var BRIDGE_CAPABILITY_IDS, KNOWN_CAPABILITY_IDS, CAPABILITY_LITERAL, BRIDGE_MARKERS, NEEDS_BOOT_WIRING, AWAITING_THIRD_PARTY_SIGN_OFF, NOT_DIST_ADDABLE;
+var BRIDGE_CAPABILITY_IDS, KNOWN_CAPABILITY_IDS, CAPABILITY_LITERAL, BRIDGE_MARKERS, NEEDS_BOOT_WIRING, NOT_DIST_ADDABLE;
 var init_known = __esm({
   "../../core/sdk/capability-catalog/src/known.ts"() {
     init_builtins();
@@ -22059,13 +22059,7 @@ var init_known = __esm({
       // on Android the shell must pick Godot's libc++_shared over the core's (himi-game's godotStl).
       godot: "needs the shell's GameSurface view and, on Android, its libc++_shared pick for the engine, which a build cannot add"
     });
-    AWAITING_THIRD_PARTY_SIGN_OFF = Object.freeze({
-      calls: "links the community libwebrtc engine (HimalayaCoreCalls / :himalaya-core-calls), whose third-party sign-off for store-shipping apps is still open, so a dist build does not add it to a customer binary"
-    });
-    NOT_DIST_ADDABLE = Object.freeze({
-      ...NEEDS_BOOT_WIRING,
-      ...AWAITING_THIRD_PARTY_SIGN_OFF
-    });
+    NOT_DIST_ADDABLE = NEEDS_BOOT_WIRING;
   }
 });
 
@@ -35387,6 +35381,69 @@ function resolveServeBase() {
   }
   return (raw ?? "").replace(/\/$/, "");
 }
+function resolvePlaneControlReadBase() {
+  const explicit = process.env.HIMALAYA_PLAYER_CONTROL_URL;
+  if (explicit) return explicit.replace(/\/$/, "");
+  const override = process.env.HIMALAYA_PLAYER_SERVE_URL;
+  if (override) {
+    const base = resolveServeBase();
+    return sameOrigin(base, LOCAL_ORIGINS.serve) ? LOCAL_ORIGINS.control : base;
+  }
+  let control = "";
+  try {
+    control = resolveTarget().control ?? "";
+  } catch {
+  }
+  const serve = resolveServeBase();
+  return isLocalHostUrl(control) && isLocalHostUrl(serve) && !sameUrlOrigin(control, serve) ? control.replace(/\/$/, "") : serve;
+}
+function isLocalHostUrl(url) {
+  let h2;
+  try {
+    h2 = new URL(url).hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  } catch {
+    return false;
+  }
+  if (h2 === "localhost" || h2 === "::1" || h2.endsWith(".local")) return true;
+  const p2 = h2.split(".").map(Number);
+  if (p2.length !== 4 || p2.some((n2) => !Number.isInteger(n2))) return false;
+  return p2[0] === 127 || p2[0] === 10 || p2[0] === 192 && p2[1] === 168 || p2[0] === 169 && p2[1] === 254 || p2[0] === 172 && p2[1] >= 16 && p2[1] <= 31;
+}
+function sameUrlOrigin(a2, b2) {
+  try {
+    return new URL(a2).origin === new URL(b2).origin;
+  } catch {
+    return false;
+  }
+}
+function isLoopbackUrl(url) {
+  try {
+    return ["127.0.0.1", "localhost", "[::1]"].includes(new URL(url).hostname);
+  } catch {
+    return false;
+  }
+}
+function sameOrigin(url, local) {
+  try {
+    const a2 = new URL(url);
+    const b2 = new URL(local);
+    return isLoopbackUrl(url) && a2.port === b2.port && a2.protocol === b2.protocol && (a2.pathname === "/" || a2.pathname === "");
+  } catch {
+    return false;
+  }
+}
+function tenantHostPlaneRead(url, headers2, hostApp, method = "GET") {
+  if (!hostApp || !isTenantHost(hostApp) || method !== "GET" && method !== "HEAD") return null;
+  const [path2, query = ""] = url.split("?");
+  if (path2 === "/v1/site/member-app/resolve") return resolvePlaneControlReadBase() || null;
+  if (path2 === "/v1/release/current") {
+    const app = new URLSearchParams(query).get("app")?.trim();
+    if (!app || app === hostApp || HOSTED_TENANTS[hostApp].includes(app)) return null;
+    if (targetTenant(url, headers2, hostApp) !== null) return null;
+    return resolveServeBase() || null;
+  }
+  return null;
+}
 function targetTenant(url, headers2, hostApp) {
   const hdr = headers2["x-himalaya-app"];
   const headerApp = Array.isArray(hdr) ? hdr[0] : hdr;
@@ -35454,6 +35511,7 @@ var PLAYER_APP_ID, HOSTED_TENANTS, TENANT_PREFIX, LOOPBACK_PEERS, STRIP_RESPONSE
 var init_player_proxy = __esm({
   "../../core/dev-server/src/player-proxy.ts"() {
     init_config();
+    init_serve_origins();
     PLAYER_APP_ID = "himi-player";
     HOSTED_TENANTS = {
       "himi-spaces-lite": ["himi-branded-lite"]
@@ -132468,6 +132526,8 @@ function createDevServer(opts = {}) {
               forwardAs: clientHost ? { host: clientHost, prefix: `${TENANT_PREFIX}${encodeURIComponent(tenant)}` } : void 0
             });
           }
+          const planeRead = tenantHostPlaneRead(url, req.headers, state.appName, req.method);
+          if (planeRead) return await proxyToServe(planeRead, req, res);
         }
         if (url.split("?")[0] === "/v1/app-icon" && req.method === "GET") {
           const iconApp = new URLSearchParams(url.split("?")[1] ?? "").get("app") ?? "";
@@ -156718,25 +156778,25 @@ var init_preview_assets_generated = __esm({
   "../../packages/serve/src/preview-assets.generated.ts"() {
     init_preview_assets_format();
     PREVIEW_ASSET_MANIFEST = [
-      { key: "assets/index-BDNhcRLx.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1271913, sha256: "b78f7b3400ea25a2066e24c6b771199b819a833b624499d221edbc5f1b01a18b" },
-      { key: "assets/pdf-mXRF2YFr.js", contentType: "application/javascript; charset=utf-8", offset: 1271921, length: 488199, sha256: "3ecd61c959307bee0f74d6d9a3c6ab94dbf7b7305d6d67e2f0167dbf3bc6034a" },
-      { key: "assets/pdf.worker.min-BQa_JDET.js", contentType: "application/javascript; charset=utf-8", offset: 1760120, length: 73, sha256: "41bcfda4f3c8c0a81c785ea87c69afc8e7d0ed8c333324aee94c273d881bb6aa" },
-      { key: "assets/pdf.worker.min-BmVo14Nb.mjs", contentType: "application/javascript; charset=utf-8", offset: 1760193, length: 1317034, sha256: "a33cfe728c584fdba4fcc1fd54bcdc2f9f2f13889ddbb5b2bd1d0f8cbe49b84e" },
-      { key: "assets/pdfDocument-BZIqh5sA.js", contentType: "application/javascript; charset=utf-8", offset: 3077227, length: 2858, sha256: "32abe2da16ae5c22ce831a4a75bdb6e6121dc99fdae72be8ec22038d6982dd81" },
-      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 3080085, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
-      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 3084695, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
-      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 3573279, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
-      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 3664203, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
-      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 3755187, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
-      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 3846167, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
-      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 3937039, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
-      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 4028019, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
-      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 4136655, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
-      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 4245739, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
-      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 4354787, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
-      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 4462487, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
-      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 4550595, length: 4947, sha256: "475486545202c2973900224ffffa48ffbd7313e49b559cbcf9be678b068bff82" },
-      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 4555542, length: 17512, sha256: "c5c8612a8b3f5a1828d0c6593106036a180eea11da80232f5181548a50679137" }
+      { key: "assets/index-CfDtWTd9.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1271649, sha256: "b09aff3c4ca8b6d279140f389c9c2c85988dd12e78414ac3e1584f72456ee566" },
+      { key: "assets/pdf-CVazw9Ub.js", contentType: "application/javascript; charset=utf-8", offset: 1271657, length: 488199, sha256: "e42ce9b09b54fe70642b68c38e7209b4a357177f277ef8c40faa3262f1853cde" },
+      { key: "assets/pdf.worker.min-BQa_JDET.js", contentType: "application/javascript; charset=utf-8", offset: 1759856, length: 73, sha256: "41bcfda4f3c8c0a81c785ea87c69afc8e7d0ed8c333324aee94c273d881bb6aa" },
+      { key: "assets/pdf.worker.min-BmVo14Nb.mjs", contentType: "application/javascript; charset=utf-8", offset: 1759929, length: 1317034, sha256: "a33cfe728c584fdba4fcc1fd54bcdc2f9f2f13889ddbb5b2bd1d0f8cbe49b84e" },
+      { key: "assets/pdfDocument-HGrmnRP0.js", contentType: "application/javascript; charset=utf-8", offset: 3076963, length: 2858, sha256: "abf488e7017dd90516a2ada53ec9f0f9bf9402173c8f5b7483917c4d60b03411" },
+      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 3079821, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
+      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 3084431, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
+      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 3573015, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
+      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 3663939, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
+      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 3754923, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
+      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 3845903, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
+      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 3936775, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
+      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 4027755, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
+      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 4136391, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
+      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 4245475, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
+      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 4354523, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
+      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 4462223, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
+      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 4550331, length: 4947, sha256: "d9b156d2824937902486f47a6250a5589f6e33f224eef7bd512506612779159e" },
+      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 4555278, length: 17512, sha256: "c5c8612a8b3f5a1828d0c6593106036a180eea11da80232f5181548a50679137" }
     ];
   }
 });

package/guides/web-page-native-sdk.md

@@ -39,10 +39,9 @@ Your page can only use capabilities the **app owner** turned on for your site. I
   `capabilities`, allowing **every** method the capability's page lists — except
   `presigned_upload.putFile`, which reads a device file and is allowed only when `files` is enabled
   too. So enabling a capability is enough; the owner does not list methods.
-- **What a Brandy app cannot enable:** `app_info`, `calls`, `godot`, `himi_apps`, `live_activity`,
+- **What a Brandy app cannot enable:** `app_info`, `godot`, `himi_apps`, `live_activity`,
   `local_database`, `release_control`, `system_intents`, `ui` and `wix_platform` — most need wiring
-  a website app's shell does not have, and `calls` waits on a third-party sign-off for its WebRTC
-  engine, so plan your page without them. `base44` works only when the
+  a website app's shell does not have, so plan your page without them. `base44` works only when the
   app also has a Base44 binding. Every other capability in the reference can be enabled; other Himi
   apps (not Brandy) may offer these too.
 - Enabling a capability changes the app's native permissions, so the owner ships a **new app

package/guides/web-page-sdk-reference.md

@@ -20,7 +20,7 @@ the SDK sources, so it matches the shipped SDKs.
 - [`biometrics`](https://apps.wix.com/_api/himi-serve/authoring/resource/web-sdk%2Fbiometrics?format=md) — Biometric authentication capability. 2 methods.
 - [`browser_auth`](https://apps.wix.com/_api/himi-serve/authoring/resource/web-sdk%2Fbrowser_auth?format=md) — Native browser SSO. 1 method.
 - [`calendar`](https://apps.wix.com/_api/himi-serve/authoring/resource/web-sdk%2Fcalendar?format=md) — Device calendar. 6 methods.
-- [`calls`](https://apps.wix.com/_api/himi-serve/authoring/resource/web-sdk%2Fcalls?format=md) — Real-time 1:1 audio calls (Stage 1). 16 methods · not in Brandy.
+- [`calls`](https://apps.wix.com/_api/himi-serve/authoring/resource/web-sdk%2Fcalls?format=md) — Real-time 1:1 audio calls (Stage 1). 16 methods.
 - [`camera`](https://apps.wix.com/_api/himi-serve/authoring/resource/web-sdk%2Fcamera?format=md) — Camera capability. 3 methods.
 - [`clipboard`](https://apps.wix.com/_api/himi-serve/authoring/resource/web-sdk%2Fclipboard?format=md) — System clipboard. 3 methods.
 - [`contacts`](https://apps.wix.com/_api/himi-serve/authoring/resource/web-sdk%2Fcontacts?format=md) — Device address book. 4 methods.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1353.0",
+  "version": "0.1354.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "1a0d58e6899a9865208dd609c52f853493400202cbdc1a198968c548"
+  "falconPackageHash": "07e69214f20355a26a4e813ff46d40f5f5e4f8eaff658f0598038078"
 }