@wix/himalaya-cli 0.1367.0 → 0.1368.0

package/dist/cli.mjs

@@ -35371,6 +35371,16 @@ function loadSupervisorRegistry() {
 function isPlayerHost(appName2) {
   return appName2 === PLAYER_APP_ID || process.env.HIMALAYA_DEV_MULTI_APP === "1";
 }
+function tenantsOf(hostApp) {
+  if (!Object.prototype.hasOwnProperty.call(HOSTED_TENANTS, hostApp)) return [];
+  const fixed = HOSTED_TENANTS[hostApp];
+  const extra = (process.env.HIMALAYA_DEV_HOSTED_TENANTS ?? "").split(",").map((a2) => a2.trim()).filter((a2) => /^[a-z0-9][a-z0-9._-]{0,127}$/i.test(a2) && a2 !== hostApp && a2 !== PLAYER_APP_ID);
+  return extra.length ? [...fixed, ...extra.filter((a2) => !fixed.includes(a2))] : fixed;
+}
+function optedInTenant(tenant) {
+  if (Object.values(HOSTED_TENANTS).some((t2) => t2.includes(tenant))) return false;
+  return (process.env.HIMALAYA_DEV_HOSTED_TENANTS ?? "").split(",").some((a2) => a2.trim() === tenant);
+}
 function isTenantHost(appName2) {
   return !!appName2 && Object.prototype.hasOwnProperty.call(HOSTED_TENANTS, appName2);
 }
@@ -35386,7 +35396,7 @@ function resolveTenantBase(tenant, registry2 = loadSupervisorRegistry) {
       if (running?.status === "running" && running.port) port = running.port;
     } catch {
     }
-    port ??= ledgerDevServerPort(tenant);
+    if (!optedInTenant(tenant)) port ??= ledgerDevServerPort(tenant);
     if (port) return `http://127.0.0.1:${port}`;
   }
   return resolveServeBase();
@@ -35411,7 +35421,7 @@ function tenantPrefixed(url, hostApp, method = "GET") {
     return null;
   }
   if (!normalized.startsWith("/v1/") || normalized !== path2 || isTenantAdminPath(normalized)) return null;
-  return HOSTED_TENANTS[hostApp].includes(tenant) ? { tenant, url: tenantUrl } : null;
+  return tenantsOf(hostApp).includes(tenant) ? { tenant, url: tenantUrl } : null;
 }
 function forwardedBaseUrl(req) {
   if (!LOOPBACK_PEERS.has(req.socket?.remoteAddress ?? "")) return null;
@@ -35493,7 +35503,9 @@ function tenantHostPlaneRead(url, headers2, hostApp, method = "GET") {
   if (path2 === "/v1/release/current") {
     const app = new URLSearchParams(query).get("app")?.trim();
     if (!app || app === hostApp || HOSTED_TENANTS[hostApp].includes(app)) return null;
-    if (targetTenant(url, headers2, hostApp) !== null) return null;
+    const hdr = headers2["x-himalaya-app"];
+    const headerApp = (Array.isArray(hdr) ? hdr[0] : hdr)?.trim();
+    if (headerApp && tenantsOf(hostApp).includes(headerApp)) return null;
     return resolveServeBase() || null;
   }
   return null;
@@ -35513,7 +35525,7 @@ function targetTenant(url, headers2, hostApp) {
   }
   if (!app) return null;
   if (app === hostApp || app === PLAYER_APP_ID) return null;
-  if (hostApp && isTenantHost(hostApp) && !HOSTED_TENANTS[hostApp].includes(app)) return null;
+  if (hostApp && isTenantHost(hostApp) && !tenantsOf(hostApp).includes(app)) return null;
   return app;
 }
 function shouldServeFromPlane(url, headers2, hostApp) {
@@ -132563,6 +132575,8 @@ function createDevServer(opts = {}) {
         await maybeReseedNetMocks(state);
         if (url.startsWith("/__dev/")) return await handleDev(req, res, state);
         if (isTenantHost(state.appName)) {
+          const planeRead = tenantHostPlaneRead(url, req.headers, state.appName, req.method);
+          if (planeRead) return await proxyToServe(planeRead, req, res);
           const prefixed = tenantPrefixed(url, state.appName, req.method);
           const tenant = prefixed?.tenant ?? (shouldServeFromPlane(url, req.headers, state.appName) && !isTenantAdminPath(url) ? targetTenant(url, req.headers, state.appName) : null);
           if (tenant) {
@@ -132580,8 +132594,6 @@ function createDevServer(opts = {}) {
               forwardAs: clientHost ? { host: clientHost, prefix: `${TENANT_PREFIX}${encodeURIComponent(tenant)}` } : void 0
             });
           }
-          const planeRead = tenantHostPlaneRead(url, req.headers, state.appName, req.method);
-          if (planeRead) return await proxyToServe(planeRead, req, res);
         }
         if (url.split("?")[0] === "/v1/app-icon" && req.method === "GET") {
           const iconApp = new URLSearchParams(url.split("?")[1] ?? "").get("app") ?? "";
@@ -170122,19 +170134,42 @@ function decideSiteApp(input) {
     ...input.installedVersion ? { installedVersion: input.installedVersion } : {}
   });
   if (!verdict.ok) return fallback(picked, verdict.reason);
-  if (!(input.hostable ?? NATIVELY_HOSTABLE_APPS).includes(picked)) {
+  const ungranted = req.requirements.capabilities.filter((c2) => !HOSTED_APP_CAPABILITIES.includes(c2));
+  if ((input.hostable ?? NATIVELY_HOSTABLE_APPS) === "any" && ungranted.length) {
+    return fallback(picked, `This Spaces build does not grant a member app ${ungranted.join(", ")} yet (${picked} declares it)`);
+  }
+  const hostable = input.hostable ?? NATIVELY_HOSTABLE_APPS;
+  if (hostable !== "any" && !hostable.includes(picked)) {
     return fallback(picked, `This Spaces build cannot host a custom member app yet (${picked} is compatible)`);
   }
   return { appId: picked, source: "picked" };
 }
-var DEFAULT_SITE_APP, NATIVELY_HOSTABLE_APPS, APP_ID3;
+var DEFAULT_SITE_APP, NATIVELY_HOSTABLE_APPS, HOSTED_APP_CAPABILITIES, APP_ID3;
 var init_site_app = __esm({
   "../../apps/himi-spaces-lite/site-app.ts"() {
     init_host_compatibility();
     init_registry_app_normalize();
     init_site_open();
     DEFAULT_SITE_APP = HOSTED_MEMBER_APP;
-    NATIVELY_HOSTABLE_APPS = [DEFAULT_SITE_APP];
+    NATIVELY_HOSTABLE_APPS = "any";
+    HOSTED_APP_CAPABILITIES = [
+      "animation",
+      "app_info",
+      "clipboard",
+      "file_picker",
+      "haptics",
+      "keyboard",
+      "media_playback",
+      "motion",
+      "on_device_ai",
+      "open_url",
+      "pdf",
+      "share",
+      "stream",
+      "theme",
+      "ui",
+      "wix_api"
+    ];
     APP_ID3 = /^[a-z0-9][a-z0-9._-]{0,127}$/i;
   }
 });

package/guides/himi-json-output.md

@@ -135,10 +135,12 @@ keeps the service's own `error` in `serverError` and its HTTP `status`; the CLI
 
 `show` succeeds with `opens` (what members get: the picked app or `himi-branded-lite`), `compatible`
 (whether the picked release fits the Spaces host manifest, judged with `checkHostCompatibility`), and —
-whenever members get Branded Lite instead of the pick — `reason`. `opens` is Spaces' own decision, so a
-compatible pick that this Spaces build cannot host yet reports `compatible: true` with `opens:
-"himi-branded-lite"` and that reason. An incompatible pick is not a failure: it is `ok: true` with
-`compatible: false`.
+whenever members get Branded Lite instead of the pick — `reason`. `opens` is Spaces' own decision: a
+compatible pick reports `compatible: true` with `opens` naming that app — except one that needs a
+capability the hosted-app sandbox does not grant (on-device stores such as `local_database`,
+`secure_storage` and `files`, or push, purchases, release control and the like), which reports
+`compatible: true` with `opens: "himi-branded-lite"` and that reason. Read `opens`, not `compatible`, for
+what members get. An incompatible pick is not a failure: it is `ok: true` with `compatible: false`.
 
 ## Follow-ups
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1367.0",
+  "version": "0.1368.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "f0bd979c3332da32c4c59ee213e5f02fad1f6edd492c8ab44ee4947b"
+  "falconPackageHash": "b0dba7f9b4c5184e704a739e1f459e4930cc9b446af7d0866d9038ae"
 }