@wix/himalaya-cli 0.1369.0 → 0.1371.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/dev-server/src/wix-cache-policy.d.ts

@@ -11,6 +11,9 @@ export interface WixCachePolicy {
     rules: WixCacheRule[];
     defaultCacheable: boolean;
 }
+/** The path a rule's prefix names: itself, or the path of an absolute `https://host/path` prefix
+ *  (an account-level read a worker makes to a full Wix URL) — so the platform denies apply to it. */
+export declare function rulePath(pathPrefix: string): string;
 export declare function clampRule(rule: WixCacheRule, denyPrefixes: string[], maxTTL: number): WixCacheRule;
 /** What an app declares in `defineApp({ cache })`. */
 export type DeclaredWixCache = AppCacheConfig;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/serve-runtime/src/wix-bridge.d.ts

@@ -141,4 +141,122 @@ export declare function wixClientIdOf(appConfigJson: string): {
 } | {
     error: "unsupported_auth" | "no_client_id";
 };
+/** The account-session cookies worth forwarding — `WixNativeAuthProvider.isForwardableWixSessionCookie`
+ *  (iOS) by name, and the predicate RFC 0071 §3 measured: an instance minted with exactly these works
+ *  as a plain `Authorization` header, and one minted with a session-BINDING cookie
+ *  (`server-session-bind`, `bSession`, …) would not. The mint and every forwarded call use this one
+ *  predicate, so the instance and the call always name the same principal. */
+export declare function isForwardableWixSessionCookie(name: string): boolean;
+/** [cookieHeader] narrowed to the forwardable account-session cookies, or "" when it carries no
+ *  `wixSession2` (nothing to act as). */
+export declare function forwardableWixSessionCookies(cookieHeader: string | null | undefined): string;
+/** Where an account sign-in starts: Wix's own login (email, Google, Apple, 2FA), back to [postLogin]. */
+export declare function wixAccountSignInUrl(postLogin: string): string;
+/**
+ * EVERY endpoint the account session is forwarded to: host, method and exact path, taken from what
+ * apps/himi-spaces-lite/{my-sites,join,site-open}.ts call (their header comments cite the RN Spaces
+ * sources). An exact path, not a prefix: a prefix on apps.wix.com would hand the account's session to
+ * every service mounted under it. Anything else gets no cookie — it is served by the bridge's other
+ * rungs, which carry none. tests/webwix-account.test.ts holds this list against those files.
+ */
+export declare const ACCOUNT_FORWARD_ALLOWLIST: ReadonlyArray<{
+    host: string;
+    method: string;
+    path: string;
+}>;
+/** The parsed target when [method] [url] is on `ACCOUNT_FORWARD_ALLOWLIST`, else null. https on the
+ *  default port, no userinfo — the same shape check as `isAllowedConsumerStreamTarget`. */
+export declare function allowedAccountTarget(method: string, url: string): URL | null;
+/** Whether a successful [method] [url] was a join (see `ACCOUNT_JOIN_PATHS`). */
+export declare function isAccountJoinCall(method: string, url: string): boolean;
+/**
+ * One allowlisted call as the account: the forwardable session cookies, the XSRF mirror and JSON
+ * accept (the recipe `wixOwnerSitesCall` documents), and — for a site-scoped call — the site's Member
+ * instance as a raw `Authorization` (RFC 0071 §3: never `Bearer`). Refuses anything off the
+ * allowlist, and never follows a redirect: a 3xx is this call's answer, not a hop that would carry
+ * the session somewhere else.
+ */
+export declare function wixAccountCall(method: string, url: string, body: string | undefined, sessionCookie: string, fetchImpl?: typeof fetch, forwardedHeaders?: Record<string, string>, memberInstance?: string): Promise<WixBridgeEnvelope>;
+/** RFC 0071 §3 — the account is not a member of [metaSiteId]. Raised ONLY by the Member mint (403/404)
+ *  or its validation, never by a call's own 403. The name is the contract: the bridge answers it as
+ *  `{"error":"NotSiteMember"}`, which apps/himi-spaces-lite/site-open.ts `isNotSiteMember` reads. */
+export declare class NotSiteMember extends Error {
+    readonly metaSiteId: string;
+    readonly reason: string;
+    readonly code = "NotSiteMember";
+    constructor(metaSiteId: string, reason: string);
+}
+/** The account session itself is gone: the Member mint — which authenticates by the session alone —
+ *  answered 401. Not a membership verdict and not transient: the host must
+ *  sign the account in again. */
+export declare class AccountSessionExpired extends Error {
+    readonly metaSiteId: string;
+    readonly reason: string;
+    readonly code = "AccountSessionExpired";
+    constructor(metaSiteId: string, reason: string);
+}
+/** The Member instance could not be had for a TRANSIENT reason (network, 5xx, timeout). Not a
+ *  membership verdict: a host retries it and never shows the join screen. */
+export declare class SiteInstanceUnavailable extends Error {
+    readonly metaSiteId: string;
+    readonly reason: string;
+    readonly code = "SiteInstanceUnavailable";
+    constructor(metaSiteId: string, reason: string);
+}
+/** Why [instance] is not a Member instance of [metaSiteId], or null when it is — iOS
+ *  `memberInstanceRejection`, word for word: the payload names the site, a non-empty `siteMemberId`
+ *  equal to `uid`, and no `permissions` (a User instance carries `permissions: "OWNER"`). */
+export declare function memberInstanceRejection(instance: string, metaSiteId: string): string | null;
+/** When to stop using [instance]: 60 s before its payload's `expirationDate` (RFC 0071 §3), or
+ *  [fallbackMs] after [now] when it carries none. */
+export declare function memberInstanceRefreshAt(instance: string, now: number, fallbackMs?: number): number;
+/** How long a refusal is remembered. Short on purpose: it only stops one screen's burst of calls from
+ *  re-minting per call; a join clears it at once (`forgetRefusals`). */
+export declare const MEMBER_NEGATIVE_TTL_MS = 10000;
+/** A transient failure is remembered for less: it is the next retry's to try. */
+export declare const MEMBER_TRANSIENT_TTL_MS = 3000;
+/**
+ * RFC 0071 §3 — per-(site, account session) Member instances: single-flight (N racing calls cost one
+ * mint), a short negative cache, refreshed 60 s before the instance's own expiry. Keyed by a DIGEST
+ * of `wixSession2`, never the cookie itself. Same mint as owner preview's `OwnerInstanceCache`, with
+ * `signed_instance_type=Member`, and — unlike owner mode — no fallback: a failure fails the call.
+ */
+export declare class MemberInstanceCache {
+    private fetchImpl;
+    private mintTimeoutMs;
+    private cache;
+    private inflight;
+    private refusals;
+    /** Per session: bumped by `forgetSession` / `forgetRefusals`. A mint that started under an older
+     *  generation still answers its own callers, but writes nothing back — otherwise a mint in flight
+     *  across a sign-out re-caches the signed-out instance, and one in flight across a join re-caches
+     *  the `NotSiteMember` the join just made stale. */
+    private generations;
+    constructor(fetchImpl?: typeof fetch, mintTimeoutMs?: number);
+    private session;
+    private key;
+    /** The site's Member instance for this session. Throws `NotSiteMember` or `SiteInstanceUnavailable`.
+     *  `force`: Wix refused the instance this cache handed out (a 401) — mint a new one. */
+    instance(msid: string, sessionCookie: string, opts?: {
+        force?: boolean;
+        now?: number;
+    }): Promise<string>;
+    /** Drop everything held for this session — instances and refusals alike: its sign-out or expiry
+     *  (RFC 0071 §6, sign-out purges every per-site instance). */
+    forgetSession(sessionCookie: string): void;
+    /** Drop every refusal held for this session — after a join, which makes them stale. */
+    forgetRefusals(sessionCookie: string): void;
+    private mint;
+}
+/** The bridge's answer for a Member-instance failure: `NotSiteMember` → 403, `AccountSessionExpired` →
+ *  401, anything else → 502, in the `{ error }` shape every bridge refusal has. The name in `error` is
+ *  what a host branches on. */
+export declare function memberInstanceRefusal(e: unknown): {
+    status: number;
+    body: {
+        error: string;
+        metaSiteId?: string;
+        reason?: string;
+    };
+};
 export {};

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/define-app.d.ts

@@ -652,11 +652,15 @@ export interface AndroidAssetLinks {
     packageName: string;
     sha256CertFingerprints: string[];
 }
+/** An absolute cache-rule prefix: `https://` + a Wix host + a path (`https://apps.wix.com/…`). */
+export declare function isWixAbsoluteCachePrefix(prefix: string): boolean;
 /** Per-endpoint cache intent declared by an app. */
 export interface AppCacheRule {
     /** HTTP method this rule applies to. Omit for any method. */
     method?: string;
-    /** Path prefix, e.g. "/stores/v3/products/". Matched by prefix. */
+    /** Path prefix, e.g. "/stores/v3/products/". Matched by prefix. A call a worker makes to an
+     *  absolute Wix URL (an account-level read such as `https://apps.wix.com/…`) is matched by an
+     *  absolute prefix instead: `https://` + a Wix host (`*.wix.com`, `*.wixapis.com`) + a path. */
     pathPrefix: string;
     cacheable: boolean;
     /** Fresh window, seconds. */

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/core.mjs

@@ -7272,6 +7272,12 @@ function validateNames(kind, names) {
 }
 
 // ../../core/ts/src/define-app.ts
+function isWixAbsoluteCachePrefix(prefix) {
+  const m = /^https:\/\/([a-z0-9.-]+)(\/.*)$/i.exec(prefix);
+  if (!m) return false;
+  const host = m[1].toLowerCase();
+  return host === "wix.com" || host.endsWith(".wix.com") || host === "wixapis.com" || host.endsWith(".wixapis.com");
+}
 var ALL_ORIENTATIONS = [
   "portrait",
   "portraitUpsideDown",
@@ -7630,8 +7636,8 @@ function validateConfigShape(config) {
   }
   if (config.cache) {
     for (const r of config.cache.rules ?? []) {
-      if (!r.pathPrefix || !r.pathPrefix.startsWith("/")) {
-        throw new Error(`defineApp: cache rule pathPrefix must start with "/". Got "${r.pathPrefix}".`);
+      if (!r.pathPrefix || !(r.pathPrefix.startsWith("/") || isWixAbsoluteCachePrefix(r.pathPrefix))) {
+        throw new Error(`defineApp: cache rule pathPrefix must start with "/" or be an https:// Wix URL (*.wix.com, *.wixapis.com). Got "${r.pathPrefix}".`);
       }
       if (r.ttl < 0 || (r.swr ?? 0) < 0) {
         throw new Error(`defineApp: cache rule ttl/swr must be non-negative (pathPrefix "${r.pathPrefix}").`);
@@ -13851,6 +13857,7 @@ export {
   isValidStreamPolicy,
   isViewTarget,
   isWidgetFamilySurface,
+  isWixAbsoluteCachePrefix,
   layoutDirection,
   mergeIdiomOverlay,
   mergeSiteMenu,