@wix/himalaya-cli 0.1370.0 → 0.1372.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/serve-runtime/src/wix-bridge.d.ts

@@ -141,4 +141,122 @@ export declare function wixClientIdOf(appConfigJson: string): {
 } | {
     error: "unsupported_auth" | "no_client_id";
 };
+/** The account-session cookies worth forwarding — `WixNativeAuthProvider.isForwardableWixSessionCookie`
+ *  (iOS) by name, and the predicate RFC 0071 §3 measured: an instance minted with exactly these works
+ *  as a plain `Authorization` header, and one minted with a session-BINDING cookie
+ *  (`server-session-bind`, `bSession`, …) would not. The mint and every forwarded call use this one
+ *  predicate, so the instance and the call always name the same principal. */
+export declare function isForwardableWixSessionCookie(name: string): boolean;
+/** [cookieHeader] narrowed to the forwardable account-session cookies, or "" when it carries no
+ *  `wixSession2` (nothing to act as). */
+export declare function forwardableWixSessionCookies(cookieHeader: string | null | undefined): string;
+/** Where an account sign-in starts: Wix's own login (email, Google, Apple, 2FA), back to [postLogin]. */
+export declare function wixAccountSignInUrl(postLogin: string): string;
+/**
+ * EVERY endpoint the account session is forwarded to: host, method and exact path, taken from what
+ * apps/himi-spaces-lite/{my-sites,join,site-open}.ts call (their header comments cite the RN Spaces
+ * sources). An exact path, not a prefix: a prefix on apps.wix.com would hand the account's session to
+ * every service mounted under it. Anything else gets no cookie — it is served by the bridge's other
+ * rungs, which carry none. tests/webwix-account.test.ts holds this list against those files.
+ */
+export declare const ACCOUNT_FORWARD_ALLOWLIST: ReadonlyArray<{
+    host: string;
+    method: string;
+    path: string;
+}>;
+/** The parsed target when [method] [url] is on `ACCOUNT_FORWARD_ALLOWLIST`, else null. https on the
+ *  default port, no userinfo — the same shape check as `isAllowedConsumerStreamTarget`. */
+export declare function allowedAccountTarget(method: string, url: string): URL | null;
+/** Whether a successful [method] [url] was a join (see `ACCOUNT_JOIN_PATHS`). */
+export declare function isAccountJoinCall(method: string, url: string): boolean;
+/**
+ * One allowlisted call as the account: the forwardable session cookies, the XSRF mirror and JSON
+ * accept (the recipe `wixOwnerSitesCall` documents), and — for a site-scoped call — the site's Member
+ * instance as a raw `Authorization` (RFC 0071 §3: never `Bearer`). Refuses anything off the
+ * allowlist, and never follows a redirect: a 3xx is this call's answer, not a hop that would carry
+ * the session somewhere else.
+ */
+export declare function wixAccountCall(method: string, url: string, body: string | undefined, sessionCookie: string, fetchImpl?: typeof fetch, forwardedHeaders?: Record<string, string>, memberInstance?: string): Promise<WixBridgeEnvelope>;
+/** RFC 0071 §3 — the account is not a member of [metaSiteId]. Raised ONLY by the Member mint (403/404)
+ *  or its validation, never by a call's own 403. The name is the contract: the bridge answers it as
+ *  `{"error":"NotSiteMember"}`, which apps/himi-spaces-lite/site-open.ts `isNotSiteMember` reads. */
+export declare class NotSiteMember extends Error {
+    readonly metaSiteId: string;
+    readonly reason: string;
+    readonly code = "NotSiteMember";
+    constructor(metaSiteId: string, reason: string);
+}
+/** The account session itself is gone: the Member mint — which authenticates by the session alone —
+ *  answered 401. Not a membership verdict and not transient: the host must
+ *  sign the account in again. */
+export declare class AccountSessionExpired extends Error {
+    readonly metaSiteId: string;
+    readonly reason: string;
+    readonly code = "AccountSessionExpired";
+    constructor(metaSiteId: string, reason: string);
+}
+/** The Member instance could not be had for a TRANSIENT reason (network, 5xx, timeout). Not a
+ *  membership verdict: a host retries it and never shows the join screen. */
+export declare class SiteInstanceUnavailable extends Error {
+    readonly metaSiteId: string;
+    readonly reason: string;
+    readonly code = "SiteInstanceUnavailable";
+    constructor(metaSiteId: string, reason: string);
+}
+/** Why [instance] is not a Member instance of [metaSiteId], or null when it is — iOS
+ *  `memberInstanceRejection`, word for word: the payload names the site, a non-empty `siteMemberId`
+ *  equal to `uid`, and no `permissions` (a User instance carries `permissions: "OWNER"`). */
+export declare function memberInstanceRejection(instance: string, metaSiteId: string): string | null;
+/** When to stop using [instance]: 60 s before its payload's `expirationDate` (RFC 0071 §3), or
+ *  [fallbackMs] after [now] when it carries none. */
+export declare function memberInstanceRefreshAt(instance: string, now: number, fallbackMs?: number): number;
+/** How long a refusal is remembered. Short on purpose: it only stops one screen's burst of calls from
+ *  re-minting per call; a join clears it at once (`forgetRefusals`). */
+export declare const MEMBER_NEGATIVE_TTL_MS = 10000;
+/** A transient failure is remembered for less: it is the next retry's to try. */
+export declare const MEMBER_TRANSIENT_TTL_MS = 3000;
+/**
+ * RFC 0071 §3 — per-(site, account session) Member instances: single-flight (N racing calls cost one
+ * mint), a short negative cache, refreshed 60 s before the instance's own expiry. Keyed by a DIGEST
+ * of `wixSession2`, never the cookie itself. Same mint as owner preview's `OwnerInstanceCache`, with
+ * `signed_instance_type=Member`, and — unlike owner mode — no fallback: a failure fails the call.
+ */
+export declare class MemberInstanceCache {
+    private fetchImpl;
+    private mintTimeoutMs;
+    private cache;
+    private inflight;
+    private refusals;
+    /** Per session: bumped by `forgetSession` / `forgetRefusals`. A mint that started under an older
+     *  generation still answers its own callers, but writes nothing back — otherwise a mint in flight
+     *  across a sign-out re-caches the signed-out instance, and one in flight across a join re-caches
+     *  the `NotSiteMember` the join just made stale. */
+    private generations;
+    constructor(fetchImpl?: typeof fetch, mintTimeoutMs?: number);
+    private session;
+    private key;
+    /** The site's Member instance for this session. Throws `NotSiteMember` or `SiteInstanceUnavailable`.
+     *  `force`: Wix refused the instance this cache handed out (a 401) — mint a new one. */
+    instance(msid: string, sessionCookie: string, opts?: {
+        force?: boolean;
+        now?: number;
+    }): Promise<string>;
+    /** Drop everything held for this session — instances and refusals alike: its sign-out or expiry
+     *  (RFC 0071 §6, sign-out purges every per-site instance). */
+    forgetSession(sessionCookie: string): void;
+    /** Drop every refusal held for this session — after a join, which makes them stale. */
+    forgetRefusals(sessionCookie: string): void;
+    private mint;
+}
+/** The bridge's answer for a Member-instance failure: `NotSiteMember` → 403, `AccountSessionExpired` →
+ *  401, anything else → 502, in the `{ error }` shape every bridge refusal has. The name in `error` is
+ *  what a host branches on. */
+export declare function memberInstanceRefusal(e: unknown): {
+    status: number;
+    body: {
+        error: string;
+        metaSiteId?: string;
+        reason?: string;
+    };
+};
 export {};