@wix/himalaya-cli 0.1437.0 → 0.1439.0

package/dist/cli.mjs

@@ -6939,7 +6939,7 @@ function validator(schema) {
 }
 function compileV2(html, profile, options) {
   const diagnostics = [], sourceMap2 = {}, dependencies = [options.file];
-  const requiredCapabilities = /* @__PURE__ */ new Set();
+  const requiredCapabilities2 = /* @__PURE__ */ new Set();
   const $2 = cheerio2.load(html, { sourceCodeLocationInfo: true });
   const loc = (el2) => ({ file: options.file, line: el2?.sourceCodeLocation?.startLine ?? 1, column: el2?.sourceCodeLocation?.startCol ?? 1 });
   const error = (el2, code, message, hint) => diagnostics.push({ ...loc(el2), code, severity: "error", message, ...hint ? { hint } : {} });
@@ -6973,7 +6973,7 @@ function compileV2(html, profile, options) {
     } else error(script, "HHP-SCRIPT", "Use one external application/himalaya-controller script. Inline/page JavaScript is unavailable.");
   }
   let info4;
-  for (const cap of moduleCapabilities(controller?.source ?? directService?.source ?? "", controller?.file ?? options.file, profile)) requiredCapabilities.add(cap);
+  for (const cap of moduleCapabilities(controller?.source ?? directService?.source ?? "", controller?.file ?? options.file, profile)) requiredCapabilities2.add(cap);
   if (controller) {
     dependencies.push(controller.file);
     info4 = analyzeController(controller.source, controller.file, profile, diagnostics);
@@ -7049,7 +7049,7 @@ function compileV2(html, profile, options) {
         if (!info4?.handlers.has(action.slice(`tier5.${serviceName}.`.length))) error(el2, "HHP-EVENT", `Unknown structured handler ${action}.`);
       } else if (action.startsWith("capability.")) {
         const [, cap, method] = action.split(".");
-        requiredCapabilities.add(cap);
+        requiredCapabilities2.add(cap);
         if (!grants(profile.declaredCapabilities, cap)) error(el2, "HHP-CAPABILITY-MISSING", `Action requires declared capability ${cap}.`);
         if (!own5(profile.capabilities, cap)?.methods.includes(method)) error(el2, "HHP-EVENT", `Unknown capability method ${action}.`);
       } else if (!profile.handlers?.includes(action)) error(el2, "HHP-EVENT", `Action ${action} is not declared by this app.`);
@@ -7288,7 +7288,7 @@ function compileV2(html, profile, options) {
     if (tag === "a") {
       if (attrs.href?.startsWith("#")) props.action = { actionId: "himi.open", params: { screenId: attrs.href.slice(1) } };
       else if (/^https:\/\//.test(attrs.href ?? "")) {
-        requiredCapabilities.add("open_url");
+        requiredCapabilities2.add("open_url");
         if (!grants(profile.declaredCapabilities, "open_url")) error(el2, "HHP-CAPABILITY-MISSING", "External links require open_url.");
         props.action = { actionId: "capability.open_url.open", args: { url: attrs.href } };
       } else error(el2, "HHP-LINK", "Links require #screenId or an HTTPS URL.");
@@ -7419,7 +7419,7 @@ ${directService.source}
     bundleName,
     sourceMap: sourceMap2,
     dependencies,
-    manifest: { profileVersion: "hhp/2", catalogVersion: profile.catalogVersion, screenId, bundleName, serviceName: info4 ? serviceName : null, requiredCapabilities: [...requiredCapabilities].sort(), inputSha256: createHash6("sha256").update(html).digest("hex") }
+    manifest: { profileVersion: "hhp/2", catalogVersion: profile.catalogVersion, screenId, bundleName, serviceName: info4 ? serviceName : null, requiredCapabilities: [...requiredCapabilities2].sort(), inputSha256: createHash6("sha256").update(html).digest("hex") }
   };
 }
 var camel, semantic, actionAliases, ajv, validators;
@@ -8078,7 +8078,6 @@ function resolveTranslation(value, catalog3, sourceCatalog) {
 var BINDING_SIGILS, BINDING_SIGIL_RE, TRANSLATION_PREFIX, TRANSLATION_KEY_RE;
 var init_bindings = __esm({
   "../../core/ts/src/bindings.ts"() {
-    "use strict";
     BINDING_SIGILS = ["service", "flag", "item", "t"];
     BINDING_SIGIL_RE = new RegExp(
       `^\\$(?:${BINDING_SIGILS.filter((s2) => s2 !== "t").join("|")})\\b|^\\$t:`
@@ -15051,7 +15050,7 @@ async function compileContentHhp(root, opts = {}) {
       seen.add(file3);
       const source = readFileSync16(file3, "utf8");
       inspectModule(source, file3, profile, diagnostics);
-      for (const cap of moduleCapabilities(source, file3, profile)) requiredCapabilities.add(cap);
+      for (const cap of moduleCapabilities(source, file3, profile)) requiredCapabilities2.add(cap);
       const sf2 = ts3.createSourceFile(file3, source, ts3.ScriptTarget.Latest, true);
       for (const stmt of sf2.statements) if ((ts3.isImportDeclaration(stmt) || ts3.isExportDeclaration(stmt)) && stmt.moduleSpecifier && ts3.isStringLiteral(stmt.moduleSpecifier) && stmt.moduleSpecifier.text.startsWith(".")) {
         let imported = localPath(root, stmt.moduleSpecifier.text, file3);
@@ -15066,9 +15065,9 @@ async function compileContentHhp(root, opts = {}) {
     diagnostics.push(...result2.diagnostics);
     results.push(result2);
     const seen = /* @__PURE__ */ new Set();
-    const requiredCapabilities = new Set(result2.manifest.requiredCapabilities);
+    const requiredCapabilities2 = new Set(result2.manifest.requiredCapabilities);
     for (const dependency of result2.dependencies.filter((f2) => /\.tsx?$/.test(f2))) inspect2(dependency);
-    result2.manifest.requiredCapabilities = [...requiredCapabilities].sort();
+    result2.manifest.requiredCapabilities = [...requiredCapabilities2].sort();
     outputs.set(`dev/hhp/${id}.descriptor.json`, JSON.stringify(result2.descriptor, null, 2) + "\n");
     outputs.set(`dev/hhp/${id}.map.json`, JSON.stringify({ ...result2.manifest, nodes: Object.fromEntries(Object.entries(result2.sourceMap).map(([key3, node]) => [key3, { ...node, file: relative3(root, node.file).split(sep6).join("/") }])) }, null, 2) + "\n");
     if (result2.worker && result2.bundleName) {
@@ -17852,6 +17851,7 @@ function resolveIdiom(tokens2, ctx = {}) {
 var IDIOM_CONTEXTS, UNSAFE_KEYS;
 var init_idiom = __esm({
   "../../core/ts/src/idiom.ts"() {
+    "use strict";
     IDIOM_CONTEXTS = {
       ios: { native: ["ios"] },
       android: { native: ["material"] },
@@ -22774,6 +22774,9 @@ var init_plan = __esm({
 });
 
 // ../../core/sdk/capability-catalog/src/builtins.ts
+function hasBuiltin(platform, id) {
+  return CAPABILITY_BUILTINS[platform].includes(id);
+}
 var IOS_BUILTINS, WEB_BUILTINS, CAPABILITY_BUILTINS;
 var init_builtins = __esm({
   "../../core/sdk/capability-catalog/src/builtins.ts"() {
@@ -23282,6 +23285,10 @@ function binaryCoreSatellitePath(product) {
 function mavenArtifactForGradleProject(project) {
   return project.replace(/^:/, "");
 }
+function binaryModuleLinks(buildSet2) {
+  const { spm, gradle } = modulesFor(buildSet2);
+  return { spm, maven: gradle.map((g2) => `${BINARY_CORE_MAVEN_GROUP}:${mavenArtifactForGradleProject(g2)}`) };
+}
 function coreVersionHasModules(version4) {
   const parse4 = (v2) => /^(\d+)\.(\d+)\.(\d+)/.exec(v2.trim())?.slice(1).map(Number);
   const a2 = parse4(version4);
@@ -23340,6 +23347,58 @@ var init_binary_core = __esm({
 });
 
 // ../../core/sdk/capability-catalog/src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  BINARY_CORE_ANDROID_PUBLISH_BUILDS: () => BINARY_CORE_ANDROID_PUBLISH_BUILDS,
+  BINARY_CORE_IOS_PATH_ONLY_SATELLITES: () => BINARY_CORE_IOS_PATH_ONLY_SATELLITES,
+  BINARY_CORE_IOS_SATELLITES: () => BINARY_CORE_IOS_SATELLITES,
+  BINARY_CORE_IOS_TRAIT_SATELLITES: () => BINARY_CORE_IOS_TRAIT_SATELLITES,
+  BINARY_CORE_IOS_TRAIT_SELECTOR: () => BINARY_CORE_IOS_TRAIT_SELECTOR,
+  BINARY_CORE_MAVEN_GROUP: () => BINARY_CORE_MAVEN_GROUP,
+  BINARY_CORE_MODULES_SINCE: () => BINARY_CORE_MODULES_SINCE,
+  BINARY_CORE_PRE_SPLIT_USAGE_STRINGS: () => BINARY_CORE_PRE_SPLIT_USAGE_STRINGS,
+  BINARY_CORE_SPM_PACKAGE: () => BINARY_CORE_SPM_PACKAGE,
+  BINARY_CORE_USAGE_STRINGS: () => BINARY_CORE_USAGE_STRINGS,
+  BRIDGE_CAPABILITY_IDS: () => BRIDGE_CAPABILITY_IDS,
+  CAPABILITY_BUILTINS: () => CAPABILITY_BUILTINS,
+  CAPABILITY_IMPLIES: () => CAPABILITY_IMPLIES,
+  CAPABILITY_NATIVE: () => CAPABILITY_NATIVE,
+  CATALOG_CAPABILITY_IDS: () => CATALOG_CAPABILITY_IDS,
+  COMPONENT_MODULES: () => COMPONENT_MODULES,
+  KNOWN_CAPABILITY_IDS: () => KNOWN_CAPABILITY_IDS,
+  NATIVE_MODULES: () => NATIVE_MODULES,
+  NOT_DIST_ADDABLE: () => NOT_DIST_ADDABLE,
+  androidPlanFor: () => androidPlanFor,
+  binaryCoreSatellitePath: () => binaryCoreSatellitePath,
+  binaryCoreSatelliteTrait: () => binaryCoreSatelliteTrait,
+  binaryCoreUsageStringsFor: () => binaryCoreUsageStringsFor,
+  binaryCoreVersion: () => binaryCoreVersion,
+  binaryModuleLinks: () => binaryModuleLinks,
+  capabilitiesOfModule: () => capabilitiesOfModule,
+  capabilitiesUsedBy: () => capabilitiesUsedBy,
+  capabilityDispatchesIn: () => capabilityDispatchesIn,
+  catalogKey: () => catalogKey,
+  componentModuleRequirements: () => componentModuleRequirements,
+  coreVersionHasModules: () => coreVersionHasModules,
+  distAddRefusal: () => distAddRefusal,
+  distributionOptIns: () => distributionOptIns,
+  expandCapabilities: () => expandCapabilities,
+  grants: () => grants,
+  hasBuiltin: () => hasBuiltin,
+  iosPlanFor: () => iosPlanFor,
+  isBinaryCore: () => isBinaryCore,
+  isKnownCapability: () => isKnownCapability,
+  linksModule: () => linksModule,
+  macosPlanFor: () => macosPlanFor,
+  mavenArtifactForGradleProject: () => mavenArtifactForGradleProject,
+  moduleForGradleProject: () => moduleForGradleProject,
+  moduleForSpmProduct: () => moduleForSpmProduct,
+  modulesFor: () => modulesFor,
+  nativeRequirementsFor: () => nativeRequirementsFor,
+  needsNativeBuild: () => needsNativeBuild,
+  unlinkedComponentModules: () => unlinkedComponentModules,
+  usageStringCopyFor: () => usageStringCopyFor
+});
 var init_src2 = __esm({
   "../../core/sdk/capability-catalog/src/index.ts"() {
     init_types();
@@ -131112,8 +131171,8 @@ var init_AppRegistry = __esm({
 });
 
 // ../../core/web-renderer/src/index.ts
-var src_exports = {};
-__export(src_exports, {
+var src_exports2 = {};
+__export(src_exports2, {
   Bound: () => Bound,
   BoundList: () => BoundList,
   FakeServiceProvider: () => FakeServiceProvider,
@@ -131175,12 +131234,14 @@ __export(render_descriptor_exports, {
   clientEnvFor: () => clientEnvFor,
   collectNativeOnly: () => collectNativeOnly,
   isMissingPlaywrightExecutable: () => isMissingPlaywrightExecutable,
+  launchPngBrowser: () => launchPngBrowser,
   nodeHidden: () => nodeHidden,
   pngAvailable: () => pngAvailable,
   pngPageHtml: () => pngPageHtml,
   renderDescriptorWeb: () => renderDescriptorWeb,
   renderPngBatch: () => renderPngBatch,
   renderSchemeFor: () => renderSchemeFor,
+  setPngEgress: () => setPngEgress,
   setPngFontCss: () => setPngFontCss,
   stabilizePngPage: () => stabilizePngPage,
   withRetry: () => withRetry2
@@ -131474,7 +131535,7 @@ async function renderDescriptorWeb(descriptor, tokens2, scheme, wantPng, service
   ) : void 0;
   let html;
   try {
-    const { renderDescriptorToHtml: renderDescriptorToHtml2 } = await Promise.resolve().then(() => (init_src5(), src_exports));
+    const { renderDescriptorToHtml: renderDescriptorToHtml2 } = await Promise.resolve().then(() => (init_src5(), src_exports2));
     html = renderDescriptorToHtml2(
       payload,
       tokens2 ?? {},
@@ -131571,8 +131632,24 @@ async function stabilizePngPage(page, scheme) {
     await new Promise((resolve66) => browser.requestAnimationFrame(() => browser.requestAnimationFrame(() => resolve66())));
   }, scheme);
 }
-async function renderPngBatch(items) {
-  if (!items.length) return [];
+function setPngEgress(start) {
+  const prev = pngEgress;
+  pngEgress = start;
+  return prev;
+}
+async function pngEgressStart() {
+  if (pngEgress !== void 0) return pngEgress;
+  const spec = "./png-egress.js";
+  try {
+    return (await import(
+      /* @vite-ignore */
+      spec
+    )).startEgressProxy;
+  } catch {
+    return null;
+  }
+}
+async function launchPngBrowser() {
   let chromium;
   try {
     ({ chromium } = await import("playwright"));
@@ -131580,13 +131657,41 @@ async function renderPngBatch(items) {
     return null;
   }
   if (!chromium) return null;
+  const start = await pngEgressStart();
+  if (!start) return null;
+  let egress;
+  try {
+    egress = await start();
+  } catch {
+    return null;
+  }
   const launch = chromium.launch.bind(chromium);
   let browser;
   try {
-    browser = await withRetry2(() => launch(), 3);
+    browser = await withRetry2(() => launch({
+      proxy: { server: egress.url, bypass: "<-loopback>" },
+      args: ["--force-webrtc-ip-handling-policy=disable_non_proxied_udp", "--webrtc-ip-handling-policy=disable_non_proxied_udp"]
+    }), 3);
   } catch {
+    await egress.close().catch(() => {
+    });
     return null;
   }
+  return {
+    browser,
+    close: async () => {
+      await browser.close().catch(() => {
+      });
+      await egress.close().catch(() => {
+      });
+    }
+  };
+}
+async function renderPngBatch(items) {
+  if (!items.length) return [];
+  const launched = await launchPngBrowser();
+  if (!launched) return null;
+  const { browser } = launched;
   try {
     const out2 = [];
     for (const it2 of items) {
@@ -131607,11 +131712,10 @@ async function renderPngBatch(items) {
     }
     return out2;
   } finally {
-    await browser.close().catch(() => {
-    });
+    await launched.close();
   }
 }
-var A11Y_MODIFIER_KEYS, TREE_TEXT_VALUE_PROPS, asStringOrNumber, asStringOnly, asOtpCode, VALUE_PATH_TEXT, MEDIA_PLAYER_QUEUE_PROPERTIES, NATIVE_ONLY_TYPES, HOST_PAGE_FONT, pngFontCss;
+var A11Y_MODIFIER_KEYS, TREE_TEXT_VALUE_PROPS, asStringOrNumber, asStringOnly, asOtpCode, VALUE_PATH_TEXT, MEDIA_PLAYER_QUEUE_PROPERTIES, NATIVE_ONLY_TYPES, HOST_PAGE_FONT, pngFontCss, pngEgress;
 var init_render_descriptor = __esm({
   "../../core/dev-server/src/render-descriptor.ts"() {
     init_tokens2();
@@ -131655,6 +131759,229 @@ var init_render_descriptor = __esm({
   }
 });
 
+// ../../core/dev-server/src/png-egress.ts
+import http from "node:http";
+import net from "node:net";
+import { lookup as lookup2 } from "node:dns/promises";
+function isPublicAddress(ip) {
+  const family = net.isIP(ip);
+  if (family === 0) return false;
+  return family === 4 ? !BLOCKED_V4.check(ip, "ipv4") : !BLOCKED_V6.check(ip, "ipv6");
+}
+function originKey(origin) {
+  try {
+    const u2 = new URL(origin);
+    return hostPortKey(u2.hostname, u2.port || (u2.protocol === "https:" ? "443" : "80"));
+  } catch {
+    return null;
+  }
+}
+function hostPortKey(host, port) {
+  return `${host.replace(/^\[|\]$/g, "").replace(/\.$/, "").toLowerCase()}:${port}`;
+}
+function allowPngOrigins(origins) {
+  const keys = origins.map(originKey).filter((k2) => !!k2);
+  for (const k2 of keys) allowedOrigins.set(k2, (allowedOrigins.get(k2) ?? 0) + 1);
+  return () => {
+    for (const k2 of keys) {
+      const n2 = (allowedOrigins.get(k2) ?? 1) - 1;
+      if (n2 <= 0) allowedOrigins.delete(k2);
+      else allowedOrigins.set(k2, n2);
+    }
+  };
+}
+function ownOrigins(port, publicBase) {
+  return [`http://localhost:${port}`, `http://127.0.0.1:${port}`, `http://[::1]:${port}`, ...publicBase ? [publicBase] : []];
+}
+async function resolveEgress(host, port, allow = allowedOrigins) {
+  const bare = host.replace(/^\[|\]$/g, "");
+  let addrs;
+  try {
+    addrs = net.isIP(bare) ? [{ address: bare, family: net.isIP(bare) }] : await lookup2(bare.replace(/\.$/, ""), { all: true, order: "ipv4first" });
+  } catch {
+    return null;
+  }
+  if (!addrs.length) return null;
+  if (allow.has(hostPortKey(host, port))) return addrs;
+  return addrs.every((a2) => isPublicAddress(a2.address)) ? addrs : null;
+}
+function connectFirst(addrs, port, track) {
+  return new Promise((resolve66, reject) => {
+    const tryAt = (i2) => {
+      if (i2 >= addrs.length) return reject(new Error("no address answered"));
+      const s2 = net.connect({ host: addrs[i2].address, family: addrs[i2].family, port });
+      track(s2);
+      s2.setTimeout(CONNECT_TIMEOUT_MS, () => s2.destroy(new Error("connect timeout")));
+      const onFail = () => {
+        s2.destroy();
+        tryAt(i2 + 1);
+      };
+      s2.once("error", onFail);
+      s2.once("connect", () => {
+        s2.off("error", onFail);
+        s2.setTimeout(0);
+        resolve66(s2);
+      });
+    };
+    tryAt(0);
+  });
+}
+async function startEgressProxy() {
+  const blocked = [];
+  const sockets = /* @__PURE__ */ new Set();
+  const track = (s2) => {
+    sockets.add(s2);
+    s2.once("close", () => sockets.delete(s2));
+  };
+  const guard = (s2) => {
+    track(s2);
+    s2.on("error", () => s2.destroy());
+  };
+  const server = http.createServer(async (req, res) => {
+    let u2;
+    try {
+      u2 = new URL(req.url ?? "");
+    } catch {
+      res.writeHead(400).end();
+      return;
+    }
+    const port2 = Number(u2.port || 80);
+    const addrs = u2.protocol === "http:" ? await resolveEgress(u2.hostname, port2) : null;
+    if (!addrs) {
+      blocked.push(hostPortKey(u2.hostname, port2));
+      res.writeHead(403).end();
+      return;
+    }
+    let sock;
+    try {
+      sock = await connectFirst(addrs, port2, guard);
+    } catch {
+      res.writeHead(502).end();
+      return;
+    }
+    const headers2 = { ...req.headers, host: u2.host };
+    delete headers2["proxy-connection"];
+    const upstream = http.request({ createConnection: () => sock, method: req.method, path: `${u2.pathname}${u2.search}`, headers: headers2 }, (up) => {
+      res.writeHead(up.statusCode ?? 502, up.headers);
+      up.pipe(res);
+    });
+    upstream.on("error", () => {
+      if (!res.headersSent) res.writeHead(502);
+      res.end();
+    });
+    req.pipe(upstream);
+  });
+  server.on("connection", guard);
+  server.on("clientError", (_e2, socket) => socket.destroy());
+  server.on("connect", async (req, socket, head) => {
+    guard(socket);
+    const m2 = /^\[?([^\]]+?)\]?:(\d+)$/.exec(req.url ?? "");
+    const addrs = m2 ? await resolveEgress(m2[1], Number(m2[2])) : null;
+    if (!m2 || !addrs) {
+      blocked.push(m2 ? hostPortKey(m2[1], m2[2]) : String(req.url));
+      socket.end("HTTP/1.1 403 Forbidden\r\n\r\n");
+      return;
+    }
+    let upstream;
+    try {
+      upstream = await connectFirst(addrs, Number(m2[2]), guard);
+    } catch {
+      socket.end("HTTP/1.1 502 Bad Gateway\r\n\r\n");
+      return;
+    }
+    socket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+    if (head.length) upstream.write(head);
+    upstream.pipe(socket);
+    socket.pipe(upstream);
+  });
+  server.on("upgrade", async (req, socket, head) => {
+    guard(socket);
+    let u2;
+    try {
+      u2 = new URL(req.url ?? "");
+    } catch {
+      socket.destroy();
+      return;
+    }
+    const port2 = Number(u2.port || 80);
+    const addrs = await resolveEgress(u2.hostname, port2);
+    if (!addrs) {
+      blocked.push(hostPortKey(u2.hostname, port2));
+      socket.end("HTTP/1.1 403 Forbidden\r\n\r\n");
+      return;
+    }
+    let upstream;
+    try {
+      upstream = await connectFirst(addrs, port2, guard);
+    } catch {
+      socket.end("HTTP/1.1 502 Bad Gateway\r\n\r\n");
+      return;
+    }
+    const lines = [`${req.method} ${u2.pathname}${u2.search} HTTP/1.1`];
+    for (let i2 = 0; i2 < req.rawHeaders.length; i2 += 2) lines.push(`${req.rawHeaders[i2]}: ${req.rawHeaders[i2 + 1]}`);
+    upstream.write(`${lines.join("\r\n")}\r
+\r
+`);
+    if (head.length) upstream.write(head);
+    upstream.pipe(socket);
+    socket.pipe(upstream);
+  });
+  await new Promise((resolve66, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => resolve66());
+  });
+  const { port } = server.address();
+  return {
+    url: `http://127.0.0.1:${port}`,
+    blocked,
+    close: () => new Promise((resolve66) => {
+      server.close(() => resolve66());
+      for (const s2 of sockets) s2.destroy();
+      server.closeAllConnections?.();
+    })
+  };
+}
+var BLOCKED_V4, BLOCKED_V6, CONNECT_TIMEOUT_MS, allowedOrigins;
+var init_png_egress = __esm({
+  "../../core/dev-server/src/png-egress.ts"() {
+    BLOCKED_V4 = new net.BlockList();
+    BLOCKED_V6 = new net.BlockList();
+    for (const [addr, prefix] of [
+      ["0.0.0.0", 8],
+      ["10.0.0.0", 8],
+      ["100.64.0.0", 10],
+      ["127.0.0.0", 8],
+      ["169.254.0.0", 16],
+      ["172.16.0.0", 12],
+      ["192.0.0.0", 24],
+      ["192.0.2.0", 24],
+      ["192.88.99.0", 24],
+      ["192.168.0.0", 16],
+      ["198.18.0.0", 15],
+      ["198.51.100.0", 24],
+      ["203.0.113.0", 24],
+      ["224.0.0.0", 4],
+      ["240.0.0.0", 4]
+    ]) BLOCKED_V4.addSubnet(addr, prefix, "ipv4");
+    for (const [addr, prefix] of [
+      ["::", 96],
+      ["::ffff:0:0", 96],
+      ["64:ff9b::", 96],
+      ["64:ff9b:1::", 48],
+      ["100::", 64],
+      ["2001::", 23],
+      ["2001:db8::", 32],
+      ["2002::", 16],
+      ["fc00::", 7],
+      ["fe80::", 10],
+      ["fec0::", 10],
+      ["ff00::", 8]
+    ]) BLOCKED_V6.addSubnet(addr, prefix, "ipv6");
+    CONNECT_TIMEOUT_MS = 1e4;
+    allowedOrigins = /* @__PURE__ */ new Map();
+  }
+});
+
 // ../../core/dev-server/src/render-fonts.ts
 import { existsSync as existsSync45, readFileSync as readFileSync49 } from "node:fs";
 import { extname, join as join44 } from "node:path";
@@ -131744,7 +132071,7 @@ async function pngFontFaceCss(tokens2, opts = {}) {
   return rules.join("");
 }
 async function idiomFontFaceCss(idiomContext) {
-  const { controlIdiomFor: controlIdiomFor2, idiomControls: idiomControls2 } = await Promise.resolve().then(() => (init_src5(), src_exports));
+  const { controlIdiomFor: controlIdiomFor2, idiomControls: idiomControls2 } = await Promise.resolve().then(() => (init_src5(), src_exports2));
   const bundled = idiomControls2(controlIdiomFor2(idiomContext)).font.bundled;
   if (!bundled) return "";
   try {
@@ -136245,6 +136572,17 @@ function createDevServer(opts = {}) {
     })();
   };
   const httpServer = createServer3(handleRequest);
+  let disallowOwnOrigins;
+  httpServer.on("listening", () => {
+    const addr = httpServer.address();
+    if (!addr || typeof addr === "string") return;
+    disallowOwnOrigins?.();
+    disallowOwnOrigins = allowPngOrigins(ownOrigins(addr.port, process.env.HIMALAYA_DEV_PUBLIC_URL));
+  });
+  httpServer.on("close", () => {
+    disallowOwnOrigins?.();
+    disallowOwnOrigins = void 0;
+  });
   httpServer.inject = (request) => injectRequest(handleRequest, request);
   httpServer.on("clientError", (err, socket) => {
     console.error(`[himalaya-dev] malformed request rejected by the HTTP parser: ${err.code ?? ""} ${err.message}`);
@@ -136320,6 +136658,7 @@ var init_src6 = __esm({
     init_check();
     init_openapi();
     init_render_descriptor();
+    init_png_egress();
     init_render_fonts();
     init_app_config();
     init_tier();
@@ -136331,6 +136670,7 @@ var init_src6 = __esm({
     init_descriptor_postprocess();
     ROOT6 = resolve38(fileURLToPath22(new URL("../../..", import.meta.url)));
     setPngFontCss(async (tokens2, idiomContext) => await pngFontFaceCss(tokens2) + (idiomContext ? await idiomFontFaceCss(idiomContext) : ""));
+    setPngEgress(startEgressProxy);
     TIER3_ROOT = resolve38(ROOT6, "core/dev-server/web");
     TIER4_ROOT = resolve38(ROOT6, "core/dev-server/tier4-bundles");
     tier4Verifier = new TierFourVerifier(TIER4_ROOT);
@@ -140282,7 +140622,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
   };
   let handlers;
   let minBinaryVersion = null;
-  const requiredCapabilities = new Set(config.capabilities ?? []);
+  const requiredCapabilities2 = new Set(config.capabilities ?? []);
   const capabilityUsage = {
     app: [...config.capabilities ?? []],
     ...Array.isArray(config.capabilityEnvelope) ? { envelope: [...config.capabilityEnvelope] } : {},
@@ -140293,7 +140633,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     const ids = Array.isArray(declared) ? declared.filter((c2) => typeof c2 === "string") : [];
     const components2 = [...collectComponentTypes(descriptor)].sort();
     capabilityUsage.screens.push({ screenId, bundle, declared: ids, components: components2 });
-    for (const c2 of componentModuleRequirements(components2, [...requiredCapabilities, ...ids])) requiredCapabilities.add(c2);
+    for (const c2 of componentModuleRequirements(components2, [...requiredCapabilities2, ...ids])) requiredCapabilities2.add(c2);
   };
   const requiredNativeComponents = /* @__PURE__ */ new Set();
   const tierScreens = [];
@@ -140537,7 +140877,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
         minBinaryVersion = maximumBinaryVersion(minBinaryVersion, lb.minBinaryVersion);
         const declared = lb.declaredCapabilities ?? lb.declared_capabilities;
         if (Array.isArray(declared)) {
-          for (const capability of declared) if (typeof capability === "string") requiredCapabilities.add(capability);
+          for (const capability of declared) if (typeof capability === "string") requiredCapabilities2.add(capability);
         }
         noteScreenCapabilities(screenId, bundleName, declared, descriptor);
       } else {
@@ -140687,7 +141027,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
             minBinaryVersion = maximumBinaryVersion(minBinaryVersion, lb.minBinaryVersion);
             const declared = lb.declaredCapabilities ?? lb.declared_capabilities;
             if (Array.isArray(declared)) {
-              for (const c2 of declared) if (typeof c2 === "string") requiredCapabilities.add(c2);
+              for (const c2 of declared) if (typeof c2 === "string") requiredCapabilities2.add(c2);
             }
             noteScreenCapabilities(screenId, bundleName, declared, descriptor);
           } else {
@@ -140855,7 +141195,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     // whose source catalog serves copy (native screens, #4221/#4250) now carries `en` here.
     ...Object.keys(catalogs).length ? { catalogs } : {},
     playerRequirements: {
-      capabilities: [...requiredCapabilities].sort(),
+      capabilities: [...requiredCapabilities2].sort(),
       nativeComponents: [...requiredNativeComponents].sort(),
       // `none` is the scaffold's spelling of "no auth" (`new-app --auth=none`), not a provider a
       // host must carry — recording it blocked every such app in the Player picker (#3695).
@@ -150220,7 +150560,7 @@ function defineAppLiteral(file2) {
   return void 0;
 }
 function loginOf(app) {
-  const auth = lookup2(app, "auth");
+  const auth = lookup3(app, "auth");
   if (auth.kind !== "written") return { kind: auth.kind === "absent" ? "other" : "opaque" };
   const value = unwrap(auth.node.initializer);
   if (ts5.isObjectLiteralExpression(value)) return { kind: "other" };
@@ -150248,7 +150588,7 @@ function unwrap(node) {
   }
   return current;
 }
-function lookup2(literal, name) {
+function lookup3(literal, name) {
   let found = { kind: "absent" };
   for (const p2 of literal.properties) {
     const key3 = p2.name && (ts5.isIdentifier(p2.name) || ts5.isStringLiteral(p2.name)) ? p2.name.text : void 0;
@@ -150259,7 +150599,7 @@ function lookup2(literal, name) {
 }
 function stringValue(node, name) {
   const literal = unwrap(node);
-  const found = ts5.isObjectLiteralExpression(literal) ? lookup2(literal, name) : void 0;
+  const found = ts5.isObjectLiteralExpression(literal) ? lookup3(literal, name) : void 0;
   const value = found?.kind === "written" ? found.node.initializer : void 0;
   return value && ts5.isStringLiteralLike(value) ? value.text : void 0;
 }
@@ -150371,7 +150711,7 @@ function enablePushInConfig(source, options) {
   };
 }
 function planPush(app, pingAppName, plan) {
-  const push = lookup2(app, "push");
+  const push = lookup3(app, "push");
   if (push.kind === "absent") {
     plan.appended.push([
       ROUTES_COMMENT,
@@ -150402,7 +150742,7 @@ function planPush(app, pingAppName, plan) {
 }
 function planRetiredFamily(block, plan) {
   const literal = unwrap(block);
-  const found = ts6.isObjectLiteralExpression(literal) ? lookup2(literal, "pingAppName") : void 0;
+  const found = ts6.isObjectLiteralExpression(literal) ? lookup3(literal, "pingAppName") : void 0;
   const value = found?.kind === "written" ? unwrap(found.node.initializer) : void 0;
   const replacement = value && ts6.isStringLiteralLike(value) ? replacementPingFamily(value.text) : void 0;
   if (!value || !replacement) return;
@@ -150410,7 +150750,7 @@ function planRetiredFamily(block, plan) {
   plan.applied.push(`pingAppName ${JSON.stringify(replacement)} in place of ${value.getText()}`);
 }
 function planCapability(app, plan) {
-  const capabilities = lookup2(app, "capabilities");
+  const capabilities = lookup3(app, "capabilities");
   if (capabilities.kind === "absent") {
     plan.appended.push(['capabilities: ["push"],']);
     plan.applied.push("push capability");
@@ -150440,7 +150780,7 @@ function planAuthSite(login, file2, site, plan) {
     );
     return;
   }
-  const siteId = lookup2(login.literal, "siteId");
+  const siteId = lookup3(login.literal, "siteId");
   if (siteId.kind === "absent") {
     plan.splices.push(appendProperties(login.literal, file2, [`${wanted},`]));
     plan.applied.push("auth siteId");
@@ -150527,8 +150867,8 @@ async function ask(question, deps) {
 function defer(dir, input, scope, reason) {
   return recordPushDeferral(dir, { reason, scope, missing: missingPushInputs(input, scope), identity: input, resume: resume(dir) });
 }
-function renderPushStatus(http, refresh = false) {
-  const body = http.body ?? {};
+function renderPushStatus(http2, refresh = false) {
+  const body = http2.body ?? {};
   const verification = obj2(body.verification);
   const state = typeof body.state === "string" && STATES.has(body.state) ? body.state : "unknown";
   const mode = verification.mode === "live" ? "live" : verification.mode === "cached" ? "cached" : "unavailable";
@@ -150537,10 +150877,10 @@ function renderPushStatus(http, refresh = false) {
     return [name, typeof value === "string" && CHECK_STATES.has(value) ? value : "unknown"];
   }));
   const rawCode = typeof body.error === "string" ? body.error.split(":")[0] : void 0;
-  const responseError = http.error ?? (rawCode ? ERROR_CODES.has(rawCode) ? rawCode : "push_setup_failed" : void 0);
-  const error = responseError ?? (!http.ok ? "push_setup_failed" : refresh && mode !== "live" ? "live_verification_unavailable" : void 0);
+  const responseError = http2.error ?? (rawCode ? ERROR_CODES.has(rawCode) ? rawCode : "push_setup_failed" : void 0);
+  const error = responseError ?? (!http2.ok ? "push_setup_failed" : refresh && mode !== "live" ? "live_verification_unavailable" : void 0);
   return {
-    ok: http.ok && state === "ready" && !error && (!refresh || verification.backendConfigurationReady === true),
+    ok: http2.ok && state === "ready" && !error && (!refresh || verification.backendConfigurationReady === true),
     state,
     verificationMode: mode,
     backendConfigurationReady: verification.backendConfigurationReady === true,
@@ -150552,8 +150892,8 @@ function renderPushStatus(http, refresh = false) {
     note: "Backend setup is separate from building the app, device registration and notification delivery."
   };
 }
-function report(http, flags, io2, dir, config) {
-  const status = renderPushStatus(http, flags.refresh === true);
+function report(http2, flags, io2, dir, config) {
+  const status = renderPushStatus(http2, flags.refresh === true);
   const result = config && !config.pushOn ? { ...status, ok: false, error: status.error ?? (config.rolledBack ? "config_edit_rolled_back" : "config_push_not_on") } : status;
   const local = readPushOnboarding(dir).push;
   io2.log(JSON.stringify({ ...result, ...local ? { localOnboarding: "deferred" } : {}, ...config ? { config } : {} }, null, 2));
@@ -154670,7 +155010,7 @@ async function runCrawl(opts) {
       for (const d2 of list) if (d2.screenId !== rep.screenId) coveredBy.set(d2.screenId, rep.screenId);
     }
   }
-  const net = opts.offline ? null : opts.netPath ? { rules: readNetRules(resolve51(opts.netPath)), from: opts.netPath } : defaultNetRules(opts.dir);
+  const net2 = opts.offline ? null : opts.netPath ? { rules: readNetRules(resolve51(opts.netPath)), from: opts.netPath } : defaultNetRules(opts.dir);
   const suppressions = opts.config?.skip ?? [];
   const suppressed = [];
   const matchSuppression = (screen, actionId, componentId, invariant) => suppressions.find((s2) => (s2.screen === void 0 || s2.screen === screen) && (s2.action === void 0 || s2.action === actionId) && (s2.component === void 0 || s2.component === componentId) && (s2.invariant === void 0 || s2.invariant === invariant));
@@ -154698,7 +155038,7 @@ async function runCrawl(opts) {
       bundleMap: baked.bundleMap ?? null,
       knownScreenIds,
       ...opts.linkableScreenIds?.size ? { linkableScreenIds: opts.linkableScreenIds } : {},
-      rules: net?.rules ?? null,
+      rules: net2?.rules ?? null,
       ...opts.cmsSeed && Object.keys(opts.cmsSeed).length ? { cmsSeed: opts.cmsSeed } : {},
       ...opts.canned?.count ? { canned: opts.canned.byKey } : {},
       ...localDbSchema?.length ? { localDbSchema } : {},
@@ -154840,7 +155180,7 @@ async function runCrawl(opts) {
           bundleJs: baked.bundleJs,
           bundleMap: baked.bundleMap ?? null,
           knownScreenIds,
-          rules: net?.rules ?? null,
+          rules: net2?.rules ?? null,
           ...opts.cmsSeed && Object.keys(opts.cmsSeed).length ? { cmsSeed: opts.cmsSeed } : {},
           ...opts.canned?.count ? { canned: opts.canned.byKey } : {},
           ...localDbSchema?.length ? { localDbSchema } : {},
@@ -154907,7 +155247,7 @@ async function runCrawl(opts) {
     // so a run over static or bundle-less screens injects the dependency and replays nothing —
     // and the label then advertised "+ relations" beside `relations.checked: 0`. This is the
     // second time this line has overstated itself: it first claimed the axis unconditionally.
-    transport: describeTransport(net, opts, {
+    transport: describeTransport(net2, opts, {
       relations: relationsChecked > 0,
       hostile: opts.hostile !== false && Boolean(deps.crawlScreenHostile),
       deep: Boolean(opts.deep && opts.deep >= 2 && deps.crawlScreenDeep)
@@ -154945,9 +155285,9 @@ async function runCrawl(opts) {
     ...results.some((r2) => r2.observations) ? { observations: Object.fromEntries(results.filter((r2) => r2.observations).map((r2) => [r2.screen, r2.observations])) } : {}
   };
 }
-function describeTransport(net, opts, ran) {
+function describeTransport(net2, opts, ran) {
   const layers3 = [];
-  if (net) layers3.push(`mocked (${net.from})`);
+  if (net2) layers3.push(`mocked (${net2.from})`);
   const cmsCount = Object.keys(opts.cmsSeed ?? {}).length;
   if (cmsCount) layers3.push(`cms (${cmsCount} seeded collection${cmsCount === 1 ? "" : "s"})`);
   if (opts.canned?.count) layers3.push(`canned (${opts.canned.count} frozen endpoints, ${opts.canned.from} \u2014 exercises code paths, not API-contract truth)`);
@@ -164024,7 +164364,7 @@ function siteFinding(app, siteId, fileName) {
   const check = `make sure the app's member login uses siteId ${JSON.stringify(siteId)}: a build bakes the purchases app only for the site its login resolves to.`;
   const login = loginOf(app);
   if (login.kind !== "member") return { instruction: `${fileName} does not write auth as a WixConsumerAuthProvider({ \u2026 }) call it can read, so ${check}` };
-  const found = lookup2(login.literal, "siteId");
+  const found = lookup3(login.literal, "siteId");
   const value = found.kind === "written" ? unwrap(found.node.initializer) : void 0;
   if (!value || !ts8.isStringLiteralLike(value)) return { instruction: `auth's siteId is not written as a literal, so ${check}` };
   if (value.text.toLowerCase() === siteId.toLowerCase()) return {};
@@ -164035,7 +164375,7 @@ function bundleFinding(app, { bundleId, storeBundleId }, fileName) {
     if (storeBundleId === bundleId) return {};
     return { conflict: `store/store.config.yaml builds bundle "${storeBundleId}", but the purchases app is registered for "${bundleId}". ${fileName} was not edited.` };
   }
-  const found = lookup2(app, "bundleId");
+  const found = lookup3(app, "bundleId");
   const value = found.kind === "written" ? unwrap(found.node.initializer) : void 0;
   if (!value || !ts8.isStringLiteralLike(value)) {
     return { instruction: `${fileName} does not write bundleId as a literal: make sure this app builds bundle ${JSON.stringify(bundleId)}, the one the purchases app is registered for.` };
@@ -164044,11 +164384,11 @@ function bundleFinding(app, { bundleId, storeBundleId }, fileName) {
   return { conflict: `${fileName} builds bundle "${value.text}", but the purchases app is registered for "${bundleId}". This is another app's config, so it was not edited.` };
 }
 function bindingFinding(app, file2, purchasesAppId, wanted, fileName) {
-  const wixIap = lookup2(app, "wixIap");
+  const wixIap = lookup3(app, "wixIap");
   if (wixIap.kind === "absent") return { splice: appendProperties(app, file2, [`${wanted},`]), applied: "wixIap.purchasesAppId" };
   const literal = wixIap.kind === "written" ? unwrap(wixIap.node.initializer) : void 0;
   if (!literal || !ts8.isObjectLiteralExpression(literal)) return { instruction: `${fileName} computes wixIap, so it was not edited: it must evaluate to ${wanted}.` };
-  const current = lookup2(literal, "purchasesAppId");
+  const current = lookup3(literal, "purchasesAppId");
   if (current.kind === "absent") return { splice: appendProperties(literal, file2, [`purchasesAppId: ${JSON.stringify(purchasesAppId)},`]), applied: "wixIap.purchasesAppId" };
   const value = current.kind === "written" ? unwrap(current.node.initializer) : void 0;
   if (!value || !ts8.isStringLiteralLike(value)) return { instruction: `${fileName} computes wixIap.purchasesAppId, so it was not edited: it must evaluate to ${JSON.stringify(purchasesAppId)}.` };
@@ -164056,7 +164396,7 @@ function bindingFinding(app, file2, purchasesAppId, wanted, fileName) {
   return { conflict: `${fileName} already binds purchases app "${value.text}", but this site's purchases app for the bundle is "${purchasesAppId}". Nothing was changed; fix whichever is stale.` };
 }
 function capabilityFinding(app, fileName) {
-  const capabilities = lookup2(app, "capabilities");
+  const capabilities = lookup3(app, "capabilities");
   const list = capabilities.kind === "written" ? unwrap(capabilities.node.initializer) : void 0;
   if (capabilities.kind !== "absent" && (!list || !ts8.isArrayLiteralExpression(list))) {
     return { instruction: `Add "iap" to capabilities: the purchases app is baked only into a build that declares it, and ${fileName} does not list capabilities inline.` };
@@ -164756,14 +165096,13 @@ function createReviewScreenRenderer() {
     }
     return built;
   }
+  let closeLaunched;
   async function launch() {
-    let chromium;
-    try {
-      ({ chromium } = await import("playwright"));
-    } catch {
-      throw new Error("taking a screenshot needs Playwright's Chromium: run `npx playwright install chromium`");
-    }
-    return chromium.launch();
+    const { launchPngBrowser: launchPngBrowser2 } = await Promise.resolve().then(() => (init_render_descriptor(), render_descriptor_exports));
+    const launched = await launchPngBrowser2();
+    if (!launched) throw new Error("taking a screenshot needs Playwright's Chromium: run `npx playwright install chromium`");
+    closeLaunched = launched.close;
+    return launched.browser;
   }
   return {
     async render({ contentDir: contentDir2, screenId, input, host, entityId }) {
@@ -164806,7 +165145,8 @@ function createReviewScreenRenderer() {
       return pngAvailable2();
     },
     async close() {
-      if (browser) await (await browser.catch(() => void 0))?.close().catch(() => {
+      if (browser) await browser.catch(() => void 0);
+      await closeLaunched?.().catch(() => {
       });
     }
   };
@@ -167114,8 +167454,8 @@ async function runNotifyPing(flags, io2, deps = {}) {
     requestId: requestId2,
     ...flags["dry-run"] === true ? { dryRun: true } : {}
   };
-  const http = await pushSendRequest({ target: session.target, wixToken: session.wixToken, siteToken: siteToken2, body, previewTag: session.previewTag, fetchImpl: deps.fetchImpl });
-  return report2(http, body, flags, io2);
+  const http2 = await pushSendRequest({ target: session.target, wixToken: session.wixToken, siteToken: siteToken2, body, previewTag: session.previewTag, fetchImpl: deps.fetchImpl });
+  return report2(http2, body, flags, io2);
 }
 async function runAllMembers(args) {
   const { input, siteToken: siteToken2, session, requestId: requestId2, flags, io: io2, deps } = args;
@@ -167204,25 +167544,25 @@ function flagRefusal(flags) {
   if (SWITCHES.some((f2) => flags[f2] !== void 0 && typeof flags[f2] !== "boolean")) return "invalid_boolean_flag";
   return void 0;
 }
-function report2(http, sent, flags, io2) {
-  const code = refusalCode2(http);
+function report2(http2, sent, flags, io2) {
+  const code = refusalCode2(http2);
   if (code === "send_outcome_unknown") {
     return refuse6(io2, code, `Ping may have accepted it. Re-run the same command with --request-id ${sent.requestId}: Ping runs one request at most once per site for 24 hours.`, 1, { requestId: sent.requestId });
   }
-  if (code === "rate_limited" && http.retryAfterSec) {
-    return refuse6(io2, code, `Test sends are limited per owner; retry in ${http.retryAfterSec} seconds.`, 1, { retryAfterSec: http.retryAfterSec });
+  if (code === "rate_limited" && http2.retryAfterSec) {
+    return refuse6(io2, code, `Test sends are limited per owner; retry in ${http2.retryAfterSec} seconds.`, 1, { retryAfterSec: http2.retryAfterSec });
   }
   if (code) return refuse6(io2, code, HINTS[code], 1);
-  if (flags.json === true) io2.log(JSON.stringify(http.body, null, 2));
-  else io2.log(summary(http.body ?? {}, sent));
+  if (flags.json === true) io2.log(JSON.stringify(http2.body, null, 2));
+  else io2.log(summary(http2.body ?? {}, sent));
   return 0;
 }
-function refusalCode2(http) {
-  if (http.error) return http.error === "push_send_unreachable" ? "send_outcome_unknown" : http.error;
-  if (http.ok && (http.body?.state === "accepted" || http.body?.state === "dry_run")) return void 0;
-  const code = String(http.body?.error ?? "");
+function refusalCode2(http2) {
+  if (http2.error) return http2.error === "push_send_unreachable" ? "send_outcome_unknown" : http2.error;
+  if (http2.ok && (http2.body?.state === "accepted" || http2.body?.state === "dry_run")) return void 0;
+  const code = String(http2.body?.error ?? "");
   if (KNOWN_CODES.has(code)) return code;
-  return http.ok || http.status >= 500 ? "send_outcome_unknown" : "push_send_failed";
+  return http2.ok || http2.status >= 500 ? "send_outcome_unknown" : "push_send_failed";
 }
 function summary(result, sent) {
   if (result.state === "dry_run") {
@@ -167797,10 +168137,13 @@ __export(plan_exports, {
   RESERVED_SCREEN_IDS: () => RESERVED_SCREEN_IDS,
   displayName: () => displayName2,
   gateFor: () => gateFor,
+  hasLinkField: () => hasLinkField,
   humanize: () => humanize,
+  missingCapabilities: () => missingCapabilities,
   planEntity: () => planEntity,
   planEntityScreens: () => planEntityScreens,
   pluralize: () => pluralize,
+  requiredCapabilities: () => requiredCapabilities,
   rowTitleField: () => rowTitleField,
   snake: () => snake
 });
@@ -167876,6 +168219,12 @@ function fieldReadOnly(f2) {
   const rls = f2.rls;
   return !!rls && typeof rls === "object" && "write" in rls && rls.write !== true;
 }
+function requiredCapabilities(sp) {
+  return ["base44", ...sp.plans.some(hasLinkField) ? ["open_url"] : []];
+}
+function missingCapabilities(sp, declared) {
+  return requiredCapabilities(sp).filter((c2) => !declared.has(c2)).map((capability) => ({ capability, entities: (capability === "open_url" ? sp.plans.filter(hasLinkField) : sp.plans).map((p2) => p2.name) }));
+}
 function ruleFor(spec, op) {
   const rls = spec.rls;
   if (!rls || typeof rls !== "object") return void 0;
@@ -167954,7 +168303,7 @@ function planEntityScreens(specs, app = "") {
   if (names2.length <= ENTITY_TAB_SLOTS) return { plans, tabs: names2, more: [] };
   return { plans, tabs: names2.slice(0, ENTITY_TAB_SLOTS - 1), more: names2.slice(ENTITY_TAB_SLOTS - 1) };
 }
-var PlanError, RESERVED_SCREEN_IDS, MORE_SCREEN_ID, ENTITY_TAB_SLOTS, OWNER_RULES, pascal, PREFERRED_TITLES, LONG_TEXT, IMAGE_KEY, SEGMENTED_MAX, isPlainString, isEnum, isDate, isImage, isLongText, nounOf;
+var PlanError, RESERVED_SCREEN_IDS, MORE_SCREEN_ID, ENTITY_TAB_SLOTS, OWNER_RULES, pascal, PREFERRED_TITLES, LONG_TEXT, IMAGE_KEY, SEGMENTED_MAX, isPlainString, isEnum, isDate, isImage, isLongText, hasLinkField, nounOf;
 var init_plan4 = __esm({
   "src/base44-screens/plan.ts"() {
     init_base44_schema();
@@ -167980,6 +168329,7 @@ var init_plan4 = __esm({
     isDate = (f2) => f2.type === "string" && (f2.format === "date" || f2.format === "date-time");
     isImage = (f2) => f2.type === "string" && !isEnum(f2) && (f2.format === "file" || IMAGE_KEY.test(f2.key));
     isLongText = (f2) => f2.type === "string" && !isEnum(f2) && (f2.format === "richtext" || LONG_TEXT.test(f2.key));
+    hasLinkField = (p2) => p2.detail.some((d2) => d2.show === "link");
     nounOf = (display) => display.split(" ").map((w2) => /^[A-Z]{2,}s?$/.test(w2) ? w2 : w2.toLowerCase()).join(" ");
   }
 });
@@ -168031,13 +168381,25 @@ export default defineEntityList(PLAN);
 `;
 }
 function renderDetailEntry(p2) {
-  return `// One ${p2.name} (${p2.ids.detail}), pushed from ${p2.ids.list} with its id \u2014 generated by \`himi base44 screens\`.
+  if (!hasLinkField(p2)) {
+    return `// One ${p2.name} (${p2.ids.detail}), pushed from ${p2.ids.list} with its id \u2014 generated by \`himi base44 screens\`.
 // The behaviour lives in the shared engine (../_shared/entity-detail.ts); this file only names the
 // entity's plan.
 import { defineEntityDetail } from "../_shared/entity-detail.js";
 import { PLAN } from "../_shared/${planFile(p2)}.js";
 
 export default defineEntityDetail(PLAN);
+`;
+  }
+  return `// One ${p2.name} (${p2.ids.detail}), pushed from ${p2.ids.list} with its id \u2014 generated by \`himi base44 screens\`.
+// The behaviour lives in the shared engine (../_shared/entity-detail.ts); this file names the
+// entity's plan and hands it \`open\`, which an email / URL fact opens through (the open_url
+// capability \u2014 only an entity with such a field imports it).
+import { open } from "@himalaya/open-url";
+import { defineEntityDetail } from "../_shared/entity-detail.js";
+import { PLAN } from "../_shared/${planFile(p2)}.js";
+
+export default defineEntityDetail(PLAN, { open });
 `;
 }
 function renderDevRegistrations(sp) {
@@ -168763,8 +169125,8 @@ function readEntities(files, dirs) {
 function functionSignature(code) {
   if (code === void 0) return { kind: "unknown" };
   const methods = [...new Set([...code.matchAll(/\b(?:req|request)\.method\s*[!=]==?\s*["'](GET|POST|PUT|PATCH|DELETE)["']/g)].map((m2) => m2[1]))];
-  const http = /\bDeno\.serve\s*\(|\bserve\s*\(\s*(?:async\s*)?\(?\s*req/.test(code);
-  return { kind: http ? "http" : "invoke", ...methods.length ? { methods } : {} };
+  const http2 = /\bDeno\.serve\s*\(|\bserve\s*\(\s*(?:async\s*)?\(?\s*req/.test(code);
+  return { kind: http2 ? "http" : "invoke", ...methods.length ? { methods } : {} };
 }
 function automationsOf(v2) {
   if (!Array.isArray(v2)) return void 0;
@@ -170755,9 +171117,9 @@ function cmsStatusNote(taxonomy) {
       bits.push("skipped: no owner token \u2014 re-run with `--site <msid>` (owner auth) to list the site's collections");
       break;
     case "error": {
-      const http = taxonomy.cmsErrorStatus;
-      const remedy = http === 429 ? "the site rate-limited the listing \u2014 wait and re-run" : http != null && http >= 500 ? "Wix Data failed upstream \u2014 retry later, and investigate the service if it persists" : http === 401 || http === 403 ? "check the owner token is current and carries the Wix Data read permission, then re-run" : "check the owner token and the `--site <msid>` you passed, then re-run";
-      bits.push(`error${http ? ` HTTP ${http}` : ""}: the listing call failed \u2014 ${remedy}`);
+      const http2 = taxonomy.cmsErrorStatus;
+      const remedy = http2 === 429 ? "the site rate-limited the listing \u2014 wait and re-run" : http2 != null && http2 >= 500 ? "Wix Data failed upstream \u2014 retry later, and investigate the service if it persists" : http2 === 401 || http2 === 403 ? "check the owner token is current and carries the Wix Data read permission, then re-run" : "check the owner token and the `--site <msid>` you passed, then re-run";
+      bits.push(`error${http2 ? ` HTTP ${http2}` : ""}: the listing call failed \u2014 ${remedy}`);
       break;
     }
     default:
@@ -174974,7 +175336,7 @@ var init_dist = __esm({
             return promiseCallback.reject(new Error(SAME_SITE_CONTEXT_VAL_ERR));
           }
         }
-        const http = options.http ?? true;
+        const http2 = options.http ?? true;
         const now = Date.now();
         const expireCheck = options.expire ?? true;
         const allPaths = options.allPaths ?? false;
@@ -174995,7 +175357,7 @@ var init_dist = __esm({
           if (c2.secure && !potentiallyTrustworthy) {
             return false;
           }
-          if (c2.httpOnly && !http) {
+          if (c2.httpOnly && !http2) {
             return false;
           }
           if (sameSiteLevel) {
@@ -184778,7 +185140,9 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
                                            base44.entities entity (base44-starter packages), write
                                            controls gated by each entity's rls. Re-running is a
                                            no-op; a hand-edited generated file is skipped-edited
-                                           unless --force. Never calls Base44.
+                                           unless --force. An email / URL field opens through
+                                           open_url, so config.ts capabilities must list it
+                                           (else missing_capability). Never calls Base44.
   himi base44 entities create [--app <a> | --content <dir>] [--yes] [--allow-destructive]
                               [--apply-permissions] [--empty-app-ok]
                                            create/update the app's OWNED Himi<App>* entities. Base44's
@@ -185040,7 +185404,7 @@ function execNpmConfig(file2, args, options) {
   });
 }
 var npmScopedWixRegistry = createScopedRegistryResolver();
-async function scopedRegistryBefore(lookup3, deadline, onTimeout) {
+async function scopedRegistryBefore(lookup4, deadline, onTimeout) {
   let cancel = () => {
   };
   const expired = new Promise((resolve66) => {
@@ -185051,16 +185415,16 @@ async function scopedRegistryBefore(lookup3, deadline, onTimeout) {
     cancel = () => clearTimeout(timer);
   });
   try {
-    return await Promise.race([Promise.resolve().then(() => lookup3(Math.max(0, deadline - Date.now()))), expired]);
+    return await Promise.race([Promise.resolve().then(() => lookup4(Math.max(0, deadline - Date.now()))), expired]);
   } catch {
     return void 0;
   } finally {
     cancel();
   }
 }
-function lookupOnce(lookup3) {
+function lookupOnce(lookup4) {
   let first;
-  return (budgetMs) => first ??= Promise.resolve().then(() => lookup3(budgetMs));
+  return (budgetMs) => first ??= Promise.resolve().then(() => lookup4(budgetMs));
 }
 function registryCandidates(env, scoped) {
   const ordered = [isTrustedRegistry(scoped) ? normalizeRegistry(scoped) : void 0, trustedConfiguredRegistry(env), PUBLIC_NPM_REGISTRY];
@@ -192866,9 +193230,12 @@ ${report3.ok ? "OK \u2014 data + serve plane reachable." : typeof report3.hint =
           }
           const app = await appId(dir);
           let base44;
+          let appCapabilities;
           try {
             const { loadAppConfigModule: loadAppConfigModule2 } = await Promise.resolve().then(() => (init_app_config_loader(), app_config_loader_exports));
-            base44 = (await loadAppConfigModule2(dir))?.base44;
+            const loaded = await loadAppConfigModule2(dir);
+            base44 = loaded?.base44;
+            appCapabilities = loaded?.capabilities;
           } catch (e2) {
             const finding = (await Promise.resolve().then(() => (init_base44_lint(), base44_lint_exports))).base44DefineAppFinding(e2);
             if (finding) {
@@ -192887,7 +193254,7 @@ ${report3.ok ? "OK \u2014 data + serve plane reachable." : typeof report3.hint =
             io2.error(JSON.stringify({ ok: false, code: "invalid_config", app, issues: errors, hint: '`himi validate` reports these with pass: "base44"' }));
             return 1;
           }
-          const { planEntityScreens: planEntityScreens2, PlanError: PlanError2 } = await Promise.resolve().then(() => (init_plan4(), plan_exports));
+          const { planEntityScreens: planEntityScreens2, PlanError: PlanError2, missingCapabilities: missingCapabilities2, requiredCapabilities: requiredCapabilities2 } = await Promise.resolve().then(() => (init_plan4(), plan_exports));
           let sp;
           try {
             sp = planEntityScreens2(specs, app);
@@ -192895,6 +193262,18 @@ ${report3.ok ? "OK \u2014 data + serve plane reachable." : typeof report3.hint =
             if (e2 instanceof PlanError2) return fail6(e2.code, e2.message, { app, ...e2.extra });
             throw e2;
           }
+          const { catalogKey: catalogKey2, expandCapabilities: expandCapabilities2 } = await Promise.resolve().then(() => (init_src2(), src_exports));
+          const declaredCaps = expandCapabilities2((Array.isArray(appCapabilities) ? appCapabilities : []).filter((c2) => typeof c2 === "string").map(catalogKey2));
+          const missingCaps = missingCapabilities2(sp, declaredCaps);
+          if (missingCaps.length) {
+            const [first] = missingCaps;
+            return fail6("missing_capability", `config.ts capabilities does not declare "${first.capability}", which the generated screens need (${first.entities.join(", ")})`, {
+              app,
+              capability: first.capability,
+              missing: missingCaps,
+              hint: `add it \u2014 capabilities: [..., ${missingCaps.map((m2) => `"${m2.capability}"`).join(", ")}] \u2014 then re-run; the native config follows from the capability catalog (himi docs capabilities). Nothing was written.`
+            });
+          }
           const rendered = gen.renderAll(sp);
           const dryRun = flags["dry-run"] === true;
           const { files } = gen.writeGenerated(dir, rendered, { force: flags.force === true, dryRun });
@@ -192905,6 +193284,7 @@ ${report3.ok ? "OK \u2014 data + serve plane reachable." : typeof report3.hint =
             ...dryRun ? { dryRun: true } : {},
             files,
             plans: sp.plans.map((p2) => ({ entity: p2.name, physical: p2.entity, list: p2.ids.list, detail: p2.ids.detail, gates: p2.gates })),
+            capabilities: requiredCapabilities2(sp),
             tabs: sp.tabs,
             more: sp.more,
             ...orphaned.length ? { orphaned, note: "generated files for entities no longer declared \u2014 never deleted; remove them by hand if the screens should go" } : {},

package/guides/base44-app-to-himi-app.md

@@ -139,12 +139,12 @@ Write `.himi/screen-plan.md` before editing code. For each entity in `book.entit
 | `string` + long text (`description`, `notes`, `body`, …) | `Text` with `maxLines` | `TextField` with `multilineMaxLines` |
 | `string` + `enum` | `Badge` / `Text` | `SegmentedControl` (≤ 4 values) or `Picker` |
 | `string` + `format: date` / `date-time` | formatted `Text` | `DatePicker` |
-| `string` + `format: email` / `uri` | `Text` (the generator does not make it tappable yet) | `TextField` with `keyboard: "email"` / `"url"` |
+| `string` + `format: email` / `uri` | a tappable row: an email opens mail, a URL the in-app browser, through `@himalaya/open-url` (needs `open_url`, below) | `TextField` with `keyboard: "email"` / `"url"` |
 | `string` holding an image URL (`image`, `photo`, `avatar`, `*_url`) | `Image` | read-only, see [file upload](#what-the-sdk-cannot-do) |
 | `number` / `integer` | `Text` (with unit) | `Stepper` (small ranges) or numeric `TextField` |
 | `boolean` | `Badge` or `Text` | `Toggle` |
-| `array` of strings | comma-joined `Text` | `ChipsInput` |
-| `object` / nested `array` of objects | its JSON as `Text` (a sub-section of rows is yours to build) | none. Edit it on the web app |
+| `array` of strings | read-only `FilterChips` (no selection, no `onChange`) | `ChipsInput` |
+| `object` / nested `array` of objects | a labelled sub-section of key/value rows, one level deep: one row per key (an array: one row per item, `Item 1`, …), a deeper value inline as `Key: value · …` | none. Edit it on the web app |
 | built-ins `id`, `created_date`, `updated_date`, `created_by` | "Created …" metadata row | never editable |
 
 4. **Respect the entity's rules.** `rls` (and field-level `rls`) decide what the signed-in user
@@ -161,7 +161,17 @@ Write `.himi/screen-plan.md` before editing code. For each entity in `book.entit
    A field whose field-level `rls.write` is not `true` is read-only in the form. The gate is
    advisory: a denied call still fails with Base44's message, and every screen paints that error
    rather than swallowing it.
-5. **Use the sample rows** (`sampleRows`, already redacted) to size rows and choose the subtitle,
+5. **Declare `open_url` when an entity has an email or URL field.** The detail opens those facts
+   through `@himalaya/open-url`, so the app must list the capability:
+   `capabilities: ["base44", "open_url"]` in `config.ts`. Without it `himi base44 screens` writes
+   nothing and fails with `code: "missing_capability"` (`capability: "open_url"`, and `missing[]`
+   names the entities that need it). The binary's native config follows from that list (the
+   capability catalog, `himi docs capabilities`), so a shell built without it needs a new
+   `himi dist`. Only the detail of an entity with such a field imports `@himalaya/open-url` and
+   declares `open_url`. A value that is not an address or an http(s) URL (`javascript:`, an app
+   scheme) is shown as plain text and never opened. A link, chips or section fact with no value
+   shows a `—` row instead.
+6. **Use the sample rows** (`sampleRows`, already redacted) to size rows and choose the subtitle,
    never as data the app ships.
 
 Compose each screen with [`designing-himi-screens`](designing-himi-screens.md)
@@ -202,8 +212,10 @@ Re-running is safe. Each generated file starts with
   `skipped-edited` and left alone, and the command still exits 0. Pass `--force` to overwrite it;
 - files for an entity you removed from `config.ts` are reported in `orphaned[]` and never deleted.
 
-`--dry-run` reports the same outcomes without writing. Failures carry a top-level `code`
-(`no_entities_block`, `entity_id_collision`, `content_dir_not_base44_starter`), per
+`--dry-run` reports the same outcomes without writing. On success `capabilities[]` lists what the
+generated screens need (`base44`, plus `open_url` with a link field). Failures carry a top-level
+`code` (`no_entities_block`, `entity_id_collision`, `missing_capability`,
+`content_dir_not_base44_starter`), per
 [`himi-json-output`](himi-json-output.md). The generator never calls Base44.
 
 To change a screen beyond what the plan expresses (a filtered list, a child section, a custom

package/guides/himi-json-output.md

@@ -324,9 +324,14 @@ on stderr (exit 1):
 - `no_entities_block`: `config.ts` declares no `base44.entities`, so there is nothing to generate.
 - `entity_id_collision`: two entities would generate the same screen id (or one would shadow
   `b44_functions` / `b44_account` / `b44_more`); `entity`, `screenId` and `with` name the clash.
+- `missing_capability`: an entity has an email / URL field, which the detail opens through
+  `@himalaya/open-url`, and `config.ts` `capabilities` does not list `open_url`. `capability` names
+  it and `missing[]` gives `{ capability, entities }` per missing id. Nothing is written. Add it to
+  `capabilities` and re-run.
 - `config_unloadable` / `invalid_config`: as for `himi base44 entities` above.
 
-On success (`ok: true`, stdout, exit 0) `files[]` gives every generated path with its `outcome`:
+On success (`ok: true`, stdout, exit 0) `capabilities[]` lists the ids the generated screens need
+(`base44`, plus `open_url` with a link field), and `files[]` gives every generated path with its `outcome`:
 `written`, `unchanged`, or `skipped-edited` (the file was edited by hand and was left alone; pass
 `--force` to overwrite it). A skipped file is not a failure. `orphaned[]`, when present, lists
 generated files for entities no longer declared. They are never deleted.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1437.0",
+  "version": "0.1439.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "9420ac69c3606bfc2c5c00103d9082f80dbed8b2d813d658111e6eeb"
+  "falconPackageHash": "517214ad79ba1f66fcc679a54a5edf1e5242a258037728e41501f8ce"
 }