@wix/himalaya-cli 0.1438.0 → 0.1439.0

package/dist/cli.mjs

@@ -8078,7 +8078,6 @@ function resolveTranslation(value, catalog3, sourceCatalog) {
 var BINDING_SIGILS, BINDING_SIGIL_RE, TRANSLATION_PREFIX, TRANSLATION_KEY_RE;
 var init_bindings = __esm({
   "../../core/ts/src/bindings.ts"() {
-    "use strict";
     BINDING_SIGILS = ["service", "flag", "item", "t"];
     BINDING_SIGIL_RE = new RegExp(
       `^\\$(?:${BINDING_SIGILS.filter((s2) => s2 !== "t").join("|")})\\b|^\\$t:`
@@ -17852,6 +17851,7 @@ function resolveIdiom(tokens2, ctx = {}) {
 var IDIOM_CONTEXTS, UNSAFE_KEYS;
 var init_idiom = __esm({
   "../../core/ts/src/idiom.ts"() {
+    "use strict";
     IDIOM_CONTEXTS = {
       ios: { native: ["ios"] },
       android: { native: ["material"] },
@@ -131234,12 +131234,14 @@ __export(render_descriptor_exports, {
   clientEnvFor: () => clientEnvFor,
   collectNativeOnly: () => collectNativeOnly,
   isMissingPlaywrightExecutable: () => isMissingPlaywrightExecutable,
+  launchPngBrowser: () => launchPngBrowser,
   nodeHidden: () => nodeHidden,
   pngAvailable: () => pngAvailable,
   pngPageHtml: () => pngPageHtml,
   renderDescriptorWeb: () => renderDescriptorWeb,
   renderPngBatch: () => renderPngBatch,
   renderSchemeFor: () => renderSchemeFor,
+  setPngEgress: () => setPngEgress,
   setPngFontCss: () => setPngFontCss,
   stabilizePngPage: () => stabilizePngPage,
   withRetry: () => withRetry2
@@ -131630,8 +131632,24 @@ async function stabilizePngPage(page, scheme) {
     await new Promise((resolve66) => browser.requestAnimationFrame(() => browser.requestAnimationFrame(() => resolve66())));
   }, scheme);
 }
-async function renderPngBatch(items) {
-  if (!items.length) return [];
+function setPngEgress(start) {
+  const prev = pngEgress;
+  pngEgress = start;
+  return prev;
+}
+async function pngEgressStart() {
+  if (pngEgress !== void 0) return pngEgress;
+  const spec = "./png-egress.js";
+  try {
+    return (await import(
+      /* @vite-ignore */
+      spec
+    )).startEgressProxy;
+  } catch {
+    return null;
+  }
+}
+async function launchPngBrowser() {
   let chromium;
   try {
     ({ chromium } = await import("playwright"));
@@ -131639,13 +131657,41 @@ async function renderPngBatch(items) {
     return null;
   }
   if (!chromium) return null;
+  const start = await pngEgressStart();
+  if (!start) return null;
+  let egress;
+  try {
+    egress = await start();
+  } catch {
+    return null;
+  }
   const launch = chromium.launch.bind(chromium);
   let browser;
   try {
-    browser = await withRetry2(() => launch(), 3);
+    browser = await withRetry2(() => launch({
+      proxy: { server: egress.url, bypass: "<-loopback>" },
+      args: ["--force-webrtc-ip-handling-policy=disable_non_proxied_udp", "--webrtc-ip-handling-policy=disable_non_proxied_udp"]
+    }), 3);
   } catch {
+    await egress.close().catch(() => {
+    });
     return null;
   }
+  return {
+    browser,
+    close: async () => {
+      await browser.close().catch(() => {
+      });
+      await egress.close().catch(() => {
+      });
+    }
+  };
+}
+async function renderPngBatch(items) {
+  if (!items.length) return [];
+  const launched = await launchPngBrowser();
+  if (!launched) return null;
+  const { browser } = launched;
   try {
     const out2 = [];
     for (const it2 of items) {
@@ -131666,11 +131712,10 @@ async function renderPngBatch(items) {
     }
     return out2;
   } finally {
-    await browser.close().catch(() => {
-    });
+    await launched.close();
   }
 }
-var A11Y_MODIFIER_KEYS, TREE_TEXT_VALUE_PROPS, asStringOrNumber, asStringOnly, asOtpCode, VALUE_PATH_TEXT, MEDIA_PLAYER_QUEUE_PROPERTIES, NATIVE_ONLY_TYPES, HOST_PAGE_FONT, pngFontCss;
+var A11Y_MODIFIER_KEYS, TREE_TEXT_VALUE_PROPS, asStringOrNumber, asStringOnly, asOtpCode, VALUE_PATH_TEXT, MEDIA_PLAYER_QUEUE_PROPERTIES, NATIVE_ONLY_TYPES, HOST_PAGE_FONT, pngFontCss, pngEgress;
 var init_render_descriptor = __esm({
   "../../core/dev-server/src/render-descriptor.ts"() {
     init_tokens2();
@@ -131714,6 +131759,229 @@ var init_render_descriptor = __esm({
   }
 });
 
+// ../../core/dev-server/src/png-egress.ts
+import http from "node:http";
+import net from "node:net";
+import { lookup as lookup2 } from "node:dns/promises";
+function isPublicAddress(ip) {
+  const family = net.isIP(ip);
+  if (family === 0) return false;
+  return family === 4 ? !BLOCKED_V4.check(ip, "ipv4") : !BLOCKED_V6.check(ip, "ipv6");
+}
+function originKey(origin) {
+  try {
+    const u2 = new URL(origin);
+    return hostPortKey(u2.hostname, u2.port || (u2.protocol === "https:" ? "443" : "80"));
+  } catch {
+    return null;
+  }
+}
+function hostPortKey(host, port) {
+  return `${host.replace(/^\[|\]$/g, "").replace(/\.$/, "").toLowerCase()}:${port}`;
+}
+function allowPngOrigins(origins) {
+  const keys = origins.map(originKey).filter((k2) => !!k2);
+  for (const k2 of keys) allowedOrigins.set(k2, (allowedOrigins.get(k2) ?? 0) + 1);
+  return () => {
+    for (const k2 of keys) {
+      const n2 = (allowedOrigins.get(k2) ?? 1) - 1;
+      if (n2 <= 0) allowedOrigins.delete(k2);
+      else allowedOrigins.set(k2, n2);
+    }
+  };
+}
+function ownOrigins(port, publicBase) {
+  return [`http://localhost:${port}`, `http://127.0.0.1:${port}`, `http://[::1]:${port}`, ...publicBase ? [publicBase] : []];
+}
+async function resolveEgress(host, port, allow = allowedOrigins) {
+  const bare = host.replace(/^\[|\]$/g, "");
+  let addrs;
+  try {
+    addrs = net.isIP(bare) ? [{ address: bare, family: net.isIP(bare) }] : await lookup2(bare.replace(/\.$/, ""), { all: true, order: "ipv4first" });
+  } catch {
+    return null;
+  }
+  if (!addrs.length) return null;
+  if (allow.has(hostPortKey(host, port))) return addrs;
+  return addrs.every((a2) => isPublicAddress(a2.address)) ? addrs : null;
+}
+function connectFirst(addrs, port, track) {
+  return new Promise((resolve66, reject) => {
+    const tryAt = (i2) => {
+      if (i2 >= addrs.length) return reject(new Error("no address answered"));
+      const s2 = net.connect({ host: addrs[i2].address, family: addrs[i2].family, port });
+      track(s2);
+      s2.setTimeout(CONNECT_TIMEOUT_MS, () => s2.destroy(new Error("connect timeout")));
+      const onFail = () => {
+        s2.destroy();
+        tryAt(i2 + 1);
+      };
+      s2.once("error", onFail);
+      s2.once("connect", () => {
+        s2.off("error", onFail);
+        s2.setTimeout(0);
+        resolve66(s2);
+      });
+    };
+    tryAt(0);
+  });
+}
+async function startEgressProxy() {
+  const blocked = [];
+  const sockets = /* @__PURE__ */ new Set();
+  const track = (s2) => {
+    sockets.add(s2);
+    s2.once("close", () => sockets.delete(s2));
+  };
+  const guard = (s2) => {
+    track(s2);
+    s2.on("error", () => s2.destroy());
+  };
+  const server = http.createServer(async (req, res) => {
+    let u2;
+    try {
+      u2 = new URL(req.url ?? "");
+    } catch {
+      res.writeHead(400).end();
+      return;
+    }
+    const port2 = Number(u2.port || 80);
+    const addrs = u2.protocol === "http:" ? await resolveEgress(u2.hostname, port2) : null;
+    if (!addrs) {
+      blocked.push(hostPortKey(u2.hostname, port2));
+      res.writeHead(403).end();
+      return;
+    }
+    let sock;
+    try {
+      sock = await connectFirst(addrs, port2, guard);
+    } catch {
+      res.writeHead(502).end();
+      return;
+    }
+    const headers2 = { ...req.headers, host: u2.host };
+    delete headers2["proxy-connection"];
+    const upstream = http.request({ createConnection: () => sock, method: req.method, path: `${u2.pathname}${u2.search}`, headers: headers2 }, (up) => {
+      res.writeHead(up.statusCode ?? 502, up.headers);
+      up.pipe(res);
+    });
+    upstream.on("error", () => {
+      if (!res.headersSent) res.writeHead(502);
+      res.end();
+    });
+    req.pipe(upstream);
+  });
+  server.on("connection", guard);
+  server.on("clientError", (_e2, socket) => socket.destroy());
+  server.on("connect", async (req, socket, head) => {
+    guard(socket);
+    const m2 = /^\[?([^\]]+?)\]?:(\d+)$/.exec(req.url ?? "");
+    const addrs = m2 ? await resolveEgress(m2[1], Number(m2[2])) : null;
+    if (!m2 || !addrs) {
+      blocked.push(m2 ? hostPortKey(m2[1], m2[2]) : String(req.url));
+      socket.end("HTTP/1.1 403 Forbidden\r\n\r\n");
+      return;
+    }
+    let upstream;
+    try {
+      upstream = await connectFirst(addrs, Number(m2[2]), guard);
+    } catch {
+      socket.end("HTTP/1.1 502 Bad Gateway\r\n\r\n");
+      return;
+    }
+    socket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+    if (head.length) upstream.write(head);
+    upstream.pipe(socket);
+    socket.pipe(upstream);
+  });
+  server.on("upgrade", async (req, socket, head) => {
+    guard(socket);
+    let u2;
+    try {
+      u2 = new URL(req.url ?? "");
+    } catch {
+      socket.destroy();
+      return;
+    }
+    const port2 = Number(u2.port || 80);
+    const addrs = await resolveEgress(u2.hostname, port2);
+    if (!addrs) {
+      blocked.push(hostPortKey(u2.hostname, port2));
+      socket.end("HTTP/1.1 403 Forbidden\r\n\r\n");
+      return;
+    }
+    let upstream;
+    try {
+      upstream = await connectFirst(addrs, port2, guard);
+    } catch {
+      socket.end("HTTP/1.1 502 Bad Gateway\r\n\r\n");
+      return;
+    }
+    const lines = [`${req.method} ${u2.pathname}${u2.search} HTTP/1.1`];
+    for (let i2 = 0; i2 < req.rawHeaders.length; i2 += 2) lines.push(`${req.rawHeaders[i2]}: ${req.rawHeaders[i2 + 1]}`);
+    upstream.write(`${lines.join("\r\n")}\r
+\r
+`);
+    if (head.length) upstream.write(head);
+    upstream.pipe(socket);
+    socket.pipe(upstream);
+  });
+  await new Promise((resolve66, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => resolve66());
+  });
+  const { port } = server.address();
+  return {
+    url: `http://127.0.0.1:${port}`,
+    blocked,
+    close: () => new Promise((resolve66) => {
+      server.close(() => resolve66());
+      for (const s2 of sockets) s2.destroy();
+      server.closeAllConnections?.();
+    })
+  };
+}
+var BLOCKED_V4, BLOCKED_V6, CONNECT_TIMEOUT_MS, allowedOrigins;
+var init_png_egress = __esm({
+  "../../core/dev-server/src/png-egress.ts"() {
+    BLOCKED_V4 = new net.BlockList();
+    BLOCKED_V6 = new net.BlockList();
+    for (const [addr, prefix] of [
+      ["0.0.0.0", 8],
+      ["10.0.0.0", 8],
+      ["100.64.0.0", 10],
+      ["127.0.0.0", 8],
+      ["169.254.0.0", 16],
+      ["172.16.0.0", 12],
+      ["192.0.0.0", 24],
+      ["192.0.2.0", 24],
+      ["192.88.99.0", 24],
+      ["192.168.0.0", 16],
+      ["198.18.0.0", 15],
+      ["198.51.100.0", 24],
+      ["203.0.113.0", 24],
+      ["224.0.0.0", 4],
+      ["240.0.0.0", 4]
+    ]) BLOCKED_V4.addSubnet(addr, prefix, "ipv4");
+    for (const [addr, prefix] of [
+      ["::", 96],
+      ["::ffff:0:0", 96],
+      ["64:ff9b::", 96],
+      ["64:ff9b:1::", 48],
+      ["100::", 64],
+      ["2001::", 23],
+      ["2001:db8::", 32],
+      ["2002::", 16],
+      ["fc00::", 7],
+      ["fe80::", 10],
+      ["fec0::", 10],
+      ["ff00::", 8]
+    ]) BLOCKED_V6.addSubnet(addr, prefix, "ipv6");
+    CONNECT_TIMEOUT_MS = 1e4;
+    allowedOrigins = /* @__PURE__ */ new Map();
+  }
+});
+
 // ../../core/dev-server/src/render-fonts.ts
 import { existsSync as existsSync45, readFileSync as readFileSync49 } from "node:fs";
 import { extname, join as join44 } from "node:path";
@@ -136304,6 +136572,17 @@ function createDevServer(opts = {}) {
     })();
   };
   const httpServer = createServer3(handleRequest);
+  let disallowOwnOrigins;
+  httpServer.on("listening", () => {
+    const addr = httpServer.address();
+    if (!addr || typeof addr === "string") return;
+    disallowOwnOrigins?.();
+    disallowOwnOrigins = allowPngOrigins(ownOrigins(addr.port, process.env.HIMALAYA_DEV_PUBLIC_URL));
+  });
+  httpServer.on("close", () => {
+    disallowOwnOrigins?.();
+    disallowOwnOrigins = void 0;
+  });
   httpServer.inject = (request) => injectRequest(handleRequest, request);
   httpServer.on("clientError", (err, socket) => {
     console.error(`[himalaya-dev] malformed request rejected by the HTTP parser: ${err.code ?? ""} ${err.message}`);
@@ -136379,6 +136658,7 @@ var init_src6 = __esm({
     init_check();
     init_openapi();
     init_render_descriptor();
+    init_png_egress();
     init_render_fonts();
     init_app_config();
     init_tier();
@@ -136390,6 +136670,7 @@ var init_src6 = __esm({
     init_descriptor_postprocess();
     ROOT6 = resolve38(fileURLToPath22(new URL("../../..", import.meta.url)));
     setPngFontCss(async (tokens2, idiomContext) => await pngFontFaceCss(tokens2) + (idiomContext ? await idiomFontFaceCss(idiomContext) : ""));
+    setPngEgress(startEgressProxy);
     TIER3_ROOT = resolve38(ROOT6, "core/dev-server/web");
     TIER4_ROOT = resolve38(ROOT6, "core/dev-server/tier4-bundles");
     tier4Verifier = new TierFourVerifier(TIER4_ROOT);
@@ -150279,7 +150560,7 @@ function defineAppLiteral(file2) {
   return void 0;
 }
 function loginOf(app) {
-  const auth = lookup2(app, "auth");
+  const auth = lookup3(app, "auth");
   if (auth.kind !== "written") return { kind: auth.kind === "absent" ? "other" : "opaque" };
   const value = unwrap(auth.node.initializer);
   if (ts5.isObjectLiteralExpression(value)) return { kind: "other" };
@@ -150307,7 +150588,7 @@ function unwrap(node) {
   }
   return current;
 }
-function lookup2(literal, name) {
+function lookup3(literal, name) {
   let found = { kind: "absent" };
   for (const p2 of literal.properties) {
     const key3 = p2.name && (ts5.isIdentifier(p2.name) || ts5.isStringLiteral(p2.name)) ? p2.name.text : void 0;
@@ -150318,7 +150599,7 @@ function lookup2(literal, name) {
 }
 function stringValue(node, name) {
   const literal = unwrap(node);
-  const found = ts5.isObjectLiteralExpression(literal) ? lookup2(literal, name) : void 0;
+  const found = ts5.isObjectLiteralExpression(literal) ? lookup3(literal, name) : void 0;
   const value = found?.kind === "written" ? found.node.initializer : void 0;
   return value && ts5.isStringLiteralLike(value) ? value.text : void 0;
 }
@@ -150430,7 +150711,7 @@ function enablePushInConfig(source, options) {
   };
 }
 function planPush(app, pingAppName, plan) {
-  const push = lookup2(app, "push");
+  const push = lookup3(app, "push");
   if (push.kind === "absent") {
     plan.appended.push([
       ROUTES_COMMENT,
@@ -150461,7 +150742,7 @@ function planPush(app, pingAppName, plan) {
 }
 function planRetiredFamily(block, plan) {
   const literal = unwrap(block);
-  const found = ts6.isObjectLiteralExpression(literal) ? lookup2(literal, "pingAppName") : void 0;
+  const found = ts6.isObjectLiteralExpression(literal) ? lookup3(literal, "pingAppName") : void 0;
   const value = found?.kind === "written" ? unwrap(found.node.initializer) : void 0;
   const replacement = value && ts6.isStringLiteralLike(value) ? replacementPingFamily(value.text) : void 0;
   if (!value || !replacement) return;
@@ -150469,7 +150750,7 @@ function planRetiredFamily(block, plan) {
   plan.applied.push(`pingAppName ${JSON.stringify(replacement)} in place of ${value.getText()}`);
 }
 function planCapability(app, plan) {
-  const capabilities = lookup2(app, "capabilities");
+  const capabilities = lookup3(app, "capabilities");
   if (capabilities.kind === "absent") {
     plan.appended.push(['capabilities: ["push"],']);
     plan.applied.push("push capability");
@@ -150499,7 +150780,7 @@ function planAuthSite(login, file2, site, plan) {
     );
     return;
   }
-  const siteId = lookup2(login.literal, "siteId");
+  const siteId = lookup3(login.literal, "siteId");
   if (siteId.kind === "absent") {
     plan.splices.push(appendProperties(login.literal, file2, [`${wanted},`]));
     plan.applied.push("auth siteId");
@@ -150586,8 +150867,8 @@ async function ask(question, deps) {
 function defer(dir, input, scope, reason) {
   return recordPushDeferral(dir, { reason, scope, missing: missingPushInputs(input, scope), identity: input, resume: resume(dir) });
 }
-function renderPushStatus(http, refresh = false) {
-  const body = http.body ?? {};
+function renderPushStatus(http2, refresh = false) {
+  const body = http2.body ?? {};
   const verification = obj2(body.verification);
   const state = typeof body.state === "string" && STATES.has(body.state) ? body.state : "unknown";
   const mode = verification.mode === "live" ? "live" : verification.mode === "cached" ? "cached" : "unavailable";
@@ -150596,10 +150877,10 @@ function renderPushStatus(http, refresh = false) {
     return [name, typeof value === "string" && CHECK_STATES.has(value) ? value : "unknown"];
   }));
   const rawCode = typeof body.error === "string" ? body.error.split(":")[0] : void 0;
-  const responseError = http.error ?? (rawCode ? ERROR_CODES.has(rawCode) ? rawCode : "push_setup_failed" : void 0);
-  const error = responseError ?? (!http.ok ? "push_setup_failed" : refresh && mode !== "live" ? "live_verification_unavailable" : void 0);
+  const responseError = http2.error ?? (rawCode ? ERROR_CODES.has(rawCode) ? rawCode : "push_setup_failed" : void 0);
+  const error = responseError ?? (!http2.ok ? "push_setup_failed" : refresh && mode !== "live" ? "live_verification_unavailable" : void 0);
   return {
-    ok: http.ok && state === "ready" && !error && (!refresh || verification.backendConfigurationReady === true),
+    ok: http2.ok && state === "ready" && !error && (!refresh || verification.backendConfigurationReady === true),
     state,
     verificationMode: mode,
     backendConfigurationReady: verification.backendConfigurationReady === true,
@@ -150611,8 +150892,8 @@ function renderPushStatus(http, refresh = false) {
     note: "Backend setup is separate from building the app, device registration and notification delivery."
   };
 }
-function report(http, flags, io2, dir, config) {
-  const status = renderPushStatus(http, flags.refresh === true);
+function report(http2, flags, io2, dir, config) {
+  const status = renderPushStatus(http2, flags.refresh === true);
   const result = config && !config.pushOn ? { ...status, ok: false, error: status.error ?? (config.rolledBack ? "config_edit_rolled_back" : "config_push_not_on") } : status;
   const local = readPushOnboarding(dir).push;
   io2.log(JSON.stringify({ ...result, ...local ? { localOnboarding: "deferred" } : {}, ...config ? { config } : {} }, null, 2));
@@ -154729,7 +155010,7 @@ async function runCrawl(opts) {
       for (const d2 of list) if (d2.screenId !== rep.screenId) coveredBy.set(d2.screenId, rep.screenId);
     }
   }
-  const net = opts.offline ? null : opts.netPath ? { rules: readNetRules(resolve51(opts.netPath)), from: opts.netPath } : defaultNetRules(opts.dir);
+  const net2 = opts.offline ? null : opts.netPath ? { rules: readNetRules(resolve51(opts.netPath)), from: opts.netPath } : defaultNetRules(opts.dir);
   const suppressions = opts.config?.skip ?? [];
   const suppressed = [];
   const matchSuppression = (screen, actionId, componentId, invariant) => suppressions.find((s2) => (s2.screen === void 0 || s2.screen === screen) && (s2.action === void 0 || s2.action === actionId) && (s2.component === void 0 || s2.component === componentId) && (s2.invariant === void 0 || s2.invariant === invariant));
@@ -154757,7 +155038,7 @@ async function runCrawl(opts) {
       bundleMap: baked.bundleMap ?? null,
       knownScreenIds,
       ...opts.linkableScreenIds?.size ? { linkableScreenIds: opts.linkableScreenIds } : {},
-      rules: net?.rules ?? null,
+      rules: net2?.rules ?? null,
       ...opts.cmsSeed && Object.keys(opts.cmsSeed).length ? { cmsSeed: opts.cmsSeed } : {},
       ...opts.canned?.count ? { canned: opts.canned.byKey } : {},
       ...localDbSchema?.length ? { localDbSchema } : {},
@@ -154899,7 +155180,7 @@ async function runCrawl(opts) {
           bundleJs: baked.bundleJs,
           bundleMap: baked.bundleMap ?? null,
           knownScreenIds,
-          rules: net?.rules ?? null,
+          rules: net2?.rules ?? null,
           ...opts.cmsSeed && Object.keys(opts.cmsSeed).length ? { cmsSeed: opts.cmsSeed } : {},
           ...opts.canned?.count ? { canned: opts.canned.byKey } : {},
           ...localDbSchema?.length ? { localDbSchema } : {},
@@ -154966,7 +155247,7 @@ async function runCrawl(opts) {
     // so a run over static or bundle-less screens injects the dependency and replays nothing —
     // and the label then advertised "+ relations" beside `relations.checked: 0`. This is the
     // second time this line has overstated itself: it first claimed the axis unconditionally.
-    transport: describeTransport(net, opts, {
+    transport: describeTransport(net2, opts, {
       relations: relationsChecked > 0,
       hostile: opts.hostile !== false && Boolean(deps.crawlScreenHostile),
       deep: Boolean(opts.deep && opts.deep >= 2 && deps.crawlScreenDeep)
@@ -155004,9 +155285,9 @@ async function runCrawl(opts) {
     ...results.some((r2) => r2.observations) ? { observations: Object.fromEntries(results.filter((r2) => r2.observations).map((r2) => [r2.screen, r2.observations])) } : {}
   };
 }
-function describeTransport(net, opts, ran) {
+function describeTransport(net2, opts, ran) {
   const layers3 = [];
-  if (net) layers3.push(`mocked (${net.from})`);
+  if (net2) layers3.push(`mocked (${net2.from})`);
   const cmsCount = Object.keys(opts.cmsSeed ?? {}).length;
   if (cmsCount) layers3.push(`cms (${cmsCount} seeded collection${cmsCount === 1 ? "" : "s"})`);
   if (opts.canned?.count) layers3.push(`canned (${opts.canned.count} frozen endpoints, ${opts.canned.from} \u2014 exercises code paths, not API-contract truth)`);
@@ -164083,7 +164364,7 @@ function siteFinding(app, siteId, fileName) {
   const check = `make sure the app's member login uses siteId ${JSON.stringify(siteId)}: a build bakes the purchases app only for the site its login resolves to.`;
   const login = loginOf(app);
   if (login.kind !== "member") return { instruction: `${fileName} does not write auth as a WixConsumerAuthProvider({ \u2026 }) call it can read, so ${check}` };
-  const found = lookup2(login.literal, "siteId");
+  const found = lookup3(login.literal, "siteId");
   const value = found.kind === "written" ? unwrap(found.node.initializer) : void 0;
   if (!value || !ts8.isStringLiteralLike(value)) return { instruction: `auth's siteId is not written as a literal, so ${check}` };
   if (value.text.toLowerCase() === siteId.toLowerCase()) return {};
@@ -164094,7 +164375,7 @@ function bundleFinding(app, { bundleId, storeBundleId }, fileName) {
     if (storeBundleId === bundleId) return {};
     return { conflict: `store/store.config.yaml builds bundle "${storeBundleId}", but the purchases app is registered for "${bundleId}". ${fileName} was not edited.` };
   }
-  const found = lookup2(app, "bundleId");
+  const found = lookup3(app, "bundleId");
   const value = found.kind === "written" ? unwrap(found.node.initializer) : void 0;
   if (!value || !ts8.isStringLiteralLike(value)) {
     return { instruction: `${fileName} does not write bundleId as a literal: make sure this app builds bundle ${JSON.stringify(bundleId)}, the one the purchases app is registered for.` };
@@ -164103,11 +164384,11 @@ function bundleFinding(app, { bundleId, storeBundleId }, fileName) {
   return { conflict: `${fileName} builds bundle "${value.text}", but the purchases app is registered for "${bundleId}". This is another app's config, so it was not edited.` };
 }
 function bindingFinding(app, file2, purchasesAppId, wanted, fileName) {
-  const wixIap = lookup2(app, "wixIap");
+  const wixIap = lookup3(app, "wixIap");
   if (wixIap.kind === "absent") return { splice: appendProperties(app, file2, [`${wanted},`]), applied: "wixIap.purchasesAppId" };
   const literal = wixIap.kind === "written" ? unwrap(wixIap.node.initializer) : void 0;
   if (!literal || !ts8.isObjectLiteralExpression(literal)) return { instruction: `${fileName} computes wixIap, so it was not edited: it must evaluate to ${wanted}.` };
-  const current = lookup2(literal, "purchasesAppId");
+  const current = lookup3(literal, "purchasesAppId");
   if (current.kind === "absent") return { splice: appendProperties(literal, file2, [`purchasesAppId: ${JSON.stringify(purchasesAppId)},`]), applied: "wixIap.purchasesAppId" };
   const value = current.kind === "written" ? unwrap(current.node.initializer) : void 0;
   if (!value || !ts8.isStringLiteralLike(value)) return { instruction: `${fileName} computes wixIap.purchasesAppId, so it was not edited: it must evaluate to ${JSON.stringify(purchasesAppId)}.` };
@@ -164115,7 +164396,7 @@ function bindingFinding(app, file2, purchasesAppId, wanted, fileName) {
   return { conflict: `${fileName} already binds purchases app "${value.text}", but this site's purchases app for the bundle is "${purchasesAppId}". Nothing was changed; fix whichever is stale.` };
 }
 function capabilityFinding(app, fileName) {
-  const capabilities = lookup2(app, "capabilities");
+  const capabilities = lookup3(app, "capabilities");
   const list = capabilities.kind === "written" ? unwrap(capabilities.node.initializer) : void 0;
   if (capabilities.kind !== "absent" && (!list || !ts8.isArrayLiteralExpression(list))) {
     return { instruction: `Add "iap" to capabilities: the purchases app is baked only into a build that declares it, and ${fileName} does not list capabilities inline.` };
@@ -164815,14 +165096,13 @@ function createReviewScreenRenderer() {
     }
     return built;
   }
+  let closeLaunched;
   async function launch() {
-    let chromium;
-    try {
-      ({ chromium } = await import("playwright"));
-    } catch {
-      throw new Error("taking a screenshot needs Playwright's Chromium: run `npx playwright install chromium`");
-    }
-    return chromium.launch();
+    const { launchPngBrowser: launchPngBrowser2 } = await Promise.resolve().then(() => (init_render_descriptor(), render_descriptor_exports));
+    const launched = await launchPngBrowser2();
+    if (!launched) throw new Error("taking a screenshot needs Playwright's Chromium: run `npx playwright install chromium`");
+    closeLaunched = launched.close;
+    return launched.browser;
   }
   return {
     async render({ contentDir: contentDir2, screenId, input, host, entityId }) {
@@ -164865,7 +165145,8 @@ function createReviewScreenRenderer() {
       return pngAvailable2();
     },
     async close() {
-      if (browser) await (await browser.catch(() => void 0))?.close().catch(() => {
+      if (browser) await browser.catch(() => void 0);
+      await closeLaunched?.().catch(() => {
       });
     }
   };
@@ -167173,8 +167454,8 @@ async function runNotifyPing(flags, io2, deps = {}) {
     requestId: requestId2,
     ...flags["dry-run"] === true ? { dryRun: true } : {}
   };
-  const http = await pushSendRequest({ target: session.target, wixToken: session.wixToken, siteToken: siteToken2, body, previewTag: session.previewTag, fetchImpl: deps.fetchImpl });
-  return report2(http, body, flags, io2);
+  const http2 = await pushSendRequest({ target: session.target, wixToken: session.wixToken, siteToken: siteToken2, body, previewTag: session.previewTag, fetchImpl: deps.fetchImpl });
+  return report2(http2, body, flags, io2);
 }
 async function runAllMembers(args) {
   const { input, siteToken: siteToken2, session, requestId: requestId2, flags, io: io2, deps } = args;
@@ -167263,25 +167544,25 @@ function flagRefusal(flags) {
   if (SWITCHES.some((f2) => flags[f2] !== void 0 && typeof flags[f2] !== "boolean")) return "invalid_boolean_flag";
   return void 0;
 }
-function report2(http, sent, flags, io2) {
-  const code = refusalCode2(http);
+function report2(http2, sent, flags, io2) {
+  const code = refusalCode2(http2);
   if (code === "send_outcome_unknown") {
     return refuse6(io2, code, `Ping may have accepted it. Re-run the same command with --request-id ${sent.requestId}: Ping runs one request at most once per site for 24 hours.`, 1, { requestId: sent.requestId });
   }
-  if (code === "rate_limited" && http.retryAfterSec) {
-    return refuse6(io2, code, `Test sends are limited per owner; retry in ${http.retryAfterSec} seconds.`, 1, { retryAfterSec: http.retryAfterSec });
+  if (code === "rate_limited" && http2.retryAfterSec) {
+    return refuse6(io2, code, `Test sends are limited per owner; retry in ${http2.retryAfterSec} seconds.`, 1, { retryAfterSec: http2.retryAfterSec });
   }
   if (code) return refuse6(io2, code, HINTS[code], 1);
-  if (flags.json === true) io2.log(JSON.stringify(http.body, null, 2));
-  else io2.log(summary(http.body ?? {}, sent));
+  if (flags.json === true) io2.log(JSON.stringify(http2.body, null, 2));
+  else io2.log(summary(http2.body ?? {}, sent));
   return 0;
 }
-function refusalCode2(http) {
-  if (http.error) return http.error === "push_send_unreachable" ? "send_outcome_unknown" : http.error;
-  if (http.ok && (http.body?.state === "accepted" || http.body?.state === "dry_run")) return void 0;
-  const code = String(http.body?.error ?? "");
+function refusalCode2(http2) {
+  if (http2.error) return http2.error === "push_send_unreachable" ? "send_outcome_unknown" : http2.error;
+  if (http2.ok && (http2.body?.state === "accepted" || http2.body?.state === "dry_run")) return void 0;
+  const code = String(http2.body?.error ?? "");
   if (KNOWN_CODES.has(code)) return code;
-  return http.ok || http.status >= 500 ? "send_outcome_unknown" : "push_send_failed";
+  return http2.ok || http2.status >= 500 ? "send_outcome_unknown" : "push_send_failed";
 }
 function summary(result, sent) {
   if (result.state === "dry_run") {
@@ -168844,8 +169125,8 @@ function readEntities(files, dirs) {
 function functionSignature(code) {
   if (code === void 0) return { kind: "unknown" };
   const methods = [...new Set([...code.matchAll(/\b(?:req|request)\.method\s*[!=]==?\s*["'](GET|POST|PUT|PATCH|DELETE)["']/g)].map((m2) => m2[1]))];
-  const http = /\bDeno\.serve\s*\(|\bserve\s*\(\s*(?:async\s*)?\(?\s*req/.test(code);
-  return { kind: http ? "http" : "invoke", ...methods.length ? { methods } : {} };
+  const http2 = /\bDeno\.serve\s*\(|\bserve\s*\(\s*(?:async\s*)?\(?\s*req/.test(code);
+  return { kind: http2 ? "http" : "invoke", ...methods.length ? { methods } : {} };
 }
 function automationsOf(v2) {
   if (!Array.isArray(v2)) return void 0;
@@ -170836,9 +171117,9 @@ function cmsStatusNote(taxonomy) {
       bits.push("skipped: no owner token \u2014 re-run with `--site <msid>` (owner auth) to list the site's collections");
       break;
     case "error": {
-      const http = taxonomy.cmsErrorStatus;
-      const remedy = http === 429 ? "the site rate-limited the listing \u2014 wait and re-run" : http != null && http >= 500 ? "Wix Data failed upstream \u2014 retry later, and investigate the service if it persists" : http === 401 || http === 403 ? "check the owner token is current and carries the Wix Data read permission, then re-run" : "check the owner token and the `--site <msid>` you passed, then re-run";
-      bits.push(`error${http ? ` HTTP ${http}` : ""}: the listing call failed \u2014 ${remedy}`);
+      const http2 = taxonomy.cmsErrorStatus;
+      const remedy = http2 === 429 ? "the site rate-limited the listing \u2014 wait and re-run" : http2 != null && http2 >= 500 ? "Wix Data failed upstream \u2014 retry later, and investigate the service if it persists" : http2 === 401 || http2 === 403 ? "check the owner token is current and carries the Wix Data read permission, then re-run" : "check the owner token and the `--site <msid>` you passed, then re-run";
+      bits.push(`error${http2 ? ` HTTP ${http2}` : ""}: the listing call failed \u2014 ${remedy}`);
       break;
     }
     default:
@@ -175055,7 +175336,7 @@ var init_dist = __esm({
             return promiseCallback.reject(new Error(SAME_SITE_CONTEXT_VAL_ERR));
           }
         }
-        const http = options.http ?? true;
+        const http2 = options.http ?? true;
         const now = Date.now();
         const expireCheck = options.expire ?? true;
         const allPaths = options.allPaths ?? false;
@@ -175076,7 +175357,7 @@ var init_dist = __esm({
           if (c2.secure && !potentiallyTrustworthy) {
             return false;
           }
-          if (c2.httpOnly && !http) {
+          if (c2.httpOnly && !http2) {
             return false;
           }
           if (sameSiteLevel) {
@@ -185123,7 +185404,7 @@ function execNpmConfig(file2, args, options) {
   });
 }
 var npmScopedWixRegistry = createScopedRegistryResolver();
-async function scopedRegistryBefore(lookup3, deadline, onTimeout) {
+async function scopedRegistryBefore(lookup4, deadline, onTimeout) {
   let cancel = () => {
   };
   const expired = new Promise((resolve66) => {
@@ -185134,16 +185415,16 @@ async function scopedRegistryBefore(lookup3, deadline, onTimeout) {
     cancel = () => clearTimeout(timer);
   });
   try {
-    return await Promise.race([Promise.resolve().then(() => lookup3(Math.max(0, deadline - Date.now()))), expired]);
+    return await Promise.race([Promise.resolve().then(() => lookup4(Math.max(0, deadline - Date.now()))), expired]);
   } catch {
     return void 0;
   } finally {
     cancel();
   }
 }
-function lookupOnce(lookup3) {
+function lookupOnce(lookup4) {
   let first;
-  return (budgetMs) => first ??= Promise.resolve().then(() => lookup3(budgetMs));
+  return (budgetMs) => first ??= Promise.resolve().then(() => lookup4(budgetMs));
 }
 function registryCandidates(env, scoped) {
   const ordered = [isTrustedRegistry(scoped) ? normalizeRegistry(scoped) : void 0, trustedConfiguredRegistry(env), PUBLIC_NPM_REGISTRY];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1438.0",
+  "version": "0.1439.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "ecadfa529dda6d1f49570340c04988f711cb239a5209ce8c69e31e86"
+  "falconPackageHash": "517214ad79ba1f66fcc679a54a5edf1e5242a258037728e41501f8ce"
 }