@wix/himalaya-cli 0.1456.0 → 0.1457.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/dev-server/src/builder.d.ts

@@ -120,6 +120,7 @@ export interface WebViewConfig {
         maxMessageBytes?: number;
         rateLimitMaxCalls?: number;
         rateLimitWindowMs?: number;
+        profile?: "" | "app_content";
     };
     contentFilterRules?: string;
     appBoundDomains?: string[];
@@ -143,6 +144,11 @@ export interface WebViewConfig {
     hideHostedSiteMenu?: boolean;
     sessionBridge?: boolean;
     hostedSiteAdapter?: "" | "wix" | "base44";
+    originIsolation?: "" | "shared" | "per_instance";
+    framePolicy?: "" | "content";
+    storageSeed?: {
+        snapshotPath?: string;
+    };
 }
 export declare function vstack(props: {
     spacing?: number;
@@ -835,6 +841,7 @@ export declare function carousel(props: {
     onChange?: ActionShape;
     autoplayIntervalMs?: number;
     itemsPath?: string;
+    liveWindow?: number;
 }, opts?: {
     id?: string;
 }): Component;
@@ -843,6 +850,7 @@ export declare function pager(props: {
     currentIndex?: number;
     onChange?: ActionShape;
     showIndicator?: boolean;
+    liveWindow?: number;
 }, opts?: {
     id?: string;
 }): Component;
@@ -1626,6 +1634,13 @@ export declare function webView(props: {
     scrollEnabled?: boolean;
     config?: WebViewConfig;
     capabilitiesRequired?: string[];
+    bridge?: "" | "worker";
+    instanceId?: string;
+    activePath?: string;
+    mutedPath?: string;
+    reloadKeyPath?: string;
+    fill?: boolean;
+    heightPath?: string;
 }, opts?: {
     id?: string;
 }): Component;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/index.d.ts

@@ -22,3 +22,5 @@ export * from "./app-identity.js";
 export * from "./app-registry-client.js";
 export * from "./site-shell.js";
 export * from "./site-menu.js";
+export * from "./webview-embedded.js";
+export * from "./webview-origin.js";

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/schema.d.ts

@@ -1204,12 +1204,16 @@ export interface CarouselProps {
     autoplayIntervalMs?: number;
     /** `$service:` binding → a live array to render as slides (overrides `items`). */
     itemsPath?: string;
+    /** RFC 0073 §4.5 — 0 (default) = all slides mounted; N ⇒ mount current ± N, unmount the rest. */
+    liveWindow?: number;
 }
 export interface PagerProps {
     pages: Component[];
     currentIndex?: number;
     onChange?: Action;
     showIndicator?: boolean;
+    /** RFC 0073 §4.5 — as {@link CarouselProps.liveWindow}. */
+    liveWindow?: number;
 }
 export interface StepIndicatorProps {
     steps: string[];
@@ -3206,6 +3210,16 @@ export interface BridgeSecurityConfig {
     rateLimitMaxCalls?: number;
     /** Rate-limit sliding window in ms (default 1000). */
     rateLimitWindowMs?: number;
+    /**
+     * RFC 0073 §4.4 — `""` (default) is today's T4 floor; `"app_content"` raises the caps for content
+     * the app owns the channel to. Explicit `max*` / `rateLimit*` fields still override either profile.
+     */
+    profile?: "" | "app_content";
+}
+/** RFC 0073 §4.2 — one-shot storage seed for a `per_instance` origin. */
+export interface WebStorageSeed {
+    /** `$service:` path to `{ legacy, principal, localStorage?, sessionStorage? }` (§4.2 trust rule). */
+    snapshotPath?: string;
 }
 /**
  * Behavior of a hosted WebView (Tier 3/4 screens via `ScreenDescriptor.webViewConfig`,
@@ -3340,6 +3354,13 @@ export interface WebViewConfig {
      * script, like {@link hideWixAds}. No-op on web (cross-origin iframe).
      */
     hideHostedSiteMenu?: boolean;
+    /** RFC 0073 §4.2 — `""` / `"shared"` (default, today) | `"per_instance"` (own origin + storage per
+     *  instance). `""` is the proto3 zero value and means `"shared"`. */
+    originIsolation?: "" | "shared" | "per_instance";
+    /** RFC 0073 §4.3 — `""` (today) | `"content"` (pin the top frame; subframes load freely, never bridged). */
+    framePolicy?: "" | "content";
+    /** RFC 0073 §4.2 — storage migration seed; requires `originIsolation: "per_instance"`. */
+    storageSeed?: WebStorageSeed;
 }
 /**
  * Embeddable WebView component (web-in-SDUI). WebViews have no intrinsic height,
@@ -3358,6 +3379,20 @@ export interface WebViewProps {
     scrollEnabled?: boolean;
     config?: WebViewConfig;
     capabilitiesRequired?: string[];
+    /** `""` (default, no channel) | `"worker"` — channel to the owning screen's worker. */
+    bridge?: "" | "worker";
+    /** Channel + storage identity; default `<screenId>?<args>/<Component.id>` (§4.1, `effectiveWebViewInstanceId`). */
+    instanceId?: string;
+    /** `$service:` bool — false ⇒ inactive (§5.4); unset ⇒ active. */
+    activePath?: string;
+    /** `$service:` bool — true ⇒ all page media muted. */
+    mutedPath?: string;
+    /** `$service:` scalar — any change remounts the document. */
+    reloadKeyPath?: string;
+    /** Take the parent's proposed size (works with weight); beats `height` / `aspectRatio`. */
+    fill?: boolean;
+    /** `$service:` number — live height in points/dp; beats `height`. */
+    heightPath?: string;
 }
 /** RFC 0069 — `ScreenDescriptor.transcriptScroll`. */
 export interface TranscriptScroll {

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/validator.d.ts

@@ -1291,6 +1291,10 @@ export declare const screenDescriptorSchema: {
                             readonly type: "integer";
                             readonly minimum: 1;
                         };
+                        readonly profile: {
+                            readonly type: "string";
+                            readonly enum: readonly ["", "app_content"];
+                        };
                     };
                 };
                 readonly contentFilterRules: {
@@ -1366,6 +1370,23 @@ export declare const screenDescriptorSchema: {
                 readonly hideHostedSiteMenu: {
                     readonly type: "boolean";
                 };
+                readonly originIsolation: {
+                    readonly type: "string";
+                    readonly enum: readonly ["", "shared", "per_instance"];
+                };
+                readonly framePolicy: {
+                    readonly type: "string";
+                    readonly enum: readonly ["", "content"];
+                };
+                readonly storageSeed: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly properties: {
+                        readonly snapshotPath: {
+                            readonly type: "string";
+                        };
+                    };
+                };
             };
         };
     };
@@ -2541,6 +2562,10 @@ export declare const widgetSnapshotSchema: {
                             readonly type: "integer";
                             readonly minimum: 1;
                         };
+                        readonly profile: {
+                            readonly type: "string";
+                            readonly enum: readonly ["", "app_content"];
+                        };
                     };
                 };
                 readonly contentFilterRules: {
@@ -2616,6 +2641,23 @@ export declare const widgetSnapshotSchema: {
                 readonly hideHostedSiteMenu: {
                     readonly type: "boolean";
                 };
+                readonly originIsolation: {
+                    readonly type: "string";
+                    readonly enum: readonly ["", "shared", "per_instance"];
+                };
+                readonly framePolicy: {
+                    readonly type: "string";
+                    readonly enum: readonly ["", "content"];
+                };
+                readonly storageSeed: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly properties: {
+                        readonly snapshotPath: {
+                            readonly type: "string";
+                        };
+                    };
+                };
             };
         };
     };

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/webview-embedded.d.ts

@@ -0,0 +1,66 @@
+/** Bridged WebViews a screen may mount at once before §4.6 warns. */
+export declare const MAX_SIMULTANEOUS_BRIDGED_WEBVIEWS = 4;
+export interface WebViewEmbeddedFinding {
+    severity: "error" | "warning";
+    /** Stable id of the §4.6 rule, for tests and tooling; never match on `message`. */
+    rule: "bridge_requires_worker" | "template_instance_id" | "duplicate_instance_id" | "instance_id_reused_across_screens" | "storage_seed_requires_per_instance" | "per_instance_with_url" | "fill_with_height" | "too_many_bridged" | "bridged_url_not_allowed" | "unknown_enum_value";
+    path: string;
+    message: string;
+}
+/** A cross-screen finding: `path` is within the screen named by `screenId`, which travels as its own
+ *  field so no consumer has to parse it back out of the path. */
+export interface WebViewEmbeddedAppFinding extends WebViewEmbeddedFinding {
+    screenId: string;
+}
+/** The wire values of the RFC 0073 string enums — what `WebViewBridge`, `WebOriginIsolation`,
+ *  `WebFramePolicy` and `BridgeSecurityProfile` decode on iOS and Android. Anything else decodes
+ *  leniently to the zero value, so `bridge: "Worker"` would silently mean no bridge. */
+export declare const WEBVIEW_EMBEDDED_ENUMS: {
+    readonly bridge: readonly ["", "worker"];
+    readonly originIsolation: readonly ["", "shared", "per_instance"];
+    readonly framePolicy: readonly ["", "content"];
+    readonly profile: readonly ["", "app_content"];
+};
+/**
+ * `value` as canonical JSON, so two args that are equal as data produce one instance id — and two
+ * that differ in type (`"1"` vs `1`) do not: object keys sorted by UTF-16 code unit at EVERY depth
+ * (`JSON.stringify` keeps insertion order), no whitespace, `undefined` object members dropped,
+ * array order kept. A number is written the way ECMAScript `Number.prototype.toString` writes it —
+ * `1`, `1.5`, `0.1`, `-2`, `1e+21`, `1e-7` (an integral double prints with no `.0`; `-0` prints
+ * `0`). Strings use `JSON.stringify` escaping. The native ports must match this byte for byte;
+ * `webview-embedded-rules.test.ts` pins it.
+ *
+ * Only JSON data is accepted. Anything JSON cannot represent — a non-finite number, a `bigint`,
+ * a function, a symbol, an `undefined` array element or sparse hole, a cyclic value, or an object that is not a plain object or
+ * array (`Date`, `Map`, a class instance) — throws a `TypeError`, rather than collapsing to `null`
+ * or `{}` and colliding with a different value.
+ */
+export declare function canonicalJson(value: unknown): string;
+/** `screen args` in canonical form: keys sorted by code unit, each `k=v` URI-encoded, joined by
+ *  `&`, where `v` is {@link canonicalJson} of the value — strings included, so `{id: "1"}`
+ *  (`id=%221%22`) and `{id: 1}` (`id=1`) stay distinct. `undefined` is dropped (it is not an arg);
+ *  a value that is not JSON data throws, as in {@link canonicalJson}. */
+export declare function canonicalScreenArgs(args: Readonly<Record<string, unknown>> | undefined): string;
+/**
+ * RFC 0073 §4.1 — the effective `instance_id` of a WebView: the explicit `instanceId` when the
+ * author set one (an app-wide identity chosen on purpose), otherwise
+ * `<screenId>?<canonical screen args>/<Component.id>`. Screen id and args are both part of the
+ * default because one screen can be mounted twice with different args (RFC 0010).
+ */
+export declare function effectiveWebViewInstanceId(screenId: string, args: Readonly<Record<string, unknown>> | undefined, componentId: string, explicitInstanceId?: string): string;
+/**
+ * The single-screen §4.6 rules over one screen descriptor. The cross-screen rule (an explicit
+ * `per_instance` literal reused for different content) needs every screen, so it is
+ * {@link webViewEmbeddedAppFindings}.
+ */
+export declare function webViewEmbeddedFindings(descriptor: unknown): WebViewEmbeddedFinding[];
+/**
+ * The cross-screen §4.6 rule: an explicit `per_instance` `instanceId` literal is an app-wide storage
+ * identity, so reusing it for the SAME content on several screens is intended (one widget, one
+ * storage) — reusing it for DIFFERENT content is a warning. Content is the literal `inlineHtml` or
+ * `url`; a bound value cannot be compared statically and is skipped.
+ */
+export declare function webViewEmbeddedAppFindings(screens: Iterable<{
+    screenId: string;
+    descriptor: unknown;
+}>): WebViewEmbeddedAppFinding[];

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/webview-origin.d.ts

@@ -0,0 +1,7 @@
+/** Whether `url` matches an `allowedOrigins` list — iOS `WebViewOriginPolicy.matches` exactly
+ *  (Android `allowedOriginMatches` mirrors it), over the RAW url (see `rawUrlParts`):
+ *  the host or host:port; a scheme-qualified entry ending in `/` as a PATH BOUNDARY, refused
+ *  outright when the path has a dot segment; any other prefix of the absolute URL that ends at a
+ *  boundary (`/`, `?`, `#` or the end, or the entry itself ends in `/`); a `*.example.com` /
+ *  `.example.com` suffix. */
+export declare function webViewOriginAllowed(url: string, origins: readonly string[]): boolean;