@wix/himalaya-cli 0.1459.0 → 0.1461.0

package/dist/cli.mjs

@@ -7310,6 +7310,18 @@ function compileV2(html, profile, options) {
           mods[name2] = coerce(raw, field2);
           structured(el2, mods[name2]);
         }
+        if (name2 === "onMeasure" && mods.onMeasure && typeof mods.onMeasure === "object") {
+          for (const [key3, value] of Object.entries(mods.onMeasure)) {
+            if (!key3.endsWith("Path") || typeof value !== "string") continue;
+            if (value.startsWith("$service:") || info4?.paths.has(statePath(value))) {
+              const axis = key3.replace(/Path$/, "");
+              const taken = (k2) => !!info4?.paths.has(statePath(k2));
+              let suggestion = taken(axis) ? `measured${axis[0].toUpperCase()}${axis.slice(1)}` : axis;
+              for (let n2 = 2; taken(suggestion); n2++) suggestion = `measured${axis[0].toUpperCase()}${axis.slice(1)}${n2}`;
+              error(el2, "HHP-MEASURE-TARGET", `onMeasure.${key3} ${value} names controller state; measurements publish only to the renderer's measure store.`, `Use a store key (e.g. "${suggestion}") and read it back with a $measure:<key> modifier path.`);
+            }
+          }
+        }
         continue;
       }
       const name = nativeField(attr3.startsWith("data-prop-") ? attr3.slice(10) : attr3);
@@ -160097,9 +160109,14 @@ var init_pinned_read = __esm({
 });
 
 // ../../core/serve-runtime/src/member-exchange.ts
+function internalHost(host) {
+  const h2 = host.toLowerCase().replace(/^\[|\]$/g, "");
+  return h2 === "localhost" || h2.endsWith(".localhost") || h2.endsWith(".local") || h2.endsWith(".internal") || !h2.includes(".") || /^[0-9.]+$/.test(h2) || h2.includes(":");
+}
 function hopAllowed(url, firstHost) {
   if (url.protocol !== "https:" || url.port !== "" && url.port !== "443" || url.username || url.password) return false;
   const host = url.hostname.toLowerCase();
+  if (internalHost(host)) return false;
   return host === firstHost || host === "wix.com" || host.endsWith(".wix.com") || host.endsWith(".wixsite.com") || host === "wixapis.com" || host.endsWith(".wixapis.com");
 }
 async function exchangeMemberSession(input, fetchImpl = fetch, random = randomBytes6, now = Date.now, redirectUri = REGISTERED_REDIRECT_URI) {
@@ -160109,7 +160126,7 @@ async function exchangeMemberSession(input, fetchImpl = fetch, random = randomBy
   }
   const call = async (url2, init) => {
     try {
-      return await fetchImpl(url2, { ...init, signal: AbortSignal.timeout(STEP_TIMEOUT_MS) });
+      return await fetchImpl(url2, { ...init, redirect: "manual", signal: AbortSignal.timeout(STEP_TIMEOUT_MS) });
     } catch {
       return null;
     }
@@ -161056,7 +161073,15 @@ ${releaseId}`;
         if (!exchangePin || !resolvePreviewToken(request, url)) return json5(403, { error: "draft_preview_required" }, noStore);
         const exchangeCfg = await appConfigFor(request, url, exchangeApp);
         if (!exchangeCfg.ok) return exchangeCfg.response;
-        if ((await manifest(exchangeApp))?.releaseId === exchangePin || await isRingRelease(exchangeApp, exchangePin)) {
+        let ringPinned = false;
+        if (opts.ringReleases) {
+          try {
+            ringPinned = new Set(await opts.ringReleases(exchangeApp)).has(exchangePin);
+          } catch {
+            return json5(503, { error: "ring_lookup_unavailable" }, noStore);
+          }
+        }
+        if ((await manifest(exchangeApp))?.releaseId === exchangePin || ringPinned) {
           return json5(403, { error: "draft_preview_required" }, noStore);
         }
         const exchangeClient = wixClientIdOf(utf8Decode(exchangeCfg.bytes));

package/guides/hhp.md

@@ -86,7 +86,9 @@ use a child `script type="application/himalaya-props"` containing JSON.
 ordinary-control aliases. Explicit modifiers use `data-mod-*` or `himi-mod-*`.
 A `…-path` modifier (`data-mod-hidden-path="full"`, `data-mod-background-color-path`)
 names controller state exactly like `bind:*`, or `$item.<field>` in a row; an unknown
-path is a lint error. `onMeasure` keys name the renderer's measure store instead.
+path is a lint error. `onMeasure` keys name the renderer's measure store instead
+(read back with a `$measure:<key>` path); no renderer writes a measurement into worker
+state, so an `onMeasure` key that names controller state is an `HHP-MEASURE-TARGET` error.
 `style` and `title` are HTML globals: `style` is always CSS, so a native `style`
 variant uses `variant="primary"`; `title="…"` sets a component's `title` field. CSS
 `font` applies only to text components (Text, Label, Marquee). The profile's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1459.0",
+  "version": "0.1461.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "db96f8e1d9f3f0a55120ae97f89b4211fed249d7a3f98225dc9269b1"
+  "falconPackageHash": "383d7c17e59533d072b72cd7a7d5e46ef59606d5af81f0fc19cf1c52"
 }