@wix/himalaya-cli 0.1540.0 → 0.1542.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/dev-server/src/wix-gateway.d.ts

@@ -103,4 +103,8 @@ export declare function handleWixGateway(gw: WixGatewayState, app: string, admin
 /** The ACTIVE app's own Wix clientId (loader.resolveWixClientId) — the mint-retry
  *  below mints an anonymous visitor token from it so each app hits its OWN site.
  *  Falls back to WIX_DEV_CLIENT_ID (env / amit1 default) when absent. */
-wixClientId?: string): Promise<boolean>;
+wixClientId?: string, 
+/** The ACTIVE app's MetaSite when it is bound with `visitorSource: "one-app"`: no retry then —
+ *  it has no clientId to mint from (the fallback is another site), and a One App re-mint would
+ *  be a new visitor. */
+oneAppMetaSiteId?: string): Promise<boolean>;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/dev-server/src/wix-member-login.d.ts

@@ -1,5 +1,9 @@
 /** Mint an anonymous visitor access token for the client. */
 export declare function mintVisitor(clientId: string): Promise<string>;
+/** The site's One App visitor instance (`visitorSource: "one-app"`) for a one-shot CLI read
+ *  (`render --live`, `test --record`) — sent bare as `Authorization`, like `mintVisitor`'s token.
+ *  Node only: no CORS stands in the way here. The dev-server's web sessions keep their own. */
+export declare function mintOneAppVisitorToken(metaSiteId: string): Promise<string>;
 /** Direct (captcha-free) Wix Headless member login → real member access token. */
 export declare function memberDirectLogin(clientId: string, redirectUri: string, email: string, password: string): Promise<{
     memberToken: string;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/serve-runtime/src/wix-bridge.d.ts

@@ -14,6 +14,27 @@ export interface WixBridgeEnvelope {
  *  one per pod any more — the one server-side use left is the member-login redirect, which needs a
  *  visitor token to build Wix's hosted-login URL once per login. */
 export declare function mintAnonymousVisitor(clientId: string, fetchImpl?: typeof fetch): Promise<string>;
+/** A One App visitor signed instance and the time Wix stops honouring it (`validUntil`). */
+export interface OneAppVisitorInstance {
+    instance: string;
+    expiresAt: number;
+}
+/**
+ * The site's One App VISITOR signed instance — the anonymous identity a Branded One App visitor
+ * uses (`WixConsumerAuthProvider({ visitorSource: "one-app", metaSiteId })`). Needs no credential
+ * and no OAuth client on the site. Sent to wixapis.com as a bare `Authorization` value: `Bearer
+ * <instance>` is a 400. Each mint is a NEW visitor, so callers keep it until `expiresAt`.
+ * Server-side only for the browser: the endpoint sends no CORS headers.
+ */
+export declare function mintOneAppVisitor(msid: string, fetchImpl?: typeof fetch, timeoutMs?: number): Promise<OneAppVisitorInstance>;
+/** The MetaSite an auth provider binds through the One App visitor identity
+ *  (`WixConsumerAuthProvider({ visitorSource: "one-app", metaSiteId })`), or null. */
+export declare function oneAppMetaSiteIdOf(auth: {
+    providerId?: unknown;
+    config?: unknown;
+} | null | undefined): string | null;
+/** The same, read off a published app-config's `authConfig`. */
+export declare function oneAppVisitorMsidOf(appConfigJson: string): string | null;
 /**
  * Proxy one REST call to wixapis.com with the given token. `path` must be
  * origin-relative — an absolute URL is the caller trying to use the bridge as an

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/schema.d.ts

@@ -3545,6 +3545,25 @@ export interface SearchableConfig {
     onCancel?: Action;
     /** `$service:` bool: the search is busy. */
     loadingPath?: string;
+    /** Static suggestions. On the wire for a later release: no shell draws them yet (RFC 0010 decision 11). */
+    suggestions?: SearchSuggestion[];
+    /** `$service:` array of `{ id, label, icon? }`. Not drawn yet (decision 11). */
+    suggestionsPath?: string;
+    /** `args.id` (+ `args.label`) of the tapped suggestion; a static suggestion's own `onTap` wins. */
+    onSuggestionTap?: Action;
+    /** Scope bar (`TabItem` reused). */
+    scopes?: TabItem[];
+    /** `$service:` selected scope id. */
+    scopePath?: string;
+    /** `args.selectedId`. */
+    onScopeChange?: Action;
+}
+/** RFC 0066 §2 — one static search suggestion (`SearchableConfig.suggestions`). */
+export interface SearchSuggestion {
+    id: string;
+    label: string;
+    icon?: IconRef;
+    onTap?: Action;
 }
 /** `ScreenDescriptor.hostTitle`. Each value is a literal, a `$t:` key, or a `$service:` path. */
 export interface HostTitle {

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/validator.d.ts

@@ -449,6 +449,67 @@ export declare const screenDescriptorSchema: {
                 readonly loadingPath: {
                     readonly type: "string";
                 };
+                readonly suggestions: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/searchSuggestion";
+                    };
+                };
+                readonly suggestionsPath: {
+                    readonly type: "string";
+                };
+                readonly onSuggestionTap: {
+                    readonly $ref: "#/$defs/action";
+                };
+                readonly scopes: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/searchScope";
+                    };
+                };
+                readonly scopePath: {
+                    readonly type: "string";
+                };
+                readonly onScopeChange: {
+                    readonly $ref: "#/$defs/action";
+                };
+            };
+        };
+        readonly searchSuggestion: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["id", "label"];
+            readonly properties: {
+                readonly id: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly label: {
+                    readonly type: "string";
+                };
+                readonly icon: {
+                    readonly type: "string";
+                };
+                readonly onTap: {
+                    readonly $ref: "#/$defs/action";
+                };
+            };
+        };
+        readonly searchScope: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["id", "label"];
+            readonly properties: {
+                readonly id: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly label: {
+                    readonly type: "string";
+                };
+                readonly badge: {
+                    readonly type: "string";
+                };
             };
         };
         readonly toolbarItem: {
@@ -1787,6 +1848,67 @@ export declare const widgetSnapshotSchema: {
                 readonly loadingPath: {
                     readonly type: "string";
                 };
+                readonly suggestions: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/searchSuggestion";
+                    };
+                };
+                readonly suggestionsPath: {
+                    readonly type: "string";
+                };
+                readonly onSuggestionTap: {
+                    readonly $ref: "#/$defs/action";
+                };
+                readonly scopes: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly $ref: "#/$defs/searchScope";
+                    };
+                };
+                readonly scopePath: {
+                    readonly type: "string";
+                };
+                readonly onScopeChange: {
+                    readonly $ref: "#/$defs/action";
+                };
+            };
+        };
+        readonly searchSuggestion: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["id", "label"];
+            readonly properties: {
+                readonly id: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly label: {
+                    readonly type: "string";
+                };
+                readonly icon: {
+                    readonly type: "string";
+                };
+                readonly onTap: {
+                    readonly $ref: "#/$defs/action";
+                };
+            };
+        };
+        readonly searchScope: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["id", "label"];
+            readonly properties: {
+                readonly id: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly label: {
+                    readonly type: "string";
+                };
+                readonly badge: {
+                    readonly type: "string";
+                };
             };
         };
         readonly toolbarItem: {

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/auth-providers/wix/src/index.d.ts

@@ -42,8 +42,18 @@ export interface MemberCaptchaKey {
     siteKeyId: string;
 }
 export interface WixConsumerAuthConfig {
-    /** Per-site Wix Headless OAuth client id. */
-    clientId: string;
+    /** Per-site Wix Headless OAuth client id. Required unless `visitorSource` is `"one-app"`;
+     *  there it is optional and only enables member sign-in. */
+    clientId?: string;
+    /** Where the anonymous visitor credential comes from. `"oauth"` (default) mints
+     *  `POST /oauth2/token {clientId, grantType:"anonymous"}` and needs a Headless OAuth client on
+     *  the site. `"one-app"` mints the site's One App visitor signed instance
+     *  (`GET apps.wix.com/_api/one-app-session-web/v3/businesses/<metaSiteId>/signed-instance
+     *  ?signed_instance_type=Visitor`), the same identity a Branded One App visitor uses, so a
+     *  migrated One App binds to its site WITHOUT creating anything on it. Requires `metaSiteId`. */
+    visitorSource?: "oauth" | "one-app";
+    /** The site's MetaSite ID. Required when `visitorSource` is `"one-app"`. */
+    metaSiteId?: string;
     /** Wix site binding for native CAPTCHA configuration. */
     siteId?: string;
     /** Public identifiers only. Never supply the server app secret here. */
@@ -53,8 +63,8 @@ export interface WixConsumerAuthConfig {
     };
     /** Site root URL — e.g. "https://example.wix.com/cafe". */
     siteUrl: string;
-    /** Custom URL scheme for the member-login redirect. */
-    redirectUri: string;
+    /** Custom URL scheme for the member-login redirect. Required whenever `clientId` is set. */
+    redirectUri?: string;
     /**
      * Where the password-reset email's link lands. Must be an http(s) WEB url:
      * IAM recovery shortens it into the mail body, so `redirectUri` — an app scheme

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/core.mjs

@@ -8659,7 +8659,7 @@ var screenDescriptorSchema = {
         visibilityPath: { type: "string" }
       }
     },
-    // RFC 0010 "Native top-bar search" (SearchableConfig fields 1–5, 12–15). `placement` stays a free string.
+    // RFC 0010 "Native top-bar search" (SearchableConfig fields 1–15). `placement` stays a free string.
     searchableConfig: {
       type: "object",
       additionalProperties: false,
@@ -8672,7 +8672,35 @@ var screenDescriptorSchema = {
         placement: { type: "string" },
         focusPath: { type: "string" },
         onCancel: { $ref: "#/$defs/action" },
-        loadingPath: { type: "string" }
+        loadingPath: { type: "string" },
+        suggestions: { type: "array", items: { $ref: "#/$defs/searchSuggestion" } },
+        suggestionsPath: { type: "string" },
+        onSuggestionTap: { $ref: "#/$defs/action" },
+        scopes: { type: "array", items: { $ref: "#/$defs/searchScope" } },
+        scopePath: { type: "string" },
+        onScopeChange: { $ref: "#/$defs/action" }
+      }
+    },
+    searchSuggestion: {
+      type: "object",
+      additionalProperties: false,
+      required: ["id", "label"],
+      properties: {
+        id: { type: "string", minLength: 1 },
+        label: { type: "string" },
+        icon: { type: "string" },
+        onTap: { $ref: "#/$defs/action" }
+      }
+    },
+    // A scope is a `TabItem`.
+    searchScope: {
+      type: "object",
+      additionalProperties: false,
+      required: ["id", "label"],
+      properties: {
+        id: { type: "string", minLength: 1 },
+        label: { type: "string" },
+        badge: { type: "string" }
       }
     },
     toolbarItem: {

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/sdui.mjs

@@ -7231,7 +7231,7 @@ var screenDescriptorSchema = {
         visibilityPath: { type: "string" }
       }
     },
-    // RFC 0010 "Native top-bar search" (SearchableConfig fields 1–5, 12–15). `placement` stays a free string.
+    // RFC 0010 "Native top-bar search" (SearchableConfig fields 1–15). `placement` stays a free string.
     searchableConfig: {
       type: "object",
       additionalProperties: false,
@@ -7244,7 +7244,35 @@ var screenDescriptorSchema = {
         placement: { type: "string" },
         focusPath: { type: "string" },
         onCancel: { $ref: "#/$defs/action" },
-        loadingPath: { type: "string" }
+        loadingPath: { type: "string" },
+        suggestions: { type: "array", items: { $ref: "#/$defs/searchSuggestion" } },
+        suggestionsPath: { type: "string" },
+        onSuggestionTap: { $ref: "#/$defs/action" },
+        scopes: { type: "array", items: { $ref: "#/$defs/searchScope" } },
+        scopePath: { type: "string" },
+        onScopeChange: { $ref: "#/$defs/action" }
+      }
+    },
+    searchSuggestion: {
+      type: "object",
+      additionalProperties: false,
+      required: ["id", "label"],
+      properties: {
+        id: { type: "string", minLength: 1 },
+        label: { type: "string" },
+        icon: { type: "string" },
+        onTap: { $ref: "#/$defs/action" }
+      }
+    },
+    // A scope is a `TabItem`.
+    searchScope: {
+      type: "object",
+      additionalProperties: false,
+      required: ["id", "label"],
+      properties: {
+        id: { type: "string", minLength: 1 },
+        label: { type: "string" },
+        badge: { type: "string" }
       }
     },
     toolbarItem: {

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-auth.mjs

@@ -1194,14 +1194,22 @@ function isWebUrl(value) {
     return false;
   }
 }
+var META_SITE_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function WixConsumerAuthProvider(config) {
-  if (!config.clientId) {
+  const oneApp = config.visitorSource === "one-app";
+  if (config.visitorSource !== void 0 && config.visitorSource !== "oauth" && !oneApp) {
+    throw new Error('WixConsumerAuthProvider: visitorSource must be "oauth" or "one-app".');
+  }
+  if (oneApp && !META_SITE_ID.test(config.metaSiteId ?? "")) {
+    throw new Error(`WixConsumerAuthProvider: visitorSource "one-app" requires metaSiteId (the site's MetaSite ID).`);
+  }
+  if (!oneApp && !config.clientId) {
     throw new Error("WixConsumerAuthProvider: clientId is required.");
   }
   if (!config.siteUrl) {
     throw new Error("WixConsumerAuthProvider: siteUrl is required.");
   }
-  if (!config.redirectUri) {
+  if (config.clientId && !config.redirectUri) {
     throw new Error("WixConsumerAuthProvider: redirectUri is required.");
   }
   if (config.passwordResetUrl && !isWebUrl(config.passwordResetUrl)) {
@@ -1209,16 +1217,17 @@ function WixConsumerAuthProvider(config) {
       `WixConsumerAuthProvider: passwordResetUrl must be an http(s) web URL with a host (got "${config.passwordResetUrl}") \u2014 the reset email's link cannot be an app scheme.`
     );
   }
-  if (!config.siteId) {
+  if (!config.siteId && config.clientId) {
     const siteId = pairedEnvSiteId(config.clientId);
     if (siteId) config = { ...config, siteId };
   }
   return {
     providerId: "wix-consumer",
     config: {
-      clientId: config.clientId,
+      ...config.clientId ? { clientId: config.clientId } : {},
+      ...oneApp ? { visitorSource: "one-app", metaSiteId: config.metaSiteId.toLowerCase() } : {},
       siteUrl: config.siteUrl,
-      redirectUri: config.redirectUri,
+      ...config.redirectUri ? { redirectUri: config.redirectUri } : {},
       bootAsVisitor: config.bootAsVisitor ?? true,
       ...config.passwordResetUrl ? { passwordResetUrl: config.passwordResetUrl } : {},
       preserveVisitorOnSignOut: config.preserveVisitorOnSignOut ?? true,