@wix/himalaya-cli 0.1541.0 → 0.1543.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/dev-server/src/wix-gateway.d.ts

@@ -103,4 +103,8 @@ export declare function handleWixGateway(gw: WixGatewayState, app: string, admin
 /** The ACTIVE app's own Wix clientId (loader.resolveWixClientId) — the mint-retry
  *  below mints an anonymous visitor token from it so each app hits its OWN site.
  *  Falls back to WIX_DEV_CLIENT_ID (env / amit1 default) when absent. */
-wixClientId?: string): Promise<boolean>;
+wixClientId?: string, 
+/** The ACTIVE app's MetaSite when it is bound with `visitorSource: "one-app"`: no retry then —
+ *  it has no clientId to mint from (the fallback is another site), and a One App re-mint would
+ *  be a new visitor. */
+oneAppMetaSiteId?: string): Promise<boolean>;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/dev-server/src/wix-member-login.d.ts

@@ -1,5 +1,9 @@
 /** Mint an anonymous visitor access token for the client. */
 export declare function mintVisitor(clientId: string): Promise<string>;
+/** The site's One App visitor instance (`visitorSource: "one-app"`) for a one-shot CLI read
+ *  (`render --live`, `test --record`) — sent bare as `Authorization`, like `mintVisitor`'s token.
+ *  Node only: no CORS stands in the way here. The dev-server's web sessions keep their own. */
+export declare function mintOneAppVisitorToken(metaSiteId: string): Promise<string>;
 /** Direct (captcha-free) Wix Headless member login → real member access token. */
 export declare function memberDirectLogin(clientId: string, redirectUri: string, email: string, password: string): Promise<{
     memberToken: string;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/serve-runtime/src/wix-bridge.d.ts

@@ -14,6 +14,27 @@ export interface WixBridgeEnvelope {
  *  one per pod any more — the one server-side use left is the member-login redirect, which needs a
  *  visitor token to build Wix's hosted-login URL once per login. */
 export declare function mintAnonymousVisitor(clientId: string, fetchImpl?: typeof fetch): Promise<string>;
+/** A One App visitor signed instance and the time Wix stops honouring it (`validUntil`). */
+export interface OneAppVisitorInstance {
+    instance: string;
+    expiresAt: number;
+}
+/**
+ * The site's One App VISITOR signed instance — the anonymous identity a Branded One App visitor
+ * uses (`WixConsumerAuthProvider({ visitorSource: "one-app", metaSiteId })`). Needs no credential
+ * and no OAuth client on the site. Sent to wixapis.com as a bare `Authorization` value: `Bearer
+ * <instance>` is a 400. Each mint is a NEW visitor, so callers keep it until `expiresAt`.
+ * Server-side only for the browser: the endpoint sends no CORS headers.
+ */
+export declare function mintOneAppVisitor(msid: string, fetchImpl?: typeof fetch, timeoutMs?: number): Promise<OneAppVisitorInstance>;
+/** The MetaSite an auth provider binds through the One App visitor identity
+ *  (`WixConsumerAuthProvider({ visitorSource: "one-app", metaSiteId })`), or null. */
+export declare function oneAppMetaSiteIdOf(auth: {
+    providerId?: unknown;
+    config?: unknown;
+} | null | undefined): string | null;
+/** The same, read off a published app-config's `authConfig`. */
+export declare function oneAppVisitorMsidOf(appConfigJson: string): string | null;
 /**
  * Proxy one REST call to wixapis.com with the given token. `path` must be
  * origin-relative — an absolute URL is the caller trying to use the bridge as an

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/auth-providers/wix/src/index.d.ts

@@ -42,8 +42,18 @@ export interface MemberCaptchaKey {
     siteKeyId: string;
 }
 export interface WixConsumerAuthConfig {
-    /** Per-site Wix Headless OAuth client id. */
-    clientId: string;
+    /** Per-site Wix Headless OAuth client id. Required unless `visitorSource` is `"one-app"`;
+     *  there it is optional and only enables member sign-in. */
+    clientId?: string;
+    /** Where the anonymous visitor credential comes from. `"oauth"` (default) mints
+     *  `POST /oauth2/token {clientId, grantType:"anonymous"}` and needs a Headless OAuth client on
+     *  the site. `"one-app"` mints the site's One App visitor signed instance
+     *  (`GET apps.wix.com/_api/one-app-session-web/v3/businesses/<metaSiteId>/signed-instance
+     *  ?signed_instance_type=Visitor`), the same identity a Branded One App visitor uses, so a
+     *  migrated One App binds to its site WITHOUT creating anything on it. Requires `metaSiteId`. */
+    visitorSource?: "oauth" | "one-app";
+    /** The site's MetaSite ID. Required when `visitorSource` is `"one-app"`. */
+    metaSiteId?: string;
     /** Wix site binding for native CAPTCHA configuration. */
     siteId?: string;
     /** Public identifiers only. Never supply the server app secret here. */
@@ -53,8 +63,8 @@ export interface WixConsumerAuthConfig {
     };
     /** Site root URL — e.g. "https://example.wix.com/cafe". */
     siteUrl: string;
-    /** Custom URL scheme for the member-login redirect. */
-    redirectUri: string;
+    /** Custom URL scheme for the member-login redirect. Required whenever `clientId` is set. */
+    redirectUri?: string;
     /**
      * Where the password-reset email's link lands. Must be an http(s) WEB url:
      * IAM recovery shortens it into the mail body, so `redirectUri` — an app scheme

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-auth.mjs

@@ -1194,14 +1194,22 @@ function isWebUrl(value) {
     return false;
   }
 }
+var META_SITE_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function WixConsumerAuthProvider(config) {
-  if (!config.clientId) {
+  const oneApp = config.visitorSource === "one-app";
+  if (config.visitorSource !== void 0 && config.visitorSource !== "oauth" && !oneApp) {
+    throw new Error('WixConsumerAuthProvider: visitorSource must be "oauth" or "one-app".');
+  }
+  if (oneApp && !META_SITE_ID.test(config.metaSiteId ?? "")) {
+    throw new Error(`WixConsumerAuthProvider: visitorSource "one-app" requires metaSiteId (the site's MetaSite ID).`);
+  }
+  if (!oneApp && !config.clientId) {
     throw new Error("WixConsumerAuthProvider: clientId is required.");
   }
   if (!config.siteUrl) {
     throw new Error("WixConsumerAuthProvider: siteUrl is required.");
   }
-  if (!config.redirectUri) {
+  if (config.clientId && !config.redirectUri) {
     throw new Error("WixConsumerAuthProvider: redirectUri is required.");
   }
   if (config.passwordResetUrl && !isWebUrl(config.passwordResetUrl)) {
@@ -1209,16 +1217,17 @@ function WixConsumerAuthProvider(config) {
       `WixConsumerAuthProvider: passwordResetUrl must be an http(s) web URL with a host (got "${config.passwordResetUrl}") \u2014 the reset email's link cannot be an app scheme.`
     );
   }
-  if (!config.siteId) {
+  if (!config.siteId && config.clientId) {
     const siteId = pairedEnvSiteId(config.clientId);
     if (siteId) config = { ...config, siteId };
   }
   return {
     providerId: "wix-consumer",
     config: {
-      clientId: config.clientId,
+      ...config.clientId ? { clientId: config.clientId } : {},
+      ...oneApp ? { visitorSource: "one-app", metaSiteId: config.metaSiteId.toLowerCase() } : {},
       siteUrl: config.siteUrl,
-      redirectUri: config.redirectUri,
+      ...config.redirectUri ? { redirectUri: config.redirectUri } : {},
       bootAsVisitor: config.bootAsVisitor ?? true,
       ...config.passwordResetUrl ? { passwordResetUrl: config.passwordResetUrl } : {},
       preserveVisitorOnSignOut: config.preserveVisitorOnSignOut ?? true,

package/dist/cli.mjs

@@ -10189,7 +10189,6 @@ function resolveTranslation(value2, catalog4, sourceCatalog) {
 var BINDING_SIGILS, COLON_SIGILS, BINDING_SIGIL_RE, APP_BINDING_PREFIX, APP_BINDING_RE, TRANSLATION_PREFIX, TRANSLATION_KEY_RE;
 var init_bindings = __esm({
   "../../core/ts/src/bindings.ts"() {
-    "use strict";
     BINDING_SIGILS = ["service", "flag", "item", "t"];
     COLON_SIGILS = /* @__PURE__ */ new Set(["t"]);
     BINDING_SIGIL_RE = new RegExp(
@@ -12711,7 +12710,6 @@ function webViewOriginAllowed(url, origins) {
 }
 var init_webview_origin = __esm({
   "../../core/ts/src/webview-origin.ts"() {
-    "use strict";
   }
 });
 
@@ -27918,6 +27916,39 @@ async function mintAnonymousVisitor(clientId, fetchImpl = fetch) {
   if (res.status !== 200 || !j2.access_token) throw new Error(`visitor mint failed (${res.status})`);
   return j2.access_token;
 }
+async function mintOneAppVisitor(msid, fetchImpl = fetch, timeoutMs = ONE_APP_VISITOR_MINT_TIMEOUT_MS) {
+  if (!isSafeMsid(msid)) throw new Error("visitor mint failed (bad msid)");
+  const res = await fetchImpl(`${ONE_APP_SESSION}/${encodeURIComponent(msid)}/signed-instance?signed_instance_type=Visitor`, {
+    method: "GET",
+    headers: { Accept: "application/json" },
+    credentials: "omit",
+    redirect: "error",
+    signal: AbortSignal.timeout(timeoutMs)
+  });
+  const text11 = await res.text();
+  let j2 = {};
+  try {
+    j2 = text11 ? JSON.parse(text11) : {};
+  } catch {
+  }
+  const expiresAt = typeof j2.validUntil === "string" ? Date.parse(j2.validUntil) : NaN;
+  if (res.status !== 200 || typeof j2.signedInstance !== "string" || !j2.signedInstance || j2.signedInstanceType !== "Visitor" || !Number.isFinite(expiresAt)) {
+    throw new Error(`visitor mint failed (${res.status})`);
+  }
+  return { instance: j2.signedInstance, expiresAt };
+}
+function oneAppMetaSiteIdOf(auth) {
+  const config = auth?.config;
+  if (auth?.providerId !== "wix-consumer" || config?.visitorSource !== "one-app") return null;
+  return typeof config.metaSiteId === "string" && isSafeMsid(config.metaSiteId) ? config.metaSiteId : null;
+}
+function oneAppVisitorMsidOf(appConfigJson) {
+  try {
+    return oneAppMetaSiteIdOf(JSON.parse(appConfigJson)?.authConfig);
+  } catch {
+    return null;
+  }
+}
 async function wixVisitorCall(method, path2, body, token, fetchImpl = fetch, forwardedHeaders = {}) {
   if (/^[a-z][a-z0-9+.-]*:\/\//i.test(path2)) throw new Error("absolute URLs are not allowed");
   const url = `${WIX_API}${path2.startsWith("/") ? path2 : `/${path2}`}`;
@@ -28176,13 +28207,14 @@ async function resolveInviteShortLink(shortId, fetchImpl = fetch, timeoutMs = 15
   }
   return null;
 }
-var WIX_API, ONE_APP_SESSION, OWNER_SCOPED_WIX_HOST, WIX_FORWARDABLE_HEADERS, OWNER_REFRESH_MARGIN_MS, OWNER_RENEW_MIN_AGE_MS, OWNER_MINT_TIMEOUT_MS, OwnerInstanceCache, OWNER_SITES_QUERY_PATH, OWNER_SITES_COUNT_PATH, OwnerSitesCache, ACCOUNT_FORWARD_ALLOWLIST, ACCOUNT_JOIN_PATHS, NotSiteMember, AccountSessionExpired, SiteInstanceUnavailable, MEMBER_REFRESH_MARGIN_MS, MEMBER_NEGATIVE_TTL_MS, MEMBER_TRANSIENT_TTL_MS, MemberInstanceCache, MEMBER_SESSION_URL, MemberSessionRefused, INVITE_MAX_HOPS;
+var WIX_API, ONE_APP_SESSION, OWNER_SCOPED_WIX_HOST, ONE_APP_VISITOR_MINT_TIMEOUT_MS, WIX_FORWARDABLE_HEADERS, OWNER_REFRESH_MARGIN_MS, OWNER_RENEW_MIN_AGE_MS, OWNER_MINT_TIMEOUT_MS, OwnerInstanceCache, OWNER_SITES_QUERY_PATH, OWNER_SITES_COUNT_PATH, OwnerSitesCache, ACCOUNT_FORWARD_ALLOWLIST, ACCOUNT_JOIN_PATHS, NotSiteMember, AccountSessionExpired, SiteInstanceUnavailable, MEMBER_REFRESH_MARGIN_MS, MEMBER_NEGATIVE_TTL_MS, MEMBER_TRANSIENT_TTL_MS, MemberInstanceCache, MEMBER_SESSION_URL, MemberSessionRefused, INVITE_MAX_HOPS;
 var init_wix_bridge = __esm({
   "../../core/serve-runtime/src/wix-bridge.ts"() {
     init_sha256();
     WIX_API = "https://www.wixapis.com";
     ONE_APP_SESSION = "https://apps.wix.com/_api/one-app-session-web/v3/businesses";
     OWNER_SCOPED_WIX_HOST = /(^|\.)wix\.com$/i;
+    ONE_APP_VISITOR_MINT_TIMEOUT_MS = 8e3;
     WIX_FORWARDABLE_HEADERS = /* @__PURE__ */ new Set([
       "x-wix-language",
       "x-wix-linguist",
@@ -28532,6 +28564,7 @@ __export(wix_member_login_exports, {
   isAllowedConsumerStreamTarget: () => isAllowedConsumerStreamTarget,
   memberDirectLogin: () => memberDirectLogin,
   memberDirectRegister: () => memberDirectRegister,
+  mintOneAppVisitorToken: () => mintOneAppVisitorToken,
   mintVisitor: () => mintVisitor,
   readMemberId: () => readMemberId,
   webWixCall: () => webWixCall,
@@ -28555,6 +28588,9 @@ async function mintVisitor(clientId) {
   if (r3.status !== 200 || !r3.json.access_token) throw new Error(`visitor mint failed (${r3.status})`);
   return r3.json.access_token;
 }
+async function mintOneAppVisitorToken(metaSiteId) {
+  return (await mintOneAppVisitor(metaSiteId)).instance;
+}
 function isRedirectCallback(url, redirectUri) {
   if (url.startsWith(redirectUri)) return true;
   const path2 = (u2) => u2.pathname.replace(/\/+$/, "") || "/";
@@ -28862,7 +28898,7 @@ function parseTarget(target) {
     return { host: "", path: path2, query };
   }
 }
-async function handleWixGateway(gw, app, adminUrl, req, res, wixClientId) {
+async function handleWixGateway(gw, app, adminUrl, req, res, wixClientId, oneAppMetaSiteId) {
   const url = req.url ?? "";
   const path2 = url.split("?")[0];
   const scope2 = path2.startsWith("/__dev/wix/") ? "wix" : path2.startsWith("/__dev/net/") ? "net" : null;
@@ -29064,7 +29100,7 @@ data: ${JSON.stringify({ mode: gw.mode })}
       status = 0;
       respText = JSON.stringify({ gatewayError: String(e2?.message ?? e2) });
     }
-    if (scope2 === "wix" && (status === 401 || status === 403)) {
+    if (scope2 === "wix" && (status === 401 || status === 403) && !oneAppMetaSiteId) {
       try {
         const vt2 = await mintVisitor(wixClientId ?? WIX_DEV_CLIENT_ID);
         const retryHeaders = {};
@@ -129977,9 +130013,10 @@ function webWixSession(req, res, state) {
   if (id !== requestedId) {
     res.setHeader("set-cookie", `${WEBWIX_COOKIE}=${id}; Path=/; HttpOnly; SameSite=Lax`);
   }
+  const binding2 = wixBindingOf(state.app);
   let session = state.wixWebSessions.get(id);
-  if (!session) {
-    session = {};
+  if (!session || session.binding !== binding2) {
+    session = { binding: binding2 };
     state.wixWebSessions.set(id, session);
   }
   return session;
@@ -130157,14 +130194,15 @@ async function handleWebWix(req, res, state) {
         await pipeWebWixStream(upstream2, res, abort.signal, recordStream);
         return;
       }
-      if (!session.visitorToken && !session.memberToken) {
+      const live3 = currentBindingSession(session, state);
+      if (!live3.visitorToken && !live3.memberToken) {
         try {
-          session.visitorToken = await mintVisitor(resolveWixClientId(state.app) ?? WEBWIX_CLIENT_ID);
+          live3.visitorToken = await mintAppVisitor(state.app, live3);
         } catch {
         }
       }
-      const isMember = !!session.memberToken;
-      let token = session.memberToken ?? session.visitorToken ?? "";
+      const isMember = !!live3.memberToken;
+      let token = live3.memberToken ?? live3.visitorToken ?? "";
       let upstream = await webWixStream(method, target.toString(), body, token, void 0, forwardedHeaders, abort.signal);
       if ((upstream.status === 401 || upstream.status === 403) && !isMember && !abort.signal.aborted) {
         try {
@@ -130172,7 +130210,8 @@ async function handleWebWix(req, res, state) {
         } catch {
         }
         try {
-          token = session.visitorToken = await mintVisitor(resolveWixClientId(state.app) ?? WEBWIX_CLIENT_ID);
+          const again = currentBindingSession(live3, state);
+          token = again.visitorToken = await mintAppVisitor(state.app, again);
           upstream = await webWixStream(method, target.toString(), body, token, void 0, forwardedHeaders, abort.signal);
         } catch {
         }
@@ -130195,6 +130234,9 @@ async function handleWebWix(req, res, state) {
     return;
   }
   if (path2 === "/v1/__webwix/login" && req.method === "POST") {
+    if (oneAppMetaSiteIdOf(state.app?.meta.auth) && !resolveWixClientId(state.app)) {
+      return reply(200, { ok: false, code: "unavailable", error: "member_login_unavailable" });
+    }
     const b2 = await readJson10();
     try {
       const { memberToken, visitorToken } = await memberDirectLogin(
@@ -130204,8 +130246,8 @@ async function handleWebWix(req, res, state) {
         String(b2.password ?? "")
       );
       session.memberToken = memberToken;
-      session.visitorToken = visitorToken;
       session.email = String(b2.email ?? "");
+      if (!oneAppMetaSiteIdOf(state.app?.meta.auth)) session.visitorToken = visitorToken;
       if (session.account) webAccountMemberInstances.forgetSession(session.account.cookie);
       session.account = void 0;
       return reply(200, { ok: true, email: session.email });
@@ -130460,19 +130502,21 @@ async function handleWebWix(req, res, state) {
         return reply(status, { error: auth2 ? "webwix_owner_mint_failed" : "webwix_bridge_upstream_failed" });
       }
     }
-    if (!session.visitorToken && !session.memberToken) {
+    const live3 = currentBindingSession(session, state);
+    if (!live3.visitorToken && !live3.memberToken) {
       try {
-        session.visitorToken = await mintVisitor(resolveWixClientId(state.app) ?? WEBWIX_CLIENT_ID);
+        live3.visitorToken = await mintAppVisitor(state.app, live3);
       } catch {
       }
     }
-    const token = session.memberToken ?? session.visitorToken ?? "";
+    const token = live3.memberToken ?? live3.visitorToken ?? "";
     try {
       let r3 = await webWixCall(method, requestedPath, body, token, void 0, forwardedHeaders);
-      if ((r3.status === 401 || r3.status === 403) && !session.memberToken) {
+      if ((r3.status === 401 || r3.status === 403) && !live3.memberToken) {
         try {
-          session.visitorToken = await mintVisitor(resolveWixClientId(state.app) ?? WEBWIX_CLIENT_ID);
-          r3 = await webWixCall(method, requestedPath, body, session.visitorToken, void 0, forwardedHeaders);
+          const again = currentBindingSession(live3, state);
+          again.visitorToken = await mintAppVisitor(state.app, again);
+          r3 = await webWixCall(method, requestedPath, body, again.visitorToken, void 0, forwardedHeaders);
         } catch {
         }
       }
@@ -130511,6 +130555,9 @@ async function handleWebWix(req, res, state) {
     });
   }
   if (path2 === "/v1/__webwix/register" && req.method === "POST") {
+    if (oneAppMetaSiteIdOf(state.app?.meta.auth) && !resolveWixClientId(state.app)) {
+      return reply(200, { ok: false, code: "unavailable", error: "member_login_unavailable" });
+    }
     const b2 = await readJson10();
     try {
       const { memberToken, visitorToken } = await memberDirectRegister(
@@ -130522,8 +130569,8 @@ async function handleWebWix(req, res, state) {
         b2.lastName ? String(b2.lastName) : void 0
       );
       session.memberToken = memberToken;
-      session.visitorToken = visitorToken;
       session.email = String(b2.email ?? "");
+      if (!oneAppMetaSiteIdOf(state.app?.meta.auth)) session.visitorToken = visitorToken;
       if (session.account) webAccountMemberInstances.forgetSession(session.account.cookie);
       session.account = void 0;
       return reply(200, { ok: true, email: session.email });
@@ -130535,7 +130582,7 @@ async function handleWebWix(req, res, state) {
 }
 async function handleDev(req, res, state) {
   const url = req.url ?? "";
-  if (await handleWixGateway(state.wix, state.appName, state.adminUrl, req, res, resolveWixClientId(state.app))) return;
+  if (await handleWixGateway(state.wix, state.appName, state.adminUrl, req, res, resolveWixClientId(state.app), oneAppMetaSiteIdOf(state.app?.meta.auth) ?? void 0)) return;
   if (url === "/__dev/health") {
     return sendJson(res, 200, {
       status: "ok",
@@ -132130,7 +132177,7 @@ ${err.message}`);
   });
   return httpServer;
 }
-var ROOT6, TIER3_ROOT, TIER4_ROOT, tier4Verifier, TIER5_ROOT2, ACTION_HANDLERS_ROOT, SAMPLES_ROOT, TELEMETRY_BUFFER_CAP, overrideHistorySeq, CACHE_CONTROL, DescriptorDepthRefusal, TIER5_SRC_ROOT, HMR_TMP_DIR, appReloadSeq, appReloadChain, WEBWIX_CLIENT_ID, WEBWIX_REDIRECT, WEBWIX_COOKIE, webOwnerPreviewInstances, webAccountMemberInstances, MIME, widgetOverrides;
+var ROOT6, TIER3_ROOT, TIER4_ROOT, tier4Verifier, TIER5_ROOT2, ACTION_HANDLERS_ROOT, SAMPLES_ROOT, TELEMETRY_BUFFER_CAP, overrideHistorySeq, CACHE_CONTROL, DescriptorDepthRefusal, TIER5_SRC_ROOT, HMR_TMP_DIR, appReloadSeq, appReloadChain, WEBWIX_CLIENT_ID, mintAppVisitor, wixBindingOf, currentBindingSession, WEBWIX_REDIRECT, WEBWIX_COOKIE, webOwnerPreviewInstances, webAccountMemberInstances, MIME, widgetOverrides;
 var init_src5 = __esm({
   "../../core/dev-server/src/index.ts"() {
     init_inject();
@@ -132144,6 +132191,7 @@ var init_src5 = __esm({
     init_aria_realtime_dev();
     init_wix_member_login();
     init_wix_bridge();
+    init_wix_bridge();
     init_wix_account_session();
     init_flag_assignments();
     init_images();
@@ -132202,6 +132250,19 @@ var init_src5 = __esm({
     appReloadSeq = 0;
     appReloadChain = Promise.resolve();
     WEBWIX_CLIENT_ID = process.env.DEMO_APP_WIX_CLIENT_ID ?? "4f58d461-c1f5-4a5d-a467-62cc2329e4dd";
+    mintAppVisitor = async (app, session) => {
+      const metaSiteId = oneAppMetaSiteIdOf(app?.meta.auth);
+      if (!metaSiteId) return mintVisitor(resolveWixClientId(app) ?? WEBWIX_CLIENT_ID);
+      if (session.binding !== wixBindingOf(app)) return (await mintOneAppVisitor(metaSiteId)).instance;
+      const held = session.oneAppVisitor;
+      if (held && held.expiresAt - 6e4 > Date.now()) return held.instance;
+      session.oneAppVisitorMint ??= mintOneAppVisitor(metaSiteId).then((visitor) => session.oneAppVisitor = visitor).finally(() => {
+        session.oneAppVisitorMint = void 0;
+      });
+      return (await session.oneAppVisitorMint).instance;
+    };
+    wixBindingOf = (app) => JSON.stringify(app?.meta.auth ?? null);
+    currentBindingSession = (session, state) => session.binding === wixBindingOf(state.app) ? session : { binding: wixBindingOf(state.app) };
     WEBWIX_REDIRECT = "himalaya-demo-app://oauth/callback";
     WEBWIX_COOKIE = "himi_webwix_session";
     webOwnerPreviewInstances = new OwnerInstanceCache(fetch);
@@ -137856,12 +137917,13 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     if (liveWixCall) return liveWixCall;
     const auth = config.auth;
     const clientId = auth?.config?.clientId;
-    if (auth?.providerId !== "wix-consumer" || typeof clientId !== "string" || !clientId) {
+    const oneAppMsid = oneAppMetaSiteIdOf(auth);
+    if (!oneAppMsid && (auth?.providerId !== "wix-consumer" || typeof clientId !== "string" || !clientId)) {
       throw new Error(
         "`himi render --live` requires a WixConsumerAuthProvider clientId in config.ts; none found" + (auth?.providerId ? ` (this app's auth provider is "${auth.providerId}", not "wix-consumer")` : "") + ". Only a Wix Headless consumer client can mint the visitor token that backs a live read. Add `auth: WixConsumerAuthProvider({ clientId, siteUrl, redirectUri })`, or render without --live (initial state only)."
       );
     }
-    if (clientId === PLACEHOLDER_CLIENT_ID) {
+    if (!oneAppMsid && clientId === PLACEHOLDER_CLIENT_ID) {
       throw Object.assign(
         new Error(
           `\`himi render --live\` found the scaffolded placeholder clientId "${PLACEHOLDER_CLIENT_ID}" in config.ts \u2014 it cannot mint a visitor token, so every Wix call would fail and the render would show the initial state. Set a real Wix Headless (wix-consumer) clientId in config.ts, or export WIX_CLIENT_ID. Drop --live to render the initial state deliberately.`
@@ -137869,7 +137931,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
         { exitCode: 2 }
       );
     }
-    const token = await mintVisitor(clientId);
+    const token = oneAppMsid ? await mintOneAppVisitorToken(oneAppMsid) : await mintVisitor(clientId);
     liveWixCall = async (method, path2, body) => {
       const bodyStr = body === void 0 ? void 0 : typeof body === "string" ? body : JSON.stringify(body);
       const r3 = await webWixCall(method, path2, bodyStr, token);
@@ -138664,7 +138726,12 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     auth: (() => {
       const a2 = config.auth;
       const cid = a2?.config?.clientId;
-      return { ...a2?.providerId ? { providerId: a2.providerId } : {}, ...typeof cid === "string" && cid ? { clientId: cid } : {} };
+      const oneAppMetaSiteId = oneAppMetaSiteIdOf(a2);
+      return {
+        ...a2?.providerId ? { providerId: a2.providerId } : {},
+        ...typeof cid === "string" && cid ? { clientId: cid } : {},
+        ...oneAppMetaSiteId ? { oneAppMetaSiteId } : {}
+      };
     })()
   };
 }
@@ -138738,6 +138805,7 @@ var init_build3 = __esm({
     init_screen_views();
     init_validate_descriptor();
     init_wix_member_login();
+    init_wix_bridge();
     init_wix_placeholders();
     init_render_descriptor();
     init_render_fonts();
@@ -140776,6 +140844,7 @@ async function loadAuthoring() {
       crawlSignature: crawl.crawlSignature,
       recordScreenTraffic: crawl.recordScreenTraffic,
       mintVisitor: wml.mintVisitor,
+      mintOneAppVisitorToken: wml.mintOneAppVisitorToken,
       webWixCall: wml.webWixCall,
       freezeTrafficToMocks: nf2.freezeTrafficToMocks,
       bootAndSnapshotState: crawl.bootAndSnapshotState,
@@ -151053,19 +151122,19 @@ function isSymlink2(path2) {
 async function introducedErrors(dir, validate5, file2, isOwnFinding) {
   const edited = await validate5(dir, { fresh: true });
   if (edited.code === 0) return void 0;
-  if (!comparable(edited)) return `himi validate failed and its report could not be read: ${edited.tail ?? "no output"}`;
+  const { comparable: comparable2, compareErrors: compareErrors2 } = await Promise.resolve().then(() => (init_template_trim(), template_trim_exports));
+  if (!comparable2(edited)) return `himi validate failed and its report could not be read: ${edited.tail ?? "no output"}`;
   if (edited.errors.every((e2) => isOwnFinding(e2.ruleCode))) return void 0;
   file2.restore();
   const baseline = await validate5(dir, { fresh: true });
   file2.reapply();
-  if (!comparable(baseline)) return "himi validate could not check the original config.ts to compare against";
-  const introduced = compareErrors(edited.errors, baseline.errors ?? []).introduced.filter((e2) => !isOwnFinding(e2.ruleCode));
+  if (!comparable2(baseline)) return "himi validate could not check the original config.ts to compare against";
+  const introduced = compareErrors2(edited.errors, baseline.errors ?? []).introduced.filter((e2) => !isOwnFinding(e2.ruleCode));
   return introduced.length ? `the edit introduced ${introduced.length === 1 ? "an error" : `${introduced.length} errors`}: ` + introduced.map((e2) => e2.message).join("; ") : void 0;
 }
 var init_config_source_edit = __esm({
   "src/config-source-edit.ts"() {
     init_progress();
-    init_template_trim();
   }
 });
 
@@ -168052,6 +168121,57 @@ var init_package_share = __esm({
   }
 });
 
+// ../../core/serve-runtime/src/rate-limit.ts
+var FixedWindowRateLimiter;
+var init_rate_limit = __esm({
+  "../../core/serve-runtime/src/rate-limit.ts"() {
+    FixedWindowRateLimiter = class {
+      max;
+      windowMs;
+      now;
+      /** Cap on distinct keys tracked, so a flood of unique keys cannot grow the map without
+       *  bound. When exceeded, the soonest-to-reset entry is dropped (expired ones first — they are
+       *  the soonest) — in O(1): see `hits`. */
+      maxKeys;
+      /** Kept in `resetAt` order: a window is (re)inserted at the END when it opens, and every window
+       *  is `windowMs` long, so the FIRST entry is always the soonest to reset. That is what makes
+       *  eviction O(1) — a scan of the whole map per new key, once it is full, was an O(maxKeys) cost
+       *  a flood of unique keys could make this pod pay on every request. */
+      hits = /* @__PURE__ */ new Map();
+      constructor(opts) {
+        this.max = Math.max(1, opts.max);
+        this.windowMs = Math.max(1, opts.windowMs);
+        this.now = opts.now ?? Date.now;
+        this.maxKeys = Math.max(1, opts.maxKeys ?? 1e5);
+      }
+      /** Count one request against `key`. Does NOT mutate on refusal past the first over-limit hit
+       *  count — a refused caller cannot push their own reset further out by hammering. */
+      check(key3) {
+        const t2 = this.now();
+        let entry = this.hits.get(key3);
+        if (!entry || t2 >= entry.resetAt) {
+          if (entry) this.hits.delete(key3);
+          else if (this.hits.size >= this.maxKeys) this.evictOne();
+          entry = { count: 0, resetAt: t2 + this.windowMs };
+          this.hits.set(key3, entry);
+        }
+        if (entry.count >= this.max) {
+          return { ok: false, retryAfterSec: Math.max(1, Math.ceil((entry.resetAt - t2) / 1e3)) };
+        }
+        entry.count += 1;
+        return { ok: true, retryAfterSec: 0 };
+      }
+      /** Evict the soonest-to-reset entry — the first, by the ordering `hits` keeps. O(1). An expired
+       *  entry left elsewhere in the map is harmless: `check` treats it as absent, and it reaches the
+       *  front in its turn. */
+      evictOne() {
+        const first = this.hits.keys().next();
+        if (!first.done) this.hits.delete(first.value);
+      }
+    };
+  }
+});
+
 // ../../core/serve-runtime/src/wix-member-auth.ts
 function wixMemberAuthOf(appConfigJson, callbackUrl) {
   let cfg;
@@ -168394,6 +168514,10 @@ var init_account_rung = __esm({
 function json5(status, body, headers2 = {}) {
   return new Response(JSON.stringify(body), { status, headers: { "content-type": JSON_CT3, ...headers2 } });
 }
+function visitorMintCaller(request) {
+  const hops = (request.headers.get("x-forwarded-for") ?? "").split(",").map((h2) => h2.trim()).filter(Boolean);
+  return hops.at(-1) ?? "direct";
+}
 function isCookieAuthorizedPath(path2) {
   return path2 === "/v1/__webwix/call" || path2 === "/v1/__webwix/stream" || path2 === "/v1/owner" || path2.startsWith("/v1/owner/") || path2 === "/v1/__webwix/identity" || path2 === "/v1/__webwix/login" || path2 === "/v1/__webwix/register" || path2 === "/v1/__webwix/logout" || path2 === MEMBER_CALLBACK_PATH || ACCOUNT_RUNG_PATHS.has(path2);
 }
@@ -168417,6 +168541,7 @@ function makeServeHandler(opts) {
   })();
   const webwixFetch = opts.webwixFetch ?? fetch;
   const webwixOwnerInstances = new OwnerInstanceCache(webwixFetch);
+  const visitorMintLimiter = new FixedWindowRateLimiter({ max: opts.visitorMintRatePerMin ?? 30, windowMs: 6e4 });
   const webwixOwnerSites = new OwnerSitesCache(webwixFetch);
   const webwixAccountInstances = new MemberInstanceCache(webwixFetch);
   const webwixOwnerRungOn = () => opts.webwixOwnerRung !== false;
@@ -168546,6 +168671,17 @@ ${releaseId}`;
   function resolveApp(request, url) {
     return request.headers.get("x-himalaya-app") || url.searchParams.get("app") || opts.defaultApp || null;
   }
+  async function visitorMintTarget(request, url) {
+    const mintFetch = opts.oneAppVisitorFetch ?? (opts.webwixBridge === false ? null : webwixFetch);
+    if (!mintFetch) return json5(503, { error: "webwix_bridge_disabled" });
+    const app = resolveApp(request, url);
+    if (!app) return json5(400, { error: "missing_app" });
+    const cfg = await appConfigFor(request, url, app);
+    if (!cfg.ok) return cfg.response;
+    const msid = oneAppVisitorMsidOf(utf8Decode(cfg.bytes));
+    if (!msid) return json5(404, { error: "visitor_instance_not_configured" });
+    return { app, msid, mintFetch };
+  }
   function sendDoc(request, body, pinned = false) {
     const etag = strongEtag(body);
     const cache = pinned ? PINNED_CACHE_CONTROL : DOC_CACHE_CONTROL;
@@ -168622,7 +168758,7 @@ ${releaseId}`;
     const origin = request.headers.get("origin");
     if (!origin) return {};
     const path2 = new URL(request.url).pathname;
-    if (isCookieAuthorizedPath(path2)) return {};
+    if (isCookieAuthorizedPath(path2) || path2 === VISITOR_INSTANCE_PATH) return {};
     return {
       "access-control-allow-origin": origin,
       vary: "Origin",
@@ -168799,6 +168935,11 @@ ${releaseId}`;
           }
         });
       }
+      if (request.method === "HEAD" && path2 === VISITOR_INSTANCE_PATH) {
+        const target = await visitorMintTarget(request, url);
+        if (target instanceof Response) return new Response(null, { status: target.status, headers: target.headers });
+        return new Response(null, { status: 200, headers: { "content-type": JSON_CT3, "cache-control": "no-store" } });
+      }
       if ((request.method === "GET" || request.method === "HEAD") && path2 === "/v1/__webwix/identity") {
         const headers2 = { "content-type": JSON_CT3, "cache-control": "no-store" };
         if (request.method === "HEAD") return new Response(null, { status: 200, headers: headers2 });
@@ -169066,6 +169207,19 @@ ${releaseId}`;
           return json5(403, { error: "webwix_owner_mint_failed" });
         }
       }
+      if (path2 === VISITOR_INSTANCE_PATH) {
+        const target = await visitorMintTarget(request, url);
+        if (target instanceof Response) return target;
+        const { app: app2, msid, mintFetch } = target;
+        const rate = visitorMintLimiter.check(`${app2}|${visitorMintCaller(request)}`);
+        if (!rate.ok) return json5(429, { error: "visitor_instance_rate_limited" }, { "retry-after": String(rate.retryAfterSec) });
+        try {
+          const entry = await mintOneAppVisitor(msid, mintFetch);
+          return json5(200, { ...entry, expiresInMs: Math.max(0, entry.expiresAt - Date.now()) }, { "cache-control": "no-store" });
+        } catch {
+          return json5(502, { error: "webwix_bridge_upstream_failed" });
+        }
+      }
       if (path2 === "/v1/owner/sites") {
         if (!webwixOwnerRungOn()) return json5(503, { error: "webwix_owner_disabled" });
         const cookie = request.headers.get("cookie") ?? "";
@@ -169542,7 +169696,7 @@ ${releaseId}`;
     return withCors(request, response);
   };
 }
-var JSON_CT3;
+var JSON_CT3, VISITOR_INSTANCE_PATH;
 var init_server2 = __esm({
   "../../core/serve/src/server.ts"() {
     init_sha256();
@@ -169553,10 +169707,12 @@ var init_server2 = __esm({
     init_member_exchange();
     init_member_forward();
     init_package_share();
+    init_rate_limit();
     init_wix_bridge();
     init_account_rung();
     init_wix_member_auth();
     JSON_CT3 = "application/json; charset=utf-8";
+    VISITOR_INSTANCE_PATH = "/v1/visitor/instance";
   }
 });
 
@@ -169964,6 +170120,11 @@ function liveWixClientId(appConfig) {
   const clientId = appConfigWixClientId(appConfig);
   return clientId && clientId !== PLACEHOLDER_CLIENT_ID ? clientId : void 0;
 }
+function liveWixBinding(appConfig) {
+  if (liveWixClientId(appConfig) !== void 0) return true;
+  const auth = authConfigOf(appConfig);
+  return auth?.providerId === "wix-consumer" && auth.config?.visitorSource === "one-app" && typeof auth.config.metaSiteId === "string" && auth.config.metaSiteId.length > 0;
+}
 var init_wix_client_id = __esm({
   "src/wix-client-id.ts"() {
     init_wix_placeholders();
@@ -170011,38 +170172,38 @@ var init_preview_assets_generated = __esm({
   "../../packages/serve/src/preview-assets.generated.ts"() {
     init_preview_assets_format();
     PREVIEW_ASSET_MANIFEST = [
-      { key: "assets/DashboardHost-5wf0y6ol.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 2916, sha256: "546fee4e3168812aba2ab98e7fbb62e7d707a8c90e84336f51c0baf0902186f4" },
-      { key: "assets/DevDrawer-CQGmhbIs.js", contentType: "application/javascript; charset=utf-8", offset: 2924, length: 16744, sha256: "3b37c8bbe8fcfef63066c97c53eab384c96c0db989ef6026cac53c3d87416228" },
-      { key: "assets/IdiomCompare-Iuvv8Rlj.js", contentType: "application/javascript; charset=utf-8", offset: 19668, length: 1892, sha256: "34a2df21726dacbb47d85a9fd471b4fd2733de325e9178034904bfaa182c8e29" },
-      { key: "assets/LightboxViewer-fHwveX-i.js", contentType: "application/javascript; charset=utf-8", offset: 21560, length: 8132, sha256: "a43c88fd1ab25dab31e649bec5b2837c029c9f1d2f6d7542bca90c8be7b9c354" },
-      { key: "assets/PhonePreviewControl-BSsfEWOn.js", contentType: "application/javascript; charset=utf-8", offset: 29692, length: 37729, sha256: "312fd178c95f4284589f216b4a7cbc948028eee9eeb16ffcf3d9b0801b8547ba" },
-      { key: "assets/SchemeCompare-DXtTgPI6.js", contentType: "application/javascript; charset=utf-8", offset: 67421, length: 1824, sha256: "d4120f73b44a15965268c926c8da522a12f80faf00711ce89aa9b54d88ef54b0" },
+      { key: "assets/DashboardHost-D5EVbc2F.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 2916, sha256: "2f182ad05cc79b7f2da3f70cf51c0b1c86e8432b02e6e38965cd1d4099c9fdc6" },
+      { key: "assets/DevDrawer-BK3Vg-Y2.js", contentType: "application/javascript; charset=utf-8", offset: 2924, length: 16744, sha256: "197a32bfcf8120e32bddb02699547aa4cf3199b22f0e3d4d73efecdef9a52051" },
+      { key: "assets/IdiomCompare-BFXQ1M5s.js", contentType: "application/javascript; charset=utf-8", offset: 19668, length: 1892, sha256: "b81a659bfc6b8e6190cdd259302402f0388ab2536e44ca9223bd9b3b9e39f0bd" },
+      { key: "assets/LightboxViewer-nAaLa1ml.js", contentType: "application/javascript; charset=utf-8", offset: 21560, length: 8132, sha256: "e85aa0c290afacd74031bd18f9dd1db2cd7acfc50b0d9b041156f482ab066d0d" },
+      { key: "assets/PhonePreviewControl-B5H1rgoN.js", contentType: "application/javascript; charset=utf-8", offset: 29692, length: 37729, sha256: "a24d2a30b7d1aef5ef5797bf4f3df71cfba60c9f26f2cfcdd1986c41cda172ef" },
+      { key: "assets/SchemeCompare-DJKQL41W.js", contentType: "application/javascript; charset=utf-8", offset: 67421, length: 1824, sha256: "248e3af4523b33ab3acbb17fae089a5854f9936d1679a7ff72389c6f21379b94" },
       { key: "assets/glassPreviewBrowser-Bt5ZFmG4.js", contentType: "application/javascript; charset=utf-8", offset: 69245, length: 342, sha256: "20d73f97d38f6d9a0b79e68e24954cd6bbfe66833a6e6aecae00a9102e64cab3" },
-      { key: "assets/index-DxXULrki.js", contentType: "application/javascript; charset=utf-8", offset: 69587, length: 1344114, sha256: "e8c56c448a052fd93491c0030e7ac00bed1cbd14142efe297556812a783bde10" },
-      { key: "assets/pdf-CdYoBtlC.js", contentType: "application/javascript; charset=utf-8", offset: 1413701, length: 488199, sha256: "41a0c995fb20f5a2dc4abdd47f283b4fa4cc5eec3cabe146b0e01cf86143f27f" },
-      { key: "assets/pdf.worker.min-BQa_JDET.js", contentType: "application/javascript; charset=utf-8", offset: 1901900, length: 73, sha256: "41bcfda4f3c8c0a81c785ea87c69afc8e7d0ed8c333324aee94c273d881bb6aa" },
-      { key: "assets/pdf.worker.min-BmVo14Nb.mjs", contentType: "application/javascript; charset=utf-8", offset: 1901973, length: 1317034, sha256: "a33cfe728c584fdba4fcc1fd54bcdc2f9f2f13889ddbb5b2bd1d0f8cbe49b84e" },
-      { key: "assets/pdfDocument-BMhHjlqg.js", contentType: "application/javascript; charset=utf-8", offset: 3219007, length: 3379, sha256: "0588a47454ed1787b2373dd097bc3ce32705f0f9c2c263c27cd3c8c2dc09a0fd" },
-      { key: "assets/pdfFetch-Cc8i1I1h.js", contentType: "application/javascript; charset=utf-8", offset: 3222386, length: 2266, sha256: "1d21ad008921942217c9eac0c35b1713773b9d89c71e3ab4412781f7bb88f463" },
-      { key: "assets/webviewBridgeHost-D0zOUOdW.js", contentType: "application/javascript; charset=utf-8", offset: 3224652, length: 9849, sha256: "58d93339322d6084df15033f9c2445577430178efe2d1cd8b7a7fec2d75714cf" },
-      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 3234501, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
-      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 3239111, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
-      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 3727695, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
-      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 3818619, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
-      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 3909603, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
-      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 4000583, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
-      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 4091455, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
-      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 4182435, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
-      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 4291071, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
-      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 4400155, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
-      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 4509203, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
-      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 4616903, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
-      { key: "himi-sw.js", contentType: "application/javascript; charset=utf-8", offset: 4705011, length: 6748, sha256: "4a92459977d7cefa1a6a7e020c3a63509737f083b3f2773557c1a5771665811a" },
-      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 4711759, length: 4947, sha256: "be9d960987b43b3e0bf73db51329ec433fe6ed5eefe0a7cc32bc2e33f1fad21f" },
-      { key: "ios-glass-preview.css", contentType: "text/css; charset=utf-8", offset: 4716706, length: 7193, sha256: "a482f4796147c2a3893942e10ab225bd3b6f749f7125fe0330680d4c20ea0212" },
-      { key: "ios-glass-preview.svg", contentType: "image/svg+xml", offset: 4723899, length: 423, sha256: "b9cd5989d31464a0422f260a332af6be5add0b04de2148944de35158f3b75efc" },
-      { key: "kit-tab-bar.css", contentType: "text/css; charset=utf-8", offset: 4724322, length: 1171, sha256: "9e2c3a0faaf05d5471badf167a4d3bdf1c4e6dd65c432eea6d254158bfd99585" },
-      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 4725493, length: 18778, sha256: "ba734d58c88281c71c01d9a2842a991d06f3ed91bf03449427ef11c7f6d1605d" }
+      { key: "assets/index-OGlXUsSh.js", contentType: "application/javascript; charset=utf-8", offset: 69587, length: 1346613, sha256: "39df48514d225b66a41c34eb937e6cdd485a4490b8b6e9d271f6dcea53ca06a5" },
+      { key: "assets/pdf-BLYfkY1C.js", contentType: "application/javascript; charset=utf-8", offset: 1416200, length: 488199, sha256: "3f1ac8017be9bf7de66589ec2a4859a06eba02962a34c9167f4da208792bf0f2" },
+      { key: "assets/pdf.worker.min-BQa_JDET.js", contentType: "application/javascript; charset=utf-8", offset: 1904399, length: 73, sha256: "41bcfda4f3c8c0a81c785ea87c69afc8e7d0ed8c333324aee94c273d881bb6aa" },
+      { key: "assets/pdf.worker.min-BmVo14Nb.mjs", contentType: "application/javascript; charset=utf-8", offset: 1904472, length: 1317034, sha256: "a33cfe728c584fdba4fcc1fd54bcdc2f9f2f13889ddbb5b2bd1d0f8cbe49b84e" },
+      { key: "assets/pdfDocument-8MxOHwUZ.js", contentType: "application/javascript; charset=utf-8", offset: 3221506, length: 3379, sha256: "503a8fde785394352aed2b87dee68d1b940513efb24726dbfc31be155d0ca9aa" },
+      { key: "assets/pdfFetch-Cc8i1I1h.js", contentType: "application/javascript; charset=utf-8", offset: 3224885, length: 2266, sha256: "1d21ad008921942217c9eac0c35b1713773b9d89c71e3ab4412781f7bb88f463" },
+      { key: "assets/webviewBridgeHost-u1DlT1Hn.js", contentType: "application/javascript; charset=utf-8", offset: 3227151, length: 9849, sha256: "a7b2309a785ded4a2cabd9016a5daa60229c7e470a28b81592d431ac462b43b2" },
+      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 3237e3, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
+      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 3241610, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
+      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 3730194, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
+      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 3821118, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
+      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 3912102, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
+      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 4003082, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
+      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 4093954, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
+      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 4184934, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
+      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 4293570, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
+      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 4402654, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
+      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 4511702, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
+      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 4619402, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
+      { key: "himi-sw.js", contentType: "application/javascript; charset=utf-8", offset: 4707510, length: 6748, sha256: "4a92459977d7cefa1a6a7e020c3a63509737f083b3f2773557c1a5771665811a" },
+      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 4714258, length: 4947, sha256: "48b12d2dabe7e76a3ca777acd531bc1a85d19d913c2d85b39dd85c5096130b48" },
+      { key: "ios-glass-preview.css", contentType: "text/css; charset=utf-8", offset: 4719205, length: 7193, sha256: "a482f4796147c2a3893942e10ab225bd3b6f749f7125fe0330680d4c20ea0212" },
+      { key: "ios-glass-preview.svg", contentType: "image/svg+xml", offset: 4726398, length: 423, sha256: "b9cd5989d31464a0422f260a332af6be5add0b04de2148944de35158f3b75efc" },
+      { key: "kit-tab-bar.css", contentType: "text/css; charset=utf-8", offset: 4726821, length: 1171, sha256: "9e2c3a0faaf05d5471badf167a4d3bdf1c4e6dd65c432eea6d254158bfd99585" },
+      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 4727992, length: 18778, sha256: "ba734d58c88281c71c01d9a2842a991d06f3ed91bf03449427ef11c7f6d1605d" }
     ];
   }
 });
@@ -170069,7 +170230,7 @@ function makePackageRunHandler(opts) {
   const store = new FileReleaseStore(opts.releaseRoot);
   const webwixDirect = async () => {
     try {
-      return liveWixClientId(await store.getAppConfig(opts.app)) !== void 0;
+      return liveWixBinding(await store.getAppConfig(opts.app));
     } catch {
       return false;
     }
@@ -170081,7 +170242,9 @@ function makePackageRunHandler(opts) {
     ...opts.chrome ? { chrome: opts.chrome } : {},
     header: opts.header ?? null,
     ...opts.screenEvents ? { screenEvents: opts.screenEvents } : {},
-    ...opts.liveWix ? { serve: { webwixDirect } } : {}
+    // A One App-bound app's visitor instance is minted HERE, in Node: the tab cannot reach that
+    // endpoint (no CORS), and this plane has no bridge to do it.
+    ...opts.liveWix ? { serve: { webwixDirect, oneAppVisitorFetch: fetch } } : {}
   });
 }
 async function fetchBytes(url) {
@@ -196508,7 +196671,7 @@ async function testCommand(ctx) {
     return results.every((result2) => result2.ok) ? 0 : 1;
   }
   const app = await appId(dir);
-  const { buildContentBundles: buildContentBundles2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2, crawlScreen: crawlScreen2, crawlScreenJourney: crawlScreenJourney2, crawlScreenHostile: crawlScreenHostile2, crawlScreenRelations: crawlScreenRelations2, crawlScreenCapabilitySuccess: crawlScreenCapabilitySuccess2, findingKey: findingKey2, startWorkerCoverage: startWorkerCoverage2, uncoveredFunctions: uncoveredFunctions2, crawlScreenDeep: crawlScreenDeep2, crawlSignature: crawlSignature2, recordScreenTraffic: recordScreenTraffic2, mintVisitor: mintVisitor2, webWixCall: webWixCall2, freezeTrafficToMocks: freezeTrafficToMocks2, bootAndSnapshotState: bootAndSnapshotState2, isUnservedRequest: isUnservedRequest2, renderDescriptorWeb: renderDescriptorWeb2, renderPngBatch: renderPngBatch2, pngAvailable: pngAvailable2, crawlBlockingPasses } = await loadAuthoring();
+  const { buildContentBundles: buildContentBundles2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2, crawlScreen: crawlScreen2, crawlScreenJourney: crawlScreenJourney2, crawlScreenHostile: crawlScreenHostile2, crawlScreenRelations: crawlScreenRelations2, crawlScreenCapabilitySuccess: crawlScreenCapabilitySuccess2, findingKey: findingKey2, startWorkerCoverage: startWorkerCoverage2, uncoveredFunctions: uncoveredFunctions2, crawlScreenDeep: crawlScreenDeep2, crawlSignature: crawlSignature2, recordScreenTraffic: recordScreenTraffic2, mintVisitor: mintVisitor2, mintOneAppVisitorToken: mintOneAppVisitorToken2, webWixCall: webWixCall2, freezeTrafficToMocks: freezeTrafficToMocks2, bootAndSnapshotState: bootAndSnapshotState2, isUnservedRequest: isUnservedRequest2, renderDescriptorWeb: renderDescriptorWeb2, renderPngBatch: renderPngBatch2, pngAvailable: pngAvailable2, crawlBlockingPasses } = await loadAuthoring();
   const { readTestConfig: readTestConfig2, runCrawl: runCrawl2, formatReport: formatReport2, readCannedResponses: readCannedResponses2, makeRecordingWixCall: makeRecordingWixCall2, runRecordPass: runRecordPass2, runShotsPass: runShotsPass2, defaultNetRules: defaultNetRules2, readNetRules: readNetRules2, scopeDescriptors: scopeDescriptors2, writeRecordedMocks: writeRecordedMocks2 } = await Promise.resolve().then(() => (init_test(), test_exports));
   let config;
   try {
@@ -196697,13 +196860,14 @@ async function testCommand(ctx) {
   let recorded;
   if (record3) {
     const a2 = outcome.auth;
-    if (a2?.providerId !== "wix-consumer" || !a2.clientId) {
+    const oneAppMsid = a2?.oneAppMetaSiteId;
+    if (!oneAppMsid && (a2?.providerId !== "wix-consumer" || !a2.clientId)) {
       io2.error(JSON.stringify({
         error: "`himi test --record` requires a WixConsumerAuthProvider clientId in config.ts; none found" + (a2?.providerId ? ` (this app's auth provider is "${a2.providerId}", not "wix-consumer")` : "") + ". Only a Wix Headless consumer client can mint the visitor token that backs the recording reads."
       }));
       return 2;
     }
-    if (a2.clientId === PLACEHOLDER_CLIENT_ID) {
+    if (!oneAppMsid && a2?.clientId === PLACEHOLDER_CLIENT_ID) {
       io2.error(JSON.stringify({
         error: `\`himi test --record\` found the scaffolded placeholder clientId "${PLACEHOLDER_CLIENT_ID}" in config.ts \u2014 it cannot mint a visitor token, so every recorded read would fail and the frozen mocks would capture the failures rather than the site. Set a real Wix Headless (wix-consumer) clientId in config.ts, or export WIX_CLIENT_ID. Drop --record to crawl on the existing fixtures.`
       }));
@@ -196711,7 +196875,7 @@ async function testCommand(ctx) {
     }
     let token;
     try {
-      token = await mintVisitor2(a2.clientId);
+      token = oneAppMsid ? await mintOneAppVisitorToken2(oneAppMsid) : await mintVisitor2(a2.clientId);
     } catch (e2) {
       io2.error(JSON.stringify({ error: `--record could not mint a visitor token: ${e2.message}. Recording needs network access and a valid Wix Headless clientId.` }));
       return 1;

package/guides/one-app-to-himi-app.md

@@ -65,7 +65,7 @@ partial artifacts are diagnostics for recovery, never a usable empty fallback.
 the complete-manifest check or provide a resume command.
 
 The migration invocation authorizes this scoped continuation: plan, local app
-implementation, necessary same-site OAuth client reconciliation, validation, and
+implementation, the same-site One App visitor binding, validation, and
 an authenticated hosted draft. Do not restart generic product discovery or add a
 generic plan-approval pause. Carry this scope through installed agent instructions
 and resume sessions. It does not authorize live promotion, native distribution,
@@ -395,7 +395,31 @@ not share mutable filters accidentally. Keep static authored content in the app,
 and products, services, availability, posts and member records live on the same site.
 Refresh data after operations without reconnecting layout to the One App editor.
 
-Resolve the same site's mobile OAuth client using the existing idempotent command:
+Bind the app to the same site through its **One App visitor identity**. It is the
+identity a visitor of the source Branded app already has, so it needs no OAuth client
+and creates nothing on the customer's site. The `branded-lite` template does not supply `provisioning.json`:
+bind it directly in the generated app's `config.ts`, with its existing
+`WixConsumerAuthProvider` import and the [Wix auth configuration contract](https://apps.wix.com/_api/himi-serve/docs/wix-api-usage.md).
+Replace the template's placeholders and environment fallbacks so an unrelated local
+`WIX_CLIENT_ID` cannot repoint the build:
+
+```ts
+auth: WixConsumerAuthProvider({
+  visitorSource: "one-app",
+  metaSiteId: "<source-msid>",
+  siteUrl: "<verified-source-website-publicUrl>",
+  bootAsVisitor: true,
+  preserveVisitorOnSignOut: true,
+}),
+```
+
+Every surface reads the site with it: the native apps, the hosted draft preview, and
+`himi run`, `himi render --live` and `himi test --record`. It is a visitor: member
+sign-in still needs a Headless OAuth client.
+
+**Only when the site owner wants member sign-in now**, and with their agreement,
+resolve the site's mobile OAuth client with the existing idempotent command (it is
+an owner-scoped write to the customer's site):
 
 ```sh
 himi site client ensure --site <source-msid> --name <stable-migration-client-name> \
@@ -404,17 +428,13 @@ himi site client ensure --site <source-msid> --name <stable-migration-client-nam
 
 Reuse a compatible client first; create or update only as necessary. Preserve its
 existing redirect URIs when adding the app's redirect. Require a successful,
-non-dry-run result and verify its `siteId`, public `clientId` and `redirectUri`.
-This command reconciles the OAuth client; it does not configure the generated app.
-
-The `branded-lite` template does not supply `provisioning.json`. Bind the result
-directly in the generated app's `config.ts`, using its existing
-`WixConsumerAuthProvider` import and the [Wix auth configuration contract](https://apps.wix.com/_api/himi-serve/docs/wix-api-usage.md).
-Replace the template's placeholders and environment fallbacks with this app's
-verified binding so an unrelated local `WIX_CLIENT_ID` cannot repoint the build:
+non-dry-run result and verify its `siteId`, public `clientId` and `redirectUri`, then
+add them beside the One App binding:
 
 ```ts
 auth: WixConsumerAuthProvider({
+  visitorSource: "one-app",
+  metaSiteId: "<source-msid>",
   clientId: "<returned-public-client-id>",
   siteUrl: "<verified-source-website-publicUrl>",
   redirectUri: "<returned-registered-app-redirect-uri>",
@@ -427,8 +447,9 @@ The site URL comes from the verified `website.publicUrl` in the collected Busine
 context or an existing verified binding; `site client ensure` does not return it.
 Keep visitor/member gates from the reconstruction plan and resolve a missing site
 URL against the auth contract instead of shipping a template URL. Verify that the
-built app uses the intended client and the exact registered redirect. The public
-client ID is app configuration; the collection credential is not.
+built app reads the intended site (and, with a client, uses the exact registered
+redirect). The MetaSite and a public client ID are app configuration; the collection
+credential is not.
 
 Use `--write-provisioning <path>` only when a valid adoption manifest already
 exists, including its identity, branding and installed verticals. That option

package/guides/wix-api-usage.md

@@ -65,11 +65,11 @@ export default defineApp({
   // …
   auth: WixConsumerAuthProvider({
     clientId: "4f58d461-…",   // the site's headless clientId — THIS is the site binding
-                              // (metaSiteId is implied by it; there is no separate field)
+                              // (metaSiteId is implied by it; `metaSiteId` is only for one-app mode below)
     siteUrl: "https://<site>.wixsite.com/<slug>",
-    redirectUri: "himalaya-<app>://oauth/callback",  // REQUIRED — the provider throws
+    redirectUri: "himalaya-<app>://oauth/callback",  // REQUIRED with a clientId — the provider throws
                               // "WixConsumerAuthProvider: redirectUri is required." without it,
-                              // even when bootAsVisitor is true (the check fires unconditionally).
+                              // even when bootAsVisitor is true.
                               // Use your app's URL scheme; the scaffolds ship this exact shape.
     bootAsVisitor: true,      // mint an anonymous visitor token at boot
   }),
@@ -85,6 +85,28 @@ members, etc. Scope is **visitor**: reads a site exposes anonymously work; owner
 live at `@himalaya/wix-auth` in-repo / `@wix/himalaya/wix-auth` off-repo — `himi sdk` lists the runtime
 data clients, not these config-time providers).
 
+**No OAuth client on the site? Bind by MetaSite instead (`visitorSource: "one-app"`).** A Headless
+OAuth client can only be created by the site's owner. An app migrated from a Branded One App reads its
+site the way that app's visitors already do — the site's **One App visitor signed instance** — so it
+needs no client and creates nothing on the site:
+
+```ts
+auth: WixConsumerAuthProvider({
+  visitorSource: "one-app",
+  metaSiteId: "0c55162c-…",          // the site's MetaSite ID
+  siteUrl: "https://www.<site>.com/",
+  bootAsVisitor: true,
+}),
+```
+
+The instance comes from `GET apps.wix.com/_api/one-app-session-web/v3/businesses/<metaSiteId>/signed-instance?signed_instance_type=Visitor`
+(no credentials) and is sent as a bare `Authorization` header (`Bearer <instance>` is a 400). Native
+mints it directly; the browser cannot (no CORS), so the app's own origin mints it at `/v1/visitor/instance`;
+`himi run`, `render --live` and `test --record` mint it in Node. Each mint is a new visitor, so it is
+kept until its `validUntil` (~4h) and re-minted only once expired — a 401 on an unexpired instance is
+the endpoint's answer (members-only reads refuse every visitor). Scope is visitor: member sign-in still
+needs a `clientId` (+ `redirectUri`), which you may add beside it.
+
 Monorepo / native Branded Lite (env overrides, auth bake, shareable binary with icon/splash):
 [branded-lite-site-binding.md](branded-lite-site-binding.md).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1541.0",
+  "version": "0.1543.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "77f49a0fa384b30d68adfb678fda491e11084dd3f66b62764b113aaf"
+  "falconPackageHash": "09228c43934e4e9f2b68984330c9830359aca30af7bd2c96c0073572"
 }

package/templates/beauty-salon/tier5-src/himi-branded-lite-orders/index.ts

@@ -200,8 +200,11 @@ const memberKey = (member: { email: string; scope?: string }) => member.email ?
 let cacheWrite = Promise.resolve();
 const svc = defineBackendCollection("himiBrandedOrders", {
   restorePagesOnLoad: true,
+  // `nextCursor` and `filterOptions` are bound by himi_orders (pagination cursor, filter sheet), so they are
+  // seeded here: `himi validate --strict` refuses a binding the initial state cannot resolve.
   state: derive({ status: "loading", rows: [], identityLine: "", emptyText: "", isLoading: true,
-    notLoading: false, isErrored: false, notErrored: true, noEmpty: true, hideList: true, siteHint: "" }),
+    notLoading: false, isErrored: false, notErrored: true, noEmpty: true, hideList: true, siteHint: "",
+    nextCursor: "", filterOptions: [] }),
   source: {
     id: (row: OrderRow) => row.id,
     clearOnError: orderAccessDenied,

package/templates/branded-lite/tier5-src/himi-branded-lite-orders/index.ts

@@ -200,8 +200,11 @@ const memberKey = (member: { email: string; scope?: string }) => member.email ?
 let cacheWrite = Promise.resolve();
 const svc = defineBackendCollection("himiBrandedOrders", {
   restorePagesOnLoad: true,
+  // `nextCursor` and `filterOptions` are bound by himi_orders (pagination cursor, filter sheet), so they are
+  // seeded here: `himi validate --strict` refuses a binding the initial state cannot resolve.
   state: derive({ status: "loading", rows: [], identityLine: "", emptyText: "", isLoading: true,
-    notLoading: false, isErrored: false, notErrored: true, noEmpty: true, hideList: true, siteHint: "" }),
+    notLoading: false, isErrored: false, notErrored: true, noEmpty: true, hideList: true, siteHint: "",
+    nextCursor: "", filterOptions: [] }),
   source: {
     id: (row: OrderRow) => row.id,
     clearOnError: orderAccessDenied,

package/templates/gym-fitness/tier5-src/himi-branded-lite-orders/index.ts

@@ -200,8 +200,11 @@ const memberKey = (member: { email: string; scope?: string }) => member.email ?
 let cacheWrite = Promise.resolve();
 const svc = defineBackendCollection("himiBrandedOrders", {
   restorePagesOnLoad: true,
+  // `nextCursor` and `filterOptions` are bound by himi_orders (pagination cursor, filter sheet), so they are
+  // seeded here: `himi validate --strict` refuses a binding the initial state cannot resolve.
   state: derive({ status: "loading", rows: [], identityLine: "", emptyText: "", isLoading: true,
-    notLoading: false, isErrored: false, notErrored: true, noEmpty: true, hideList: true, siteHint: "" }),
+    notLoading: false, isErrored: false, notErrored: true, noEmpty: true, hideList: true, siteHint: "",
+    nextCursor: "", filterOptions: [] }),
   source: {
     id: (row: OrderRow) => row.id,
     clearOnError: orderAccessDenied,

package/templates/portfolio-creative/tier5-src/himi-branded-lite-orders/index.ts

@@ -200,8 +200,11 @@ const memberKey = (member: { email: string; scope?: string }) => member.email ?
 let cacheWrite = Promise.resolve();
 const svc = defineBackendCollection("himiBrandedOrders", {
   restorePagesOnLoad: true,
+  // `nextCursor` and `filterOptions` are bound by himi_orders (pagination cursor, filter sheet), so they are
+  // seeded here: `himi validate --strict` refuses a binding the initial state cannot resolve.
   state: derive({ status: "loading", rows: [], identityLine: "", emptyText: "", isLoading: true,
-    notLoading: false, isErrored: false, notErrored: true, noEmpty: true, hideList: true, siteHint: "" }),
+    notLoading: false, isErrored: false, notErrored: true, noEmpty: true, hideList: true, siteHint: "",
+    nextCursor: "", filterOptions: [] }),
   source: {
     id: (row: OrderRow) => row.id,
     clearOnError: orderAccessDenied,

package/templates/retail-store/tier5-src/himi-branded-lite-orders/index.ts

@@ -200,8 +200,11 @@ const memberKey = (member: { email: string; scope?: string }) => member.email ?
 let cacheWrite = Promise.resolve();
 const svc = defineBackendCollection("himiBrandedOrders", {
   restorePagesOnLoad: true,
+  // `nextCursor` and `filterOptions` are bound by himi_orders (pagination cursor, filter sheet), so they are
+  // seeded here: `himi validate --strict` refuses a binding the initial state cannot resolve.
   state: derive({ status: "loading", rows: [], identityLine: "", emptyText: "", isLoading: true,
-    notLoading: false, isErrored: false, notErrored: true, noEmpty: true, hideList: true, siteHint: "" }),
+    notLoading: false, isErrored: false, notErrored: true, noEmpty: true, hideList: true, siteHint: "",
+    nextCursor: "", filterOptions: [] }),
   source: {
     id: (row: OrderRow) => row.id,
     clearOnError: orderAccessDenied,