@wix/himalaya-cli 0.1569.0 → 0.1571.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/dev-server/src/l10n-strings.d.ts

@@ -50,8 +50,9 @@ export interface L10nStringFinding {
 export declare function collectDescriptorStrings(descriptor: unknown, options?: {
     /**
      * Values the app has DECLARED as copy (its `strings/<locale>.json` table), for which
-     * the "has a letter" rule of `isUserVisibleCopy` is waived — and only that rule: the
-     * binding/id/url/hex/length filters still apply. Exists for letterless copy — a phone
+     * the "has a letter" and lowercase-word heuristics are waived: a declared unit
+     * such as "member" is copy despite looking like an id. Binding/id/url/hex/length
+     * filters still apply, and only copy fields are collected. Exists for letterless copy — a phone
      * or number format such as "+1 555 0100" has no letter, so the heuristic calls it
      * noise, and the extractor dropped `reserve.phonePlaceholder` (#3320). Only exact
      * table values qualify, so an arbitrary "4.8" in sample data stays out.

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/define-app.d.ts

@@ -229,6 +229,14 @@ export interface AppConfig {
      * omitted. Must satisfy `capabilities ⊆ capabilityEnvelope`.
      */
     capabilityEnvelope?: Capability[];
+    /**
+     * For a shell that `himi dist` builds other apps from: the capabilities such a build STARTS from,
+     * instead of this config's own `capabilities`. The build adds what the release declares, so a
+     * customer's binary carries this base plus its own opt-ins, not every feature the shell's
+     * reference app has. Must list what the shell's boot needs and what a build cannot add
+     * (`distAddRefusal`). A local build of the shell still uses `capabilities`.
+     */
+    capabilityBase?: Capability[];
     /**
      * Per-capability permission prompt copy — the sentence the OS shows when the app asks for
      * camera, location, photos, … (iOS usage strings). Served on app-config, so `himi dist` bakes

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/auth-providers/wix/src/index.d.ts

@@ -128,5 +128,12 @@ export interface WixNativeAuthConfig {
      *  active site (`HostIdentity`) and show no login of its own. Run standalone, the app keeps this
      *  provider and its login, unchanged. Baked into auth.json by tools/auth-bake. */
     hostProvided?: boolean;
+    /** #4655 — OWNER mode only. On the first launch after this app replaced an older one IN PLACE
+     *  (same bundle id / applicationId and signing identity), adopt — once — a live Wix session the
+     *  previous app left in the platform cookie jars (iOS `HTTPCookieStorage.shared`, Android WebView
+     *  `CookieManager`), so the upgrading owner lands signed in. A dead session falls through to the
+     *  login gate; a Himi sign-out is never undone by it. Refused in consumer and account mode.
+     *  See docs/wix-authentication.md → "Adopting a legacy session on an in-place upgrade". */
+    adoptLegacySession?: boolean;
 }
 export declare function WixNativeAuthProvider(config: WixNativeAuthConfig): AuthProvider;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/flows/screens/src/business-contact-service.d.ts

@@ -0,0 +1,17 @@
+export interface BusinessContactServiceOptions {
+    service?: string;
+    /** Must read an allowed, site-bound public total. Never use a preview/page length. */
+    loadMemberCount?: () => Promise<unknown>;
+}
+/** Shared worker half of businessContactSection. The caller supplies its allowed count read. */
+export declare function createBusinessContactService(opts?: BusinessContactServiceOptions): import("@wix/himalaya/state", { with: { "resolution-mode": "import" } }).ServiceHandle<any> & {
+    load: (arg?: {
+        showMemberCount?: boolean;
+        memberCount?: number;
+    }) => Promise<any>;
+    open: (arg?: {
+        kind?: string;
+        value?: string;
+        failureLabel?: string;
+    }) => Promise<any>;
+};

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/flows/screens/src/business-contact.d.ts

@@ -0,0 +1,73 @@
+/** Public, build-time business evidence. Coordinates describe the business, never the device. */
+export interface BusinessContact {
+    address?: string;
+    phone?: string;
+    email?: string;
+    website?: string;
+    description?: string;
+    isPhysical?: boolean;
+    coordinates?: {
+        latitude: number;
+        longitude: number;
+    };
+}
+export interface BusinessContactSettings {
+    isBusinessProfile?: boolean;
+    isAddressVisible?: boolean;
+    showMap?: boolean;
+    isPhoneVisible?: boolean;
+    isWebSiteLinkVisible?: boolean;
+    isEmailVisible?: boolean;
+    isDescriptionVisible?: boolean;
+    isGetInTouchVisible?: boolean;
+    getInTouchTitle?: string;
+    getInTouchDescription?: string;
+    getInTouchButton?: string;
+}
+export interface BusinessContactCopy {
+    title: string;
+    message: string;
+    directions: string;
+    unavailable: string;
+    memberCountUnavailable: string;
+    member: string;
+    members: string;
+}
+export interface BusinessContactOptions {
+    id?: string;
+    contact?: BusinessContact;
+    /** Raw One App contact settings, including the Business Profile discriminator when applicable. */
+    settings?: BusinessContactSettings;
+    copy?: Partial<BusinessContactCopy>;
+    service?: string;
+    /** Omit when this app has no business-chat destination. The chat owns its normal auth flow. */
+    chatScreenId?: string;
+    /** Present a source-requested count. False keeps copy extractable in a hidden fragment. */
+    showMemberCount?: boolean;
+}
+/** Optional build-time source evidence shared by a provisioned app and a migration recipe. */
+export interface BusinessContactContent {
+    contact?: BusinessContact;
+    settings?: BusinessContactSettings;
+    showMemberCount?: boolean;
+    /** Public source total, when collected. Missing is unknown, not zero. */
+    memberCount?: number;
+}
+type Node = {
+    id: string;
+    body: {
+        package: string;
+        type: string;
+        props: Record<string, unknown>;
+    };
+    modifiers?: Record<string, unknown>;
+};
+/** Mirrors mapContactUsSettingsByApp: empty normal settings get defaults; partial settings do not. */
+export declare function businessContactSettings(source?: BusinessContactSettings): BusinessContactSettings;
+/** Return only a complete, finite physical business point, preserving valid zero coordinates. */
+export declare function businessContactPoint(contact: BusinessContact): BusinessContact["coordinates"];
+/** Typed link inputs, shared by the descriptor and worker. No arbitrary source URL or scheme dispatch. */
+export declare function businessContactLink(kind: string, value: unknown): string;
+/** A content section made of standard primitives. Native shells own navigation bars and bottom tabs. */
+export declare function businessContactSection(opts?: BusinessContactOptions): Node;
+export {};

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/flows/screens/src/index.d.ts

@@ -1,3 +1,6 @@
+export * from "./business-contact.js";
+export * from "./business-contact-service.js";
+export * from "./invite.js";
 import { entitlement } from "@wix/himalaya/checkout";
 type Node = Record<string, any>;
 /** An action shown by `detailedHeader`. */

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/flows/screens/src/invite-target.d.ts

@@ -0,0 +1 @@
+export declare function inviteTarget(identity: string): string;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/flows/screens/src/invite.d.ts

@@ -0,0 +1,148 @@
+/** Resolved for the current app/site. A website URL is not an invitation.
+ * Use the source invite response or a verified published target-app link. */
+export interface InviteMetadata {
+    showInviteButton: boolean;
+    /** Collected manifest.source.metaSiteId. The bound Wix transport mints the
+     * site's instance; this recipe never supplies credentials. */
+    businessId?: string;
+    url?: string;
+    text?: string;
+    subject?: string;
+}
+export interface InviteControlOptions {
+    id?: string;
+    service?: string;
+    label?: string;
+}
+/** Native action opens the shared flow. The nav worker owns its visibility;
+ * the screen worker owns login and sharing. Register the same ID/binding in
+ * topBarDefault and any complete screen override that shows this action. */
+export declare function inviteAction(opts: InviteControlOptions & {
+    screenId: string;
+}): {
+    id: string;
+    icon: string;
+    label: string;
+    accessibilityLabel: string;
+    hiddenPath: string;
+    onTap: {
+        actionId: string;
+        params: {
+            screenId: string;
+        };
+    };
+};
+/** Standard Share button inside the screen that owns createInviteService. */
+export declare function inviteButton(opts?: InviteControlOptions): {
+    id: string;
+    body: {
+        package: string;
+        type: string;
+        props: {
+            title: string;
+            style: string;
+            fullWidth: boolean;
+            action: {
+                actionId: string;
+            };
+        };
+    };
+    modifiers: {
+        hiddenPath: string;
+    };
+};
+/** Shared source-style Invite modal/page, using ordinary native navigation. */
+export declare function inviteScreen(opts: {
+    screenId: string;
+    bundleUrl: string;
+    service?: string;
+    title?: string;
+    shareLabel?: string;
+}): {
+    screenId: string;
+    renderer: string;
+    title: string;
+    schemaVersion: number;
+    cacheControl: {
+        maxAge: number;
+        staleWhileRevalidate: number;
+    };
+    topBar: {
+        actions: any[];
+    };
+    logicBundle: {
+        url: string;
+        integrity: string;
+        declaredCapabilities: string[];
+    };
+    payload: {
+        id: string;
+        body: {
+            package: string;
+            type: string;
+            props: {
+                spacing: number;
+                alignment: string;
+                children: ({
+                    id: string;
+                    body: {
+                        package: string;
+                        type: string;
+                        props: {
+                            title: string;
+                            style: string;
+                            fullWidth: boolean;
+                            action: {
+                                actionId: string;
+                            };
+                        };
+                    };
+                    modifiers: {
+                        hiddenPath: string;
+                    };
+                } | {
+                    id: string;
+                    body: {
+                        package: string;
+                        type: string;
+                        props: {
+                            text: string;
+                            style: string;
+                        };
+                    };
+                })[];
+            };
+        };
+    };
+};
+export interface InviteSourceOptions {
+    service?: string;
+    /** Read current bound metadata; never use route parameters as a share target. */
+    source: () => InviteMetadata | undefined | Promise<InviteMetadata | undefined>;
+}
+export interface InviteServiceOptions extends InviteSourceOptions {
+    /** Existing shared consumer sign-in screen, linked in navigation. It must forward
+     * the host continuation token with signInDirect/registerDirect. */
+    signInScreenId: string;
+}
+interface InviteState {
+    hidden: boolean;
+    error: string;
+}
+/** Read-only native action visibility. Mount in navLogicBundle; never creates
+ * an invitation, opens login, or consumes a pending screen-owned intent. */
+export declare function createInviteAvailabilityService(opts: InviteSourceOptions): import("@wix/himalaya/state", { with: { "resolution-mode": "import" } }).ServiceHandle<{
+    hidden: boolean;
+}> & {
+    load: (...args: never[]) => Promise<{
+        hidden: boolean;
+    }>;
+};
+/** Screen-owned Invite flow. Only an explicit Share tap or its once-consumed,
+ * host-confirmed login continuation can create an invitation. Ordinary loads,
+ * routes, hydration and native action visibility never authorize a write. */
+export declare function createInviteService(opts: InviteServiceOptions): import("@wix/himalaya/state", { with: { "resolution-mode": "import" } }).ServiceHandle<InviteState> & {
+    load: (...args: never[]) => Promise<InviteState>;
+    invite: (...args: never[]) => Promise<InviteState>;
+};
+export {};

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/wix-sdk/blog-v3/src/extensions.d.ts

@@ -34,11 +34,12 @@ export interface WixGetPostRequest {
  * but a body-less 200 was never the "body preserved whenever the backend is
  * healthy" the earlier comment claimed; the body was simply never requested.)
  *
- * On any rejection (network / backend error) we still fall back to a queryPosts
+ * On network / backend rejection we still fall back to a queryPosts
  * filter-by-id — a graceful degrade to the LIST projection (no body) that keeps
  * blog detail + saved screens rendering instead of erroring out. `queryPosts`'s
  * request type has no `fieldsets` field, so that fallback path cannot carry the
- * body.
+ * body. Detail readers can opt into `preserveAccessErrors` to keep HTTP 401/403
+ * refusals instead of a public metadata fallback; default callers are unchanged.
  *
  * When that fallback ALSO finds nothing — a deleted post, or one this visitor
  * may not see — we reject rather than resolve. `WixGetPostResponse.post`
@@ -50,7 +51,9 @@ export interface WixGetPostRequest {
  * `catch`, or an `allSettled` filter), so rejecting is what routes them into the
  * graceful degrade they already implement. The originating failure travels as
  * `cause`, so the 404-vs-network distinction is not lost. */
-export declare function getPost(postId: string, req?: WixGetPostRequest, readOptions?: WixCallOptions): Promise<WixGetPostResponse>;
+export declare function getPost(postId: string, req?: WixGetPostRequest, readOptions?: WixCallOptions & {
+    preserveAccessErrors?: boolean;
+}): Promise<WixGetPostResponse>;
 export interface WixBlogCategory {
     id: string;
     label?: string;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/auth.mjs

@@ -74,6 +74,21 @@ function matchesType(type, value) {
       return true;
   }
 }
+var AUTHORED_PATTERN_LIMIT = 64;
+var authoredPatterns = /* @__PURE__ */ new Map();
+function authoredPattern(pattern) {
+  const known = authoredPatterns.get(pattern);
+  if (known !== void 0) return known;
+  let re;
+  try {
+    re = new RegExp(`^(?:${pattern})$`);
+  } catch {
+    re = null;
+  }
+  if (authoredPatterns.size >= AUTHORED_PATTERN_LIMIT) authoredPatterns.delete(authoredPatterns.keys().next().value);
+  authoredPatterns.set(pattern, re);
+  return re;
+}
 function validate(rule, rawValue) {
   if (!rule) return null;
   const value = rawValue ?? "";
@@ -84,13 +99,8 @@ function validate(rule, rawValue) {
     return { rule: "type", type: rule.type };
   }
   if (rule.regex) {
-    let ok;
-    try {
-      ok = new RegExp(`^(?:${rule.regex})$`).test(value);
-    } catch {
-      ok = true;
-    }
-    if (!ok) return { rule: "regex" };
+    const re = authoredPattern(rule.regex);
+    if (re && !re.test(value)) return { rule: "regex" };
   }
   if (typeof rule.minLength === "number" && rule.minLength > 0 && value.length < rule.minLength) {
     return { rule: "minLength", limit: rule.minLength };

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/core/validation.mjs

@@ -112,6 +112,21 @@ function matchesType(type, value) {
       return true;
   }
 }
+var AUTHORED_PATTERN_LIMIT = 64;
+var authoredPatterns = /* @__PURE__ */ new Map();
+function authoredPattern(pattern) {
+  const known = authoredPatterns.get(pattern);
+  if (known !== void 0) return known;
+  let re;
+  try {
+    re = new RegExp(`^(?:${pattern})$`);
+  } catch {
+    re = null;
+  }
+  if (authoredPatterns.size >= AUTHORED_PATTERN_LIMIT) authoredPatterns.delete(authoredPatterns.keys().next().value);
+  authoredPatterns.set(pattern, re);
+  return re;
+}
 function validate(rule, rawValue) {
   if (!rule) return null;
   const value = rawValue ?? "";
@@ -122,13 +137,8 @@ function validate(rule, rawValue) {
     return { rule: "type", type: rule.type };
   }
   if (rule.regex) {
-    let ok;
-    try {
-      ok = new RegExp(`^(?:${rule.regex})$`).test(value);
-    } catch {
-      ok = true;
-    }
-    if (!ok) return { rule: "regex" };
+    const re = authoredPattern(rule.regex);
+    if (re && !re.test(value)) return { rule: "regex" };
   }
   if (typeof rule.minLength === "number" && rule.minLength > 0 && value.length < rule.minLength) {
     return { rule: "minLength", limit: rule.minLength };

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/core.mjs

@@ -9827,6 +9827,21 @@ function matchesType(type, value) {
       return true;
   }
 }
+var AUTHORED_PATTERN_LIMIT = 64;
+var authoredPatterns = /* @__PURE__ */ new Map();
+function authoredPattern(pattern) {
+  const known = authoredPatterns.get(pattern);
+  if (known !== void 0) return known;
+  let re;
+  try {
+    re = new RegExp(`^(?:${pattern})$`);
+  } catch {
+    re = null;
+  }
+  if (authoredPatterns.size >= AUTHORED_PATTERN_LIMIT) authoredPatterns.delete(authoredPatterns.keys().next().value);
+  authoredPatterns.set(pattern, re);
+  return re;
+}
 function validate(rule, rawValue) {
   if (!rule) return null;
   const value = rawValue ?? "";
@@ -9837,13 +9852,8 @@ function validate(rule, rawValue) {
     return { rule: "type", type: rule.type };
   }
   if (rule.regex) {
-    let ok;
-    try {
-      ok = new RegExp(`^(?:${rule.regex})$`).test(value);
-    } catch {
-      ok = true;
-    }
-    if (!ok) return { rule: "regex" };
+    const re = authoredPattern(rule.regex);
+    if (re && !re.test(value)) return { rule: "regex" };
   }
   if (typeof rule.minLength === "number" && rule.minLength > 0 && value.length < rule.minLength) {
     return { rule: "minLength", limit: rule.minLength };