@wix/himalaya-cli 0.1570.0 → 0.1572.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/define-app.d.ts

@@ -229,6 +229,14 @@ export interface AppConfig {
      * omitted. Must satisfy `capabilities ⊆ capabilityEnvelope`.
      */
     capabilityEnvelope?: Capability[];
+    /**
+     * For a shell that `himi dist` builds other apps from: the capabilities such a build STARTS from,
+     * instead of this config's own `capabilities`. The build adds what the release declares, so a
+     * customer's binary carries this base plus its own opt-ins, not every feature the shell's
+     * reference app has. Must list what the shell's boot needs and what a build cannot add
+     * (`distAddRefusal`). A local build of the shell still uses `capabilities`.
+     */
+    capabilityBase?: Capability[];
     /**
      * Per-capability permission prompt copy — the sentence the OS shows when the app asks for
      * camera, location, photos, … (iOS usage strings). Served on app-config, so `himi dist` bakes

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/auth-providers/wix/src/index.d.ts

@@ -128,5 +128,12 @@ export interface WixNativeAuthConfig {
      *  active site (`HostIdentity`) and show no login of its own. Run standalone, the app keeps this
      *  provider and its login, unchanged. Baked into auth.json by tools/auth-bake. */
     hostProvided?: boolean;
+    /** #4655 — OWNER mode only. On the first launch after this app replaced an older one IN PLACE
+     *  (same bundle id / applicationId and signing identity), adopt — once — a live Wix session the
+     *  previous app left in the platform cookie jars (iOS `HTTPCookieStorage.shared`, Android WebView
+     *  `CookieManager`), so the upgrading owner lands signed in. A dead session falls through to the
+     *  login gate; a Himi sign-out is never undone by it. Refused in consumer and account mode.
+     *  See docs/wix-authentication.md → "Adopting a legacy session on an in-place upgrade". */
+    adoptLegacySession?: boolean;
 }
 export declare function WixNativeAuthProvider(config: WixNativeAuthConfig): AuthProvider;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/wix-sdk/blog-v3/src/extensions.d.ts

@@ -34,11 +34,12 @@ export interface WixGetPostRequest {
  * but a body-less 200 was never the "body preserved whenever the backend is
  * healthy" the earlier comment claimed; the body was simply never requested.)
  *
- * On any rejection (network / backend error) we still fall back to a queryPosts
+ * On network / backend rejection we still fall back to a queryPosts
  * filter-by-id — a graceful degrade to the LIST projection (no body) that keeps
  * blog detail + saved screens rendering instead of erroring out. `queryPosts`'s
  * request type has no `fieldsets` field, so that fallback path cannot carry the
- * body.
+ * body. Detail readers can opt into `preserveAccessErrors` to keep HTTP 401/403
+ * refusals instead of a public metadata fallback; default callers are unchanged.
  *
  * When that fallback ALSO finds nothing — a deleted post, or one this visitor
  * may not see — we reject rather than resolve. `WixGetPostResponse.post`
@@ -50,7 +51,9 @@ export interface WixGetPostRequest {
  * `catch`, or an `allSettled` filter), so rejecting is what routes them into the
  * graceful degrade they already implement. The originating failure travels as
  * `cause`, so the 404-vs-network distinction is not lost. */
-export declare function getPost(postId: string, req?: WixGetPostRequest, readOptions?: WixCallOptions): Promise<WixGetPostResponse>;
+export declare function getPost(postId: string, req?: WixGetPostRequest, readOptions?: WixCallOptions & {
+    preserveAccessErrors?: boolean;
+}): Promise<WixGetPostResponse>;
 export interface WixBlogCategory {
     id: string;
     label?: string;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/wix-sdk/members-feed-viewer/src/index.d.ts

@@ -66,6 +66,12 @@ export interface MfvNotification {
 export declare function __resetMfvRouteForTests(): void;
 /** List the signed-in member's notifications, newest first. MOBILE channel. */
 export declare function queryNotifications(limit?: number, options?: WixCallOptions): Promise<MfvNotification[]>;
+/** Source member-app MOBILE/UNSEEN aggregate, capped at 100. Requires a bound
+ * single-site Member transport; old native binaries and web reject. A missing,
+ * malformed or failed result is unavailable, never an authoritative zero. */
+export declare function countUnseenNotifications(options: {
+    site: string;
+}): Promise<number>;
 /** Mark the given notification ids as READ (bulk, by-filter). */
 export declare function markRead(ids: string[]): Promise<void>;
 /** Mark ALL of the member's MOBILE notifications that aren't already READ as READ. */

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/auth.mjs

@@ -74,6 +74,21 @@ function matchesType(type, value) {
       return true;
   }
 }
+var AUTHORED_PATTERN_LIMIT = 64;
+var authoredPatterns = /* @__PURE__ */ new Map();
+function authoredPattern(pattern) {
+  const known = authoredPatterns.get(pattern);
+  if (known !== void 0) return known;
+  let re;
+  try {
+    re = new RegExp(`^(?:${pattern})$`);
+  } catch {
+    re = null;
+  }
+  if (authoredPatterns.size >= AUTHORED_PATTERN_LIMIT) authoredPatterns.delete(authoredPatterns.keys().next().value);
+  authoredPatterns.set(pattern, re);
+  return re;
+}
 function validate(rule, rawValue) {
   if (!rule) return null;
   const value = rawValue ?? "";
@@ -84,13 +99,8 @@ function validate(rule, rawValue) {
     return { rule: "type", type: rule.type };
   }
   if (rule.regex) {
-    let ok;
-    try {
-      ok = new RegExp(`^(?:${rule.regex})$`).test(value);
-    } catch {
-      ok = true;
-    }
-    if (!ok) return { rule: "regex" };
+    const re = authoredPattern(rule.regex);
+    if (re && !re.test(value)) return { rule: "regex" };
   }
   if (typeof rule.minLength === "number" && rule.minLength > 0 && value.length < rule.minLength) {
     return { rule: "minLength", limit: rule.minLength };

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/core/validation.mjs

@@ -112,6 +112,21 @@ function matchesType(type, value) {
       return true;
   }
 }
+var AUTHORED_PATTERN_LIMIT = 64;
+var authoredPatterns = /* @__PURE__ */ new Map();
+function authoredPattern(pattern) {
+  const known = authoredPatterns.get(pattern);
+  if (known !== void 0) return known;
+  let re;
+  try {
+    re = new RegExp(`^(?:${pattern})$`);
+  } catch {
+    re = null;
+  }
+  if (authoredPatterns.size >= AUTHORED_PATTERN_LIMIT) authoredPatterns.delete(authoredPatterns.keys().next().value);
+  authoredPatterns.set(pattern, re);
+  return re;
+}
 function validate(rule, rawValue) {
   if (!rule) return null;
   const value = rawValue ?? "";
@@ -122,13 +137,8 @@ function validate(rule, rawValue) {
     return { rule: "type", type: rule.type };
   }
   if (rule.regex) {
-    let ok;
-    try {
-      ok = new RegExp(`^(?:${rule.regex})$`).test(value);
-    } catch {
-      ok = true;
-    }
-    if (!ok) return { rule: "regex" };
+    const re = authoredPattern(rule.regex);
+    if (re && !re.test(value)) return { rule: "regex" };
   }
   if (typeof rule.minLength === "number" && rule.minLength > 0 && value.length < rule.minLength) {
     return { rule: "minLength", limit: rule.minLength };

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/core.mjs

@@ -9827,6 +9827,21 @@ function matchesType(type, value) {
       return true;
   }
 }
+var AUTHORED_PATTERN_LIMIT = 64;
+var authoredPatterns = /* @__PURE__ */ new Map();
+function authoredPattern(pattern) {
+  const known = authoredPatterns.get(pattern);
+  if (known !== void 0) return known;
+  let re;
+  try {
+    re = new RegExp(`^(?:${pattern})$`);
+  } catch {
+    re = null;
+  }
+  if (authoredPatterns.size >= AUTHORED_PATTERN_LIMIT) authoredPatterns.delete(authoredPatterns.keys().next().value);
+  authoredPatterns.set(pattern, re);
+  return re;
+}
 function validate(rule, rawValue) {
   if (!rule) return null;
   const value = rawValue ?? "";
@@ -9837,13 +9852,8 @@ function validate(rule, rawValue) {
     return { rule: "type", type: rule.type };
   }
   if (rule.regex) {
-    let ok;
-    try {
-      ok = new RegExp(`^(?:${rule.regex})$`).test(value);
-    } catch {
-      ok = true;
-    }
-    if (!ok) return { rule: "regex" };
+    const re = authoredPattern(rule.regex);
+    if (re && !re.test(value)) return { rule: "regex" };
   }
   if (typeof rule.minLength === "number" && rule.minLength > 0 && value.length < rule.minLength) {
     return { rule: "minLength", limit: rule.minLength };

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/screens.mjs

@@ -74,6 +74,21 @@ function matchesType(type, value) {
       return true;
   }
 }
+var AUTHORED_PATTERN_LIMIT = 64;
+var authoredPatterns = /* @__PURE__ */ new Map();
+function authoredPattern(pattern) {
+  const known = authoredPatterns.get(pattern);
+  if (known !== void 0) return known;
+  let re;
+  try {
+    re = new RegExp(`^(?:${pattern})$`);
+  } catch {
+    re = null;
+  }
+  if (authoredPatterns.size >= AUTHORED_PATTERN_LIMIT) authoredPatterns.delete(authoredPatterns.keys().next().value);
+  authoredPatterns.set(pattern, re);
+  return re;
+}
 function validate(rule, rawValue) {
   if (!rule) return null;
   const value = rawValue ?? "";
@@ -84,13 +99,8 @@ function validate(rule, rawValue) {
     return { rule: "type", type: rule.type };
   }
   if (rule.regex) {
-    let ok;
-    try {
-      ok = new RegExp(`^(?:${rule.regex})$`).test(value);
-    } catch {
-      ok = true;
-    }
-    if (!ok) return { rule: "regex" };
+    const re = authoredPattern(rule.regex);
+    if (re && !re.test(value)) return { rule: "regex" };
   }
   if (typeof rule.minLength === "number" && rule.minLength > 0 && value.length < rule.minLength) {
     return { rule: "minLength", limit: rule.minLength };

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/state.mjs

@@ -275,6 +275,21 @@ function matchesType(type, value) {
       return true;
   }
 }
+var AUTHORED_PATTERN_LIMIT = 64;
+var authoredPatterns = /* @__PURE__ */ new Map();
+function authoredPattern(pattern) {
+  const known = authoredPatterns.get(pattern);
+  if (known !== void 0) return known;
+  let re;
+  try {
+    re = new RegExp(`^(?:${pattern})$`);
+  } catch {
+    re = null;
+  }
+  if (authoredPatterns.size >= AUTHORED_PATTERN_LIMIT) authoredPatterns.delete(authoredPatterns.keys().next().value);
+  authoredPatterns.set(pattern, re);
+  return re;
+}
 function validate(rule, rawValue) {
   if (!rule) return null;
   const value = rawValue ?? "";
@@ -285,13 +300,8 @@ function validate(rule, rawValue) {
     return { rule: "type", type: rule.type };
   }
   if (rule.regex) {
-    let ok;
-    try {
-      ok = new RegExp(`^(?:${rule.regex})$`).test(value);
-    } catch {
-      ok = true;
-    }
-    if (!ok) return { rule: "regex" };
+    const re = authoredPattern(rule.regex);
+    if (re && !re.test(value)) return { rule: "regex" };
   }
   if (typeof rule.minLength === "number" && rule.minLength > 0 && value.length < rule.minLength) {
     return { rule: "minLength", limit: rule.minLength };

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-auth.mjs

@@ -1254,6 +1254,11 @@ function WixNativeAuthProvider(config) {
   if (config.mode !== "owner" && config.mode !== "consumer" && config.mode !== "account") {
     throw new Error('WixNativeAuthProvider: mode must be "owner", "consumer" or "account".');
   }
+  if (config.adoptLegacySession && config.mode !== "owner") {
+    throw new Error(
+      `WixNativeAuthProvider: adoptLegacySession is owner mode only (got mode "${config.mode}"): it adopts a Wix ACCOUNT session the previous app left in the platform cookie jars.`
+    );
+  }
   return {
     providerId: "wix-native",
     config: {
@@ -1266,7 +1271,8 @@ function WixNativeAuthProvider(config) {
       ...config.pxToken ? { pxToken: config.pxToken } : {},
       ...config.petriOverrides ? { petriOverrides: config.petriOverrides } : {},
       devMode: config.devMode ?? false,
-      ...config.hostProvided ? { hostProvided: true } : {}
+      ...config.hostProvided ? { hostProvided: true } : {},
+      ...config.adoptLegacySession ? { adoptLegacySession: true } : {}
     }
   };
 }

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-blog.mjs

@@ -15,6 +15,7 @@ function getPost(postId, req = {}, readOptions) {
     void 0,
     readOptions
   ).catch(async (cause) => {
+    if (readOptions?.preserveAccessErrors && /^HTTP\s*(?:401|403)\b/i.test(String(cause?.message ?? cause))) throw cause;
     if (readOptions?.cache || readOptions?.onCacheResult) throw cause;
     const resp = await queryPosts({ query: { filter: { id: postId } } }, readOptions);
     const post = resp.posts?.[0];

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-members-feed-viewer.mjs

@@ -61,6 +61,23 @@ async function queryNotifications(limit = 25, options) {
   );
   return res.viewerFeedNotifications ?? [];
 }
+async function countUnseenNotifications(options) {
+  const site = options?.site;
+  if (typeof site !== "string" || !/^[a-f\d]{8}-[a-f\d]{4}-[a-f\d]{4}-[a-f\d]{4}-[a-f\d]{12}$/i.test(site)) {
+    throw new Error("@himalaya/wix-members-feed-viewer: notification count requires its bound site");
+  }
+  const res = await wixCall(
+    "POST",
+    "https://apps.wix.com/_api/members-feed-viewer/v1/members-viewer-feed-notifications/count",
+    { filter: { channel: "MOBILE", status: "UNSEEN" }, maxCount: 100 },
+    { site }
+  );
+  const count = res?.count;
+  if (typeof count !== "number" || !Number.isSafeInteger(count) || count < 0 || count > 100) {
+    throw new Error("@himalaya/wix-members-feed-viewer: unavailable unseen notification count");
+  }
+  return count;
+}
 async function markRead(ids) {
   if (!ids.length) return;
   await mfvCall(
@@ -78,6 +95,7 @@ async function markAllRead() {
 }
 export {
   __resetMfvRouteForTests,
+  countUnseenNotifications,
   markAllRead,
   markRead,
   queryNotifications