@wix/himalaya-cli 0.1583.0 → 0.1585.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/dev-server/src/app-module.d.ts

@@ -186,6 +186,11 @@ export interface DerivedAppMeta {
     /** `provisioning.json` `installedVerticals` — the site's verticals, which decide which Wix
      *  notification destinations a derived route table covers. Read from disk at load time. */
     installedVerticals?: string[];
+    /** `provisioning.json` `siteId` when it is a real metaSiteId (`himi site create
+     *  --write-provisioning` / `himi site analyze --apply` write one; the dev placeholder
+     *  `development-site` is not). Resolves a frog `mobileAppId` template such as Branded Lite's
+     *  `brandedLite_{msid}`: the binary is bound by its Headless clientId and holds no msid. */
+    provisionedMsid?: string;
     /** Forwarded from AppConfig.control for the OTA app-config channel. */
     control?: import("@wix/himalaya/core").AppControl;
     /** Forwarded from AppConfig.appLinkHosts for the OTA app-config channel. */
@@ -287,8 +292,6 @@ export interface DerivedAppMeta {
     /** Android App-Links identity for /.well-known/assetlinks.json. */
     androidAssetLinks?: import("@wix/himalaya/core").AndroidAssetLinks;
 }
-/** `platforms` is the app's parsed `platforms.json` (RFC 0051 surface envelope), and
- *  `provisioning` the facts read from its `provisioning.json`. Both are passed IN rather than
- *  read here because this module is types-only by design — the readers live in loader.ts and
- *  provisioning-facts.ts, which already touch the filesystem. */
+/** A Wix metaSiteId is a UUID; anything else in `provisioning.json` is a placeholder. */
+export declare function isMetaSiteId(v: unknown): v is string;
 export declare function deriveAppMeta(name: string, m: AppDevModule, platforms?: Record<string, boolean>, provisioning?: import("./provisioning-facts.js").ProvisioningFacts): DerivedAppMeta;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/bindings.d.ts

@@ -1,5 +1,5 @@
 /** Every sigil the platform understands, without the leading `$`. */
-export declare const BINDING_SIGILS: readonly ["service", "flag", "item", "t"];
+export declare const BINDING_SIGILS: readonly ["service", "flag", "item", "t", "app"];
 export type BindingSigil = (typeof BINDING_SIGILS)[number];
 /**
  * Matches any binding expression by its leading sigil.
@@ -12,11 +12,12 @@ export type BindingSigil = (typeof BINDING_SIGILS)[number];
  * are long enough for that collision to be implausible; one letter is not, and the
  * token grammar is always `$t:<key>` anyway.
  *
- * RFC 0074's `$app:` is deliberately NOT in this list yet. Every renderer gates on it (web
- * `isBinding`, RN), and none resolves `$app:` until the runtime arms land (S3/S5/S7): adding it here
- * alone made web/RN blank a field's literal sibling while iOS/Android printed it. It joins with the
- * resolvers, all surfaces at once. Until then `isAppBinding` / `parseAppBinding` below are the
- * validator's grammar, and the per-app gate keeps `$app:` out of served content.
+ * RFC 0074's `$app:` joined with S7 (#4640), the last runtime resolver arm: iOS/Android
+ * learned it in S3/S5 and the web renderer resolves it now, so every surface treats it as a
+ * binding at once. It needs its COLON for the same reason `t` does — the grammar is always
+ * `$app:<svc>.<path>`, and `\b` after `app` would capture a literal `"$app store"` and blank
+ * it. React Native deliberately has no `$app:` resolver (RFC 0074 §12): there the binding
+ * fails open to the field's literal sibling, exactly like an unbooted worker.
  */
 export declare const BINDING_SIGIL_RE: RegExp;
 /** Is this value a binding rather than a literal? */

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/wix-sdk/blog-v3/src/extensions.d.ts

@@ -6,6 +6,8 @@ export declare function getDraftPost(postId: string, options?: WixCallOptions):
  * list projection (no body), so the body-bearing fields live here on the read
  * shape `getPost` returns once the body fieldsets are requested. */
 export interface WixPostWithContent extends WixPost {
+    /** Legacy Comments resource ID. Present when INTERNAL_ID was requested. */
+    internalId?: string;
     /** Ricos rich-content body (opaque JSON). Present only when RICH_CONTENT was requested. */
     richContent?: WixRichContent;
     /** Plain-text rendering of the body. Present only when CONTENT_TEXT was requested. */

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/wix-sdk/comments-v1/src/extensions.d.ts

@@ -29,7 +29,9 @@ type BlogCommentLike = {
 /** A created or listed comment as the blog screen's row. Accepts the curated and the auto-tier
  *  (`comments.createComment`) response shapes alike — both are the same REST wire object. */
 export declare function blogCommentRow(comment: BlogCommentLike | undefined): WixBlogCommentRow;
+/** `postId` is Blog v3 `post.internalId` (request INTERNAL_ID), not its navigation UUID. */
 export declare function createBlogComment(postId: string, text: string): Promise<WixBlogCommentRow>;
+/** First Comments page for Blog v3 `post.internalId`, not its navigation UUID. */
 export declare function listBlogComments(postId: string): Promise<WixBlogCommentRow[]>;
 /** The appId Wix Groups registers as its comments provider. Same value as
  *  GROUPS_APP_ID/GROUPS_APP_DEF_ID used elsewhere in this repo (social-feed's

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/wix-sdk/events/src/index.d.ts

@@ -126,6 +126,9 @@ export interface WixQueryEventsOptions {
     limit?: number;
     /** Page offset. */
     offset?: number;
+    /** Extra Events v3 fieldsets to read with each row (see {@link WixEventFieldset}), as
+     *  {@link getEvent} takes. Omitted → the default fieldset, and the request is unchanged. */
+    fields?: WixEventFieldset[];
     /** Status filter (e.g. `["UPCOMING"]`), matched exactly against each row's `eventStatus`.
      * Omitted → all statuses returned; a value no row carries selects nothing.
      *

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/wix-sdk/groups/src/extensions.d.ts

@@ -16,6 +16,21 @@ export declare function queryGroups(req?: WixGroupsQueryRequest, opts?: WixCallO
  * public group.
  */
 export declare function getGroup(id: string, opts?: WixCallOptions): Promise<WixGroup>;
+export interface WixGroupRule {
+    title?: string;
+    description?: string;
+}
+export interface WixListGroupRulesResponse {
+    rules?: WixGroupRule[];
+}
+/**
+ * List a group's community rules — GET /social-groups/v2/rules/{groupId}.
+ *
+ * @scope visitor — a Visitor read of a public group returned 200 with `{ rules: [] }`
+ * (2026-11-05). Whether a private/secret group's rules are visible to a non-member
+ * is unconfirmed — needsLiveProbe. A group with no rules answers an empty `rules`.
+ */
+export declare function listRules(groupId: string, opts?: WixCallOptions): Promise<WixListGroupRulesResponse>;
 export interface WixGroupCoverImage {
     /** A previously-uploaded Wix Media file id (from site-media generate-upload-url + PUT). */
     mediaId?: string;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/wix-sdk/loyalty/src/extensions.d.ts

@@ -1,3 +1,4 @@
+import { type WixCallOptions } from "./index.js";
 export interface LoyaltyOverview {
     balance?: number;
     earned?: number;
@@ -41,3 +42,15 @@ export interface LoyaltyDashboardResponse {
 /** Loyalty BFF dashboard — program status + points overview + customers page.
  *  GET /v1/loyalty-dashboard?limit=N. User-instance authed (auto-attached). */
 export declare function getLoyaltyBffDashboard(limit?: number): Promise<LoyaltyDashboardResponse>;
+/** Read the authenticated member's own Loyalty account; no customer ID is accepted.
+ * Source contract: loyalty-v1.getCurrentMemberAccount. Anonymous visitors are refused.
+ * A signed-in customer recording is still required for migration acceptance.
+ * @scope member
+ */
+export declare function getCurrentMemberLoyaltyAccount(readOptions?: WixCallOptions): Promise<{
+    account?: {
+        points?: {
+            balance?: number;
+        };
+    };
+}>;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/wix-sdk/members-v1/src/index.d.ts

@@ -34,6 +34,11 @@ export interface WixPaging {
 export interface WixMembersQuery {
     filter?: Record<string, unknown>;
     paging?: WixPaging;
+    /** REST Query's wire name is `sorting`; `sort` remains for existing callers. */
+    sorting?: Array<{
+        fieldName: string;
+        order?: "ASC" | "DESC";
+    }>;
     sort?: unknown[];
 }
 export interface WixMemberImage {
@@ -77,10 +82,16 @@ export interface WixMembersMetadata {
     count?: number;
     offset?: number;
     total?: number;
+    tooManyToCount?: boolean;
 }
 export interface WixQueryMembersRequest {
     query?: WixMembersQuery;
     fieldsets?: string[];
+    /** Branded directory search uses these public member fields, on the server. */
+    search?: {
+        expression: string;
+        fields?: string[];
+    };
 }
 export interface WixQueryMembersResponse {
     members: WixMember[];
@@ -177,8 +188,11 @@ export interface WixActivityCounter {
     /** The app the counters belong to (match against MEMBERS_FOLLOWERS_APP_ID). */
     appId?: string;
     memberId?: string;
-    /** Per-key counters, e.g. { followerCount: { count }, followingCount: { count } }. */
-    counters?: Record<string, {
+    /** Branded's REST wire shape is a keyed array. Keep the older map shape readable too. */
+    counters?: Array<{
+        key?: string;
+        count?: number;
+    }> | Record<string, {
         count?: number;
     }>;
 }
@@ -198,8 +212,9 @@ export interface WixMyConnectionsResponse {
     connectedMembers?: WixMemberConnection[];
 }
 /** Followers / following totals for a member — POST
- *  /members/v1/activity-counters/query. Parses the Followers-app counter entry;
- *  defaults each total to 0 when absent. May 403 → caller should default. */
+ *  /members/v1/activity-counters/query. Requires explicit nonnegative safe integer
+ *  totals for this member's Followers-app entry. Missing/invalid totals reject,
+ *  as do permission failures; callers should hide unavailable counts, never invent zero. */
 export declare function getFollowCounts(memberId: string, options?: WixCallOptions): Promise<WixFollowCounts>;
 /** Whether the signed-in member follows `targetId` — POST
  *  /members/v3/followers/my/connections. Returns false on any miss. May 403 →

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/core.mjs

@@ -8378,8 +8378,8 @@ function isComponentAllowedForFamily(key, family) {
 }
 
 // ../../core/ts/src/bindings.ts
-var BINDING_SIGILS = ["service", "flag", "item", "t"];
-var COLON_SIGILS = /* @__PURE__ */ new Set(["t"]);
+var BINDING_SIGILS = ["service", "flag", "item", "t", "app"];
+var COLON_SIGILS = /* @__PURE__ */ new Set(["t", "app"]);
 var BINDING_SIGIL_RE = new RegExp(
   `^\\$(?:${BINDING_SIGILS.filter((s) => !COLON_SIGILS.has(s)).join("|")})\\b|^\\$(?:${[...COLON_SIGILS].join("|")}):`
 );

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/sdui.mjs

@@ -6950,8 +6950,8 @@ var WIDGET_VOCABULARY = {
 var WIDGET_COMPONENTS = new Set(Object.keys(WIDGET_VOCABULARY));
 
 // ../../core/ts/src/bindings.ts
-var BINDING_SIGILS = ["service", "flag", "item", "t"];
-var COLON_SIGILS = /* @__PURE__ */ new Set(["t"]);
+var BINDING_SIGILS = ["service", "flag", "item", "t", "app"];
+var COLON_SIGILS = /* @__PURE__ */ new Set(["t", "app"]);
 var BINDING_SIGIL_RE = new RegExp(
   `^\\$(?:${BINDING_SIGILS.filter((s) => !COLON_SIGILS.has(s)).join("|")})\\b|^\\$(?:${[...COLON_SIGILS].join("|")}):`
 );
@@ -9353,6 +9353,10 @@ function isFunctionsOnlyConfig(config) {
 function uiConfig(config) {
   return config ?? {};
 }
+var META_SITE_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isMetaSiteId(v) {
+  return typeof v === "string" && META_SITE_ID.test(v);
+}
 function deriveAppMeta(name, m, platforms = {}, provisioning = {}) {
   const config = m.config;
   return {
@@ -9367,6 +9371,7 @@ function deriveAppMeta(name, m, platforms = {}, provisioning = {}) {
     push: servedPush(config.push),
     ...config.push?.screens ? { pushScreens: config.push.screens } : {},
     ...provisioning.installedVerticals ? { installedVerticals: provisioning.installedVerticals } : {},
+    ...isMetaSiteId(provisioning.siteId) ? { provisionedMsid: provisioning.siteId } : {},
     control: config.control,
     appLinkHosts: config.appLinkHosts,
     permissionCopy: config.permissionCopy,
@@ -9486,6 +9491,7 @@ export {
   iconButton,
   image,
   isFunctionsOnlyConfig,
+  isMetaSiteId,
   label,
   labeledContent,
   lazyList,

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-comments.mjs

@@ -80,6 +80,9 @@ async function listBlogComments(postId) {
     "GET",
     `/comments/v1/comments/list-by-resource?${query}`
   );
+  if (!Array.isArray(response?.comments) && !(response?.comments == null && response?.pagingMetadata?.count === 0)) {
+    throw new Error("Blog comments response has no comment page");
+  }
   const rows = (response.comments ?? []).map((comment) => ({
     id: comment.id ?? "comment",
     authorName: commentAuthor(comment),

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-events.mjs

@@ -230,7 +230,9 @@ function normalizeEventAt(e, now) {
     id,
     title,
     day: date && !Number.isNaN(date.getTime()) ? String(date.getDate()) : title.slice(0, 1).toUpperCase(),
-    month: date && !Number.isNaN(date.getTime()) ? date.toLocaleString("en-US", { month: "short" }).toUpperCase() : "",
+    // From the fixed table, not `toLocaleString`: QuickJS (the watch engine) has no ECMA-402 and
+    // answers that call with the whole "11/10/2030, 12:00:00 PM" string.
+    month: date && !Number.isNaN(date.getTime()) ? MONTHS_SHORT[date.getMonth()].toUpperCase() : "",
     dateLine: eventWhen(e, now),
     // "Past" for a finished event, "" otherwise — the shared collection row prints it in the
     // meta line, so an event from last month no longer reads as current.
@@ -300,7 +302,7 @@ function eventStartMs(e) {
 async function queryEvents(opts = {}, readOptions) {
   const limit = opts.limit ?? opts.query?.paging?.limit ?? 50;
   const offset = opts.offset ?? opts.query?.paging?.offset ?? 0;
-  const res = await wixCall("POST", "/events/v3/events/query", { query: { ...opts.query, paging: { limit, offset } } }, readOptions);
+  const res = await wixCall("POST", "/events/v3/events/query", { query: { ...opts.query, paging: { limit, offset } }, ...opts.fields?.length ? { fields: opts.fields } : {} }, readOptions);
   let events = (res.events ?? []).map(decodeEvent);
   if (opts.statuses) {
     const wanted = new Set(opts.statuses);

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-groups.mjs

@@ -6,6 +6,10 @@ function getGroup(id, opts) {
   if (!id) throw new Error("getGroup: id is required");
   return wixCall("GET", `/social-groups-proxy/groups/v2/groups/${encodeURIComponent(id)}`, void 0, opts);
 }
+function listRules(groupId, opts) {
+  if (!groupId) throw new Error("listRules: groupId is required");
+  return wixCall("GET", `/social-groups/v2/rules/${encodeURIComponent(groupId)}`, void 0, opts);
+}
 function createGroup(group) {
   return wixCall("POST", "/social-groups-proxy/groups/v2/groups", { group });
 }
@@ -102,6 +106,7 @@ export {
   joinGroup,
   leaveGroup,
   listJoinGroupRequests,
+  listRules,
   queryGroups,
   queryMembers,
   rejectJoinGroupRequests,

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-loyalty.mjs

@@ -3,6 +3,9 @@ var LOYALTY_BFF = "https://apps.wix.com/loyalty/mobile-api/v1";
 function getLoyaltyBffDashboard(limit = 25) {
   return wixCall("GET", `${LOYALTY_BFF}/loyalty-dashboard?limit=${encodeURIComponent(String(limit))}`);
 }
+function getCurrentMemberLoyaltyAccount(readOptions) {
+  return wixCall("GET", "/loyalty-accounts/v1/accounts/my-account", void 0, readOptions);
+}
 
 // ../../stdlib/wix-sdk/loyalty/src/index.ts
 function wixCall(method, path, body, readOptions) {
@@ -40,6 +43,7 @@ function listLoyaltyEarningRules(readOptions) {
   return wixCall("GET", "/_api/loyalty-earning-rules/v1/earning-rules/rules", void 0, readOptions);
 }
 export {
+  getCurrentMemberLoyaltyAccount,
   getLoyaltyBffDashboard,
   getLoyaltyProgram,
   listLoyaltyEarningRules,

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-members.mjs

@@ -84,10 +84,17 @@ async function getFollowCounts(memberId, options) {
     { query: { filter: { memberId: { $in: [memberId] } } } },
     options
   );
-  const entry = (res.activityCounters ?? []).find((c) => c.appId === MEMBERS_FOLLOWERS_APP_ID);
+  const entry = (res.activityCounters ?? []).find((c) => c.appId === MEMBERS_FOLLOWERS_APP_ID && c.memberId === memberId);
+  const counters = entry?.counters;
+  const value = (key) => Array.isArray(counters) ? counters.find((counter) => counter?.key === key)?.count : counters?.[key]?.count;
+  const followers = value("followerCount");
+  const following = value("followingCount");
+  if (typeof followers !== "number" || !Number.isSafeInteger(followers) || followers < 0 || typeof following !== "number" || !Number.isSafeInteger(following) || following < 0) {
+    throw new Error("getFollowCounts: explicit member totals are unavailable");
+  }
   return {
-    followers: entry?.counters?.followerCount?.count ?? 0,
-    following: entry?.counters?.followingCount?.count ?? 0
+    followers,
+    following
   };
 }
 async function isFollowingMember(targetId) {