@wix/himalaya-cli 0.1633.0 → 0.1634.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/wix-sdk/members-feed-viewer/src/index.d.ts

@@ -64,13 +64,17 @@ export interface MfvNotification {
 }
 /** Reset the learned route. Tests only — there is no runtime caller. */
 export declare function __resetMfvRouteForTests(): void;
-/** List the signed-in member's notifications, newest first. MOBILE channel. */
+/** List the signed-in member's notifications, newest first. MOBILE channel. Needs a Member
+ *  transport: a Visitor is refused (403) and an old native build refuses the route, so both
+ *  reject. The bound site is stamped by the host, so no site argument is needed. */
 export declare function queryNotifications(limit?: number, options?: WixCallOptions): Promise<MfvNotification[]>;
-/** Source member-app MOBILE/UNSEEN aggregate, capped at 100. Requires a bound
- * single-site Member transport; old native binaries and web reject. A missing,
- * malformed or failed result is unavailable, never an authoritative zero. */
-export declare function countUnseenNotifications(options: {
-    site: string;
+/** Source member-app MOBILE/UNSEEN aggregate, capped at 100. Needs a Member transport; old native
+ * binaries and web reject. A missing, malformed or failed result is unavailable, never an
+ * authoritative zero. The host fixes the business: a bound capability sends its own site, and the
+ * multi-tenant Player (no bound site) lets the Member credential decide. `site` is optional and only
+ * ever names the bound site: native refuses any other, and an unbound host refuses every named one. */
+export declare function countUnseenNotifications(options?: {
+    site?: string;
 }): Promise<number>;
 /** Mark the given notification ids as READ (bulk, by-filter). */
 export declare function markRead(ids: string[]): Promise<void>;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/wix-sdk/members-v1/src/index.d.ts

@@ -226,3 +226,37 @@ export declare function getFollowCounts(memberId: string, options?: WixCallOptio
  *  /members/v3/followers/my/connections. Returns false on any miss. May 403 →
  *  caller should default to false. */
 export declare function isFollowingMember(targetId: string): Promise<boolean>;
+/** When a member last opened the app, as the One App computes it: `unit` is "min", "hour" or "day", and `ts`
+ *  (epoch milliseconds, as a string) is there for a day count the One App prints as a date. */
+export interface WixMemberLastOpenApp {
+    amount?: number;
+    unit?: string;
+    ts?: string;
+}
+/** One member's activity from the One App members service. */
+export interface WixMemberActivity {
+    id: string;
+    /** Server role, e.g. "MEMBER". */
+    role?: string;
+    online: boolean;
+    /** `null` for a member who never opened the app. */
+    lastOpenApp: WixMemberLastOpenApp | null;
+}
+/** Role and last-active for up to 100 members by id — POST apps.wix.com/_api/members-one-app/api/members.
+ *  Public Members v1 carries neither: `lastLoginDate` is a login time and needs the owner-only FULL field
+ *  set. The One App service answers a Visitor with this, so a members list can show "Active 11h ago".
+ *  A member id the service does not know is left out of the answer.
+ *
+ *  Pinned One App member source, like the notification count: it needs a native runtime that allows this
+ *  one route for the bound business. Older native builds and web reject, so callers treat a rejection as
+ *  "no activity to show", never as an error in their own list.
+ *
+ * @scope visitor — a Visitor reads it as well as a signed-in member; the native runtime allows only the bound business's route. */
+export declare function queryMemberActivity(ids: string[]): Promise<WixMemberActivity[]>;
+/** Which of `targetIds` the signed-in member follows, in ONE call — POST
+ *  /members/v3/followers/my/connections. For a members list that shows a Follow control per row.
+ *  A Visitor gets an empty answer (no connections), so nothing here needs a sign-in; callers still
+ *  skip the call for a Visitor.
+ *
+ * @scope visitor — an anonymous visitor session is enough; it answers an empty list when nobody is signed in. */
+export declare function listFollowedMembers(targetIds: string[]): Promise<string[]>;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-members-feed-viewer.mjs

@@ -46,10 +46,11 @@ async function mfvCall(method, suffix, body, options) {
     }
   }
 }
+var APPS_WIX = "https://apps.wix.com/_api/members-feed-viewer/v1";
 async function queryNotifications(limit = 25, options) {
-  const res = await mfvCall(
+  const res = await wixCall(
     "POST",
-    "/members-viewer-feed-notifications/query",
+    `${APPS_WIX}/members-viewer-feed-notifications/query`,
     {
       query: {
         cursorPaging: { limit },
@@ -59,18 +60,18 @@ async function queryNotifications(limit = 25, options) {
     },
     options
   );
-  return res.viewerFeedNotifications ?? [];
+  return res?.viewerFeedNotifications ?? [];
 }
 async function countUnseenNotifications(options) {
   const site = options?.site;
-  if (typeof site !== "string" || !/^[a-f\d]{8}-[a-f\d]{4}-[a-f\d]{4}-[a-f\d]{4}-[a-f\d]{12}$/i.test(site)) {
-    throw new Error("@himalaya/wix-members-feed-viewer: notification count requires its bound site");
+  if (site !== void 0 && (typeof site !== "string" || !/^[a-f\d]{8}-[a-f\d]{4}-[a-f\d]{4}-[a-f\d]{4}-[a-f\d]{12}$/i.test(site))) {
+    throw new Error("@himalaya/wix-members-feed-viewer: notification count site must be a canonical bound site id");
   }
   const res = await wixCall(
     "POST",
-    "https://apps.wix.com/_api/members-feed-viewer/v1/members-viewer-feed-notifications/count",
+    `${APPS_WIX}/members-viewer-feed-notifications/count`,
     { filter: { channel: "MOBILE", status: "UNSEEN" }, maxCount: 100 },
-    { site }
+    site === void 0 ? void 0 : { site }
   );
   const count = res?.count;
   if (typeof count !== "number" || !Number.isSafeInteger(count) || count < 0 || count > 100) {

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-members.mjs

@@ -107,6 +107,33 @@ async function isFollowingMember(targetId) {
   );
   return res.connectedMembers?.[0]?.isFollowing === true;
 }
+async function queryMemberActivity(ids) {
+  const unique = [...new Set(ids.filter(Boolean))];
+  if (!unique.length) return [];
+  if (unique.length > 100) throw new Error("queryMemberActivity: at most 100 ids per call");
+  const res = await wixCall(
+    "POST",
+    "https://apps.wix.com/_api/members-one-app/api/members?filter=members",
+    // The service reads its query as a JSON string, the shape the One App client sends.
+    { query: JSON.stringify({ paging: { limit: unique.length, offset: 0 }, sort: [{ nickname: "asc" }], isOwnerApp: false, filter: { id: { $in: unique } } }) }
+  );
+  return (res?.items ?? []).filter((item) => item?.id).map((item) => ({
+    id: item.id,
+    role: item.member?.role,
+    online: item.member?.online === true,
+    lastOpenApp: item.member?.lastOpenApp ?? null
+  }));
+}
+async function listFollowedMembers(targetIds) {
+  const ids = [...new Set(targetIds.filter(Boolean))];
+  if (!ids.length) return [];
+  const res = await wixCall(
+    "POST",
+    "/members/v3/followers/my/connections",
+    { connectedMemberIds: ids }
+  );
+  return (res.connectedMembers ?? []).filter((c) => c.isFollowing === true && c.memberId).map((c) => c.memberId);
+}
 export {
   approveMember,
   blockMember,
@@ -120,6 +147,8 @@ export {
   joinCommunity,
   leaveCommunity,
   listCurrentMemberBlocking,
+  listFollowedMembers,
+  queryMemberActivity,
   queryMembers,
   unblockCurrentMember,
   unfollowMember,

package/dist/browser-plane/assets.json

@@ -0,0 +1,166 @@
+{
+  "files": [
+    {
+      "name": "sw.js",
+      "bytes": 2452155
+    },
+    {
+      "name": "host.html",
+      "bytes": 6795
+    },
+    {
+      "name": "package-reader.js",
+      "bytes": 9864
+    },
+    {
+      "name": "t5-frame.html",
+      "bytes": 23047
+    },
+    {
+      "name": "t5-worker-frame.html",
+      "bytes": 23064
+    },
+    {
+      "name": "preview-deferred/c3457ce58c96b65f303fec0ddf5f06733004eaf9e21e62302b155ec63a7765f7.bin",
+      "bytes": 488215
+    },
+    {
+      "name": "preview-deferred/521a0e528916d678d7588b2cddf3dadd3bb959a6d62426382f61c77a82017e35.bin",
+      "bytes": 90
+    },
+    {
+      "name": "preview-deferred/a33cfe728c584fdba4fcc1fd54bcdc2f9f2f13889ddbb5b2bd1d0f8cbe49b84e.bin",
+      "bytes": 1317034
+    },
+    {
+      "name": "preview-deferred/d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134.bin",
+      "bytes": 488584
+    },
+    {
+      "name": "preview-deferred/ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf.bin",
+      "bytes": 90924
+    },
+    {
+      "name": "preview-deferred/bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa.bin",
+      "bytes": 90984
+    },
+    {
+      "name": "preview-deferred/368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5.bin",
+      "bytes": 90980
+    },
+    {
+      "name": "preview-deferred/97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1.bin",
+      "bytes": 90872
+    },
+    {
+      "name": "preview-deferred/642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e.bin",
+      "bytes": 90980
+    },
+    {
+      "name": "preview-deferred/37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29.bin",
+      "bytes": 108636
+    },
+    {
+      "name": "preview-deferred/62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9.bin",
+      "bytes": 109084
+    },
+    {
+      "name": "preview-deferred/4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02.bin",
+      "bytes": 109048
+    },
+    {
+      "name": "preview-deferred/dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5.bin",
+      "bytes": 107700
+    },
+    {
+      "name": "preview-deferred/dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b.bin",
+      "bytes": 88108
+    }
+  ],
+  "deferred": [
+    {
+      "key": "assets/pdf-m0Fd7UDI.js",
+      "contentType": "application/javascript; charset=utf-8",
+      "sha256": "c3457ce58c96b65f303fec0ddf5f06733004eaf9e21e62302b155ec63a7765f7",
+      "file": "preview-deferred/c3457ce58c96b65f303fec0ddf5f06733004eaf9e21e62302b155ec63a7765f7.bin"
+    },
+    {
+      "key": "assets/pdf.worker.min-BGnVRhRG.js",
+      "contentType": "application/javascript; charset=utf-8",
+      "sha256": "521a0e528916d678d7588b2cddf3dadd3bb959a6d62426382f61c77a82017e35",
+      "file": "preview-deferred/521a0e528916d678d7588b2cddf3dadd3bb959a6d62426382f61c77a82017e35.bin"
+    },
+    {
+      "key": "assets/pdf.worker.min-BmVo14Nb.mjs",
+      "contentType": "application/javascript; charset=utf-8",
+      "sha256": "a33cfe728c584fdba4fcc1fd54bcdc2f9f2f13889ddbb5b2bd1d0f8cbe49b84e",
+      "file": "preview-deferred/a33cfe728c584fdba4fcc1fd54bcdc2f9f2f13889ddbb5b2bd1d0f8cbe49b84e.bin"
+    },
+    {
+      "key": "fonts/Roboto-Variable.ttf",
+      "contentType": "font/ttf",
+      "sha256": "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134",
+      "file": "preview-deferred/d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134.bin"
+    },
+    {
+      "key": "fonts/WixMadeforDisplay-Bold.ttf",
+      "contentType": "font/ttf",
+      "sha256": "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf",
+      "file": "preview-deferred/ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf.bin"
+    },
+    {
+      "key": "fonts/WixMadeforDisplay-ExtraBold.ttf",
+      "contentType": "font/ttf",
+      "sha256": "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa",
+      "file": "preview-deferred/bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa.bin"
+    },
+    {
+      "key": "fonts/WixMadeforDisplay-Medium.ttf",
+      "contentType": "font/ttf",
+      "sha256": "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5",
+      "file": "preview-deferred/368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5.bin"
+    },
+    {
+      "key": "fonts/WixMadeforDisplay-Regular.ttf",
+      "contentType": "font/ttf",
+      "sha256": "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1",
+      "file": "preview-deferred/97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1.bin"
+    },
+    {
+      "key": "fonts/WixMadeforDisplay-SemiBold.ttf",
+      "contentType": "font/ttf",
+      "sha256": "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e",
+      "file": "preview-deferred/642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e.bin"
+    },
+    {
+      "key": "fonts/WixMadeforText-Bold.ttf",
+      "contentType": "font/ttf",
+      "sha256": "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29",
+      "file": "preview-deferred/37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29.bin"
+    },
+    {
+      "key": "fonts/WixMadeforText-ExtraBold.ttf",
+      "contentType": "font/ttf",
+      "sha256": "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9",
+      "file": "preview-deferred/62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9.bin"
+    },
+    {
+      "key": "fonts/WixMadeforText-Medium.ttf",
+      "contentType": "font/ttf",
+      "sha256": "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02",
+      "file": "preview-deferred/4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02.bin"
+    },
+    {
+      "key": "fonts/WixMadeforText-Regular.ttf",
+      "contentType": "font/ttf",
+      "sha256": "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5",
+      "file": "preview-deferred/dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5.bin"
+    },
+    {
+      "key": "fonts/WixMadeforText-SemiBold.ttf",
+      "contentType": "font/ttf",
+      "sha256": "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b",
+      "file": "preview-deferred/dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b.bin"
+    }
+  ]
+}

package/dist/browser-plane/host.html

@@ -0,0 +1,156 @@
+<!doctype html>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Himi — the app, in your browser</title>
+<!--
+  The host page for the browser plane.
+
+  Its whole job is: register the worker, WAIT until it is controlling this client, hand it a
+  release, then get out of the way by navigating into the app.
+
+  THE WAIT IS NOT OPTIONAL. The web host fires its boot-document fetch before React mounts, so a
+  first load that is not yet controlled sends those `/v1` requests to the network, where they 404 —
+  and the app renders its "no release" state against a plane that is actually fine. Measured in the
+  spike that preceded this: `/v1/__spike` reached the origin server on the uncontrolled load and
+  was intercepted only after control. Hence `navigator.serviceWorker.controller` is polled, not
+  assumed, and the page reloads once if it has to.
+-->
+<style>
+  :root { color-scheme: light dark; }
+  body { font: 15px/1.5 system-ui, -apple-system, "Segoe UI", sans-serif; margin: 0;
+         display: grid; place-items: center; min-height: 100vh; }
+  main { max-width: 34rem; padding: 2rem; }
+  h1 { font-size: 1.25rem; margin: 0 0 .5rem; }
+  p { margin: .25rem 0; color: #555; }
+  @media (prefers-color-scheme: dark) { p { color: #aaa; } }
+  ol { padding-left: 1.1rem; margin: 1rem 0 0; }
+  li { margin: .3rem 0; }
+  li[data-state="done"]::marker { content: "✓ "; }
+  li[data-state="fail"]::marker { content: "✗ "; }
+  li[data-state="fail"] { color: #b91c1c; }
+  code { background: #0001; padding: .1rem .3rem; border-radius: 3px; }
+  #drop { margin-top: 1.25rem; padding: 1.5rem; border: 2px dashed #0003; border-radius: 8px;
+          text-align: center; color: #666; }
+  #drop.over { border-color: #2563eb; background: #2563eb11; }
+</style>
+<main>
+  <h1>Himi — the app, in your browser</h1>
+  <p>Build, preview and drive a Himi app locally. No server, and nothing leaves this machine.</p>
+  <ol id="steps"></ol>
+  <div id="drop" hidden>Drop a <code>.himi</code> package here, or pass one from the CLI.</div>
+</main>
+<script type="module">
+const steps = document.getElementById("steps");
+const drop = document.getElementById("drop");
+const step = (label) => {
+  const li = document.createElement("li");
+  li.textContent = label;
+  steps.append(li);
+  return {
+    done: (extra) => { li.dataset.state = "done"; if (extra) li.textContent = `${label} — ${extra}`; },
+    fail: (why) => { li.dataset.state = "fail"; li.textContent = `${label} — ${why}`; },
+  };
+};
+
+async function register() {
+  const s = step("Starting the local plane");
+  if (!("serviceWorker" in navigator)) {
+    s.fail("this browser has no service worker; the plane needs one");
+    return null;
+  }
+  try {
+    await navigator.serviceWorker.register("./sw.js", { scope: "./" });
+    await navigator.serviceWorker.ready;
+    // `ready` resolves on ACTIVATION, which is not the same as this client being controlled.
+    // Only `controller` says the interception is live for us.
+    if (!navigator.serviceWorker.controller) {
+      // ONE reload, enforced. A worker that never claims this client would otherwise put the page
+      // in a silent reload loop; a bounded retry that then FAILS VISIBLY is the difference between
+      // a bug someone can report and a tab that just blinks.
+      if (sessionStorage.getItem("himi.sw.retried") === "1") {
+        s.fail("the worker activated but never took control of this page — reloading again would loop");
+        return null;
+      }
+      try { sessionStorage.setItem("himi.sw.retried", "1"); } catch { /* private mode: fall through */ }
+      s.done("reloading to take control");
+      location.reload();
+      return null;
+    }
+    try { sessionStorage.removeItem("himi.sw.retried"); } catch { /* nothing to clear */ }
+    s.done("controlling this page");
+    return navigator.serviceWorker.controller;
+  } catch (e) {
+    s.fail(String(e));
+    return null;
+  }
+}
+
+/** postMessage with a reply port, so `load` is awaitable rather than fire-and-hope. */
+function ask(worker, message) {
+  return new Promise((resolve, reject) => {
+    const ch = new MessageChannel();
+    ch.port1.onmessage = (e) => (e.data?.ok ? resolve(e.data) : reject(new Error(e.data?.error ?? "worker refused")));
+    setTimeout(() => reject(new Error("the worker did not answer")), 30_000);
+    worker.postMessage(message, [ch.port2]);
+  });
+}
+
+async function loadAndGo(worker, payload) {
+  const s = step(`Loading ${payload.app}`);
+  try {
+    // The clientId rides INSIDE the payload — it belongs to the app, not to the worker, so a
+    // second release for a different app brings its own.
+    const { stats } = await ask(worker, { type: "load-release", payload });
+    s.done(`${(stats.bytes / 1024).toFixed(0)} KB in memory`);
+  } catch (e) {
+    s.fail(String(e));
+    return;
+  }
+  step("Opening the app").done();
+  // The MOUNT follows the release's own chrome choice. Hardcoding `/preview` made
+  // `himi run --browser --chrome app` render the device chassis anyway — the usage string and the
+  // non-browser path both promise otherwise.
+  const mount = payload.chrome === "app" ? "app" : "preview";
+  location.href = `/${mount}/a/${encodeURIComponent(payload.app)}`;
+}
+
+const worker = await register();
+if (worker) {
+  // Three ways in, all the same payload shape.
+  //  1. the CLI, which posts the release to this page and names it in the fragment
+  //  2. a URL the host page was given
+  //  3. a dropped .himi
+  const hash = new URLSearchParams(location.hash.slice(1));
+  const src = hash.get("release") ?? new URLSearchParams(location.search).get("release");
+  if (src) {
+    const s = step("Fetching the release");
+    try {
+      const res = await fetch(src);
+      if (!res.ok) throw new Error(`the release URL answered HTTP ${res.status}`);
+      const payload = await res.json();
+      s.done();
+      await loadAndGo(worker, payload);
+    } catch (e) { s.fail(String(e)); }
+  } else {
+    drop.hidden = false;
+    step("Waiting for a release").done("drop a .himi below");
+    for (const ev of ["dragenter", "dragover"]) {
+      drop.addEventListener(ev, (e) => { e.preventDefault(); drop.classList.add("over"); });
+    }
+    drop.addEventListener("dragleave", () => drop.classList.remove("over"));
+    drop.addEventListener("drop", async (e) => {
+      e.preventDefault();
+      drop.classList.remove("over");
+      const file = e.dataTransfer?.files?.[0];
+      if (!file) return;
+      const s = step(`Reading ${file.name}`);
+      try {
+        const { openPackageAsPayload } = await import("./package-reader.js");
+        const payload = await openPackageAsPayload(file);
+        s.done();
+        await loadAndGo(worker, payload);
+      } catch (err) { s.fail(String(err)); }
+    });
+  }
+}
+</script>

package/dist/browser-plane/package-reader.js

@@ -0,0 +1,4 @@
+var m="himi-package/2",E="himi-package/1",g="himi-package.json",b="release-manifest.json",H="source.zip";function w(n){return n?.contents==="dev"?"dev":"release"}var B=/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/,A=/^[a-f0-9]{64}$/;function S(n){return B.test(n)}function D(n){return Array.isArray(n.handlers)?n.handlers:[]}var v=n=>{if(typeof TextDecoder>"u")throw new Error("this JS host has no TextDecoder, so package text cannot be decoded safely");return new TextDecoder().decode(n)};function I(n,t,e){let s=n(t);if(!s)return null;try{return JSON.parse(v(s))}catch(r){return e.push(`${t} is not valid JSON: ${r.message}`),null}}function _(n,t={}){let e=[],s=[],r=I(n,g,e);if(!r&&t.requireHeader&&e.push(`${g} is missing \u2014 not a .himi package`),r&&r.format!==m&&r.format!==E&&e.push(`unsupported package format ${JSON.stringify(r.format)} (this build reads ${E} and ${m})`),r?.format===m&&r.launchMode!=="live"&&r.launchMode!=="snapshot"&&e.push(`${g} format ${m} needs launchMode "live" or "snapshot"`),r?.format===m&&(typeof r.contentHash!="string"||r.contentHash.trim()==="")&&e.push(`${g} format ${m} needs contentHash`),r&&r.contents!==void 0&&r.contents!=="release"&&r.contents!=="dev")e.push(`${g} has an unreadable contents ${JSON.stringify(r.contents)} (expected "release" or "dev")`);else if(r){let i=n(H)!==null;w(r)==="dev"&&!i&&e.push(`${H} is missing \u2014 the header says this package carries source`),w(r)==="release"&&i&&e.push(`${H} is present in a package whose header declares no source`)}let a=I(n,b,e);if(!a)return e.some(i=>i.startsWith(b))||e.push(`${b} is missing`),{ok:!1,errors:e,warnings:s,header:r,manifest:null};let p=a.screens,c=a.bundles;if((!p||typeof p!="object")&&e.push("release-manifest.json missing 'screens' object"),(!c||typeof c!="object")&&e.push("release-manifest.json missing 'bundles' object"),e.length>0)return{ok:!1,errors:e,warnings:s,header:r,manifest:a};r&&(r.app&&a.app&&r.app!==a.app&&e.push(`header app ${JSON.stringify(r.app)} disagrees with manifest app ${JSON.stringify(a.app)}`),r.releaseId&&a.releaseId&&r.releaseId!==a.releaseId&&e.push(`header releaseId ${JSON.stringify(r.releaseId)} disagrees with manifest releaseId ${JSON.stringify(a.releaseId)}`),t.contentHash&&r.contentHash&&t.contentHash!==r.contentHash&&e.push("contentHash mismatch \u2014 the package was truncated or modified after packing"));for(let[i,o]of Object.entries(p??{})){if(!S(i)){e.push(`screen id ${JSON.stringify(i)} is not a safe entry name`);continue}n(`screens/${i}.json`)||e.push(`screens/${i}.json missing (referenced in manifest)`);let u=o?.bundle;u!=null&&!(u in(c??{}))&&e.push(`screen "${i}" references bundle "${u}" which is absent from manifest.bundles`)}for(let[i,o]of Object.entries(c??{})){if(!o?.sha256||!A.test(o.sha256)){e.push(`bundle "${i}" has no valid sha256`);continue}n(`bundles/${o.sha256}.bundle.js`)||e.push(`bundles/${o.sha256}.bundle.js missing (bundle "${i}")`)}a.handlers!=null&&!Array.isArray(a.handlers)&&e.push(`manifest.handlers must be an array (got ${typeof a.handlers})`);for(let i of D(a)){let o=JSON.stringify(i?.id??"?");if(!i?.bundleHash||!A.test(i.bundleHash)){e.push(`handler ${o} has no valid bundleHash`);continue}n(`bundles/${i.bundleHash}.bundle.js`)||e.push(`bundles/${i.bundleHash}.bundle.js missing (handler ${o})`)}for(let[i,o]of Object.entries(a.assets??{})){if(!o?.sha256||!A.test(o.sha256)){e.push(`asset "${i}" has no valid sha256`);continue}n(`assets/${o.sha256}`)||e.push(`assets/${o.sha256} missing (asset "${i}")`)}for(let i of Object.keys(a.widgets??{})){if(!S(i)){e.push(`widget id ${JSON.stringify(i)} is not a safe entry name`);continue}n(`widgets/${i}.json`)||e.push(`widgets/${i}.json missing (referenced in manifest)`)}return(t.warnMissingDocs??!0)&&(n("app-config.json")||s.push("app-config.json is absent \u2014 the host has no navigation baseline"),n("tokens.json")||s.push("tokens.json is absent \u2014 the host falls back to default design tokens")),{ok:e.length===0,errors:e,warnings:s,header:r,manifest:a}}function j(n){return n.filter(t=>t.path!==g).slice().sort((t,e)=>t.path<e.path?-1:t.path>e.path?1:0).map(t=>`${t.path} ${t.hash}`).join(`
+`)}var L=67324752,V=33639248,G=101010256,P=null;function J(n){if(!P){P=new Uint32Array(256);for(let e=0;e<256;e++){let s=e;for(let r=0;r<8;r++)s=s&1?3988292384^s>>>1:s>>>1;P[e]=s>>>0}}let t=4294967295;for(let e=0;e<n.length;e++)t=P[(t^n[e])&255]^t>>>8;return(t^4294967295)>>>0}function Z(n){return!n||n.length>512||n.startsWith("/")||n.includes("\\")||n.includes("\0")||/^[A-Za-z]:/.test(n)?!1:!n.split("/").some(t=>t===""||t==="."||t==="..")}var F={maxCompressedBytes:64*1024*1024,maxExpandedBytes:256*1024*1024,maxEntries:1e4,maxDecompressionRatio:1e3};function M(n,t,e=F){if(n>e.maxCompressedBytes)throw new Error(`package archive is ${n} bytes, over the ${e.maxCompressedBytes}-byte compressed-size limit`);if(t.length>e.maxEntries)throw new Error(`package archive has ${t.length} entries, over the ${e.maxEntries}-entry limit`);let s=0;for(let r of t){if(s+=r.rawSize,s>e.maxExpandedBytes)throw new Error(`package expands to more than the ${e.maxExpandedBytes}-byte expanded-size limit`);if(r.rawSize>0&&(r.compSize===0||r.rawSize/r.compSize>e.maxDecompressionRatio))throw new Error(`package entry ${JSON.stringify(r.name)} exceeds the ${e.maxDecompressionRatio}:1 decompression-ratio limit`)}}function O(n){let t=new DataView(n.buffer,n.byteOffset,n.byteLength),e=o=>t.getUint32(o,!0),s=o=>t.getUint16(o,!0),r=-1,a=Math.max(0,n.length-65535-22);for(let o=n.length-22;o>=a;o--)if(e(o)===G){r=o;break}if(r<0)throw new Error("not a zip archive (no end-of-central-directory record)");let p=s(r+10),c=e(r+16),i=[];for(let o=0;o<p;o++){if(c+46>n.length||e(c)!==V)throw new Error("corrupt zip central directory");let u=s(c+10),d=e(c+16),f=e(c+20),l=e(c+24),$=s(c+28),N=s(c+30),z=s(c+32),k=e(c+42),h=v(n.subarray(c+46,c+46+$));if(c+=46+$+N+z,h.endsWith("/"))continue;if(!Z(h))throw new Error(`unsafe zip entry name: ${JSON.stringify(h)}`);if(k+30>n.length||e(k)!==L)throw new Error(`corrupt zip local header for ${h}`);let R=k+30+s(k+26)+s(k+28);if(R+f>n.length)throw new Error(`truncated zip entry ${h}`);i.push({name:h,method:u,crc:d,dataStart:R,compSize:f,rawSize:l})}return i}function C(n,t){if(t.length!==n.rawSize)throw new Error(`size mismatch for zip entry ${n.name}`);if(J(t)!==n.crc)throw new Error(`checksum mismatch for zip entry ${n.name} \u2014 the package is damaged`)}function q(){return typeof DecompressionStream<"u"}var K="this browser cannot open a compressed .himi package (DecompressionStream is unavailable) \u2014 open it with `himi run`, or host the package unpacked with `himi pack --format dir`";async function Y(n){if(!q())throw new Error(K);let t=new Blob([n]).stream().pipeThrough(new DecompressionStream("deflate-raw"));return new Uint8Array(await new Response(t).arrayBuffer())}async function W(n,t){let e=n.subarray(t.dataStart,t.dataStart+t.compSize),s;if(t.method===0)s=e.slice();else if(t.method===8)try{s=await Y(e)}catch(r){throw new Error(`corrupt entry ${t.name} \u2014 the package is damaged (${r.message})`)}else throw new Error(`unsupported compression method ${t.method} for ${t.name}`);return C(t,s),s}async function T(n){let t=n instanceof Uint8Array?n:new Uint8Array(n),e=new Map,s=O(t);M(t.length,s);for(let r of s)e.set(r.name,await W(t,r));return e}async function X(n,t,e){let s=c=>n.get(c)??null,r=await ee(n),a=_(s,{requireHeader:e.requireHeader,contentHash:r});if(!a.ok||!a.manifest)throw new Error(a.errors.length?`not a Himi package:
+  ${a.errors.join(`
+  `)}`:`not a Himi package \u2014 no ${b}`);if(w(a.header)==="dev")throw new Error("this package carries the app's source (a dev package). The web host opens release packages only \u2014 restore it with `himi import <package.himi>` instead.");let p=a.header?.app??a.manifest.app;if(!p)throw new Error("package declares no app id");return{app:p,header:a.header,manifest:a.manifest,read:s,validation:a,source:t}}async function Q(n){let t=await crypto.subtle.digest("SHA-256",n);return Array.from(new Uint8Array(t),e=>e.toString(16).padStart(2,"0")).join("")}async function ee(n){let t=await Promise.all(Array.from(n,async([s,r])=>({path:s,hash:await Q(r)}))),e=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(j(t)));return"sha256-"+btoa(String.fromCharCode(...new Uint8Array(e)))}async function U(n){return X(await T(await n.arrayBuffer()),{kind:"file",name:n.name},{requireHeader:!0})}var y=n=>n?new TextDecoder().decode(n):void 0;function x(n){if(!n)return;let t="",e=32768;for(let s=0;s<n.length;s+=e)t+=String.fromCharCode(...n.subarray(s,s+e));return btoa(t)}function ne(n){if(n)try{return JSON.parse(n)?.authConfig?.config?.clientId}catch{return}}function te(n){let t=n.manifest,e=d=>n.read(d),s={},r={};for(let[d,f]of Object.entries(t.screens??{})){let l=y(e(`screens/${d}.json`));l!==void 0&&(s[d]=l,f.descriptorHash&&(r[f.descriptorHash]=l))}let a=(d,f)=>{if(!d||r[d]!==void 0)return;let l=y(e(f))??y(e(`docs/${d}.json`));l!==void 0&&(r[d]=l)};for(let[d,f]of Object.entries(t.catalogs??{}))a(f,`catalogs/${d}.json`);a(t.tokensHash,"tokens.json"),a(t.appConfigHash,"app-config.json");let p={};for(let d of Object.values(t.bundles??{})){let f=x(e(`bundles/${d.sha256}.bundle.js`));f!==void 0&&(p[d.sha256]=f)}let c={};for(let d of Object.values(t.assets??{})){let f=x(e(`assets/${d.sha256}`));f!==void 0&&(c[d.sha256]={base64:f,contentType:d.contentType})}let i={};for(let d of Object.keys(t.widgets??{})){let f=y(e(`widgets/${d}.json`));f!==void 0&&(i[d]=f)}let o=y(e("app-config.json")),u=ne(o);return{app:n.app,manifest:t,screens:s,bundles:p,docs:r,assets:c,widgets:i,tokens:y(e("tokens.json")),appConfig:o,icon:x(e("icon.png")),header:n.header,...u?{wixClientId:u}:{}}}async function pe(n){let t=await U(n);return te(t)}export{pe as openPackageAsPayload,te as payloadFromPackage};

package/dist/browser-plane/preview-deferred/521a0e528916d678d7588b2cddf3dadd3bb959a6d62426382f61c77a82017e35.bin

@@ -0,0 +1 @@
+var e=``+new URL(`pdf.worker.min-BmVo14Nb.mjs`,import.meta.url).href;export{e as default};