@wix/himalaya-cli 0.1633.0 → 0.1635.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/screens.mjs

@@ -2734,18 +2734,45 @@ function wixApiGlobal() {
 function startPaymentCall(scope, wixTransactionId) {
   return post(scope, "/payments/start", { appleBundleId: scope.binding.bundleId, wixTransactionId });
 }
-function startItemPaymentCall(scope, item) {
-  return post(scope, "/payments/start-item", { appleBundleId: scope.binding.bundleId, item: { catalogItemId: item.catalogItemId, catalogAppId: item.catalogAppId } });
+function startItemPaymentCall(scope, item, storeCountryCode) {
+  const { catalogItemId, catalogAppId, options } = item;
+  return post(scope, "/payments/start-item", {
+    appleBundleId: scope.binding.bundleId,
+    item: { catalogItemId, catalogAppId, ...options ? { options } : {} },
+    ...storeCountryCode ? { storeCountryCode } : {}
+  });
 }
 function catalogItemOf(raw) {
   const item = isObject3(raw) ? raw : {};
-  const { catalogItemId, catalogAppId } = item;
+  const { catalogItemId, catalogAppId, options } = item;
   const valid = typeof catalogItemId === "string" && catalogItemId.length > 0 && catalogItemId.length <= 36 && isUUID(catalogAppId);
-  return valid ? { catalogItemId, catalogAppId } : null;
+  if (!valid || options !== void 0 && !isJsonObject(options)) return null;
+  return options && Object.keys(options).length > 0 ? { catalogItemId, catalogAppId, options } : { catalogItemId, catalogAppId };
+}
+function isStoreCountryCode(value) {
+  return typeof value === "string" && /^[A-Z]{3}$/.test(value);
+}
+var MAX_JSON_DEPTH = 32;
+function isJsonObject(value, depth = 0) {
+  return depth < MAX_JSON_DEPTH && isPlainObject(value) && Object.values(value).every((v) => isJsonValue(v, depth + 1));
+}
+function isJsonValue(value, depth) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return true;
+  if (typeof value === "number") return Number.isFinite(value);
+  if (Array.isArray(value)) return depth < MAX_JSON_DEPTH && value.every((v) => isJsonValue(v, depth + 1));
+  return isJsonObject(value, depth);
+}
+function isPlainObject(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
 }
 function completePaymentCall(scope, signedTransaction) {
   return post(scope, "/payments/complete", { appleBundleId: scope.binding.bundleId, apple: { signedTransaction } });
 }
+function cancelPaymentCall(scope, paymentId) {
+  return post(scope, `/payments/${encodeURIComponent(paymentId)}/cancel`, { appleBundleId: scope.binding.bundleId });
+}
 function paymentCall(scope, paymentId) {
   return get2(scope, `/payments/${encodeURIComponent(paymentId)}`);
 }
@@ -2758,10 +2785,17 @@ function decodeStarted(raw, expected) {
   return payment && { payment, storeProductId: raw.storeProductId, appAccountToken: raw.appAccountToken };
 }
 function decodeStartedItem(raw, expected) {
-  if (!isObject3(raw) || !isUUID(raw.ecomOrderId)) return null;
+  if (!isObject3(raw)) return null;
+  const ecomOrderId = optionalId(raw.ecomOrderId);
+  const joinApplicationId = optionalId(raw.joinApplicationId);
+  if (ecomOrderId === null || joinApplicationId === null || !ecomOrderId && !joinApplicationId) return null;
   const started = decodeStarted(raw, expected);
   if (!started || started.payment.appProductId !== expected.catalogItemId) return null;
-  return { ...started, ecomOrderId: raw.ecomOrderId };
+  return { ...started, ...ecomOrderId ? { ecomOrderId } : {}, ...joinApplicationId ? { joinApplicationId } : {} };
+}
+function optionalId(value) {
+  if (value === void 0 || value === "") return void 0;
+  return isUUID(value) ? value : null;
 }
 function decodePaymentAnswer(raw, expected) {
   return isObject3(raw) ? decodePayment(raw.payment, expected) : null;
@@ -2887,11 +2921,12 @@ function createWixIapClient(deps) {
   }
   function startItemPayment(input) {
     const item = catalogItemOf(input.item);
-    if (!item) return Promise.resolve(failure2("startItemPayment", "invalidArgument"));
+    const country = input.storeCountryCode;
+    if (!item || country !== void 0 && !isStoreCountryCode(country)) return Promise.resolve(failure2("startItemPayment", "invalidArgument"));
     return runUnrepeatable({
       operation: "startItemPayment",
       codes: START_ITEM_PAYMENT_CODES,
-      request: (scope) => startItemPaymentCall(scope, item),
+      request: (scope) => startItemPaymentCall(scope, item, country),
       decode: (raw, scope) => {
         const started = decodeStartedItem(raw, { ...expectationOf2(scope), catalogItemId: item.catalogItemId });
         return started && { status: "started", ...started };
@@ -2923,6 +2958,18 @@ function createWixIapClient(deps) {
       }
     });
   }
+  function cancelPayment(input) {
+    if (!isUUID(input.paymentId)) return Promise.resolve(failure2("cancelPayment", "invalidArgument"));
+    return run({
+      operation: "cancelPayment",
+      codes: CANCEL_PAYMENT_CODES,
+      request: (scope) => cancelPaymentCall(scope, input.paymentId),
+      decode: (raw, scope) => {
+        const payment = decodePaymentAnswer(raw, { ...expectationOf2(scope), paymentId: input.paymentId });
+        return payment && { status: "answered", payment };
+      }
+    });
+  }
   async function run(spec) {
     return (await execute(spec)).result;
   }
@@ -2972,7 +3019,7 @@ function createWixIapClient(deps) {
   function isCurrent(session) {
     return deps.session.current().generation === session.generation;
   }
-  return { startPayment, startItemPayment, completePayment, getPayment };
+  return { startPayment, startItemPayment, completePayment, getPayment, cancelPayment };
 }
 async function attempt2(transport, call, spec, expectation) {
   try {
@@ -3036,8 +3083,18 @@ var START_ITEM_PAYMENT_CODES = [
   "ALREADY_OWNED",
   "ITEM_NOT_AVAILABLE",
   "SITE_NOT_ACCEPTING_PAYMENTS",
-  "UNSUPPORTED_ORDER"
+  "UNSUPPORTED_ORDER",
+  "CATALOG_NOT_SUPPORTED",
+  "VERTICAL_ACCESS_DENIED",
+  "EVENT_CHECKOUT_NOT_ECOM",
+  "ALREADY_SUBSCRIBED",
+  "SUBSCRIPTION_NOT_IN_APP",
+  "BILLING_COUNTRY_REQUIRED",
+  "APP_NOT_CONFIGURED",
+  "NOT_BOOKING_OWNER",
+  "BOOKING_PAYMENT_PENDING"
 ];
+var CANCEL_PAYMENT_CODES = ["NOT_PENDING", "APP_NOT_CONFIGURED", "NOT_FOUND"];
 var UNDECIDED = /* @__PURE__ */ new Set(["unavailable", "sessionChanged", "invalidResponse"]);
 var COMPLETE_PAYMENT_CODES = [
   "INVALID_PURCHASE",
@@ -3727,7 +3784,7 @@ function createWixOrderBackend(deps) {
     const attempt4 = existing?.cashierOrderId && existing.verticalRef ? await reopenOrOpen(sale, { cashierOrderId: existing.cashierOrderId, verticalRef: existing.verticalRef }) : await sale.adapter.openOrder(sale.item, sale.bridge, beforeCreate, afterCreate);
     if (prevented) return prevented;
     if (guarded !== void 0 && attempt4.status === "open" && !stillGuarded(sale, guarded)) return retry("unavailable");
-    const ref = recordOrder(sale, existing, attempt4);
+    const ref = recordOrder(sale, existing, attempt4, guarded);
     return isStop(ref) ? ref : { ref, placed: isPlaced(attempt4) };
   }
   function stillGuarded(sale, guarded) {
@@ -3739,8 +3796,8 @@ function createWixOrderBackend(deps) {
     const closed = reopened.status === "refused" && reopened.reason === "orderClosed";
     return closed && !sale.adapter.repeatable ? sale.adapter.openOrder(sale.item, sale.bridge) : reopened;
   }
-  function recordOrder(sale, existing, attempt4) {
-    if (attempt4.noOrderCreated && refAt(sale.partition, sale.catalogRef)?.stage === "openingOrder" && !sale.partition.remove(sale.catalogRef)) {
+  function recordOrder(sale, existing, attempt4, guarded) {
+    if (attempt4.noOrderCreated && guarded !== void 0 && stillGuarded(sale, guarded) && !sale.partition.remove(sale.catalogRef)) {
       return stopWith("rejected", "storageUnavailable");
     }
     if (attempt4.status === "granted") return alreadyOwned(sale);
@@ -3821,12 +3878,14 @@ function createWixOrderBackend(deps) {
   }
   function startedItem(sale, itemPayment, started) {
     if (started.storeProductId !== sale.appleProduct.productId) return contextResult(sale.catalogRef, stopWith("rejected", "productChanged"));
+    const verticalRef = itemPayment.verticalRefOf(started);
+    if (!verticalRef) return contextResult(sale.catalogRef, OUTCOME_UNKNOWN);
     const { payment, storeProductId, appAccountToken } = started;
     const recorded = persist(sale, {
       key: sale.catalogRef,
       stage: "started",
       kind: sale.adapter.kind,
-      verticalRef: itemPayment.verticalRefOf(started.ecomOrderId),
+      verticalRef,
       wixTransactionId: payment.wixTransactionId,
       paymentId: payment.paymentId,
       storeProductId,
@@ -3991,7 +4050,16 @@ var ITEM_REFUSALS = {
   ALREADY_OWNED: "paymentRefused",
   ITEM_NOT_AVAILABLE: "orderRefused",
   SITE_NOT_ACCEPTING_PAYMENTS: "sitePaymentUnavailable",
-  UNSUPPORTED_ORDER: "orderRefused"
+  UNSUPPORTED_ORDER: "orderRefused",
+  CATALOG_NOT_SUPPORTED: "unsupportedItem",
+  EVENT_CHECKOUT_NOT_ECOM: "unsupportedItem",
+  VERTICAL_ACCESS_DENIED: "notConfigured",
+  APP_NOT_CONFIGURED: "notConfigured",
+  ALREADY_SUBSCRIBED: "paymentRefused",
+  SUBSCRIPTION_NOT_IN_APP: "paymentRefused",
+  BILLING_COUNTRY_REQUIRED: "orderRefused",
+  NOT_BOOKING_OWNER: "orderRefused",
+  BOOKING_PAYMENT_PENDING: "paymentInProgress"
 };
 var KIND_STOPS = {
   authRequired: SIGN_IN,

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/sdui.mjs

@@ -9425,6 +9425,7 @@ function deriveAppMeta(name, m, platforms = {}, provisioning = {}) {
     site: config.navigation?.site,
     streamPolicy: config.navigation?.streamPolicy,
     topBarLogo: config.navigation?.topBarLogo,
+    presentationQueue: config.navigation?.presentationQueue,
     splash: config.splash,
     locale: config.locale,
     deepLinkPatterns: config.navigation?.deepLinkPatterns,

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-members-feed-viewer.mjs

@@ -46,10 +46,11 @@ async function mfvCall(method, suffix, body, options) {
     }
   }
 }
+var APPS_WIX = "https://apps.wix.com/_api/members-feed-viewer/v1";
 async function queryNotifications(limit = 25, options) {
-  const res = await mfvCall(
+  const res = await wixCall(
     "POST",
-    "/members-viewer-feed-notifications/query",
+    `${APPS_WIX}/members-viewer-feed-notifications/query`,
     {
       query: {
         cursorPaging: { limit },
@@ -59,18 +60,18 @@ async function queryNotifications(limit = 25, options) {
     },
     options
   );
-  return res.viewerFeedNotifications ?? [];
+  return res?.viewerFeedNotifications ?? [];
 }
 async function countUnseenNotifications(options) {
   const site = options?.site;
-  if (typeof site !== "string" || !/^[a-f\d]{8}-[a-f\d]{4}-[a-f\d]{4}-[a-f\d]{4}-[a-f\d]{12}$/i.test(site)) {
-    throw new Error("@himalaya/wix-members-feed-viewer: notification count requires its bound site");
+  if (site !== void 0 && (typeof site !== "string" || !/^[a-f\d]{8}-[a-f\d]{4}-[a-f\d]{4}-[a-f\d]{4}-[a-f\d]{12}$/i.test(site))) {
+    throw new Error("@himalaya/wix-members-feed-viewer: notification count site must be a canonical bound site id");
   }
   const res = await wixCall(
     "POST",
-    "https://apps.wix.com/_api/members-feed-viewer/v1/members-viewer-feed-notifications/count",
+    `${APPS_WIX}/members-viewer-feed-notifications/count`,
     { filter: { channel: "MOBILE", status: "UNSEEN" }, maxCount: 100 },
-    { site }
+    site === void 0 ? void 0 : { site }
   );
   const count = res?.count;
   if (typeof count !== "number" || !Number.isSafeInteger(count) || count < 0 || count > 100) {

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-members.mjs

@@ -107,6 +107,33 @@ async function isFollowingMember(targetId) {
   );
   return res.connectedMembers?.[0]?.isFollowing === true;
 }
+async function queryMemberActivity(ids) {
+  const unique = [...new Set(ids.filter(Boolean))];
+  if (!unique.length) return [];
+  if (unique.length > 100) throw new Error("queryMemberActivity: at most 100 ids per call");
+  const res = await wixCall(
+    "POST",
+    "https://apps.wix.com/_api/members-one-app/api/members?filter=members",
+    // The service reads its query as a JSON string, the shape the One App client sends.
+    { query: JSON.stringify({ paging: { limit: unique.length, offset: 0 }, sort: [{ nickname: "asc" }], isOwnerApp: false, filter: { id: { $in: unique } } }) }
+  );
+  return (res?.items ?? []).filter((item) => item?.id).map((item) => ({
+    id: item.id,
+    role: item.member?.role,
+    online: item.member?.online === true,
+    lastOpenApp: item.member?.lastOpenApp ?? null
+  }));
+}
+async function listFollowedMembers(targetIds) {
+  const ids = [...new Set(targetIds.filter(Boolean))];
+  if (!ids.length) return [];
+  const res = await wixCall(
+    "POST",
+    "/members/v3/followers/my/connections",
+    { connectedMemberIds: ids }
+  );
+  return (res.connectedMembers ?? []).filter((c) => c.isFollowing === true && c.memberId).map((c) => c.memberId);
+}
 export {
   approveMember,
   blockMember,
@@ -120,6 +147,8 @@ export {
   joinCommunity,
   leaveCommunity,
   listCurrentMemberBlocking,
+  listFollowedMembers,
+  queryMemberActivity,
   queryMembers,
   unblockCurrentMember,
   unfollowMember,

package/dist/browser-plane/assets.json

@@ -0,0 +1,166 @@
+{
+  "files": [
+    {
+      "name": "sw.js",
+      "bytes": 2455277
+    },
+    {
+      "name": "host.html",
+      "bytes": 6795
+    },
+    {
+      "name": "package-reader.js",
+      "bytes": 9864
+    },
+    {
+      "name": "t5-frame.html",
+      "bytes": 23047
+    },
+    {
+      "name": "t5-worker-frame.html",
+      "bytes": 23064
+    },
+    {
+      "name": "preview-deferred/67feb362281a3040ee05592769227c58a98ec3c8073dac95ecb5629141c67061.bin",
+      "bytes": 488215
+    },
+    {
+      "name": "preview-deferred/521a0e528916d678d7588b2cddf3dadd3bb959a6d62426382f61c77a82017e35.bin",
+      "bytes": 90
+    },
+    {
+      "name": "preview-deferred/a33cfe728c584fdba4fcc1fd54bcdc2f9f2f13889ddbb5b2bd1d0f8cbe49b84e.bin",
+      "bytes": 1317034
+    },
+    {
+      "name": "preview-deferred/d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134.bin",
+      "bytes": 488584
+    },
+    {
+      "name": "preview-deferred/ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf.bin",
+      "bytes": 90924
+    },
+    {
+      "name": "preview-deferred/bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa.bin",
+      "bytes": 90984
+    },
+    {
+      "name": "preview-deferred/368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5.bin",
+      "bytes": 90980
+    },
+    {
+      "name": "preview-deferred/97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1.bin",
+      "bytes": 90872
+    },
+    {
+      "name": "preview-deferred/642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e.bin",
+      "bytes": 90980
+    },
+    {
+      "name": "preview-deferred/37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29.bin",
+      "bytes": 108636
+    },
+    {
+      "name": "preview-deferred/62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9.bin",
+      "bytes": 109084
+    },
+    {
+      "name": "preview-deferred/4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02.bin",
+      "bytes": 109048
+    },
+    {
+      "name": "preview-deferred/dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5.bin",
+      "bytes": 107700
+    },
+    {
+      "name": "preview-deferred/dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b.bin",
+      "bytes": 88108
+    }
+  ],
+  "deferred": [
+    {
+      "key": "assets/pdf-CDxdgL1u.js",
+      "contentType": "application/javascript; charset=utf-8",
+      "sha256": "67feb362281a3040ee05592769227c58a98ec3c8073dac95ecb5629141c67061",
+      "file": "preview-deferred/67feb362281a3040ee05592769227c58a98ec3c8073dac95ecb5629141c67061.bin"
+    },
+    {
+      "key": "assets/pdf.worker.min-BGnVRhRG.js",
+      "contentType": "application/javascript; charset=utf-8",
+      "sha256": "521a0e528916d678d7588b2cddf3dadd3bb959a6d62426382f61c77a82017e35",
+      "file": "preview-deferred/521a0e528916d678d7588b2cddf3dadd3bb959a6d62426382f61c77a82017e35.bin"
+    },
+    {
+      "key": "assets/pdf.worker.min-BmVo14Nb.mjs",
+      "contentType": "application/javascript; charset=utf-8",
+      "sha256": "a33cfe728c584fdba4fcc1fd54bcdc2f9f2f13889ddbb5b2bd1d0f8cbe49b84e",
+      "file": "preview-deferred/a33cfe728c584fdba4fcc1fd54bcdc2f9f2f13889ddbb5b2bd1d0f8cbe49b84e.bin"
+    },
+    {
+      "key": "fonts/Roboto-Variable.ttf",
+      "contentType": "font/ttf",
+      "sha256": "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134",
+      "file": "preview-deferred/d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134.bin"
+    },
+    {
+      "key": "fonts/WixMadeforDisplay-Bold.ttf",
+      "contentType": "font/ttf",
+      "sha256": "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf",
+      "file": "preview-deferred/ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf.bin"
+    },
+    {
+      "key": "fonts/WixMadeforDisplay-ExtraBold.ttf",
+      "contentType": "font/ttf",
+      "sha256": "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa",
+      "file": "preview-deferred/bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa.bin"
+    },
+    {
+      "key": "fonts/WixMadeforDisplay-Medium.ttf",
+      "contentType": "font/ttf",
+      "sha256": "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5",
+      "file": "preview-deferred/368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5.bin"
+    },
+    {
+      "key": "fonts/WixMadeforDisplay-Regular.ttf",
+      "contentType": "font/ttf",
+      "sha256": "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1",
+      "file": "preview-deferred/97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1.bin"
+    },
+    {
+      "key": "fonts/WixMadeforDisplay-SemiBold.ttf",
+      "contentType": "font/ttf",
+      "sha256": "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e",
+      "file": "preview-deferred/642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e.bin"
+    },
+    {
+      "key": "fonts/WixMadeforText-Bold.ttf",
+      "contentType": "font/ttf",
+      "sha256": "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29",
+      "file": "preview-deferred/37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29.bin"
+    },
+    {
+      "key": "fonts/WixMadeforText-ExtraBold.ttf",
+      "contentType": "font/ttf",
+      "sha256": "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9",
+      "file": "preview-deferred/62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9.bin"
+    },
+    {
+      "key": "fonts/WixMadeforText-Medium.ttf",
+      "contentType": "font/ttf",
+      "sha256": "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02",
+      "file": "preview-deferred/4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02.bin"
+    },
+    {
+      "key": "fonts/WixMadeforText-Regular.ttf",
+      "contentType": "font/ttf",
+      "sha256": "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5",
+      "file": "preview-deferred/dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5.bin"
+    },
+    {
+      "key": "fonts/WixMadeforText-SemiBold.ttf",
+      "contentType": "font/ttf",
+      "sha256": "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b",
+      "file": "preview-deferred/dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b.bin"
+    }
+  ]
+}

package/dist/browser-plane/host.html

@@ -0,0 +1,156 @@
+<!doctype html>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Himi — the app, in your browser</title>
+<!--
+  The host page for the browser plane.
+
+  Its whole job is: register the worker, WAIT until it is controlling this client, hand it a
+  release, then get out of the way by navigating into the app.
+
+  THE WAIT IS NOT OPTIONAL. The web host fires its boot-document fetch before React mounts, so a
+  first load that is not yet controlled sends those `/v1` requests to the network, where they 404 —
+  and the app renders its "no release" state against a plane that is actually fine. Measured in the
+  spike that preceded this: `/v1/__spike` reached the origin server on the uncontrolled load and
+  was intercepted only after control. Hence `navigator.serviceWorker.controller` is polled, not
+  assumed, and the page reloads once if it has to.
+-->
+<style>
+  :root { color-scheme: light dark; }
+  body { font: 15px/1.5 system-ui, -apple-system, "Segoe UI", sans-serif; margin: 0;
+         display: grid; place-items: center; min-height: 100vh; }
+  main { max-width: 34rem; padding: 2rem; }
+  h1 { font-size: 1.25rem; margin: 0 0 .5rem; }
+  p { margin: .25rem 0; color: #555; }
+  @media (prefers-color-scheme: dark) { p { color: #aaa; } }
+  ol { padding-left: 1.1rem; margin: 1rem 0 0; }
+  li { margin: .3rem 0; }
+  li[data-state="done"]::marker { content: "✓ "; }
+  li[data-state="fail"]::marker { content: "✗ "; }
+  li[data-state="fail"] { color: #b91c1c; }
+  code { background: #0001; padding: .1rem .3rem; border-radius: 3px; }
+  #drop { margin-top: 1.25rem; padding: 1.5rem; border: 2px dashed #0003; border-radius: 8px;
+          text-align: center; color: #666; }
+  #drop.over { border-color: #2563eb; background: #2563eb11; }
+</style>
+<main>
+  <h1>Himi — the app, in your browser</h1>
+  <p>Build, preview and drive a Himi app locally. No server, and nothing leaves this machine.</p>
+  <ol id="steps"></ol>
+  <div id="drop" hidden>Drop a <code>.himi</code> package here, or pass one from the CLI.</div>
+</main>
+<script type="module">
+const steps = document.getElementById("steps");
+const drop = document.getElementById("drop");
+const step = (label) => {
+  const li = document.createElement("li");
+  li.textContent = label;
+  steps.append(li);
+  return {
+    done: (extra) => { li.dataset.state = "done"; if (extra) li.textContent = `${label} — ${extra}`; },
+    fail: (why) => { li.dataset.state = "fail"; li.textContent = `${label} — ${why}`; },
+  };
+};
+
+async function register() {
+  const s = step("Starting the local plane");
+  if (!("serviceWorker" in navigator)) {
+    s.fail("this browser has no service worker; the plane needs one");
+    return null;
+  }
+  try {
+    await navigator.serviceWorker.register("./sw.js", { scope: "./" });
+    await navigator.serviceWorker.ready;
+    // `ready` resolves on ACTIVATION, which is not the same as this client being controlled.
+    // Only `controller` says the interception is live for us.
+    if (!navigator.serviceWorker.controller) {
+      // ONE reload, enforced. A worker that never claims this client would otherwise put the page
+      // in a silent reload loop; a bounded retry that then FAILS VISIBLY is the difference between
+      // a bug someone can report and a tab that just blinks.
+      if (sessionStorage.getItem("himi.sw.retried") === "1") {
+        s.fail("the worker activated but never took control of this page — reloading again would loop");
+        return null;
+      }
+      try { sessionStorage.setItem("himi.sw.retried", "1"); } catch { /* private mode: fall through */ }
+      s.done("reloading to take control");
+      location.reload();
+      return null;
+    }
+    try { sessionStorage.removeItem("himi.sw.retried"); } catch { /* nothing to clear */ }
+    s.done("controlling this page");
+    return navigator.serviceWorker.controller;
+  } catch (e) {
+    s.fail(String(e));
+    return null;
+  }
+}
+
+/** postMessage with a reply port, so `load` is awaitable rather than fire-and-hope. */
+function ask(worker, message) {
+  return new Promise((resolve, reject) => {
+    const ch = new MessageChannel();
+    ch.port1.onmessage = (e) => (e.data?.ok ? resolve(e.data) : reject(new Error(e.data?.error ?? "worker refused")));
+    setTimeout(() => reject(new Error("the worker did not answer")), 30_000);
+    worker.postMessage(message, [ch.port2]);
+  });
+}
+
+async function loadAndGo(worker, payload) {
+  const s = step(`Loading ${payload.app}`);
+  try {
+    // The clientId rides INSIDE the payload — it belongs to the app, not to the worker, so a
+    // second release for a different app brings its own.
+    const { stats } = await ask(worker, { type: "load-release", payload });
+    s.done(`${(stats.bytes / 1024).toFixed(0)} KB in memory`);
+  } catch (e) {
+    s.fail(String(e));
+    return;
+  }
+  step("Opening the app").done();
+  // The MOUNT follows the release's own chrome choice. Hardcoding `/preview` made
+  // `himi run --browser --chrome app` render the device chassis anyway — the usage string and the
+  // non-browser path both promise otherwise.
+  const mount = payload.chrome === "app" ? "app" : "preview";
+  location.href = `/${mount}/a/${encodeURIComponent(payload.app)}`;
+}
+
+const worker = await register();
+if (worker) {
+  // Three ways in, all the same payload shape.
+  //  1. the CLI, which posts the release to this page and names it in the fragment
+  //  2. a URL the host page was given
+  //  3. a dropped .himi
+  const hash = new URLSearchParams(location.hash.slice(1));
+  const src = hash.get("release") ?? new URLSearchParams(location.search).get("release");
+  if (src) {
+    const s = step("Fetching the release");
+    try {
+      const res = await fetch(src);
+      if (!res.ok) throw new Error(`the release URL answered HTTP ${res.status}`);
+      const payload = await res.json();
+      s.done();
+      await loadAndGo(worker, payload);
+    } catch (e) { s.fail(String(e)); }
+  } else {
+    drop.hidden = false;
+    step("Waiting for a release").done("drop a .himi below");
+    for (const ev of ["dragenter", "dragover"]) {
+      drop.addEventListener(ev, (e) => { e.preventDefault(); drop.classList.add("over"); });
+    }
+    drop.addEventListener("dragleave", () => drop.classList.remove("over"));
+    drop.addEventListener("drop", async (e) => {
+      e.preventDefault();
+      drop.classList.remove("over");
+      const file = e.dataTransfer?.files?.[0];
+      if (!file) return;
+      const s = step(`Reading ${file.name}`);
+      try {
+        const { openPackageAsPayload } = await import("./package-reader.js");
+        const payload = await openPackageAsPayload(file);
+        s.done();
+        await loadAndGo(worker, payload);
+      } catch (err) { s.fail(String(err)); }
+    });
+  }
+}
+</script>

package/dist/browser-plane/package-reader.js

@@ -0,0 +1,4 @@
+var m="himi-package/2",E="himi-package/1",g="himi-package.json",b="release-manifest.json",H="source.zip";function w(n){return n?.contents==="dev"?"dev":"release"}var B=/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/,A=/^[a-f0-9]{64}$/;function S(n){return B.test(n)}function D(n){return Array.isArray(n.handlers)?n.handlers:[]}var v=n=>{if(typeof TextDecoder>"u")throw new Error("this JS host has no TextDecoder, so package text cannot be decoded safely");return new TextDecoder().decode(n)};function I(n,t,e){let s=n(t);if(!s)return null;try{return JSON.parse(v(s))}catch(r){return e.push(`${t} is not valid JSON: ${r.message}`),null}}function _(n,t={}){let e=[],s=[],r=I(n,g,e);if(!r&&t.requireHeader&&e.push(`${g} is missing \u2014 not a .himi package`),r&&r.format!==m&&r.format!==E&&e.push(`unsupported package format ${JSON.stringify(r.format)} (this build reads ${E} and ${m})`),r?.format===m&&r.launchMode!=="live"&&r.launchMode!=="snapshot"&&e.push(`${g} format ${m} needs launchMode "live" or "snapshot"`),r?.format===m&&(typeof r.contentHash!="string"||r.contentHash.trim()==="")&&e.push(`${g} format ${m} needs contentHash`),r&&r.contents!==void 0&&r.contents!=="release"&&r.contents!=="dev")e.push(`${g} has an unreadable contents ${JSON.stringify(r.contents)} (expected "release" or "dev")`);else if(r){let i=n(H)!==null;w(r)==="dev"&&!i&&e.push(`${H} is missing \u2014 the header says this package carries source`),w(r)==="release"&&i&&e.push(`${H} is present in a package whose header declares no source`)}let a=I(n,b,e);if(!a)return e.some(i=>i.startsWith(b))||e.push(`${b} is missing`),{ok:!1,errors:e,warnings:s,header:r,manifest:null};let p=a.screens,c=a.bundles;if((!p||typeof p!="object")&&e.push("release-manifest.json missing 'screens' object"),(!c||typeof c!="object")&&e.push("release-manifest.json missing 'bundles' object"),e.length>0)return{ok:!1,errors:e,warnings:s,header:r,manifest:a};r&&(r.app&&a.app&&r.app!==a.app&&e.push(`header app ${JSON.stringify(r.app)} disagrees with manifest app ${JSON.stringify(a.app)}`),r.releaseId&&a.releaseId&&r.releaseId!==a.releaseId&&e.push(`header releaseId ${JSON.stringify(r.releaseId)} disagrees with manifest releaseId ${JSON.stringify(a.releaseId)}`),t.contentHash&&r.contentHash&&t.contentHash!==r.contentHash&&e.push("contentHash mismatch \u2014 the package was truncated or modified after packing"));for(let[i,o]of Object.entries(p??{})){if(!S(i)){e.push(`screen id ${JSON.stringify(i)} is not a safe entry name`);continue}n(`screens/${i}.json`)||e.push(`screens/${i}.json missing (referenced in manifest)`);let u=o?.bundle;u!=null&&!(u in(c??{}))&&e.push(`screen "${i}" references bundle "${u}" which is absent from manifest.bundles`)}for(let[i,o]of Object.entries(c??{})){if(!o?.sha256||!A.test(o.sha256)){e.push(`bundle "${i}" has no valid sha256`);continue}n(`bundles/${o.sha256}.bundle.js`)||e.push(`bundles/${o.sha256}.bundle.js missing (bundle "${i}")`)}a.handlers!=null&&!Array.isArray(a.handlers)&&e.push(`manifest.handlers must be an array (got ${typeof a.handlers})`);for(let i of D(a)){let o=JSON.stringify(i?.id??"?");if(!i?.bundleHash||!A.test(i.bundleHash)){e.push(`handler ${o} has no valid bundleHash`);continue}n(`bundles/${i.bundleHash}.bundle.js`)||e.push(`bundles/${i.bundleHash}.bundle.js missing (handler ${o})`)}for(let[i,o]of Object.entries(a.assets??{})){if(!o?.sha256||!A.test(o.sha256)){e.push(`asset "${i}" has no valid sha256`);continue}n(`assets/${o.sha256}`)||e.push(`assets/${o.sha256} missing (asset "${i}")`)}for(let i of Object.keys(a.widgets??{})){if(!S(i)){e.push(`widget id ${JSON.stringify(i)} is not a safe entry name`);continue}n(`widgets/${i}.json`)||e.push(`widgets/${i}.json missing (referenced in manifest)`)}return(t.warnMissingDocs??!0)&&(n("app-config.json")||s.push("app-config.json is absent \u2014 the host has no navigation baseline"),n("tokens.json")||s.push("tokens.json is absent \u2014 the host falls back to default design tokens")),{ok:e.length===0,errors:e,warnings:s,header:r,manifest:a}}function j(n){return n.filter(t=>t.path!==g).slice().sort((t,e)=>t.path<e.path?-1:t.path>e.path?1:0).map(t=>`${t.path} ${t.hash}`).join(`
+`)}var L=67324752,V=33639248,G=101010256,P=null;function J(n){if(!P){P=new Uint32Array(256);for(let e=0;e<256;e++){let s=e;for(let r=0;r<8;r++)s=s&1?3988292384^s>>>1:s>>>1;P[e]=s>>>0}}let t=4294967295;for(let e=0;e<n.length;e++)t=P[(t^n[e])&255]^t>>>8;return(t^4294967295)>>>0}function Z(n){return!n||n.length>512||n.startsWith("/")||n.includes("\\")||n.includes("\0")||/^[A-Za-z]:/.test(n)?!1:!n.split("/").some(t=>t===""||t==="."||t==="..")}var F={maxCompressedBytes:64*1024*1024,maxExpandedBytes:256*1024*1024,maxEntries:1e4,maxDecompressionRatio:1e3};function M(n,t,e=F){if(n>e.maxCompressedBytes)throw new Error(`package archive is ${n} bytes, over the ${e.maxCompressedBytes}-byte compressed-size limit`);if(t.length>e.maxEntries)throw new Error(`package archive has ${t.length} entries, over the ${e.maxEntries}-entry limit`);let s=0;for(let r of t){if(s+=r.rawSize,s>e.maxExpandedBytes)throw new Error(`package expands to more than the ${e.maxExpandedBytes}-byte expanded-size limit`);if(r.rawSize>0&&(r.compSize===0||r.rawSize/r.compSize>e.maxDecompressionRatio))throw new Error(`package entry ${JSON.stringify(r.name)} exceeds the ${e.maxDecompressionRatio}:1 decompression-ratio limit`)}}function O(n){let t=new DataView(n.buffer,n.byteOffset,n.byteLength),e=o=>t.getUint32(o,!0),s=o=>t.getUint16(o,!0),r=-1,a=Math.max(0,n.length-65535-22);for(let o=n.length-22;o>=a;o--)if(e(o)===G){r=o;break}if(r<0)throw new Error("not a zip archive (no end-of-central-directory record)");let p=s(r+10),c=e(r+16),i=[];for(let o=0;o<p;o++){if(c+46>n.length||e(c)!==V)throw new Error("corrupt zip central directory");let u=s(c+10),d=e(c+16),f=e(c+20),l=e(c+24),$=s(c+28),N=s(c+30),z=s(c+32),k=e(c+42),h=v(n.subarray(c+46,c+46+$));if(c+=46+$+N+z,h.endsWith("/"))continue;if(!Z(h))throw new Error(`unsafe zip entry name: ${JSON.stringify(h)}`);if(k+30>n.length||e(k)!==L)throw new Error(`corrupt zip local header for ${h}`);let R=k+30+s(k+26)+s(k+28);if(R+f>n.length)throw new Error(`truncated zip entry ${h}`);i.push({name:h,method:u,crc:d,dataStart:R,compSize:f,rawSize:l})}return i}function C(n,t){if(t.length!==n.rawSize)throw new Error(`size mismatch for zip entry ${n.name}`);if(J(t)!==n.crc)throw new Error(`checksum mismatch for zip entry ${n.name} \u2014 the package is damaged`)}function q(){return typeof DecompressionStream<"u"}var K="this browser cannot open a compressed .himi package (DecompressionStream is unavailable) \u2014 open it with `himi run`, or host the package unpacked with `himi pack --format dir`";async function Y(n){if(!q())throw new Error(K);let t=new Blob([n]).stream().pipeThrough(new DecompressionStream("deflate-raw"));return new Uint8Array(await new Response(t).arrayBuffer())}async function W(n,t){let e=n.subarray(t.dataStart,t.dataStart+t.compSize),s;if(t.method===0)s=e.slice();else if(t.method===8)try{s=await Y(e)}catch(r){throw new Error(`corrupt entry ${t.name} \u2014 the package is damaged (${r.message})`)}else throw new Error(`unsupported compression method ${t.method} for ${t.name}`);return C(t,s),s}async function T(n){let t=n instanceof Uint8Array?n:new Uint8Array(n),e=new Map,s=O(t);M(t.length,s);for(let r of s)e.set(r.name,await W(t,r));return e}async function X(n,t,e){let s=c=>n.get(c)??null,r=await ee(n),a=_(s,{requireHeader:e.requireHeader,contentHash:r});if(!a.ok||!a.manifest)throw new Error(a.errors.length?`not a Himi package:
+  ${a.errors.join(`
+  `)}`:`not a Himi package \u2014 no ${b}`);if(w(a.header)==="dev")throw new Error("this package carries the app's source (a dev package). The web host opens release packages only \u2014 restore it with `himi import <package.himi>` instead.");let p=a.header?.app??a.manifest.app;if(!p)throw new Error("package declares no app id");return{app:p,header:a.header,manifest:a.manifest,read:s,validation:a,source:t}}async function Q(n){let t=await crypto.subtle.digest("SHA-256",n);return Array.from(new Uint8Array(t),e=>e.toString(16).padStart(2,"0")).join("")}async function ee(n){let t=await Promise.all(Array.from(n,async([s,r])=>({path:s,hash:await Q(r)}))),e=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(j(t)));return"sha256-"+btoa(String.fromCharCode(...new Uint8Array(e)))}async function U(n){return X(await T(await n.arrayBuffer()),{kind:"file",name:n.name},{requireHeader:!0})}var y=n=>n?new TextDecoder().decode(n):void 0;function x(n){if(!n)return;let t="",e=32768;for(let s=0;s<n.length;s+=e)t+=String.fromCharCode(...n.subarray(s,s+e));return btoa(t)}function ne(n){if(n)try{return JSON.parse(n)?.authConfig?.config?.clientId}catch{return}}function te(n){let t=n.manifest,e=d=>n.read(d),s={},r={};for(let[d,f]of Object.entries(t.screens??{})){let l=y(e(`screens/${d}.json`));l!==void 0&&(s[d]=l,f.descriptorHash&&(r[f.descriptorHash]=l))}let a=(d,f)=>{if(!d||r[d]!==void 0)return;let l=y(e(f))??y(e(`docs/${d}.json`));l!==void 0&&(r[d]=l)};for(let[d,f]of Object.entries(t.catalogs??{}))a(f,`catalogs/${d}.json`);a(t.tokensHash,"tokens.json"),a(t.appConfigHash,"app-config.json");let p={};for(let d of Object.values(t.bundles??{})){let f=x(e(`bundles/${d.sha256}.bundle.js`));f!==void 0&&(p[d.sha256]=f)}let c={};for(let d of Object.values(t.assets??{})){let f=x(e(`assets/${d.sha256}`));f!==void 0&&(c[d.sha256]={base64:f,contentType:d.contentType})}let i={};for(let d of Object.keys(t.widgets??{})){let f=y(e(`widgets/${d}.json`));f!==void 0&&(i[d]=f)}let o=y(e("app-config.json")),u=ne(o);return{app:n.app,manifest:t,screens:s,bundles:p,docs:r,assets:c,widgets:i,tokens:y(e("tokens.json")),appConfig:o,icon:x(e("icon.png")),header:n.header,...u?{wixClientId:u}:{}}}async function pe(n){let t=await U(n);return te(t)}export{pe as openPackageAsPayload,te as payloadFromPackage};

package/dist/browser-plane/preview-deferred/521a0e528916d678d7588b2cddf3dadd3bb959a6d62426382f61c77a82017e35.bin

@@ -0,0 +1 @@
+var e=``+new URL(`pdf.worker.min-BmVo14Nb.mjs`,import.meta.url).href;export{e as default};