@wix/himalaya-cli 0.812.0 → 0.813.0

package/dist/cli.mjs

@@ -7890,6 +7890,25 @@ async function mintVisitor(clientId) {
   if (r.status !== 200 || !r.json.access_token) throw new Error(`visitor mint failed (${r.status})`);
   return r.json.access_token;
 }
+function isRedirectCallback(url, redirectUri) {
+  if (url.startsWith(redirectUri)) return true;
+  const path = (u) => u.pathname.replace(/\/+$/, "") || "/";
+  try {
+    const got = new URL(url);
+    const want = new URL(redirectUri);
+    return got.protocol === want.protocol && got.host === want.host && path(got) === path(want);
+  } catch {
+    return false;
+  }
+}
+function authCodeFrom(url) {
+  try {
+    const u = new URL(url);
+    return new URLSearchParams(u.hash.slice(1)).get("code") ?? u.searchParams.get("code") ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
 async function exchangeSessionToken(clientId, redirectUri, visitorToken, sessionToken) {
   const verifier = b64url(randomBytes4(32));
   const challenge = b64url(createHash9("sha256").update(verifier).digest());
@@ -7915,9 +7934,8 @@ async function exchangeSessionToken(clientId, redirectUri, visitorToken, session
   let url = fullUrl;
   let code;
   for (let hop = 0; hop < 8 && url; hop++) {
-    if (url.startsWith(redirectUri.split("://")[0] + "://")) {
-      const frag = new URL(url.replace("#", "?")).searchParams;
-      code = frag.get("code") ?? void 0;
+    if (isRedirectCallback(url, redirectUri)) {
+      code = authCodeFrom(url);
       break;
     }
     const res = await fetch(url, { redirect: "manual", headers: { "User-Agent": "Mozilla/5.0" } });
@@ -11459,7 +11477,6 @@ function shouldRevealError(args) {
 var EMAIL_RE, URL_HOST_RE, INTEGER_RE, NUMBER_RE;
 var init_validation = __esm({
   "../../core/ts/src/validation.ts"() {
-    "use strict";
     EMAIL_RE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/;
     URL_HOST_RE = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(:[0-9]+)?$/;
     INTEGER_RE = /^[+-]?[0-9]+$/;
@@ -14805,7 +14822,6 @@ function validateWorkerSubtree(raw, slotId, policy, actionCatalog) {
 var WORKER_SUBTREE_CEILINGS, ID_PART, ACTION_ID;
 var init_worker_subtree = __esm({
   "../../core/ts/src/worker-subtree.ts"() {
-    "use strict";
     init_worker_subtree_safe_types_generated();
     WORKER_SUBTREE_CEILINGS = Object.freeze({
       maxEncodedBytes: 65536,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.812.0",
+  "version": "0.813.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -63,5 +63,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "65ec344515508714eab1eee898f49b670f2ad738a0690a7a4dde7ed1"
+  "falconPackageHash": "da45e40ee81ea04e359c160e78f384cdb9e89688d8059747162fc2b6"
 }