@wix/himalaya-cli 0.951.0 → 0.953.0

package/dist/cli.mjs

@@ -5261,6 +5261,7 @@ function resolveTranslation(value, catalog, sourceCatalog) {
 var BINDING_SIGILS, BINDING_SIGIL_RE, TRANSLATION_PREFIX, TRANSLATION_KEY_RE;
 var init_bindings = __esm({
   "../../core/ts/src/bindings.ts"() {
+    "use strict";
     BINDING_SIGILS = ["service", "flag", "item", "t"];
     BINDING_SIGIL_RE = new RegExp(
       `^\\$(?:${BINDING_SIGILS.filter((s) => s !== "t").join("|")})\\b|^\\$t:`
@@ -18546,7 +18547,6 @@ function shouldRevealError(args) {
 var EMAIL_RE, URL_HOST_RE, INTEGER_RE, NUMBER_RE;
 var init_validation = __esm({
   "../../core/ts/src/validation.ts"() {
-    "use strict";
     EMAIL_RE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/;
     URL_HOST_RE = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(:[0-9]+)?$/;
     INTEGER_RE = /^[+-]?[0-9]+$/;
@@ -21971,7 +21971,6 @@ function validateWorkerSubtree(raw, slotId, policy, actionCatalog) {
 var WORKER_SUBTREE_CEILINGS, ID_PART, ACTION_ID;
 var init_worker_subtree = __esm({
   "../../core/ts/src/worker-subtree.ts"() {
-    "use strict";
     init_worker_subtree_safe_types_generated();
     WORKER_SUBTREE_CEILINGS = Object.freeze({
       maxEncodedBytes: 65536,
@@ -38341,7 +38340,34 @@ var init_app_source = __esm({
     init_pack();
     MAX_APP_SOURCE_BYTES = 4 * 1024 * 1024;
     SECRET_PATTERNS = [
-      { re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/, reason: "a PEM private key" },
+      // A real key, NOT source that discusses one. The BEGIN marker alone is not key material: it is
+      // a fixed English-ish string that legitimate source carries without embedding any secret — a
+      // validator that checks the prefix (apps/himi-branded-lite/store-release.ts), a test fixture that
+      // stubs a `.p8`, this very file's pattern list. Matching the marker refused to archive all of
+      // them, and the refusal's remedies did not fit real source, so the only escape was `--no-source`
+      // — turning the backup off on every push (#2914). What separates a key from talk about one is an
+      // actual base64 BODY of real volume, which prose and format-checking code do not carry.
+      //
+      // The body volume is COUNTED ACROSS LINE BREAKS rather than required as one unbroken run.
+      // Requiring 64 *contiguous* base64 characters — RFC 7468's 64-column wrap — missed a key
+      // re-wrapped narrower: a hand-edited key, or one a library emits at 48 or 32 columns, has no
+      // 64-char run at all, and a scanner whose whole job is to fail closed cannot narrow on the exact
+      // accident it exists to catch (an out-of-spec key that ends up in a repo). So the run allows the
+      // line-break tokens a wrapped body carries between its base64 chunks — a real `\n`/`\r`, or a
+      // LITERAL backslash-n from a key inlined into `.json`/`.env` (the commonest leak shape) — and
+      // requires 64 of those-or-base64 positions in total. That is a body regardless of wrap width,
+      // while staying far out of reach of prose and prefix-validating source, which break their base64
+      // runs on spaces, dots, hyphens and quotes long before 64. (64 total, not "a few hundred",
+      // because a real key split across an array of quoted per-line literals exposes as little as one
+      // 64-char line between the quotes — raising the bar would reopen the fail-closed hole downward.)
+      //
+      // The body is still required to FOLLOW the marker within a bounded window rather than be
+      // byte-adjacent to it, because a real key's body is not always the very next byte: an encrypted
+      // PEM carries `Proc-Type:`/`DEK-Info:` header lines first, and a key split across an array of
+      // string literals has quotes/commas between. `[\s\S]{0,256}?` (lazy) spans any of those and
+      // stops at the first qualifying body; 256 clears the longest real preamble while staying far too
+      // tight for an unrelated base64 constant elsewhere in a file to be mistaken for the body.
+      { re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]{0,256}?(?:[A-Za-z0-9+/]|\r|\n|\\n){64,}/, reason: "a PEM private key" },
       { re: /wixSession2=/, reason: "a Wix session cookie" },
       { re: /\bAKIA[0-9A-Z]{16}\b/, reason: "an AWS access key id" },
       { re: /\bgh[pousr]_[A-Za-z0-9]{20,}\b/, reason: "a GitHub token" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.951.0",
+  "version": "0.953.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -64,5 +64,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "56c5f7d7ce8fffb81bdbb20070597719b8337a8729a15f0eb51317bb"
+  "falconPackageHash": "2e4b7457716c298e3f9e505eae8b6ccdb0d636bc6cfd1a6e39220222"
 }