@wix/himalaya-cli 0.963.0 → 0.965.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/auth-providers/wix/src/engine-timers.d.ts

@@ -0,0 +1,17 @@
+/** Thrown by the default `sleep` on an engine with no timers, instead of a bare `ReferenceError`
+ *  escaping a Promise executor. Named so a caller can tell a missing seam from a network fault. */
+export declare class NoTimerError extends Error {
+    constructor(what: string);
+}
+/**
+ * The default pacing seam for the polling ceremonies: a real timed wait where the engine has
+ * timers, a named rejection where it does not.
+ *
+ * `what` names the caller so the message points at the config that needs a `sleep`.
+ *
+ * The global is read as a PROPERTY of `globalThis` — `undefined` on an engine that lacks it —
+ * rather than as the bare identifier that throws, and it is invoked with `globalThis` as its
+ * receiver: a DETACHED browser `setTimeout` raises "Illegal invocation", so `timer(fn, ms)`
+ * would have traded one engine's failure for another's.
+ */
+export declare function engineSleep(what: string): (ms: number) => Promise<void>;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/auth-providers/wix/src/index.d.ts

@@ -8,6 +8,7 @@ export { SessionIDService, InMemorySessionIDStore, bsiShouldRotate, localDayInde
 export { policyFor as wixRequestPolicy, isFirstPartyWixHost, isSignedUploadTarget, type MobileRequestKind, type RequestPolicy, } from "./request-policy.js";
 export { METASITE_HEADER, SIGNED_INSTANCE_EXP_HEADER, AUTH_PROXY_PREFIX, authProxyHeaders, authProxyPseudoInstance, isAuthProxyInstance, authProxyBusinessId, parseSignedInstanceExp, isSignedInstanceExpired, } from "./auth-proxy.js";
 export { DeviceAuthClient, DeviceAuthError, parseDeviceQr, type DeviceAuthorization, type DeviceAuthTokens, type DeviceAuthResult, type DeviceAuthConfig, type DeviceAuthTerminal, } from "./device-auth.js";
+export { NoTimerError, engineSleep } from "./engine-timers.js";
 export { buildRegistrationOptions, buildAuthenticationOptions, authenticatorDataCounter, assertSignCountAdvanced, PasskeyCloneError, type RegistrationOptions, type AuthenticationOptions, } from "./passkey-ceremony.js";
 export { WixAuthModalities, classifyAuthErrorCode, type PushApprovalState, type AuthModalitiesConfig, } from "./auth-modalities.js";
 export { shouldEscalateCaptcha, captchaResponseFields, CaptchaEscalation, CAPTCHA_ESCALATION_CODES, type CaptchaTier, } from "./captcha-escalation.js";

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/auth-providers/wix/src/worker-safe.d.ts

@@ -1,5 +1,6 @@
 export * from "./device-auth.js";
 export * from "./auth-modalities.js";
+export * from "./engine-timers.js";
 export * from "./captcha-escalation.js";
 export * from "./passkey-ceremony.js";
 export * from "./session-id.js";

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/time.mjs

@@ -57,7 +57,7 @@ function relativeDayWord(diff, opts) {
   const RTF = globalThis.Intl?.RelativeTimeFormat;
   if (typeof RTF === "function") {
     try {
-      const words = new Intl.RelativeTimeFormat(opts.locale, { numeric: "auto" }).format(diff, "day");
+      const words = new RTF(opts.locale, { numeric: "auto" }).format(diff, "day");
       if (words) return words.charAt(0).toUpperCase() + words.slice(1);
     } catch {
     }

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-auth/worker.mjs

@@ -2,6 +2,26 @@ var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 
+// ../../stdlib/auth-providers/wix/src/engine-timers.ts
+var NoTimerError = class extends Error {
+  constructor(what) {
+    super(
+      `${what} needs to pace its polling, but this engine has no setTimeout (JSC worker scopes and QuickJS-ng have none). Pass a \`sleep\` in the config.`
+    );
+    this.name = "NoTimerError";
+  }
+};
+function engineSleep(what) {
+  return (ms) => {
+    const host = globalThis;
+    const timer = host.setTimeout;
+    if (typeof timer !== "function") return Promise.reject(new NoTimerError(what));
+    return new Promise((resolve) => {
+      timer.call(host, () => resolve(), ms);
+    });
+  };
+}
+
 // ../../stdlib/auth-providers/wix/src/device-auth.ts
 var DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 var DeviceAuthError = class extends Error {
@@ -47,7 +67,7 @@ var DeviceAuthClient = class {
     this.baseURL = config.baseURL ?? "https://www.wixapis.com";
     this.fetchImpl = config.fetchImpl ?? globalThis.fetch;
     this.now = config.now ?? Date.now;
-    this.sleep = config.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    this.sleep = config.sleep ?? engineSleep("DeviceAuthClient");
     this.devMode = config.devMode ?? false;
   }
   /** Constrained-device side: request a device_code + user_code (show as QR). */
@@ -457,7 +477,7 @@ var WixAuthModalities = class {
     __publicField(this, "devMode");
     this.baseURL = config.baseURL ?? "https://users.wix.com";
     this.fetchImpl = config.fetchImpl ?? globalThis.fetch;
-    this.sleep = config.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    this.sleep = config.sleep ?? engineSleep("WixAuthModalities");
     this.devMode = config.devMode ?? false;
   }
   /** Passwordless: email the user a magic sign-in link. Always "succeeds" for
@@ -1016,6 +1036,7 @@ export {
   InMemorySignedInstanceStorage,
   METASITE_HEADER,
   NativeAuthError,
+  NoTimerError,
   OAUTH_AUTHORIZE_ENDPOINT,
   PasskeyCloneError,
   REDACTED,
@@ -1040,6 +1061,7 @@ export {
   captchaResponseFields,
   classifyAuthErrorCode,
   dualDomainAuthorizeUrls,
+  engineSleep,
   isAuthProxyInstance,
   isFirstPartyWixHost,
   isSensitiveFreeTextName,

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-auth.mjs

@@ -682,6 +682,26 @@ function pickHeader(headers, name) {
   return void 0;
 }
 
+// ../../stdlib/auth-providers/wix/src/engine-timers.ts
+var NoTimerError = class extends Error {
+  constructor(what) {
+    super(
+      `${what} needs to pace its polling, but this engine has no setTimeout (JSC worker scopes and QuickJS-ng have none). Pass a \`sleep\` in the config.`
+    );
+    this.name = "NoTimerError";
+  }
+};
+function engineSleep(what) {
+  return (ms) => {
+    const host = globalThis;
+    const timer = host.setTimeout;
+    if (typeof timer !== "function") return Promise.reject(new NoTimerError(what));
+    return new Promise((resolve) => {
+      timer.call(host, () => resolve(), ms);
+    });
+  };
+}
+
 // ../../stdlib/auth-providers/wix/src/device-auth.ts
 var DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 var DeviceAuthError = class extends Error {
@@ -727,7 +747,7 @@ var DeviceAuthClient = class {
     this.baseURL = config.baseURL ?? "https://www.wixapis.com";
     this.fetchImpl = config.fetchImpl ?? globalThis.fetch;
     this.now = config.now ?? Date.now;
-    this.sleep = config.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    this.sleep = config.sleep ?? engineSleep("DeviceAuthClient");
     this.devMode = config.devMode ?? false;
   }
   /** Constrained-device side: request a device_code + user_code (show as QR). */
@@ -890,7 +910,7 @@ var WixAuthModalities = class {
     __publicField(this, "devMode");
     this.baseURL = config.baseURL ?? "https://users.wix.com";
     this.fetchImpl = config.fetchImpl ?? globalThis.fetch;
-    this.sleep = config.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    this.sleep = config.sleep ?? engineSleep("WixAuthModalities");
     this.devMode = config.devMode ?? false;
   }
   /** Passwordless: email the user a magic sign-in link. Always "succeeds" for
@@ -1173,6 +1193,7 @@ export {
   METASITE_HEADER,
   MemberCaptchaPolicyStore,
   NativeAuthError,
+  NoTimerError,
   OAUTH_AUTHORIZE_ENDPOINT,
   PasskeyCloneError,
   REDACTED,
@@ -1204,6 +1225,7 @@ export {
   captchaTokensField,
   classifyAuthErrorCode,
   dualDomainAuthorizeUrls,
+  engineSleep,
   isAuthProxyInstance,
   isCaptchaDemandState,
   isFirstPartyWixHost,

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-stores.mjs

@@ -428,24 +428,138 @@ var CURRENCY_SYMBOL = {
   GBP: "\xA3",
   ILS: "\u20AA",
   AUD: "A$",
-  CAD: "C$",
+  CAD: "CA$",
   JPY: "\xA5",
-  INR: "\u20B9"
+  INR: "\u20B9",
+  KRW: "\u20A9",
+  CNY: "CN\xA5",
+  HKD: "HK$",
+  TWD: "NT$",
+  NZD: "NZ$",
+  MXN: "MX$",
+  BRL: "R$",
+  PHP: "\u20B1",
+  VND: "\u20AB",
+  XCD: "EC$",
+  XAF: "FCFA\xA0",
+  XOF: "F\u202FCFA\xA0",
+  XPF: "CFPF\xA0",
+  XCG: "Cg.\xA0",
+  // XXX is ISO 4217's "no currency", and ICU renders it with the GENERIC CURRENCY SIGN rather
+  // than the code. It is the one well-formed code that is not a currency, so it is exactly the
+  // one a hand-written table forgets — a catalog that returns `currency: "XXX"` for an unpriced
+  // item rendered "¤25.00" with Intl and "XXX 25.00" without it. The whole-alphabet sweep in
+  // `display-engine-floor.test.ts` is what found it, and is what keeps this table complete.
+  XXX: "\xA4"
 };
-function productCurrency(p) {
-  return p.currency || p.priceData?.currency || p.price?.currency || p.actualPriceRange?.minValue?.currency || "";
+var ZERO_DECIMAL_CURRENCY = {
+  AFN: true,
+  ALL: true,
+  BIF: true,
+  CLP: true,
+  COP: true,
+  DJF: true,
+  GNF: true,
+  HUF: true,
+  IDR: true,
+  IQD: true,
+  IRR: true,
+  ISK: true,
+  JPY: true,
+  KMF: true,
+  KPW: true,
+  KRW: true,
+  LAK: true,
+  LBP: true,
+  MGA: true,
+  MMK: true,
+  PKR: true,
+  PYG: true,
+  RWF: true,
+  SLL: true,
+  SOS: true,
+  SYP: true,
+  UGX: true,
+  VND: true,
+  VUV: true,
+  XAF: true,
+  XOF: true,
+  XPF: true,
+  YER: true,
+  // WITHDRAWN codes, every one found by the sweep rather than by reading a list. A catalog that
+  // has not been touched since the euro changeover still returns ESP or ITL, and ICU still
+  // formats them — so "obsolete" is not the same as "unreachable", and each was a live
+  // divergence ("ESP 25" with Intl, "ESP 25.00" without).
+  ADP: true,
+  BYR: true,
+  ESP: true,
+  ITL: true,
+  LUF: true,
+  MGF: true,
+  MRO: true,
+  STD: true,
+  TMM: true,
+  TRL: true,
+  UYI: true,
+  ZMK: true,
+  ZWD: true
+};
+function hasIntl() {
+  return typeof Intl !== "undefined" && typeof Intl.NumberFormat === "function";
+}
+function groupThousands(fixed) {
+  const parts = fixed.split(".");
+  const whole = parts[0];
+  let out = "";
+  for (let i = 0; i < whole.length; i++) {
+    if (i > 0 && (whole.length - i) % 3 === 0) out += ",";
+    out += whole[i];
+  }
+  return parts.length > 1 ? `${out}.${parts[1]}` : out;
 }
+function roundHalfExpand(abs, digits) {
+  const shifted = Number(`${abs}e${digits}`);
+  if (!Number.isFinite(shifted)) return abs;
+  const back = Number(`${Math.round(shifted)}e-${digits}`);
+  return Number.isFinite(back) ? back : abs;
+}
+var MAX_PRICE_DIGITS = 2;
 function formatMoney(amount, currency) {
   const num = typeof amount === "number" ? amount : Number(amount);
   if (currency && Number.isFinite(num)) {
-    try {
-      return new Intl.NumberFormat("en", { style: "currency", currency, maximumFractionDigits: 2 }).format(num);
-    } catch {
+    if (hasIntl()) {
+      try {
+        return new Intl.NumberFormat("en", { style: "currency", currency, maximumFractionDigits: MAX_PRICE_DIGITS }).format(num);
+      } catch {
+      }
+    } else {
+      const code = currency.toUpperCase();
+      if (/^[A-Z]{3}$/.test(code)) return fallbackMoney(num, code);
     }
   }
   const symbol = currency ? CURRENCY_SYMBOL[currency] ?? "" : "";
   return symbol ? `${symbol}${amount}` : `${amount}`;
 }
+function fallbackMoney(num, code) {
+  const sign = num < 0 ? "-" : "";
+  const abs = Math.abs(num);
+  let body = roundHalfExpand(abs, MAX_PRICE_DIGITS).toFixed(MAX_PRICE_DIGITS);
+  if (body.indexOf("e") >= 0 || body.indexOf("E") >= 0) {
+    body = String(abs);
+  } else {
+    const minDigits = ZERO_DECIMAL_CURRENCY[code] ? 0 : MAX_PRICE_DIGITS;
+    while (body.indexOf(".") >= 0 && body.length - body.indexOf(".") - 1 > minDigits && body.charAt(body.length - 1) === "0") {
+      body = body.slice(0, -1);
+    }
+    if (body.charAt(body.length - 1) === ".") body = body.slice(0, -1);
+    body = groupThousands(body);
+  }
+  const symbol = CURRENCY_SYMBOL[code];
+  return symbol ? `${sign}${symbol}${body}` : `${sign}${code}\xA0${body}`;
+}
+function productCurrency(p) {
+  return p.currency || p.priceData?.currency || p.price?.currency || p.actualPriceRange?.minValue?.currency || "";
+}
 function productPrice(p) {
   const preformatted = p.priceData?.formatted?.price || p.price?.formatted?.price || p.actualPriceRange?.minValue?.formattedAmount;
   if (preformatted) return preformatted;

package/dist/cli.mjs

@@ -18547,7 +18547,6 @@ function shouldRevealError(args) {
 var EMAIL_RE, URL_HOST_RE, INTEGER_RE, NUMBER_RE;
 var init_validation = __esm({
   "../../core/ts/src/validation.ts"() {
-    "use strict";
     EMAIL_RE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/;
     URL_HOST_RE = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(:[0-9]+)?$/;
     INTEGER_RE = /^[+-]?[0-9]+$/;
@@ -21972,7 +21971,6 @@ function validateWorkerSubtree(raw, slotId, policy, actionCatalog) {
 var WORKER_SUBTREE_CEILINGS, ID_PART, ACTION_ID;
 var init_worker_subtree = __esm({
   "../../core/ts/src/worker-subtree.ts"() {
-    "use strict";
     init_worker_subtree_safe_types_generated();
     WORKER_SUBTREE_CEILINGS = Object.freeze({
       maxEncodedBytes: 65536,
@@ -43359,19 +43357,19 @@ var init_preview_assets_generated = __esm({
   "../../packages/serve/src/preview-assets.generated.ts"() {
     init_preview_assets_format();
     PREVIEW_ASSET_MANIFEST = [
-      { key: "assets/index-BdjUMoXo.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 985049, sha256: "f401b5ebead76d81b1f3d1d401b77925b53123856ababfc4d2d407656c10601d" },
-      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 985057, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
-      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1075981, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
-      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1166965, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
-      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1257945, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
-      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1348817, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
-      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 1439797, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
-      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 1548433, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
-      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 1657517, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
-      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 1766565, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
-      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 1874265, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
-      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 1962373, length: 4448, sha256: "03bf2b6c0fec31fec522df8100cdc53a195a5fe4b792d9dc2888476cb5226624" },
-      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 1966821, length: 13784, sha256: "cfb9465254fab84f0e084bb4542c282758ea29774b5f172840cc0b9e4194ef89" }
+      { key: "assets/index-BlqJ6MkY.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 985027, sha256: "1db151e9d0c547283501228ad0e7f6edd9ef257b04ae911ce939080b8eb66de9" },
+      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 985035, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
+      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1075959, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
+      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1166943, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
+      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1257923, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
+      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1348795, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
+      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 1439775, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
+      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 1548411, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
+      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 1657495, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
+      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 1766543, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
+      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 1874243, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
+      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 1962351, length: 4448, sha256: "b53a1165bdc4d5bbad25d8707e51f94d2928807521df4b01498d4bc32d7c46b8" },
+      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 1966799, length: 13784, sha256: "cfb9465254fab84f0e084bb4542c282758ea29774b5f172840cc0b9e4194ef89" }
     ];
   }
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.963.0",
+  "version": "0.965.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -64,5 +64,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "dbb3eeb010fcbce0f61b1efca974a99bfaa2c93d927b5d5405c8c34c"
+  "falconPackageHash": "070f35e7248854d18a4d539ddbf96c1e282ed1f644a96db961470496"
 }

package/templates/beauty-salon-owner/tier5-src/_shared/aria-chat.ts

@@ -1891,7 +1891,20 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       if (!url) return s;
       const target = o.resolveEntity?.(url) ?? null;
       if (target) return navigate(s, target);
-      if (o.openLink) { try { await o.openLink(url); } catch { /* best-effort */ } }
+      // THE SINK, and it had no scheme check until now — measured against the
+      // built bundle, `openLink` handed `tel:`, `myapp://` and `javascript:`
+      // straight to `capability.open_url.open`.
+      //
+      // The in-app resolution ABOVE is deliberately left alone: it matches
+      // dashboard paths and answers null for anything else, so it cannot be
+      // steered by a scheme, and guarding earlier would also reject the `id`
+      // form this action still accepts.
+      //
+      // Not currently exploitable — `extractLinks` only matches `https?://`, so
+      // nothing reaches here with another scheme today. That is exactly why it
+      // is worth adding: the widget footer already refuses a second time at its
+      // own sink, and this path was relying on a single filter for the same rule.
+      if (o.openLink && isWebUrl(url)) { try { await o.openLink(url); } catch { /* best-effort */ } }
       return s;
     },
 

package/templates/community-club-owner/tier5-src/_shared/aria-chat.ts

@@ -1891,7 +1891,20 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       if (!url) return s;
       const target = o.resolveEntity?.(url) ?? null;
       if (target) return navigate(s, target);
-      if (o.openLink) { try { await o.openLink(url); } catch { /* best-effort */ } }
+      // THE SINK, and it had no scheme check until now — measured against the
+      // built bundle, `openLink` handed `tel:`, `myapp://` and `javascript:`
+      // straight to `capability.open_url.open`.
+      //
+      // The in-app resolution ABOVE is deliberately left alone: it matches
+      // dashboard paths and answers null for anything else, so it cannot be
+      // steered by a scheme, and guarding earlier would also reject the `id`
+      // form this action still accepts.
+      //
+      // Not currently exploitable — `extractLinks` only matches `https?://`, so
+      // nothing reaches here with another scheme today. That is exactly why it
+      // is worth adding: the widget footer already refuses a second time at its
+      // own sink, and this path was relying on a single filter for the same rule.
+      if (o.openLink && isWebUrl(url)) { try { await o.openLink(url); } catch { /* best-effort */ } }
       return s;
     },
 

package/templates/events-meetups-owner/tier5-src/_shared/aria-chat.ts

@@ -1891,7 +1891,20 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       if (!url) return s;
       const target = o.resolveEntity?.(url) ?? null;
       if (target) return navigate(s, target);
-      if (o.openLink) { try { await o.openLink(url); } catch { /* best-effort */ } }
+      // THE SINK, and it had no scheme check until now — measured against the
+      // built bundle, `openLink` handed `tel:`, `myapp://` and `javascript:`
+      // straight to `capability.open_url.open`.
+      //
+      // The in-app resolution ABOVE is deliberately left alone: it matches
+      // dashboard paths and answers null for anything else, so it cannot be
+      // steered by a scheme, and guarding earlier would also reject the `id`
+      // form this action still accepts.
+      //
+      // Not currently exploitable — `extractLinks` only matches `https?://`, so
+      // nothing reaches here with another scheme today. That is exactly why it
+      // is worth adding: the widget footer already refuses a second time at its
+      // own sink, and this path was relying on a single filter for the same rule.
+      if (o.openLink && isWebUrl(url)) { try { await o.openLink(url); } catch { /* best-effort */ } }
       return s;
     },
 

package/templates/gym-fitness-owner/tier5-src/_shared/aria-chat.ts

@@ -1891,7 +1891,20 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       if (!url) return s;
       const target = o.resolveEntity?.(url) ?? null;
       if (target) return navigate(s, target);
-      if (o.openLink) { try { await o.openLink(url); } catch { /* best-effort */ } }
+      // THE SINK, and it had no scheme check until now — measured against the
+      // built bundle, `openLink` handed `tel:`, `myapp://` and `javascript:`
+      // straight to `capability.open_url.open`.
+      //
+      // The in-app resolution ABOVE is deliberately left alone: it matches
+      // dashboard paths and answers null for anything else, so it cannot be
+      // steered by a scheme, and guarding earlier would also reject the `id`
+      // form this action still accepts.
+      //
+      // Not currently exploitable — `extractLinks` only matches `https?://`, so
+      // nothing reaches here with another scheme today. That is exactly why it
+      // is worth adding: the widget footer already refuses a second time at its
+      // own sink, and this path was relying on a single filter for the same rule.
+      if (o.openLink && isWebUrl(url)) { try { await o.openLink(url); } catch { /* best-effort */ } }
       return s;
     },
 

package/templates/nonprofit-cause-owner/tier5-src/_shared/aria-chat.ts

@@ -1891,7 +1891,20 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       if (!url) return s;
       const target = o.resolveEntity?.(url) ?? null;
       if (target) return navigate(s, target);
-      if (o.openLink) { try { await o.openLink(url); } catch { /* best-effort */ } }
+      // THE SINK, and it had no scheme check until now — measured against the
+      // built bundle, `openLink` handed `tel:`, `myapp://` and `javascript:`
+      // straight to `capability.open_url.open`.
+      //
+      // The in-app resolution ABOVE is deliberately left alone: it matches
+      // dashboard paths and answers null for anything else, so it cannot be
+      // steered by a scheme, and guarding earlier would also reject the `id`
+      // form this action still accepts.
+      //
+      // Not currently exploitable — `extractLinks` only matches `https?://`, so
+      // nothing reaches here with another scheme today. That is exactly why it
+      // is worth adding: the widget footer already refuses a second time at its
+      // own sink, and this path was relying on a single filter for the same rule.
+      if (o.openLink && isWebUrl(url)) { try { await o.openLink(url); } catch { /* best-effort */ } }
       return s;
     },
 

package/templates/owner-lite/tier5-src/_shared/aria-chat.ts

@@ -1891,7 +1891,20 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       if (!url) return s;
       const target = o.resolveEntity?.(url) ?? null;
       if (target) return navigate(s, target);
-      if (o.openLink) { try { await o.openLink(url); } catch { /* best-effort */ } }
+      // THE SINK, and it had no scheme check until now — measured against the
+      // built bundle, `openLink` handed `tel:`, `myapp://` and `javascript:`
+      // straight to `capability.open_url.open`.
+      //
+      // The in-app resolution ABOVE is deliberately left alone: it matches
+      // dashboard paths and answers null for anything else, so it cannot be
+      // steered by a scheme, and guarding earlier would also reject the `id`
+      // form this action still accepts.
+      //
+      // Not currently exploitable — `extractLinks` only matches `https?://`, so
+      // nothing reaches here with another scheme today. That is exactly why it
+      // is worth adding: the widget footer already refuses a second time at its
+      // own sink, and this path was relying on a single filter for the same rule.
+      if (o.openLink && isWebUrl(url)) { try { await o.openLink(url); } catch { /* best-effort */ } }
       return s;
     },
 

package/templates/podcast-creator-owner/tier5-src/_shared/aria-chat.ts

@@ -1891,7 +1891,20 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       if (!url) return s;
       const target = o.resolveEntity?.(url) ?? null;
       if (target) return navigate(s, target);
-      if (o.openLink) { try { await o.openLink(url); } catch { /* best-effort */ } }
+      // THE SINK, and it had no scheme check until now — measured against the
+      // built bundle, `openLink` handed `tel:`, `myapp://` and `javascript:`
+      // straight to `capability.open_url.open`.
+      //
+      // The in-app resolution ABOVE is deliberately left alone: it matches
+      // dashboard paths and answers null for anything else, so it cannot be
+      // steered by a scheme, and guarding earlier would also reject the `id`
+      // form this action still accepts.
+      //
+      // Not currently exploitable — `extractLinks` only matches `https?://`, so
+      // nothing reaches here with another scheme today. That is exactly why it
+      // is worth adding: the widget footer already refuses a second time at its
+      // own sink, and this path was relying on a single filter for the same rule.
+      if (o.openLink && isWebUrl(url)) { try { await o.openLink(url); } catch { /* best-effort */ } }
       return s;
     },
 

package/templates/portfolio-creative-owner/tier5-src/_shared/aria-chat.ts

@@ -1891,7 +1891,20 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       if (!url) return s;
       const target = o.resolveEntity?.(url) ?? null;
       if (target) return navigate(s, target);
-      if (o.openLink) { try { await o.openLink(url); } catch { /* best-effort */ } }
+      // THE SINK, and it had no scheme check until now — measured against the
+      // built bundle, `openLink` handed `tel:`, `myapp://` and `javascript:`
+      // straight to `capability.open_url.open`.
+      //
+      // The in-app resolution ABOVE is deliberately left alone: it matches
+      // dashboard paths and answers null for anything else, so it cannot be
+      // steered by a scheme, and guarding earlier would also reject the `id`
+      // form this action still accepts.
+      //
+      // Not currently exploitable — `extractLinks` only matches `https?://`, so
+      // nothing reaches here with another scheme today. That is exactly why it
+      // is worth adding: the widget footer already refuses a second time at its
+      // own sink, and this path was relying on a single filter for the same rule.
+      if (o.openLink && isWebUrl(url)) { try { await o.openLink(url); } catch { /* best-effort */ } }
       return s;
     },
 

package/templates/restaurant-owner/tier5-src/_shared/aria-chat.ts

@@ -1891,7 +1891,20 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       if (!url) return s;
       const target = o.resolveEntity?.(url) ?? null;
       if (target) return navigate(s, target);
-      if (o.openLink) { try { await o.openLink(url); } catch { /* best-effort */ } }
+      // THE SINK, and it had no scheme check until now — measured against the
+      // built bundle, `openLink` handed `tel:`, `myapp://` and `javascript:`
+      // straight to `capability.open_url.open`.
+      //
+      // The in-app resolution ABOVE is deliberately left alone: it matches
+      // dashboard paths and answers null for anything else, so it cannot be
+      // steered by a scheme, and guarding earlier would also reject the `id`
+      // form this action still accepts.
+      //
+      // Not currently exploitable — `extractLinks` only matches `https?://`, so
+      // nothing reaches here with another scheme today. That is exactly why it
+      // is worth adding: the widget footer already refuses a second time at its
+      // own sink, and this path was relying on a single filter for the same rule.
+      if (o.openLink && isWebUrl(url)) { try { await o.openLink(url); } catch { /* best-effort */ } }
       return s;
     },
 

package/templates/retail-store-owner/tier5-src/_shared/aria-chat.ts

@@ -1891,7 +1891,20 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       if (!url) return s;
       const target = o.resolveEntity?.(url) ?? null;
       if (target) return navigate(s, target);
-      if (o.openLink) { try { await o.openLink(url); } catch { /* best-effort */ } }
+      // THE SINK, and it had no scheme check until now — measured against the
+      // built bundle, `openLink` handed `tel:`, `myapp://` and `javascript:`
+      // straight to `capability.open_url.open`.
+      //
+      // The in-app resolution ABOVE is deliberately left alone: it matches
+      // dashboard paths and answers null for anything else, so it cannot be
+      // steered by a scheme, and guarding earlier would also reject the `id`
+      // form this action still accepts.
+      //
+      // Not currently exploitable — `extractLinks` only matches `https?://`, so
+      // nothing reaches here with another scheme today. That is exactly why it
+      // is worth adding: the widget footer already refuses a second time at its
+      // own sink, and this path was relying on a single filter for the same rule.
+      if (o.openLink && isWebUrl(url)) { try { await o.openLink(url); } catch { /* best-effort */ } }
       return s;
     },
 

package/templates/yoga-studio-owner/tier5-src/_shared/aria-chat.ts

@@ -1891,7 +1891,20 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       if (!url) return s;
       const target = o.resolveEntity?.(url) ?? null;
       if (target) return navigate(s, target);
-      if (o.openLink) { try { await o.openLink(url); } catch { /* best-effort */ } }
+      // THE SINK, and it had no scheme check until now — measured against the
+      // built bundle, `openLink` handed `tel:`, `myapp://` and `javascript:`
+      // straight to `capability.open_url.open`.
+      //
+      // The in-app resolution ABOVE is deliberately left alone: it matches
+      // dashboard paths and answers null for anything else, so it cannot be
+      // steered by a scheme, and guarding earlier would also reject the `id`
+      // form this action still accepts.
+      //
+      // Not currently exploitable — `extractLinks` only matches `https?://`, so
+      // nothing reaches here with another scheme today. That is exactly why it
+      // is worth adding: the widget footer already refuses a second time at its
+      // own sink, and this path was relying on a single filter for the same rule.
+      if (o.openLink && isWebUrl(url)) { try { await o.openLink(url); } catch { /* best-effort */ } }
       return s;
     },