@wix/himalaya-cli 0.1341.0 → 0.1342.0

package/dist/cli.mjs

@@ -3727,6 +3727,121 @@ var init_open_url = __esm({
   }
 });
 
+// src/browser-login.ts
+import { createServer } from "node:http";
+import { randomBytes as randomBytes2 } from "node:crypto";
+function defaultOpenBrowser(url) {
+  openUrl(url);
+}
+async function browserLogin(opts) {
+  const state = randomBytes2(16).toString("hex");
+  const log = opts.log ?? (() => {
+  });
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  return await new Promise((resolve61, reject) => {
+    let settled = false;
+    let loginUrl = "";
+    const server = createServer();
+    const finish2 = (fn2) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      server.close(() => fn2());
+      server.closeAllConnections?.();
+    };
+    const timer = setTimeout(() => {
+      finish2(() => reject(new Error(`login timed out after ${Math.round(timeoutMs / 1e3)}s waiting for the browser callback`)));
+    }, timeoutMs);
+    if (typeof timer.unref === "function") timer.unref();
+    const MAX_CALLBACK_BODY = 1024 * 1024;
+    const readCallback = (req, url, whenReady) => {
+      if (req.method !== "POST") {
+        whenReady(url.searchParams);
+        return;
+      }
+      const chunks = [];
+      let size = 0;
+      let tooLarge = false;
+      req.on("data", (c2) => {
+        size += c2.length;
+        if (size > MAX_CALLBACK_BODY) tooLarge = true;
+        else chunks.push(c2);
+      });
+      req.on("end", () => whenReady(tooLarge ? null : new URLSearchParams(Buffer.concat(chunks).toString("utf8"))));
+      req.on("error", () => whenReady(null));
+    };
+    server.on("request", (req, res) => {
+      const url = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (url.pathname !== "/callback") {
+        res.writeHead(404).end();
+        return;
+      }
+      readCallback(req, url, (params) => {
+        if (!params) {
+          res.writeHead(413, { "content-type": "text/plain" }).end("callback body too large");
+          finish2(() => reject(new Error("the login callback body was too large to be a valid token")));
+          return;
+        }
+        const token = params.get("token");
+        const gotState = params.get("state");
+        const error = params.get("error");
+        if (error) {
+          const safe = error.replace(/[^\x20-\x7e]/g, "").slice(0, 200);
+          res.writeHead(400, { "content-type": "text/plain" }).end(`login failed: ${safe}`);
+          finish2(() => reject(new Error(`issuer reported: ${safe}`)));
+          return;
+        }
+        if (gotState !== state) {
+          res.writeHead(403, { "content-type": "text/plain" }).end("state mismatch \u2014 possible callback hijack");
+          finish2(() => reject(new Error("state mismatch on the login callback \u2014 refusing the token")));
+          return;
+        }
+        if (!token) {
+          res.writeHead(400, { "content-type": "text/plain" }).end("missing token");
+          finish2(() => reject(new Error("the login callback carried no token")));
+          return;
+        }
+        res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", connection: "close" }).end(closePage(opts.doneTitle ?? "Signed in to himi"));
+        const extra = {};
+        for (const [k2, v2] of params) if (k2 !== "token" && k2 !== "state") extra[k2] = v2;
+        finish2(() => resolve61({ token, loginUrl, extra }));
+      });
+    });
+    server.on("error", (err) => finish2(() => reject(err)));
+    server.listen(opts.port ?? 0, "127.0.0.1", () => {
+      const addr = server.address();
+      const port = typeof addr === "object" && addr ? addr.port : 0;
+      if (!port) {
+        finish2(() => reject(new Error("could not bind a loopback port for the login callback")));
+        return;
+      }
+      const base = opts.ownerIssue.replace(/\/$/, "");
+      const q2 = new URLSearchParams({ ...opts.query ?? {}, callback_port: String(port), state, response_mode: "form_post" });
+      loginUrl = `${base}${opts.path ?? "/v1/owner/cli-login"}?${q2}`;
+      if (opts.noOpen) {
+        log(`Open this URL to sign in:
+  ${loginUrl}`);
+      } else {
+        log(`Opening your browser to sign in to Wix\u2026
+  (if it doesn't open: ${loginUrl})`);
+        (opts.openBrowser ?? defaultOpenBrowser)(loginUrl);
+      }
+    });
+  });
+}
+var DEFAULT_TIMEOUT_MS, closePage;
+var init_browser_login = __esm({
+  "src/browser-login.ts"() {
+    init_open_url();
+    DEFAULT_TIMEOUT_MS = 5 * 60 * 1e3;
+    closePage = (title) => `<!doctype html><meta charset="utf-8"><title>himi</title>
+<body style="font-family:system-ui,sans-serif;text-align:center;padding:56px;color:#111">
+<h1 style="font-size:20px;margin:0 0 8px">${title.replace(/[<>&"]/g, "")}</h1>
+<p style="color:#555;margin:0">You can close this tab and return to your terminal.</p>
+<script>setTimeout(function(){window.close()},1500)</script></body>`;
+  }
+});
+
 // src/cms-schema.ts
 var cms_schema_exports = {};
 __export(cms_schema_exports, {
@@ -160935,6 +161050,105 @@ var init_asc_status = __esm({
   }
 });
 
+// src/connector-token.ts
+var connector_token_exports = {};
+__export(connector_token_exports, {
+  runConnectorToken: () => runConnectorToken
+});
+async function runConnectorToken(sub, args, ctx) {
+  const base = ctx.ownerIssue.replace(/\/$/, "");
+  const doFetch = ctx.fetchImpl ?? fetch;
+  const managePage = `${base}${PREFIX}personal-token`;
+  if (sub === "create") {
+    if (args.days !== void 0 && !/^[0-9]{1,3}$/.test(args.days)) {
+      ctx.error(JSON.stringify({ ok: false, code: "invalid_days", error: "--days must be a whole number of days (1-90)" }));
+      return 2;
+    }
+    let result;
+    try {
+      result = await browserLogin({
+        ownerIssue: base,
+        path: `${PREFIX}personal-token`,
+        query: { ...args.name ? { name: args.name } : {}, ...args.days ? { days: args.days } : {} },
+        doneTitle: "Token created \u2014 return to your terminal",
+        log: ctx.log,
+        ...args.noOpen ? { noOpen: true } : {},
+        ...ctx.openBrowser ? { openBrowser: ctx.openBrowser } : {},
+        ...ctx.port ? { port: ctx.port } : {}
+      });
+    } catch (e2) {
+      ctx.error(JSON.stringify({
+        ok: false,
+        code: "token_create_failed",
+        error: e2.message,
+        hint: "sign in to wix.com in the browser that opened; with no browser here, pass --no-open and open the printed URL yourself"
+      }));
+      return 1;
+    }
+    const expiresAt = Number(result.extra.expires_at);
+    ctx.print({
+      ok: true,
+      id: result.extra.id,
+      ...Number.isFinite(expiresAt) ? { expiresAt: new Date(expiresAt).toISOString() } : {},
+      token: result.token,
+      mcpUrl: ctx.mcpUrl,
+      header: { name: "Authorization", value: `Bearer ${result.token}` },
+      howTo: "Add a custom MCP server in your tool: the URL above, authentication none / not required, and this header. Shown once \u2014 it is not stored.",
+      revoke: `himi connector token revoke ${result.extra.id ?? "<id>"} --target ${ctx.target}`
+    });
+    return 0;
+  }
+  if (sub === "list" || sub === "revoke") {
+    if (!ctx.controlToken) {
+      ctx.error(JSON.stringify({ ok: false, code: "not_signed_in", error: "not signed in", hint: `run \`himi login --browser --target ${ctx.target}\` first` }));
+      return 2;
+    }
+    if (sub === "revoke" && !args.id) {
+      ctx.error(JSON.stringify({ ok: false, code: "usage", error: "usage: himi connector token revoke <id>" }));
+      return 2;
+    }
+    const res = sub === "list" ? await doFetch(`${base}${PREFIX}personal-tokens`, { redirect: "error", headers: { "x-control-token": ctx.controlToken, accept: "application/json" } }) : await doFetch(`${base}${PREFIX}personal-tokens/revoke`, {
+      method: "POST",
+      redirect: "error",
+      headers: { "x-control-token": ctx.controlToken, "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({ id: args.id })
+    });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      const code = res.status === 404 && sub === "revoke" ? "token_not_found" : res.status === 404 ? "personal_tokens_unavailable" : res.status === 401 ? "not_signed_in" : "request_failed";
+      ctx.error(JSON.stringify({
+        ok: false,
+        code,
+        status: res.status,
+        ...body,
+        ...code === "token_not_found" ? { hint: `a token made for another of your Wix accounts is managed on ${managePage}` } : {}
+      }));
+      return 1;
+    }
+    if (sub === "list") {
+      const tokens2 = (body.tokens ?? []).map((t2) => ({
+        id: t2.id,
+        name: t2.name,
+        createdAt: new Date(t2.createdAt).toISOString(),
+        expiresAt: new Date(t2.expiresAt).toISOString()
+      }));
+      ctx.print({ ok: true, tokens: tokens2, note: `tokens of the account your \`himi login\` is for; every account's are on ${managePage}` });
+    } else {
+      ctx.print({ ok: true, revoked: args.id });
+    }
+    return 0;
+  }
+  ctx.error(JSON.stringify({ ok: false, code: "usage", error: "usage: himi connector token create [--name <n>] [--days <1-90>] [--no-open] | list | revoke <id>" }));
+  return 2;
+}
+var PREFIX;
+var init_connector_token = __esm({
+  "src/connector-token.ts"() {
+    init_browser_login();
+    PREFIX = "/v1/connector/oauth/";
+  }
+});
+
 // ../../core/functions-secrets/src/vault.ts
 import { createCipheriv, createDecipheriv as createDecipheriv2, randomBytes as randomBytes6 } from "node:crypto";
 import { mkdir, readFile as readFile2, rename, writeFile as writeFile2 } from "node:fs/promises";
@@ -164210,10 +164424,10 @@ function familyFromFontShorthand(value) {
   const WEIGHT = String.raw`bold|bolder|lighter|\d{3}`;
   const STRETCH = String.raw`(ultra-|extra-|semi-)?(condensed|expanded)`;
   const FUNC = String.raw`[a-z-]+\(.*\)${LINE}`;
-  const PREFIX = new RegExp(`^(${STYLE}|${VARIANT}|${WEIGHT}|${STRETCH}|${SIZE2}|${FUNC})$`, "i");
+  const PREFIX2 = new RegExp(`^(${STYLE}|${VARIANT}|${WEIGHT}|${STRETCH}|${SIZE2}|${FUNC})$`, "i");
   const parts = splitTopLevel(first, IS_SPACE).map((t2) => t2.trim()).filter(Boolean);
   let i2 = 0;
-  while (i2 < parts.length - 1 && PREFIX.test(parts[i2])) i2 += 1;
+  while (i2 < parts.length - 1 && PREFIX2.test(parts[i2])) i2 += 1;
   const raw = parts.slice(i2).join(" ").trim();
   const quoted = /^(['"])([\s\S]*)\1$/.exec(raw);
   const family = (quoted ? quoted[2] : raw).replace(/['"]/g, "").trim();
@@ -173751,112 +173965,8 @@ ${res.error?.message ?? ""}`;
   return { ok: false, session, message: `dpx auth status failed${firstLine ? `: ${firstLine}` : ""}` };
 }
 
-// src/browser-login.ts
-init_open_url();
-import { createServer } from "node:http";
-import { randomBytes as randomBytes2 } from "node:crypto";
-var DEFAULT_TIMEOUT_MS = 5 * 60 * 1e3;
-function defaultOpenBrowser(url) {
-  openUrl(url);
-}
-var CLOSE_PAGE = `<!doctype html><meta charset="utf-8"><title>himi login</title>
-<body style="font-family:system-ui,sans-serif;text-align:center;padding:56px;color:#111">
-<h1 style="font-size:20px;margin:0 0 8px">Signed in to himi</h1>
-<p style="color:#555;margin:0">You can close this tab and return to your terminal.</p>
-<script>setTimeout(function(){window.close()},1500)</script></body>`;
-async function browserLogin(opts) {
-  const state = randomBytes2(16).toString("hex");
-  const log = opts.log ?? (() => {
-  });
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  return await new Promise((resolve61, reject) => {
-    let settled = false;
-    let loginUrl = "";
-    const server = createServer();
-    const finish2 = (fn2) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      server.close(() => fn2());
-      server.closeAllConnections?.();
-    };
-    const timer = setTimeout(() => {
-      finish2(() => reject(new Error(`login timed out after ${Math.round(timeoutMs / 1e3)}s waiting for the browser callback`)));
-    }, timeoutMs);
-    if (typeof timer.unref === "function") timer.unref();
-    const MAX_CALLBACK_BODY = 1024 * 1024;
-    const readCallback = (req, url, whenReady) => {
-      if (req.method !== "POST") {
-        whenReady(url.searchParams);
-        return;
-      }
-      const chunks = [];
-      let size = 0;
-      let tooLarge = false;
-      req.on("data", (c2) => {
-        size += c2.length;
-        if (size > MAX_CALLBACK_BODY) tooLarge = true;
-        else chunks.push(c2);
-      });
-      req.on("end", () => whenReady(tooLarge ? null : new URLSearchParams(Buffer.concat(chunks).toString("utf8"))));
-      req.on("error", () => whenReady(null));
-    };
-    server.on("request", (req, res) => {
-      const url = new URL(req.url ?? "/", "http://127.0.0.1");
-      if (url.pathname !== "/callback") {
-        res.writeHead(404).end();
-        return;
-      }
-      readCallback(req, url, (params) => {
-        if (!params) {
-          res.writeHead(413, { "content-type": "text/plain" }).end("callback body too large");
-          finish2(() => reject(new Error("the login callback body was too large to be a valid token")));
-          return;
-        }
-        const token = params.get("token");
-        const gotState = params.get("state");
-        const error = params.get("error");
-        if (error) {
-          const safe = error.replace(/[^\x20-\x7e]/g, "").slice(0, 200);
-          res.writeHead(400, { "content-type": "text/plain" }).end(`login failed: ${safe}`);
-          finish2(() => reject(new Error(`issuer reported: ${safe}`)));
-          return;
-        }
-        if (gotState !== state) {
-          res.writeHead(403, { "content-type": "text/plain" }).end("state mismatch \u2014 possible callback hijack");
-          finish2(() => reject(new Error("state mismatch on the login callback \u2014 refusing the token")));
-          return;
-        }
-        if (!token) {
-          res.writeHead(400, { "content-type": "text/plain" }).end("missing token");
-          finish2(() => reject(new Error("the login callback carried no token")));
-          return;
-        }
-        res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", connection: "close" }).end(CLOSE_PAGE);
-        finish2(() => resolve61({ token, loginUrl }));
-      });
-    });
-    server.on("error", (err) => finish2(() => reject(err)));
-    server.listen(opts.port ?? 0, "127.0.0.1", () => {
-      const addr = server.address();
-      const port = typeof addr === "object" && addr ? addr.port : 0;
-      if (!port) {
-        finish2(() => reject(new Error("could not bind a loopback port for the login callback")));
-        return;
-      }
-      const base = opts.ownerIssue.replace(/\/$/, "");
-      loginUrl = `${base}/v1/owner/cli-login?callback_port=${port}&state=${state}&response_mode=form_post`;
-      if (opts.noOpen) {
-        log(`Open this URL to sign in:
-  ${loginUrl}`);
-      } else {
-        log(`Opening your browser to sign in to Wix\u2026
-  (if it doesn't open: ${loginUrl})`);
-        (opts.openBrowser ?? defaultOpenBrowser)(loginUrl);
-      }
-    });
-  });
-}
+// src/cli.ts
+init_browser_login();
 
 // src/cms.ts
 init_cms_schema();
@@ -175426,6 +175536,12 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
                                            Auth: the \`himi login --browser\` token, or
                                            --cookie/HIMI_WIX_COOKIE for a scripted call (a claim needs
                                            the XSRF-TOKEN cookie too).
+  himi connector token create [--name <n>] [--days <1-90>] [--no-open] | list | revoke <id> [--target <t>]
+                                           a personal access token for the hosted MCP connector, for a
+                                           tool that cannot sign in with OAuth (e.g. Base44's builder):
+                                           paste it there as the header Authorization: Bearer <token>.
+                                           create opens a Wix sign-in page and prints the token ONCE;
+                                           list/revoke use the \`himi login --browser\` token. Drafts only.
   himi whoami [--target <t>]               print the stored control token's identity for a target \u2014
                                            sub, credential kind, role, app scope, expiry. Purely LOCAL
                                            (decodes the token; no round trip), so it works offline.
@@ -176003,6 +176119,7 @@ var COMMANDS2 = [
   { name: "icon", summary: "the app's LAUNCHER icon \u2014 the home-screen / store mark, which is BINARY-floor and never over-the-air (distinct from `himi icons`, the in-screen glyph vocabulary). `status`/`check` report what this app would actually ship and validate it against both stores: exact 1024x1024, no tRNS chunk, non-interlaced, and \u2014 when the optional image toolchain is installed \u2014 no transparent regions (Apple permits an alpha channel but not transparent pixels: ITMS-90717), no pre-masked corners, no letterboxed wordmark; they also print the store-policy checklist no checker can decide. `set <file.png>` installs supplied art, `from-site` installs the logo `himi site analyze` downloaded, and `generate` makes a gradient tile + glyph \u2014 all three trim, flatten onto the app's accent, write the 1024 opaque master plus the 512 Play listing icon (Play wants 32-bit WITH alpha, so it is a separate file), and DECLARE it in himalaya.content.json, without which the release bakes no icon at all", required: "[status|check] | set <file.png> | from-site [--book <dir>] | generate [--glyph <g>] [--accent <hex>] | glyphs [--content <dir>] [--json]" },
   { name: "login", summary: "obtain a scoped serve-control token from Wix identity and store it in ~/.himalaya/serve-targets.json (so push/promote need no hand-pasted token). Three modes: --browser (your own Wix account, no VPN/BO), --wix (HEADLESS \u2014 the machine's own Wix CLI credential; the mode a CI pod or agent container can satisfy), --dpx (Wix employee, reads ~/.dpx/session/token). RFC 0026 WS3.", required: "[--browser|--wix|--dpx] [--target <t>] [--issue-url <url>]" },
   { name: "logout", summary: "remove the stored control token for a target", required: "[--target <t>]" },
+  { name: "connector", summary: "personal access tokens for the hosted MCP connector (Wix Native App Builder), for an AI tool that cannot sign in with OAuth (e.g. Base44's builder): `token create` opens a Wix sign-in page and prints a long-lived token once, to paste into the tool as `Authorization: Bearer <token>`; `token list` / `token revoke <id>` manage them with the `himi login --browser` token. The token can only build and publish DRAFTS.", required: "token create [--name <n>] [--days <1-90>] [--no-open] | token list | token revoke <id> [--target <t>]" },
   { name: "notify", summary: "Hosted --all-members requires --yes for a live send; --dry-run checks ownership/readiness and counts approved recipients without sending. `setup` optionally configures Branded/Ping from local customer key files; `status --refresh` reads live backend readiness. Setup may be deferred while building. These use serve-control and require owner plus Wix account authentication. `send`, `tokens`, `doctor`: send a REAL push notification to registered devices (RFC 0036 WS5) \u2014 APNs .p8 over HTTP/2 for iOS, FCM v1 for Android. `send` targets one device (--token / --device <registry id>) or fans out to the whole app (--all), reporting a per-device result; a token the provider says is uninstalled (APNs 410 Unregistered / FCM UNREGISTERED) is auto-disabled, while a merely wrong one (BadDeviceToken \u2014 usually a sandbox/production mismatch) is recorded and left enabled. `tokens` lists the registry. `doctor` reports which credentials resolve and which sender each platform picks. Talks to the admin-server via --admin-url/HIMALAYA_ADMIN_URL, authenticated with --admin-session/HIMALAYA_ADMIN_SESSION. `send --provider ping` is the hosted alternative: the serve plane sends to one site member (--member-email) or all approved members (--all-members) through Ping as Himalaya, with owner login instead of provider keys, and reports acceptance, never delivery. NOT `himi push`, which publishes a release.", required: "setup|status [--content <dir>] [--target <t>] [--refresh] [--yes] [--no-push-setup] | send --provider ping [--content <dir>] [--app <a>] [--site <msid>] (--member-email <email> | --all-members (--dry-run | --yes)) --title <s> [--body <s>] --link <url> [--request-id <uuid>] [--dry-run] [--json] | send|tokens|doctor [--app <a>] [--token <t> | --device <id> | --all] [--title <s>] [--body <s>] [--link <url>] [--platform ios|android] [--badge <n>] [--channel <id>] [--silent] [--dry-run] [--json]" },
   { name: "signing", summary: "READ-ONLY App Store Connect inventory for customer BYO TestFlight readiness. `inspect` lists whether the bundle id, distribution certificate, IOS_APP_STORE profile, and ASC app record exist for --bundle-id / --team-id using a local ASC .p8 (flags or ASC_KEY_* env). Never uploads or mutates Apple resources. Optional --cert-file/--profile-file classify on-disk material.", required: "inspect --bundle-id <id> --team-id <id> --asc-key-file <path> --asc-key-id <id> --asc-issuer-id <id> [--cert-file <p12> --cert-password <pw> --profile-file <mobileprovision>] [--json]" },
   { name: "site", summary: "PROVISION a Wix project, then analyze or extend it. `create` is the one door that makes a site instead of adopting one: POST /funnel/projects/v1/create (a WIX site, a HEADLESS backend, a BRANDED_APP, or a VIBE site), and for headless it also mints the OAuth app whose id IS the `WIX_CLIENT_ID` \u2014 with --redirect-uri already registered, because an unregistered redirect makes native signInDirect fail at redirect-session. `--verticals` REQUIRES `--template` and reports only what Wix confirmed: measured, installing onto a project created from the BLANK template returns 200 while the vertical's API answers 428 forever, because there is no site for it to attach to (the install asks for CREATE_SITE). A real template ships its verticals installed and populated, and installing further ones onto it then works. It MUTATES your Wix account and needs --yes; without it you get the payload and nothing is sent. `list` is the read-only site inventory (with each site's premium flag, which is what explains an installed-but-428 vertical). Auth is the account-scoped `wix token` (no --site), falling back to WIX_API_KEY + WIX_ACCOUNT_ID. `client` is the same OAuth step for a site that ALREADY exists \u2014 the one himi adopts rather than makes \u2014 so a clientId no longer means a manual trip to the dashboard: `client ensure` reconciles rather than mints, because a site can already carry a client with NO registered redirect and shipping that one fails signInDirect at runtime; it reuses a client that carries --redirect-uri, PATCHes one that matches --name but lacks it (unioning, so another app's redirect survives), and creates only when there is nothing to reuse (--new forces a fresh one). --name IS the idempotency key. `client` auth is SITE-scoped (`wix token --site <msid>`) because minting is owner-of-that-site, and --yes gates every mutation: a site that already has a usable client resolves WITHOUT it, but --write-provisioning needs --yes even then because it rewrites a manifest on disk (the dry run's planned.provisioning names the file). That query endpoint IGNORES paging (measured: query.paging, cursorPaging and a top-level paging all return the full set at offset 0), so when pagingMetadata reports more clients than came back, `ensure` REFUSES EVERY outcome \u2014 create, patch AND reuse. Reuse is refused too because pickClient breaks ties on the OLDEST createdDate, so an omitted older same-named MOBILE client with the same redirect would win a later complete read and the resolved clientId would MOVE between runs \u2014 and it gets written into provisioning.json; convergence is what makes a stray duplicate untidy rather than harmful. --name cannot narrow the query (no filter is sent; the name is applied to the rows after they arrive), so the recovery is the dashboard; --new skips the query entirely. A `patched` result is verified against what Wix STORED \u2014 the redirect list is read off the PATCH response, and re-read via GET when the response omits it, because falling back to the list himi just sent would make the guard pass vacuously on exactly the silent no-op it exists to catch. `client list` is the read-only inventory of a site's clients: act on its `shippable` column rather than `hasRedirect`, because shippable ALSO requires a MOBILE applicationType and `ensure` refuses a WEB client \u2014 a WEB one carrying your redirect looks right and is not a candidate \u2014 and it sets truncated:true rather than presenting a partial inventory as the whole one. `analyze --read-only` returns API-only generation context as JSON (identity, access probes, CMS permissions and selected redacted Velo source); it needs no browser and never uploads or applies anything. A URL is optional there: `--url` lets it read the published page's Velo code-app ids (credential-free, pinned transport) so the backend source is found on sites where the owner code-app probe 404s. `analyze` reads a site into a business-book folder (REST + Playwright, GET-only); `--url` alone is the visitor-only pass over the published pages, and `--client-id` adds the vertical probes and the app binding `--apply` requires; `site function` list/get/put/publish/invokes that site's Velo HTTP functions and is not `himi functions` (serve-plane jobs). `--apply` bakes into a brandable shell (a site shell needs no `--client-id`: it is visitor-only and binds no client); `--shell` takes the same names `himi dist --shell` does and defaults to branded-lite, and a shell that ships no prepare:customer is refused by name rather than half-built. `--shell brandy` (the site shell, RFC 0062) also derives the site's page map from its published pages and header menu \u2014 Home first, up to four tabs for the pages a visitor returns to, the rest in the drawer \u2014 into the overlay's `site` block, so it can be edited before `--apply`; only a site shell ever receives that block. It never overwrites any shell's committed apps/<shell>/provisioning.json.", required: "create <name> [--type wix|headless|branded-app|vibe] [--template <guid>] [--verticals stores,bookings,\u2026] [--folder <guid>] [--redirect-uri <uri>] [--no-oauth-app] [--write-provisioning [path]] [--site-url <url>] [--json] --yes | list | client ensure|list --site <msid> [--name <name>] [--redirect-uri <uri>] [--new] [--write-provisioning [path]] [--site-url <url>] [--json] --yes | analyze --read-only [--site <msid>] [--client-id <id>] [--url <https>] [--json] | analyze --url <https> [--client-id <id>] [--site <msid>] [--out <dir>] [--redirect-uri <uri>] [--apply] [--shell " + SHELL_ENUM + "] | function list|get|put|publish|invoke [--site <msid>] [--url <https>] [--method GET|POST|PUT|DELETE] [--source <file>] [--body <json>] [--publish] [--invoke]" },
@@ -183345,6 +183462,48 @@ ${label2}`);
           return 1;
         }
       }
+      case "connector": {
+        if (pos[1] !== "token") {
+          io2.error(JSON.stringify({ ok: false, code: "usage", error: "usage: himi connector token create|list|revoke" }));
+          return 2;
+        }
+        const target = targetName();
+        let ownerIssue;
+        let controlToken;
+        try {
+          const t2 = resolveTarget({ target, ownerIssueUrl: str9(flags["owner-issue-url"]), controlToken: str9(flags["control-token"]) });
+          ownerIssue = t2.ownerIssue;
+          controlToken = t2.controlToken;
+        } catch (e2) {
+          io2.error(JSON.stringify({ ok: false, code: "target_unresolved", error: e2.message }));
+          return 2;
+        }
+        if (!ownerIssue) {
+          io2.error(JSON.stringify({ ok: false, code: "no_owner_issuer", error: `no owner issuer for target "${target}"`, hint: "use --target wix, or set target.ownerIssue" }));
+          return 2;
+        }
+        const refusal = ownerIssuerRefusal(ownerIssue);
+        if (refusal) {
+          io2.error(JSON.stringify(refusal));
+          return 2;
+        }
+        const { runConnectorToken: runConnectorToken2 } = await Promise.resolve().then(() => (init_connector_token(), connector_token_exports));
+        const issuerHost = new URL(ownerIssue).hostname;
+        const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(issuerHost);
+        return await runConnectorToken2(
+          pos[2],
+          { id: pos[3], name: str9(flags.name), days: str9(flags.days), noOpen: flags["no-open"] === true },
+          {
+            ownerIssue,
+            ...controlToken ? { controlToken } : {},
+            target,
+            mcpUrl: str9(flags["mcp-url"]) ?? `${loopback ? ownerIssue.replace(/\/$/, "") : SERVE_ORIGIN_PUBLIC_APPS}/v1/connector/mcp`,
+            print,
+            error: (l2) => io2.error(l2),
+            log: (l2) => io2.error(l2)
+          }
+        );
+      }
       case "logout": {
         const target = targetName();
         let revoked;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1341.0",
+  "version": "0.1342.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "bcfe44cf5aea10286d209c5f29feefad31023f7e7984e176976925d3"
+  "falconPackageHash": "5025968d49cb54fee85788f23bacdd1fc4e38f6346a06dc2a2bd81c4"
 }