@wix/himalaya-cli 0.1376.0 → 0.1378.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/sdk/iap/src/wix-payments-contract.d.ts

@@ -56,9 +56,11 @@ export declare const STORES_APPLE_SALES_ENABLED = true;
 /** StartItemPayment's CatalogReference: the purchases catalog sells a Stores product under its product
  *  id (eCom's `catalogItemId`). One-time unlocks only, whatever the backend also accepts. */
 export declare const STORES_PRODUCT_SALE_RULE: AppleSaleRule;
-/** Off until a member's plan order, its cashier item id and Sandbox fulfillment are proven live.
- * Recurring and time-limited plans stay outside this rule; their Billing lifecycle is unfinished. */
-export declare const PRICING_PLAN_APPLE_SALES_ENABLED = false;
+/** One-time unlimited plans sell through the App Store. Proven live in Sandbox on 2026-10-19: a member's
+ *  online plan order is charged with one cashier item whose id is the plan id, so StartPayment maps it to the
+ *  plan's Apple product, and the order reads ACTIVE and PAID. Recurring and time-limited plans stay outside
+ *  this rule; their Billing lifecycle is unfinished. */
+export declare const PRICING_PLAN_APPLE_SALES_ENABLED = true;
 /**
  * The one definition `himi store iap connect` writes mappings by and the mapping source reads them by,
  * keyed by catalog kind. wix-iap StartPayment maps the cashier order's single item id, and Online

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/iap-checkout.mjs

@@ -689,7 +689,7 @@ var STORES_ITEM_PAYMENT_ENABLED = false;
 var STORES_APPLE_SALES_ENABLED = true;
 var STORES_PRODUCT_SALE_RULE = { appProductId: (id) => id, productType: "NON_CONSUMABLE" };
 var ONLINE_PROGRAM_SALE_RULE = { appProductId: (id) => id, productType: "NON_CONSUMABLE" };
-var PRICING_PLAN_APPLE_SALES_ENABLED = false;
+var PRICING_PLAN_APPLE_SALES_ENABLED = true;
 var PRICING_PLAN_SALE_RULE = { appProductId: (id) => id, productType: "NON_CONSUMABLE" };
 function appleSaleRules(options = {}) {
   return {

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/iap.mjs

@@ -667,7 +667,7 @@ var STORES_ITEM_PAYMENT_ENABLED = false;
 var STORES_APPLE_SALES_ENABLED = true;
 var STORES_PRODUCT_SALE_RULE = { appProductId: (id) => id, productType: "NON_CONSUMABLE" };
 var ONLINE_PROGRAM_SALE_RULE = { appProductId: (id) => id, productType: "NON_CONSUMABLE" };
-var PRICING_PLAN_APPLE_SALES_ENABLED = false;
+var PRICING_PLAN_APPLE_SALES_ENABLED = true;
 var PRICING_PLAN_SALE_RULE = { appProductId: (id) => id, productType: "NON_CONSUMABLE" };
 function appleSaleRules(options = {}) {
   return {

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/screens.mjs

@@ -942,7 +942,7 @@ var STORES_ITEM_PAYMENT_ENABLED = false;
 var STORES_APPLE_SALES_ENABLED = true;
 var STORES_PRODUCT_SALE_RULE = { appProductId: (id2) => id2, productType: "NON_CONSUMABLE" };
 var ONLINE_PROGRAM_SALE_RULE = { appProductId: (id2) => id2, productType: "NON_CONSUMABLE" };
-var PRICING_PLAN_APPLE_SALES_ENABLED = false;
+var PRICING_PLAN_APPLE_SALES_ENABLED = true;
 var PRICING_PLAN_SALE_RULE = { appProductId: (id2) => id2, productType: "NON_CONSUMABLE" };
 function appleSaleRules(options = {}) {
   return {

package/dist/cli.mjs

@@ -159772,7 +159772,7 @@ var init_wix_payments_contract = __esm({
     STORES_APPLE_SALES_ENABLED = true;
     STORES_PRODUCT_SALE_RULE = { appProductId: (id) => id, productType: "NON_CONSUMABLE" };
     ONLINE_PROGRAM_SALE_RULE = { appProductId: (id) => id, productType: "NON_CONSUMABLE" };
-    PRICING_PLAN_APPLE_SALES_ENABLED = false;
+    PRICING_PLAN_APPLE_SALES_ENABLED = true;
     PRICING_PLAN_SALE_RULE = { appProductId: (id) => id, productType: "NON_CONSUMABLE" };
     APPLE_SALE_RULES = appleSaleRules();
   }
@@ -160506,6 +160506,13 @@ async function readPlans(wix, notes) {
     throw e2;
   }
 }
+async function readOneTimeUnlimitedPlanIds(wix) {
+  const rows = await allByOffset(async (offset) => {
+    const res = await wix("GET", `/pricing-plans/v2/plans?limit=${PAGE2}&offset=${offset}`);
+    return { rows: res.plans ?? [], total: res.pagingMetadata?.total };
+  }, "/pricing-plans/v2/plans");
+  return new Set(rows.filter((p2) => planKind(p2.pricing) === "digital" && p2.archived !== true && typeof p2.id === "string").map((p2) => p2.id));
+}
 async function readWixCatalog(wix) {
   const notes = [];
   const items = [...await readStores(wix, notes), ...await readPrograms(wix, notes), ...await readPlans(wix, notes)];
@@ -160595,6 +160602,16 @@ var init_store_iap_purchases = __esm({
 });
 
 // src/store-iap-connect.ts
+async function planCheck(items, deps) {
+  const rules = deps.saleRules ?? APPLE_SALE_RULES;
+  if (!rules.pricingPlan || !items.some((item) => item.wix?.entityType === "pricingPlan")) return { ok: true, ids: /* @__PURE__ */ new Set() };
+  if (!deps.oneTimePlans) return { ok: false, why: "the site's plans were not read" };
+  try {
+    return { ok: true, ids: await deps.oneTimePlans() };
+  } catch (error) {
+    return { ok: false, why: `the site's plans could not be read (${error instanceof Error ? error.message : String(error)})` };
+  }
+}
 async function connectIap(manifest, deps, options) {
   const { target } = manifest;
   const report3 = (app2, appId2, rest) => {
@@ -160609,19 +160626,20 @@ async function connectIap(manifest, deps, options) {
       ...rest
     };
   };
+  const plans = await planCheck(manifest.items, deps);
   const found = await findOrRegister(deps.api, manifest, options.apply);
   if (!found.app) {
     const skipped = found.step.state === "planned" ? planned : noApp;
     return report3(found.step, null, {
       credentials: found.step.state === "planned" ? credentialsPlan(deps.appleKey) : skipped("the app is not registered"),
       provider: found.step.state === "planned" ? providerPlan(deps.provider) : skipped("the app is not registered"),
-      mappings: manifest.items.map((item) => mappingWithoutApp(item, found.step.state === "planned", deps.saleRules))
+      mappings: manifest.items.map((item) => mappingWithoutApp(item, found.step.state === "planned", plans, deps.saleRules))
     });
   }
   const { app } = found;
   const credentials = await storeKey(deps, app, options.apply);
   const provider = await connectProvider(deps.provider, app.id, options.apply);
-  const mappings = await mapItems(deps.api, app.id, manifest.items, options.apply, deps.saleRules);
+  const mappings = await mapItems(deps.api, app.id, manifest.items, options.apply, plans, deps.saleRules);
   return report3(found.step, app.id, { credentials, provider, mappings });
 }
 async function findOrRegister(api2, manifest, apply) {
@@ -160687,19 +160705,19 @@ function providerPlan(provider) {
     detail: "the appleIAP provider is connected through Serve's IAP routes (wix-iap ConnectProviderAccount), and this Serve target has none."
   };
 }
-async function mapItems(api2, appId2, items, apply, rules = APPLE_SALE_RULES) {
+async function mapItems(api2, appId2, items, apply, plans, rules = APPLE_SALE_RULES) {
   let catalog3;
   try {
     catalog3 = await api2.listProducts(appId2);
   } catch (error) {
     return items.map((item) => {
-      const target = mappingTarget(item, rules);
+      const target = mappingTarget(item, plans, rules);
       return "skip" in target ? target.skip : { ...target, ...failed("read the app's catalog", error) };
     });
   }
   const steps = [];
   for (const item of items) {
-    const target = mappingTarget(item, rules);
+    const target = mappingTarget(item, plans, rules);
     if ("skip" in target) {
       steps.push(target.skip);
       continue;
@@ -160719,7 +160737,7 @@ async function mapItems(api2, appId2, items, apply, rules = APPLE_SALE_RULES) {
   }
   return steps;
 }
-function mappingTarget(item, rules = APPLE_SALE_RULES) {
+function mappingTarget(item, plans, rules = APPLE_SALE_RULES) {
   const skip = (entity2, detail) => ({ skip: { entity: entity2, appProductId: null, storeProductId: item.productId, state: "skipped", code: "mapping_unsupported", detail } });
   if (!item.wix || item.unlocks?.length) {
     return skip(item.productId, "a consumable tier unlocks several Wix items, but a purchase pays one order item, so it cannot be mapped");
@@ -160730,6 +160748,12 @@ function mappingTarget(item, rules = APPLE_SALE_RULES) {
   if (PRODUCT_TYPE[item.type] !== rule.productType) {
     return skip(entity, `the App Store purchase flow sells ${item.wix.entityType} items only as ${rule.productType}, not ${PRODUCT_TYPE[item.type]}`);
   }
+  if (item.wix.entityType === "pricingPlan") {
+    if (!plans.ok) return skip(entity, `only one-time unlimited plans sell through the App Store, and ${plans.why}, so this plan was not mapped`);
+    if (!plans.ids.has(item.wix.entityId)) {
+      return skip(entity, "only one-time unlimited plans (one payment, valid until cancelled) sell through the App Store; this plan is recurring, time-limited, archived or not on the site");
+    }
+  }
   return { entity, appProductId: rule.appProductId(item.wix.entityId), storeProductId: item.productId, type: rule.productType };
 }
 function decide(catalog3, target) {
@@ -160752,8 +160776,8 @@ function decide(catalog3, target) {
   }
   return void 0;
 }
-function mappingWithoutApp(item, planning, rules = APPLE_SALE_RULES) {
-  const target = mappingTarget(item, rules);
+function mappingWithoutApp(item, planning, plans, rules = APPLE_SALE_RULES) {
+  const target = mappingTarget(item, plans, rules);
   if ("skip" in target) return target.skip;
   return planning ? { ...target, state: "planned", detail: `map ${target.appProductId} \u2192 ${target.storeProductId}` } : { ...target, ...noApp("the app is not registered") };
 }
@@ -161230,7 +161254,12 @@ async function connectWith(flags, deps, out2) {
   const transport = deps.wixTransport(manifest.target.wixSiteId);
   const route = deps.wixIapRoute();
   const serve = route ? deps.serveTransport?.(manifest.target.wixSiteId, previewTag) ?? transport : transport;
-  const connectDeps = { api: createPurchasesOwnerApi(transport), appleKey, provider: route ? wixIapProviderConnector(serve, route) : null };
+  const connectDeps = {
+    api: createPurchasesOwnerApi(transport),
+    appleKey,
+    provider: route ? wixIapProviderConnector(serve, route) : null,
+    oneTimePlans: () => readOneTimeUnlimitedPlanIds(transport)
+  };
   let plan;
   try {
     plan = await connectIap(manifest, connectDeps, { apply: false });

package/guides/himi-json-output.md

@@ -117,9 +117,9 @@ exit statuses remain intact. Manifest parsing failures still use their legacy en
 | `provider_not_connected` | wix-iap answered, but reported the provider account as not connected. |
 | `mapping_conflict` | The Wix item is already mapped to a different Apple product; left as it is. |
 | `mapping_inactive` | The mapping exists but is inactive; left as it is. |
-| `mapping_type_mismatch` | The mapping exists as a product type the purchase flow cannot sell (programs sell only as `NON_CONSUMABLE`); left as it is. |
+| `mapping_type_mismatch` | The mapping exists as a product type the purchase flow cannot sell (programs, Stores products and one-time plans sell only as `NON_CONSUMABLE`); left as it is. |
 | `sku_in_use` | The Apple product is already mapped to another Wix item; left as it is. |
-| `mapping_unsupported` | The purchase flow cannot map this item yet (a vertical other than Online Programs, a price tier, or a program declared as a consumable). |
+| `mapping_unsupported` | The purchase flow cannot map this item yet (a vertical other than Online Programs, Wix Stores or one-time Pricing Plans, a price tier, or an item declared as a consumable). |
 | `no_purchases_app` | A step did not run because the site has no purchases app for the bundle. |
 | `request_failed` | A purchases-service call failed for another reason; the original message is preserved. |
 | `setup_incomplete` | Steps are only planned (a dry run) or otherwise not yet in place. |

package/guides/iap-products.md

@@ -280,9 +280,12 @@ called as usual. In order:
    (`ConnectProviderAccount`). Reported as `provider_route_unavailable` only when the Serve target
    has no IAP routes; a refusal from the service behind it is `request_failed`. There is no read
    of the provider's state, so a rerun connects it again (the call is safe to repeat).
-4. **One mapping per Wix item → Apple product.** Online Programs map by program id (the id the
-   purchase flow looks up), and only as non-consumables. Other verticals, price tiers and
-   consumable programs are skipped with `mapping_unsupported`. An item already mapped to another
+4. **One mapping per Wix item → Apple product.** Online Programs map by program id, Wix Stores
+   digital products by product id, and one-time unlimited Pricing Plans by plan id (the ids the
+   purchase flow looks up), all only as non-consumables. A plan is mapped only when the site reads it
+   as one-time unlimited (one payment, valid until cancelled); a recurring, time-limited or archived
+   plan, or one connect cannot read, is skipped. Other verticals, price tiers and consumable items
+   are skipped with `mapping_unsupported`. An item already mapped to another
    product (`mapping_conflict`), a mapping of another product type (`mapping_type_mismatch`), an
    inactive mapping (`mapping_inactive`), or an Apple product mapped to another item
    (`sku_in_use`) is reported and left exactly as it is.

package/guides/index.json

@@ -240,6 +240,12 @@
       "category": "Wix SDK",
       "file": "wix-sdk-overview.md"
     },
+    {
+      "id": "wix-pro-gallery",
+      "title": "Build an app over Wix Pro Gallery",
+      "category": "Wix SDK",
+      "file": "wix-pro-gallery.md"
+    },
     {
       "id": "wix-login-integration",
       "title": "Add a Wix login gate",

package/guides/sdk-reference.json

@@ -1979,8 +1979,8 @@
       {
         "name": "PRICING_PLAN_APPLE_SALES_ENABLED",
         "kind": "const",
-        "jsdoc": "/** Off until a member's plan order, its cashier item id and Sandbox fulfillment are proven live.\n * Recurring and time-limited plans stay outside this rule; their Billing lifecycle is unfinished. */",
-        "decl": "export const PRICING_PLAN_APPLE_SALES_ENABLED = false;"
+        "jsdoc": "/** One-time unlimited plans sell through the App Store. Proven live in Sandbox on 2026-10-19: a member's\n *  online plan order is charged with one cashier item whose id is the plan id, so StartPayment maps it to the\n *  plan's Apple product, and the order reads ACTIVE and PAID. Recurring and time-limited plans stay outside\n *  this rule; their Billing lifecycle is unfinished. */",
+        "decl": "export const PRICING_PLAN_APPLE_SALES_ENABLED = true;"
       },
       {
         "name": "appleSaleRules",

package/guides/wix-api-usage.md

@@ -210,11 +210,11 @@ else the query 403s. In-repo, `core/dev-server/tier5-bundles-src/_shared/himi-cm
 
 ## Declared capability
 
-**Today** a worker touching a vertical / raw wixApi needs **no** `declared_capabilities` entry (the bridge is
-installed unconditionally). **Target (RFC 0043 D4):** declare **`wix_api`** — symmetric with `wix_platform`,
-enforced at both the SDK-import and native-registry layers. Declaring `wix_api` now is forward-compatible;
-once Phase 4 lands it becomes required. (Contrast: the cross-cutting facade `@himalaya/wix-platform` already
-requires `"wix_platform"`.)
+**Declare `wix_api`** for any worker that touches a vertical or raw `wixApi`. The web host's runtime denies a
+raw `wixApi.call` from a worker that did not declare it: the call fails with `capability not declared: wix_api`.
+Declare it in both places (the app-level `capabilities` in `config.ts` and the screen's `declaredCapabilities`) —
+see [Native capabilities](./himi-capabilities.md#2-declare--in-two-places). Declaring it is also what the other
+hosts will require. (Contrast: the cross-cutting facade `@himalaya/wix-platform` requires `"wix_platform"`.)
 
 ## Errors & best-effort
 

package/guides/wix-pro-gallery.md

@@ -0,0 +1,145 @@
+# Build an app over Wix Pro Gallery
+
+How to build a Himalaya app that shows a Wix site's **Pro Gallery** data: the galleries a site owner made in the Wix Editor and the images, videos and text items inside them.
+
+Read [the Wix API usage guide](./wix-api-usage.md) first for the `wixApi.call` bridge. This guide adds only what is specific to Pro Gallery.
+
+Each fact below names its source:
+
+- **[docs]** = a page on dev.wix.com (verified 2026-10-19).
+- **[call]** = a live call on a test site (2026-10-14; the list-limit and `itemLimit` checks were run again on 2026-10-19).
+- **[example]** = a Himalaya example app that renders all 13 Pro Gallery layouts and an expand-mode viewer.
+- **[device]** = a test on an Android emulator (2026-10-15 to 2026-10-18).
+
+## 1. What the API gives you
+
+[docs] The Pro Gallery API has these methods and no others:
+
+- Galleries: Create, Get, Update, Delete, List.
+- Gallery items: Create, Get, List, Update, Delete, Bulk Delete.
+- Webhooks: Gallery Created / Updated / Deleted and Gallery Item Created / Updated / Deleted.
+
+[docs] A gallery item is an image, a video or a text item. It has a title, a description and a link.
+
+[call] The gallery response holds items only. It has **no layout or style settings**. Your app picks a layout and stores its own settings (see section 6).
+
+## 2. Read the galleries the site owner made
+
+[docs] Wix does **not** recommend that you create galleries with the API. A gallery you create with the API exists only on the site's backend. It does not appear on the live site unless the owner connects it to a gallery component with code. Galleries that the owner adds in the Editor stay in sync both ways. Use the API to read and manage those galleries.
+
+[docs] The Gallery Created and Gallery Updated webhooks do not return the gallery's items. Listen to the Gallery Item Created and Gallery Item Updated webhooks for items.
+
+## 3. Read from a worker
+
+[call] A **visitor** token can read two endpoints:
+
+| Call | Use |
+| --- | --- |
+| `GET /pro-gallery/v2/galleries?limit=10&offset=&itemLimit=` | List galleries. The response has `totalGalleries` and, for each gallery, `name`, `totalItems` and the first `itemLimit` items. |
+| `GET /pro-gallery/v2/galleries/{id}?itemOffset=&itemLimit=` | One gallery. `gallery.totalItems` is the total number of items in the gallery (not a page count). Keep requesting with a growing `itemOffset` while it is below `totalItems`. |
+
+[call] Writes need an owner token. A visitor app does not write.
+
+[call] Limits you will hit:
+
+- `limit` is at most **10**. `limit=11` returns `limit got 11, expected 10 or less`.
+- `itemLimit` must be **1 or more**. `itemLimit=0` returns `itemLimit got 0, expected 1 or more`. To get only the gallery names and counts, ask for `itemLimit=1`.
+
+```ts
+const api = globalThis.himalaya?.wixApi;
+// First page of galleries, 4 preview items each
+const list = await api.call("GET", "/pro-gallery/v2/galleries?limit=10&offset=0&itemLimit=4");
+// One gallery, items 0..99. Keep paging with itemOffset while it is below gallery.totalItems.
+const one = await api.call("GET", `/pro-gallery/v2/galleries/${encodeURIComponent(id)}?itemOffset=0&itemLimit=100`);
+const { totalItems, items } = one.gallery;
+```
+
+[call] The same list call also returns 200 on `/progallery/v2/galleries` (checked 2026-10-19). The example app and this guide use `/pro-gallery/v2/...`.
+
+[example] The example app loads a gallery 100 items at a time and lists galleries 10 at a time.
+
+## 4. Item types
+
+All fields below come from [call] responses unless marked.
+
+| Item `type` | Where the media is | Notes |
+| --- | --- | --- |
+| `IMAGE` | `image.imageInfo`: `id`, `url`, `width`, `height`, `altText` | `url` is a `static.wixstatic.com` media URL. |
+| `VIDEO`, `video.type` = `WIX_MEDIA` | `video.videoInfo`: `url`, `resolutions[]` (mp4 `url`, `width`, `height`, `quality`), `posters[]` | Wix-hosted. The type is `WIX_MEDIA`, not `WIX`. |
+| `VIDEO`, `video.type` = `YOUTUBE` or `VIMEO` | `video.videoInfo.url` only | `resolutions` and `posters` are empty. There is no thumbnail in the response. |
+| `TEXT` | `text.html`, `text.css.backgroundColor` | The text is **HTML**. |
+
+Every item can also carry `title`, `description` and a `link` with `type`, `text`, `url` and `target`.
+
+Thumbnails for external video:
+
+- YouTube: build it from the video id, for example `https://img.youtube.com/vi/<id>/hqdefault.jpg` [example].
+- Vimeo: the response has no thumbnail, and this guide has no source for another way to get one. Show a placeholder.
+
+To create an image item you must pass the media id. Without it the call fails with `imageInfo … id must not be empty` [call].
+
+## 5. Resize images
+
+[docs] Add a transform to a Wix media URL:
+
+```
+{url}/v1/fit/w_{w},h_{h}/file.{ext}
+```
+
+- `fit` keeps the whole image. `fill` fills the box and crops. `crop` cuts a region (`x_`, `y_`, `w_`, `h_`).
+- `w` and `h` are 1 to 5000.
+- It works only for public media on `static.wixstatic.com`.
+- It never makes an image larger than the original.
+
+A `q_` quality parameter (for example `q_85`) also works in practice [example], but the transform page does **not** document it. Leave it out, or treat it as undocumented.
+
+Use a small size for tiles (the example app uses 800 px) and a large size for the full-screen viewer (2000 px).
+
+## 6. What the app must decide for itself
+
+- **Layout and display settings.** The API returns none, so choose a layout in the app and store the choice on the device [call].
+- **Loves / likes.** No page in the Pro Gallery API index, the gallery object, Get Gallery Item or the Velo backend introduction mentions loves or likes [docs]. An app can keep loves only on the device, so a count is that device's count.
+
+## 7. Layout recipes
+
+[example] Himalaya has no masonry or collage component. The example app builds all 13 Pro Gallery layouts (Grid, Masonry, Collage, Thumbnails, Slider, Slideshow, Panorama, Columns, Magic, Bricks, Mix, Alternate, Blog) like this:
+
+- **Masonry:** one single-column `Grid` per column. Split the items into the columns in the worker and bind each `Grid` to its own list.
+- **Collage-type layouts:** one row template for each shape of item group, chosen with `FragmentSlot`.
+- **Item ratio:** the example puts each item in one of six buckets by its width-to-height ratio, and picks row templates from the buckets.
+
+[example] A screen descriptor over **256 KiB** is rejected on push (`413 item_too_large`). `himi validate` and `himi test` do not check this size. A descriptor that holds all 13 layouts is too big, so the example app has **three gallery screens, one for each layout family**. A layout change to another family replaces the screen with the same gallery and settings.
+
+## 8. Viewer, slideshow, download and video on a device
+
+These come from Android emulator tests [device].
+
+- **Carousel.** A data-bound `Carousel` (`itemsPath`) is a plain scrolling row on native. It has no paging, no `onChange` and no autoplay. The example viewer and slideshow therefore show **one bound slide**, a swipe is `swipeDismiss`, and the example's slideshow autoplay is a `setTimeout` in the worker, guarded by `typeof setTimeout === "function"` [example]. Not every worker runtime has timers: the [Tier-5 guide](./tier-5-add-a-screen.md) says a worker has no clock and describes `refresh: { intervalMs, action }` and `_poll` for timed work. Autoplay was tested only with the `setTimeout` form, on Android; it was not tested with `refresh` or `_poll`.
+- **Declare the capabilities.** The download and video recipes below call `media_playback` and `photos`, and the worker calls the API with `wix_api`, which the web host denies when undeclared. The example app lists `media_playback`, `photos` and `wix_api` in the app-level `capabilities` in `config.ts`, and in the `declaredCapabilities` of every screen that runs its worker [example]. A call a screen did not declare is denied. See [Native capabilities](./himi-capabilities.md#2-declare--in-two-places).
+- **Download.** On Android, `photos.saveToLibrary` needs a file in the app's own store, not a URL. First call `media_playback.download` for the original image. Then pass the store-relative path to `photos.saveToLibrary`. The handle's `uri` is an absolute `file:` URI, and `saveToLibrary` rejects it.
+- **Wix video.** A Wix MP4 plays in the `Video` component.
+- **YouTube.** A YouTube embed in a `WebView` needs a `Referer` header. Without it the player shows "Error 153".
+- **Vimeo.** A Vimeo embed needs protected-media (DRM) support in the app. This is fixed in the app shell. An app binary built before the fix shows "Rights issue" on Android, so **rebuild the binary** (`himi dist`) with a current CLI and shell (see section 9).
+- **`WebView` URL from `$service:`.** On Android, a `WebView` whose `url` is a `$service:` binding never loads. Feed it from a one-row list and bind `$item.url`.
+
+## 9. Known limitations
+
+| Limitation | Status | Source |
+| --- | --- | --- |
+| No loves / likes in the public API. | Platform gap, no fix announced in the sources. Keep loves on the device. | [docs] |
+| Galleries made with the API do not show on the live site. | Wix design, stated in the Pro Gallery introduction. Create galleries in the Editor. | [docs] |
+| Vimeo shows "Rights issue" on Android. | Fixed in the app shell. Still present in binaries built before the fix: rebuild the binary. | [device] |
+| A data-bound `Carousel` does not page. | Open. One-slide viewer is the workaround; autoplay timing needs a worker timer (see section 8). | [device] |
+| A `WebView` bound to a `$service:` URL never loads on Android. | Open. Use the one-row list workaround. | [device] |
+| `photos.saveToLibrary` rejects a URL or an absolute `file:` URI on Android. | Open. Use the `media_playback.download` path in section 8. | [device] |
+| No thumbnail for Vimeo items. | Open. The response has none. | [call] |
+| The `q_` image parameter is undocumented. | Works in practice. Not on the Wix transform page. | [docs], [example] |
+
+## 10. Test data
+
+[call] To get test galleries on a site you own:
+
+1. Import media with `POST /site-media/v1/files/import`.
+2. Create galleries and items with an **owner** token (`wix token --site <msid>`).
+
+Remember section 2: a gallery created this way does not show on the live site, but a visitor read through the API returns it, so your app can show it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1376.0",
+  "version": "0.1378.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "4ea8c5abde370c4eec296f1ee365961a1dcd6337de44c6a859a25098"
+  "falconPackageHash": "797df247428aeadb6579acbf4bffa3856e28b369ea6eed3bc20ae80e"
 }