@wix/himalaya-cli 0.1539.0 → 0.1540.0

package/guides/component-reference.json

@@ -205,7 +205,7 @@
           ]
         }
       ],
-      "propsSource": "export interface TextFieldProps {\n  placeholder?: string;\n  /** LITERAL initial text. Renderers paint it verbatim — a `$service:` sentinel\n   *  here shows the raw token to the user. Bind `valuePath` instead. */\n  value?: string;\n  /** `$service:`/`$item.` binding → live text from the worker (overrides `value`).\n   *  Adopted while the field is NOT focused; an empty worker value (a draft reset\n   *  after send/post/submit) is adopted even mid-focus, so a cleared draft empties\n   *  the field without the worker ever fighting the caret. */\n  valuePath?: string;\n  onChange?: Action;\n  /** Text input enrichments. */\n  keyboard?: Keyboard;\n  secure?: boolean;\n  multilineMaxLines?: number;\n  maxLength?: number;\n  autoCapitalization?: AutoCapitalization;\n  onSubmit?: Action;\n  /** Keyboard control. `suggestions: \"off\"` kills autocorrect + the suggestion\n   *  strip. `submitLabel` paints the return key and, with `onSubmit`, fires it —\n   *  submitting dismisses the keyboard except for `\"next\"`, which keeps it up so\n   *  a worker can move focus on. */\n  suggestions?: Suggestions;\n  submitLabel?: SubmitLabel;\n  /** `$service:` binding → a TOKEN the worker changes to focus this field. Focus\n   *  is requested whenever the resolved value becomes a new NON-EMPTY value\n   *  (the first seed included, so a non-empty init focuses on open). Use a\n   *  monotonic nonce — `String(Date.now())` — since a latched boolean cannot\n   *  re-fire. Blur is the keyboard-dismiss capability, not a token here. */\n  focusPath?: string;\n  /** Accessory & state enrichments. */\n  leadingIcon?: IconRef;\n  trailingIcon?: IconRef;\n  clearButton?: boolean;\n  helperText?: string;\n  error?: boolean;\n  prefix?: string;\n  suffix?: string;\n  /** Drop the default rounded-border chrome so a caller background shows (composer pill). */\n  borderless?: boolean;\n  /** Declarative syntactic rules the RENDERER evaluates, so they hold with no\n   *  worker running (Tier 0-4) and with no bridge round-trip. Before this,\n   *  validation was reachable only by wrapping the field in `Form` -> `FormField`\n   *  - the shape the design guide steers you away from for hero flows. */\n  validation?: Validation;\n  /** `$service:`/`$item.` binding -> a worker-computed error string. Non-empty =\n   *  invalid. This is how SEMANTIC and CROSS-FIELD errors (\"passwords don't\n   *  match\", \"email taken\") reach the same error slot, with the same styling and\n   *  a11y wiring, as the declarative ones. Wins over `validation.message`. */\n  errorPath?: string;\n  /** LITERAL error string for a server-rendered screen with no worker to bind.\n   *  Lower precedence than `errorPath`, higher than the rules. */\n  errorText?: string;\n  /** Opt-in accessible show/hide button. Only applies to secure fields; initially masked. */\n  visibilityToggle?: boolean;\n}"
+      "propsSource": "export interface TextFieldProps {\n  placeholder?: string;\n  /** LITERAL initial text. Renderers paint it verbatim — a `$service:` sentinel\n   *  here shows the raw token to the user. Bind `valuePath` instead. */\n  value?: string;\n  /** `$service:`/`$item.` binding → live text from the worker (overrides `value`).\n   *  Adopted while the field is NOT focused; an empty worker value (a draft reset\n   *  after send/post/submit) is adopted even mid-focus, so a cleared draft empties\n   *  the field without the worker ever fighting the caret. */\n  valuePath?: string;\n  onChange?: Action;\n  /** Text input enrichments. */\n  keyboard?: Keyboard;\n  secure?: boolean;\n  multilineMaxLines?: number;\n  maxLength?: number;\n  autoCapitalization?: AutoCapitalization;\n  onSubmit?: Action;\n  /** Keyboard control. `suggestions: \"off\"` kills autocorrect + the suggestion\n   *  strip. `submitLabel` paints the return key and, with `onSubmit`, fires it —\n   *  submitting dismisses the keyboard except for `\"next\"`, which keeps it up so\n   *  a worker can move focus on. */\n  suggestions?: Suggestions;\n  submitLabel?: SubmitLabel;\n  /** `$service:` binding → a TOKEN the worker changes to focus this field. Focus\n   *  is requested whenever the resolved value becomes a new NON-EMPTY value\n   *  (the first seed included, so a non-empty init focuses on open). Use a\n   *  monotonic nonce — `String(Date.now())` — since a latched boolean cannot\n   *  re-fire. Blur is the keyboard-dismiss capability, not a token here. */\n  focusPath?: string;\n  /** Accessory & state enrichments. */\n  leadingIcon?: IconRef;\n  trailingIcon?: IconRef;\n  clearButton?: boolean;\n  helperText?: string;\n  error?: boolean;\n  prefix?: string;\n  suffix?: string;\n  /** Drop the default rounded-border chrome so a caller background shows (composer pill). */\n  borderless?: boolean;\n  /** Declarative syntactic rules the RENDERER evaluates, so they hold with no\n   *  worker running (Tier 0-4) and with no bridge round-trip. Before this,\n   *  validation was reachable only by wrapping the field in `Form` -> `FormField`\n   *  - the shape the design guide steers you away from for hero flows. */\n  validation?: Validation;\n  /** `$service:`/`$item.` binding -> a worker-computed error string. Non-empty =\n   *  invalid. This is how SEMANTIC and CROSS-FIELD errors (\"passwords don't\n   *  match\", \"email taken\") reach the same error slot, with the same styling and\n   *  a11y wiring, as the declarative ones. Wins over `validation.message`. */\n  errorPath?: string;\n  /** LITERAL error string for a server-rendered screen with no worker to bind.\n   *  Lower precedence than `errorPath`, higher than the rules. */\n  errorText?: string;\n  /** Opt-in accessible show/hide button. Only applies to secure fields; initially masked. */\n  visibilityToggle?: boolean;\n  /** `onChange` fires after this many ms of idle typing. 0 or unset = every change.\n   * A submit fires a pending debounced `onChange` first. */\n  debounceMs?: number;\n}"
     },
     {
       "name": "Toggle",
@@ -422,7 +422,9 @@
       "name": "SearchField",
       "category": "Search & filter",
       "propsType": "SearchFieldProps",
-      "bindings": [],
+      "bindings": [
+        "focusPath"
+      ],
       "dispatches": [
         {
           "callback": "onChange",
@@ -437,7 +439,7 @@
           "note": "These two rows share a control and key, so they are NOT independently gated: a payload observation cannot say which callback produced it, and a helper-mediated dispatch does not name the callback at the write site at all. The gate proves the callback is still referenced in the component that dispatches, not that this callback carries the payload."
         }
       ],
-      "propsSource": "export interface SearchFieldProps {\n  placeholder?: string;\n  value?: string;\n  onChange?: Action;\n  onSubmit?: Action;\n  debounceMs?: number;\n}"
+      "propsSource": "export interface SearchFieldProps {\n  placeholder?: string;\n  value?: string;\n  onChange?: Action;\n  onSubmit?: Action;\n  /** `onChange` fires after this many ms of idle typing; 0 or less (or unset) = 250 ms.\n   *  A submit fires a pending debounced `onChange` first. */\n  debounceMs?: number;\n  /** `$service:` binding → a focus TOKEN; `TextFieldProps.focusPath` semantics. */\n  focusPath?: string;\n}"
     },
     {
       "name": "FilterChips",

package/guides/component-reference.md

@@ -58,7 +58,7 @@ See also **[Modifiers](#modifiers)** (the `modifiers` block) and **[Actions](#ac
 | `Skeleton` | State envelopes | — |
 | `FragmentSlot` | Descriptor-shipped dynamic structure | `casePath` |
 | `WorkerSubtree` | Bounded worker-authored component tree | `treeJsonPath` |
-| `SearchField` | Search & filter | — |
+| `SearchField` | Search & filter | `focusPath` |
 | `FilterChips` | Search & filter | `optionsPath`, `selectedIds` |
 | `Tabs` | Navigation primitives | `optionsPath`, `activeColorPath`, `selectedId` |
 | `SegmentedControl` | Navigation primitives | `optionsPath`, `selectedId` |
@@ -620,6 +620,9 @@ export interface TextFieldProps {
   errorText?: string;
   /** Opt-in accessible show/hide button. Only applies to secure fields; initially masked. */
   visibilityToggle?: boolean;
+  /** `onChange` fires after this many ms of idle typing. 0 or unset = every change.
+   * A submit fires a pending debounced `onChange` first. */
+  debounceMs?: number;
 }
 ```
 
@@ -960,7 +963,11 @@ export interface SearchFieldProps {
   value?: string;
   onChange?: Action;
   onSubmit?: Action;
+  /** `onChange` fires after this many ms of idle typing; 0 or less (or unset) = 250 ms.
+   *  A submit fires a pending debounced `onChange` first. */
   debounceMs?: number;
+  /** `$service:` binding → a focus TOKEN; `TextFieldProps.focusPath` semantics. */
+  focusPath?: string;
 }
 ```
 

package/guides/himi-json-output.md

@@ -80,6 +80,13 @@ The `ux_evidence_*` codes map to the existing typed `uxEvidence.state`; a succes
 `recorded` state has no refusal code. Successful pushes and warnings do not gain
 failure codes. A forced push still follows the existing override rules.
 
+After a full `himi push --live`, push reads the app's rollout rings (`GET /v1/releases`). A ring
+pinned to another release keeps serving that release to its devices, so the success envelope
+then carries a `ring_pinned` entry in `warnings` (also printed to stderr) and
+`ringPins: [{ ring, releaseId, promote }]`, where `promote` is the `himi promote … --ring <ring>`
+that moves the ring to the new release. When the push passed `--control-url`, `promote` repeats it. It stays `ok: true`. When the rings cannot be read, push
+prints neither.
+
 ## `himi cms seed` codes
 
 | Code | Meaning |

package/guides/recipe-search.md

@@ -32,11 +32,12 @@ The dedicated flow has two renderers for one search model:
   new non-empty token when the screen opens; that focuses the field and opens
   the keyboard. If the screen has no worker, seed the token through local state.
 - **Debounce.** Let `onChange` update the query and start the search after the
-  user pauses. The proposed native slot uses 250 ms when `debounceMs` is zero
-  or unset; a pending change flushes before `onSubmit`, so the submitted query
-  is current.
-  For the existing inline `SearchField`, set `debounceMs` explicitly (150–300 ms
-  for local filtering; 300–400 ms for a network search).
+  user pauses. `SearchField` (and the proposed native slot) uses 250 ms when
+  `debounceMs` is zero or unset, on every renderer; a pending change flushes
+  before `onSubmit`, so the submitted query is current. Set `debounceMs`
+  explicitly to tune it (150–300 ms for local filtering; 300–400 ms for a
+  network search). A `TextField` used as a search box debounces only when
+  `debounceMs` is set — unset, it sends every change.
 - **Clear.** Clear sets the query to `""`, runs `onChange` with the empty value,
   and returns to the initial state. It is not cancellation and must not invoke
   `onCancel`.
@@ -151,8 +152,9 @@ first; this recipe only adds the query layer.
 }
 ```
 
-- `debounceMs` batches keystrokes — 150–300ms is the sweet spot; without it every
-  character dispatches a worker action.
+- `debounceMs` batches keystrokes — 150–300ms is the sweet spot. Unset (or 0), a
+  `SearchField` waits 250 ms after the last keystroke; emptying the field sends `""`
+  at once.
 - `onSubmit` (keyboard search key) is optional when `onChange` already filters live.
 - For category/facet filtering alongside text search, add `FilterChips` with
   `optionsPath: "$service:posts.categories"` and a `selectCategory` action — same

package/guides/release-notes.md

@@ -16,6 +16,13 @@ areas, always in the same order, so you can skim for the one you care about.
 
 ## 2026-11-02
 
+### Getting started & the CLI
+
+- The `restaurant`, `podcast-creator` and `podcast-creator-owner` starter templates no longer paint
+  their cream text on a light grey search field, segmented control and chips. Their `dark-luxe` kit
+  had no `surfaceTertiary`, so the base app's light value showed through at 1.04:1. The kit now
+  ships a dark `surfaceTertiary`. (#4999)
+
 ### Validate & test
 
 - **`himi validate` now judges `textPrimary` on card surfaces.** Body text was judged only against
@@ -25,6 +32,16 @@ areas, always in the same order, so you can skim for the one you care about.
   with an error (also for `textPrimary` on the page); below WCAG AA 4.5:1 it is a warning. The
   finding says when the page and the card sit on opposite sides of mid-grey, so no single text
   colour can serve both. (#4999)
+- **`himi validate` now judges `textSecondary` too, and on every surface that text sits on.** Both
+  body text colours are judged against `surfaceSecondary` and `surfaceElevated` (cards, sheets, list
+  rows), `surfaceTertiary` (search fields, segmented controls, chips, badges) and `surfaceSubtle`
+  (Android's Material low containers). Below 1.5:1 validate fails with an error, on the page too;
+  below 4.5:1 it is a warning. (#4999)
+
+### Branded Lite & Owner Lite
+
+- Branded Lite's dark-theme secondary text is now `#8B949E`. It clears 4.5:1 on the app's cards and
+  its search field; before, it was 4.31:1 on the search field. (#4999)
 
 ## 2026-11-01
 

package/guides/templates.md

@@ -143,6 +143,25 @@ preview — the `clientId` **is** the site binding (no separate MSID field). Pla
 `YOUR_WIX_CLIENT_ID` are not a real backend. Monorepo / native binary path:
 [branded-lite-site-binding.md](branded-lite-site-binding.md).
 
+### Keep the copied `_shared` helpers current
+
+`init` copies the platform helpers under `tier5-src/_shared/` once, and nothing updates them. An old
+copy keeps compiling against a newer platform and can break a feature without an error (an old
+`iap-presentation.ts` left a Buy button disabled). So every build compares each copy with the ones
+the running CLI ships. `himi build` lists a mismatch under `warnings`; `validate`, `push` and `pack`
+report it as one issue (`pass: "stale-shared"`, `ruleCode: "shared-file-differs"`, `files: [{path,
+shipped, alsoCopy}]`) with severity `warning`, which `--strict` does not promote. (`push --only`
+lists it under `warnings`; `template publish` runs the same lint but prints issues only when it
+refuses.) The message names each file and prints
+the command that refreshes it, plus any `_shared` file the shipped copy imports that your package
+lacks. A copy that matches any template's variant counts as current; the refresh takes the variant of
+the template `init` recorded in `.himi/init-source.json`, or else the one closest to your copy. Files
+the CLI does not ship are yours and are not checked.
+
+When you changed a helper on purpose, add a `// himi:forked` line to it and the check skips that
+file; `himi template sweep` adds that line to any `_shared` file it rewrites. Nothing else records
+which files you edited after `init`, so an unmarked edit and an old copy look the same.
+
 ## Publish your own
 
 Any himi app can *become* a template. Add a `himalaya.template.json` next to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1539.0",
+  "version": "0.1540.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "cf2aec518d6f8738d5ae5bc0969628fe4258bf6977f4621442bbd5d4"
+  "falconPackageHash": "a1d4dc831a852d303dab5ab6d7d7c2eea37f28a6f0c949a4d2c1ce6f"
 }

package/stdlib/design-kits/dark-luxe.json

@@ -32,6 +32,10 @@
         "light": "#101319",
         "dark": "#101319"
       },
+      "surfaceTertiary": {
+        "light": "#232834",
+        "dark": "#232834"
+      },
       "textPrimary": {
         "light": "#F1E9D2",
         "dark": "#F1E9D2"

package/templates/branded-lite/tokens.json

@@ -6,7 +6,7 @@
     "surfaceSubtle":    { "light": "#F8FAF9", "dark": "#121821", "highContrast": "#111111" },
     "surfaceTertiary":  { "light": "#E9EEF0", "dark": "#232A32", "highContrast": "#1A1A1A" },
     "textPrimary":      { "light": "#1F2328", "dark": "#E6EDF3", "highContrast": "#FFFFFF" },
-    "textSecondary":    { "light": "#59636E", "dark": "#848D98", "highContrast": "#CCCCCC" },
+    "textSecondary":    { "light": "#59636E", "dark": "#8B949E", "highContrast": "#CCCCCC" },
     "textTertiary":     { "light": "#7D8791", "dark": "#6E7681", "highContrast": "#CCCCCC" },
     "textOnAccent":     { "light": "#FFFFFF", "dark": "#FFFFFF", "highContrast": "#000000" },
     "accentPrimary":    { "light": "#0A66C2", "dark": "#1E72C7", "highContrast": "#58A6FF" },

package/templates/brandy/tokens.json

@@ -32,7 +32,7 @@
     },
     "textSecondary": {
       "light": "#59636E",
-      "dark": "#848D98",
+      "dark": "#8B949E",
       "highContrast": "#CCCCCC"
     },
     "textTertiary": {

package/templates/podcast-creator/tokens.json

@@ -21,8 +21,8 @@
       "highContrast": "#111111"
     },
     "surfaceTertiary": {
-      "light": "#E9EEF0",
-      "dark": "#232A32",
+      "light": "#232834",
+      "dark": "#232834",
       "highContrast": "#1A1A1A"
     },
     "textPrimary": {
@@ -96,8 +96,8 @@
       "highContrast": "#FFFFFF"
     },
     "accentText": {
-      "light": "#8B6FFF",
-      "dark": "#957CFF",
+      "light": "#947AFF",
+      "dark": "#947AFF",
       "highContrast": "#AE9AFF"
     }
   },

package/templates/podcast-creator-owner/tokens.json

@@ -11,8 +11,8 @@
       "highContrast": "#111111"
     },
     "surfaceTertiary": {
-      "light": "#E4E4E7",
-      "dark": "#27272A",
+      "light": "#232834",
+      "dark": "#232834",
       "highContrast": "#111111"
     },
     "surfaceElevated": {
@@ -92,8 +92,8 @@
       "dark": "#221214"
     },
     "accentText": {
-      "light": "#9474E1",
-      "dark": "#9A7CE2",
+      "light": "#9B7DE3",
+      "dark": "#9B7DE3",
       "highContrast": "#B49DEA"
     }
   },

package/templates/restaurant/tokens.json

@@ -21,8 +21,8 @@
       "highContrast": "#111111"
     },
     "surfaceTertiary": {
-      "light": "#E9EEF0",
-      "dark": "#232A32",
+      "light": "#232834",
+      "dark": "#232834",
       "highContrast": "#1A1A1A"
     },
     "textPrimary": {
@@ -96,8 +96,8 @@
       "highContrast": "#FFFFFF"
     },
     "accentText": {
-      "light": "#C36E65",
-      "dark": "#C87B74",
+      "light": "#C87A72",
+      "dark": "#C87A72",
       "highContrast": "#D49892"
     }
   },