@wix/himalaya-cli 0.1550.0 → 0.1551.0

package/dist/cli.mjs

@@ -2382,6 +2382,8 @@ var init_app_link = __esm({
 // ../../core/serve-control/src/dist-jobs.ts
 var dist_jobs_exports = {};
 __export(dist_jobs_exports, {
+  ANDROID_BUILD_TYPES: () => ANDROID_BUILD_TYPES,
+  ANDROID_BUILD_TYPE_NOT_BUILT: () => ANDROID_BUILD_TYPE_NOT_BUILT,
   ANDROID_FORMATS: () => ANDROID_FORMATS,
   ANDROID_FORMAT_NOT_BUILT: () => ANDROID_FORMAT_NOT_BUILT,
   ANDROID_FORMAT_NOT_REQUESTED: () => ANDROID_FORMAT_NOT_REQUESTED,
@@ -2389,6 +2391,7 @@ __export(dist_jobs_exports, {
   ANDROID_SIGNING_ALIASES: () => ANDROID_SIGNING_ALIASES,
   ANDROID_SIGNING_POLICIES: () => ANDROID_SIGNING_POLICIES,
   CUSTOMER_UPLOAD_LEASE_MS: () => CUSTOMER_UPLOAD_LEASE_MS,
+  DEFAULT_ANDROID_BUILD_TYPE: () => DEFAULT_ANDROID_BUILD_TYPE,
   DEFAULT_ANDROID_FORMAT: () => DEFAULT_ANDROID_FORMAT,
   DEFAULT_ANDROID_SIGNING: () => DEFAULT_ANDROID_SIGNING,
   DEFAULT_BORROWABLE_IOS_IDS: () => DEFAULT_BORROWABLE_IOS_IDS,
@@ -2418,6 +2421,7 @@ __export(dist_jobs_exports, {
   isValidDistAttemptId: () => isValidDistAttemptId,
   nextCustomerUploadClaim: () => nextCustomerUploadClaim,
   nextCustomerUploadSettlement: () => nextCustomerUploadSettlement,
+  resolveAndroidBuildType: () => resolveAndroidBuildType,
   resolveAndroidFormat: () => resolveAndroidFormat,
   resolveAndroidSigning: () => resolveAndroidSigning,
   resolveBorrowedIosId: () => resolveBorrowedIosId,
@@ -2507,7 +2511,7 @@ function isBorrowableIosId(id, allowed2 = DEFAULT_BORROWABLE_IOS_IDS) {
 function resolveBorrowedIosId(opts) {
   const { requested, platform } = opts;
   if (requested === void 0 || requested === null || requested === "") return {};
-  if (opts.selfServe || opts.role === "owner") {
+  if (opts.selfServe && !opts.wixStaff || opts.role === "owner") {
     return {
       error: {
         error: "operator_only_borrow_id",
@@ -2586,13 +2590,13 @@ function resolveAndroidSigning(requested) {
       body: {
         error: "invalid_android_signing",
         message: `androidSigning "${requested}" is not a known policy`,
-        supported: ["qa-keystore", "wix-keystore", "debug"]
+        supported: [...ANDROID_SIGNING_POLICIES]
       }
     }
   };
 }
 function androidFormatSkewFailed(record3) {
-  return record3.platform === "android" && typeof record3.error === "string" && [ANDROID_FORMAT_NOT_BUILT, ANDROID_FORMAT_WRONG_SIGNER, ANDROID_FORMAT_NOT_REQUESTED].some((code) => record3.error.includes(`${code}:`));
+  return record3.platform === "android" && typeof record3.error === "string" && [ANDROID_FORMAT_NOT_BUILT, ANDROID_FORMAT_WRONG_SIGNER, ANDROID_FORMAT_NOT_REQUESTED, ANDROID_BUILD_TYPE_NOT_BUILT].some((code) => record3.error.includes(`${code}:`));
 }
 function resolveAndroidFormat(requested) {
   if (requested === void 0 || requested === null || requested === "") return { format: DEFAULT_ANDROID_FORMAT };
@@ -2610,6 +2614,22 @@ function resolveAndroidFormat(requested) {
     }
   };
 }
+function resolveAndroidBuildType(requested) {
+  if (requested === void 0 || requested === null || requested === "") return { buildType: DEFAULT_ANDROID_BUILD_TYPE };
+  if (typeof requested === "string" && ANDROID_BUILD_TYPES.includes(requested)) {
+    return { buildType: requested };
+  }
+  return {
+    error: {
+      status: 400,
+      body: {
+        error: "invalid_android_build_type",
+        message: `androidBuildType ${typeof requested === "string" ? `"${requested.slice(0, 40)}"` : `of type ${typeof requested}`} is not a known build type`,
+        supported: [...ANDROID_BUILD_TYPES]
+      }
+    }
+  };
+}
 function encodeDistParams(env) {
   return Buffer.from(JSON.stringify(env), "utf8").toString("base64url");
 }
@@ -2653,6 +2673,8 @@ function distJobSpec(req) {
     // A Play bundle instead of an APK. Only when asked: the APK default needs no parameter, and a
     // runner that predates the variable ignores it — which the result callback catches.
     ...req.platform === "android" && req.androidFormat === "aab" ? { DIST_ANDROID_FORMAT: "aab" } : {},
+    // A debuggable APK instead of a release one. Only when asked, for the same reason as the format.
+    ...req.platform === "android" && req.androidBuildType === "debug" ? { DIST_ANDROID_BUILD_TYPE: "debug" } : {},
     ...req.previewRoute ? { HIMI_DIST_PREVIEW_ROUTE: req.previewRoute } : {},
     ...req.callbackUrl ? { HIMI_DIST_CALLBACK_URL: req.callbackUrl } : {},
     ...req.callbackToken ? { HIMI_DIST_CALLBACK_TOKEN: req.callbackToken } : {},
@@ -2691,7 +2713,7 @@ function distJobSpec(req) {
     ...req.xcodeVersion ? { xcodeVersion: req.xcodeVersion } : {}
   };
 }
-var IN_FLIGHT, SCOPE_CREATE, SCOPE_READ, SCOPE_CANCEL, DEFAULT_BASE_URL, DEFAULT_OAUTH_URL, TOKEN_TTL_MS, JobServiceError, JobServiceBroker, CUSTOMER_UPLOAD_LEASE_MS, MAX_MEASURABLE_IDENTITY_WINDOW, DIST_SHELLS, DEFAULT_DIST_SHELL, DEFAULT_BORROWABLE_IOS_IDS, BUNDLE_ID_RE, DEFAULT_DIST_SIGNING, WIX_MANAGED_SIGNING_ALIASES, DEFAULT_ANDROID_SIGNING, ANDROID_SIGNING_POLICIES, ANDROID_SIGNING_ALIASES, DEFAULT_ANDROID_FORMAT, ANDROID_FORMATS, ANDROID_FORMAT_NOT_BUILT, ANDROID_FORMAT_WRONG_SIGNER, ANDROID_FORMAT_NOT_REQUESTED, DEFAULT_GIT_URL, DIST_PACKAGE_NAME, DIST_PARAMS_FLAG, MAX_COMMAND_CHARS;
+var IN_FLIGHT, SCOPE_CREATE, SCOPE_READ, SCOPE_CANCEL, DEFAULT_BASE_URL, DEFAULT_OAUTH_URL, TOKEN_TTL_MS, JobServiceError, JobServiceBroker, CUSTOMER_UPLOAD_LEASE_MS, MAX_MEASURABLE_IDENTITY_WINDOW, DIST_SHELLS, DEFAULT_DIST_SHELL, DEFAULT_BORROWABLE_IOS_IDS, BUNDLE_ID_RE, DEFAULT_DIST_SIGNING, WIX_MANAGED_SIGNING_ALIASES, DEFAULT_ANDROID_SIGNING, ANDROID_SIGNING_POLICIES, ANDROID_SIGNING_ALIASES, DEFAULT_ANDROID_FORMAT, ANDROID_FORMATS, ANDROID_FORMAT_NOT_BUILT, ANDROID_FORMAT_WRONG_SIGNER, ANDROID_FORMAT_NOT_REQUESTED, DEFAULT_ANDROID_BUILD_TYPE, ANDROID_BUILD_TYPES, ANDROID_BUILD_TYPE_NOT_BUILT, DEFAULT_GIT_URL, DIST_PACKAGE_NAME, DIST_PARAMS_FLAG, MAX_COMMAND_CHARS;
 var init_dist_jobs = __esm({
   "../../core/serve-control/src/dist-jobs.ts"() {
     IN_FLIGHT = /* @__PURE__ */ new Set(["CREATED", "QUEUED", "WORKING"]);
@@ -2877,20 +2899,25 @@ var init_dist_jobs = __esm({
     DEFAULT_DIST_SIGNING = "wix-managed";
     WIX_MANAGED_SIGNING_ALIASES = ["wix-managed", "wix", "pool-enterprise"];
     DEFAULT_ANDROID_SIGNING = "qa-keystore";
-    ANDROID_SIGNING_POLICIES = ["qa-keystore", "wix-keystore", "debug"];
+    ANDROID_SIGNING_POLICIES = ["qa-keystore", "wix-keystore", "debug", "oneapp-debug"];
     ANDROID_SIGNING_ALIASES = {
       // The canonical spellings, derived so the two lists cannot drift apart.
       ...Object.fromEntries(ANDROID_SIGNING_POLICIES.map((p2) => [p2, p2])),
       qa: "qa-keystore",
       himi: "qa-keystore",
       wix: "wix-keystore",
-      oneapp: "wix-keystore"
+      oneapp: "wix-keystore",
+      "one-app-debug": "oneapp-debug",
+      oneappdebug: "oneapp-debug"
     };
     DEFAULT_ANDROID_FORMAT = "apk";
     ANDROID_FORMATS = ["apk", "aab"];
     ANDROID_FORMAT_NOT_BUILT = "android_format_not_built";
     ANDROID_FORMAT_WRONG_SIGNER = "android_format_wrong_signer";
     ANDROID_FORMAT_NOT_REQUESTED = "android_format_not_requested";
+    DEFAULT_ANDROID_BUILD_TYPE = "release";
+    ANDROID_BUILD_TYPES = ["release", "debug"];
+    ANDROID_BUILD_TYPE_NOT_BUILT = "android_build_type_not_built";
     DEFAULT_GIT_URL = "https://github.com/wix-private/himalaya";
     DIST_PACKAGE_NAME = "@himalaya/native-ci";
     DIST_PARAMS_FLAG = "--himi-dist";
@@ -12845,6 +12872,7 @@ function webViewOriginAllowed(url, origins) {
 }
 var init_webview_origin = __esm({
   "../../core/ts/src/webview-origin.ts"() {
+    "use strict";
   }
 });
 
@@ -23587,7 +23615,6 @@ function resolveIdiom(tokens2, ctx = {}) {
 var IDIOM_CONTEXTS, UNSAFE_KEYS;
 var init_idiom = __esm({
   "../../core/ts/src/idiom.ts"() {
-    "use strict";
     IDIOM_CONTEXTS = {
       ios: { native: ["ios"] },
       android: { native: ["material"] },

package/guides/qa-builds.md

@@ -155,7 +155,9 @@ plane that only exists in a monorepo checkout, so a bare `himi dist` there fails
 > still gets `403 operator_only_dist` (a credential that may not publish content has no business
 > spending a Mac pool), and **`--borrow-ios-id` is refused for a self-serve caller** at the
 > decision itself — a borrowed id displaces whatever owns it on every device the build reaches.
-> Self-serve builds sign `wix-managed` instead, minting the app its own id (next section).
+> Self-serve builds sign `wix-managed` instead, minting the app its own id (next section). The one
+> exception is a **Wix staff member** proven by their own Wix credential — see
+> [Wix-staff debug builds](#wix-staff-debug-builds).
 >
 > **Two switches, not one.** `/v1/admin/*` is 404'd on a public gateway host unless
 > `HIMI_PUBLIC_DEV_LOOP` is on — the same curtain self-serve `himi push` already lives behind, so
@@ -933,6 +935,7 @@ himi dist --app <app> --platform android --android-signing debug --target bo
 | `qa-keystore` *(default)* | **`tools/mobile-dist/himi-qa.keystore`** — committed, non-store, alias `himiQa`, password `123456` | same bytes on every pool machine, so a QA build installs over yesterday's and the cert-derived features have a stable SHA-1 to be registered against |
 | `wix-keystore` | `~/.signing/oneapp-production.keystore` on the pool machine | the real Wix key — see below |
 | `debug` | a machine-local `~/.android/debug.keystore`, minted if absent | the old behaviour. QA must uninstall a previous build first |
+| `oneapp-debug` | **the committed `oneAppDebug.keystore`** — the shared One App debug key, alias `oneAppDebug`, store and key password `123456` | byte-identical to the file `wix-private/mobile-apps-engine` and `wix-private/ai-scheduling-assistant` commit, SHA-1 `42:8D:0A:62:86:61:E3:01:34:9E:FA:3E:9F:06:5A:3E:FD:3B:64:97`. The default for an `androidBuildType: "debug"` build. Self-serve: Wix staff only |
 
 `wix` / `qa` are accepted short spellings. It is a **separate axis from `--signing`**, which names
 the *Apple* account, so `--platform ios,android` can take both and each leg gets the one that
@@ -952,6 +955,58 @@ self-serve door refuses it with `403 android_signing_not_allowed` and names `qa-
 as what remains open. The gate keys on the **self-serve** claim rather than the role, because
 self-serve mints `role: "publisher"` — the same role internal CI uses.
 
+### Wix-staff debug builds
+
+AppSmith's **Debug build · Wix only** download (Containers → `POST /v1/admin/dist`) asks for a
+build that only Wix staff may get:
+
+| Request field | Value | What it builds |
+|---|---|---|
+| `androidBuildType` | `"debug"` (default `"release"`) | a **debuggable** APK (`:<shell>-app:assembleDebug`; an operator `DIST_ANDROID_TASK` still wins), the way the release manager's `DEV_RELEASE` Android builds are (`assembleDevDebug` in `ai-scheduling-assistant`'s `ci-android.sh`) |
+| `androidSigning` | `"oneapp-debug"` (the default for a debug build) | signed with the shared One App debug key — the key `DEV_RELEASE` builds sign with, alias `oneAppDebug`, key password `123456`, the same as the `development` signingConfig of `mobile-apps-engine` and `ai-scheduling-assistant`. There, gradle signs; here `apksigner` re-signs the gradle output with it, because a named key always outranks the app's own signingConfig |
+| `borrowIosBundleId` | `"ent.wix.admin.dev"` | the iOS build signs under the One App enterprise dev identity: MRE maps the Wix owner app (`AppType.OWNER` = `admin`) dev builds to it (`iosDevReleaseAppNameToBundleIdentifier` in `wix-private/mre`). Still only the `ent.*` allow-list |
+
+Every field is validated on every request: an unknown `androidBuildType` is `400
+invalid_android_build_type` (iOS-only included), a debug Play bundle is `400
+android_build_type_requires_apk`, and a debug build with `wix-keystore` is `400
+android_debug_build_wix_keystore` — the Wix production key never goes on a debuggable app.
+
+**Who may ask.** An internal (operator, CI, employee) credential may ask for any of them. A
+**self-serve** credential — the site control token Containers holds — gets them only when the
+request also carries the caller's own Wix account token as `Authorization: Bearer …` and that token
+is a Wix staff member's. Proof, both from Wix:
+
+1. Wix accepts the token: the Wix CLI userinfo service answers `200` with a `userId`. A token
+   whose payload was edited is refused there (`401`), so its claims are what Wix signed.
+2. The token's instance claims carry `ws: true` — `wixStaff` in Wix's `TPAInstance`, the same
+   rule as catalyst's `RequestContext.isWixStaff` (a verified email on a Wix domain) — and their
+   `uid` is the `userId` userinfo returned.
+
+Otherwise the request is refused before anything reaches the pool:
+
+| Status | `error` / `code` | When |
+|---|---|---|
+| `403` | `internal_debug_staff_only` | no Wix credential, a credential with no staff claim, or one Wix refuses. `reason` says which (`no_credential` / `not_staff` / `credential_refused`), `options` names the fields that need staff |
+| `503` | `internal_debug_staff_check_unavailable` | Wix could not answer; retry |
+
+The exception lifts only these refusals. `wix-keystore` stays `403 android_signing_not_allowed` and
+the `ent.*` allow-list still applies (`400 borrow_id_not_allowed`). A job built under it records
+`wixStaff: true`; every Android record echoes `androidBuildType` and `androidSigning`, and an iOS
+one `borrowedIosBundleId`.
+
+**The record reports what was built.** The pool reports `androidBuildType` on the result, like
+`androidFormat`. A debug job that comes back as anything else — a release published before this
+field runs a `run-dist` that builds a release APK — is `FAILURE` with
+`android_build_type_not_built:` and keeps no link, and so is a release job that comes back debug.
+An older runner also refuses `oneapp-debug` itself, so it fails before gradle.
+
+**A debug APK talks to the public Himi servers.** A shell's `debug` build type is the developer's
+emulator build: branded-lite points it at `http://10.0.2.2:8114` and routes Wix calls through a local
+proxy on the developer's machine. A debug dist build passes `HIMI_DIST_DEBUG_SERVE_BASE_URL` (default
+`https://www.wixapis.com/himalaya-serve`, the origin a release APK bakes; operator override
+`DIST_DEBUG_SERVE_BASE_URL`), which branded-lite's debug build type reads in place of the loopback,
+turning `HIMI_DEV_GATEWAY` off. Other shells' debug builds do not change the serve origin.
+
 ### Why the QA key is committed, and what it would take to change
 
 `tools/mobile-dist/himi-qa.keystore` is a **private key in the repository**, with its password in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1550.0",
+  "version": "0.1551.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "9a87baae6e742bf463b9aca4b2c132475e6cef51f18e15512e545aab"
+  "falconPackageHash": "63639ddfe8f10381f8bcdfc3f2380ac6f84f9f6b2a0ea1442760faaa"
 }