@wix/himalaya-cli 0.1567.0 → 0.1569.0

package/guides/app-config.md

@@ -79,6 +79,16 @@ your envelope + per-surface links), and `himi render <screen> --device mac|watch
 
 ## Splash (the launch moment)
 
+**T5 Branded Lite apps:** when the existing exact screen registry contains
+`himi_branded_splash`, its descriptor/worker owns the editable in-app appearance.
+Read `himi docs splash-screens` before editing: change its `input.showIcon`, the
+root background token and the gradient token's colours/stops/angle. CSS angles such
+as 90 (horizontal) and 135 (diagonal) are supported by that T5 layer. Preserve the
+native fallback and binary OS launch settings. Generated packages keep the descriptor
+in `dev/index.ts` and the worker in `tier5-src/`. Do not assume an older native
+host can mount a newly added screen. The following contract describes the native
+fallback and legacy apps; it is not the T5 appearance editor.
+
 `splash` is ONE declaration with TWO consumers, and only the second is OTA:
 
 - **Build time** — `splash.backgroundColor` (a color TOKEN name, never a hex) generates the

package/guides/app-icon.md

@@ -26,6 +26,7 @@ it. Offer the customer the choice — it is their brand:
 ```sh
 himi icon status                      # what would ship right now, and whether a store would take it
 himi icon from-site --book .himi/business-book   # the logo `himi site analyze` downloaded
+himi icon from-one-app --evidence-dir .himi/one-app # the verified collected app's existing logo
 himi icon set ./their-logo.png        # a file the customer supplied
 himi icon generate                    # a gradient tile + glyph, for a customer with no mark
 himi icon glyphs                      # what `generate --glyph` accepts
@@ -44,10 +45,22 @@ nobody has said what the app is. So pick one with `--glyph` when you know
 (`himi icon glyphs` lists them, `book` and `graduation` among them), and read the neutral
 tile as what it is — a placeholder, still waiting for the customer's real mark.
 
-`set`, `from-site` and `generate` all do the same finishing work: **trim** the art, centre
+`set`, `from-site`, `from-one-app` and `generate` all do the same finishing work: **trim** the art, centre
 it, **flatten it onto your app's accent colour**, write it as an exactly-1024 square with no
 alpha channel, derive the 512 Play listing icon, and record it in `himalaya.content.json`.
 
+Source images accept at most 16 MiB of encoded input and a 2048-square decoded canvas.
+SVGs use density-bounded rasterization before normalization, under the same pixel cap.
+Animated GIF/WebP marks use a composited poster with the most distinguishable artwork,
+measured against one background reference for the animation. Review the resulting mark
+against the source. Poster decoding accepts at most 256 frames, a 4-million-pixel canvas,
+64 million total frame pixels and 16 MiB of encoded input; larger animations are refused
+with advice to supply the existing static mark. Other multi-page formats retain their
+first-page behavior. `from-one-app` requires the image toolchain before downloading or
+replacing an icon, so it cannot report success without normalization and the Play rendition.
+It checks both renditions in a scratch package before installing them; a rejected source
+leaves the current master, Play icon and manifest unchanged.
+
 **The declaration is the part people miss.** An off-repo package's icon is whatever
 `himalaya.content.json` names:
 
@@ -62,6 +75,12 @@ declare is art nothing ships: the release bakes no icon, and a binary then falls
 `himi icon` writes both halves, and `himi validate` / `push` / `dist` refuse a package whose
 declared icon is missing.
 
+Customer native builds copy the contract's prepared master into the iOS and Android
+launcher resources. The shared Mac materializer resizes that same master into all ten
+`AppIcon.appiconset` renditions and writes their catalog metadata; it preserves the source
+artwork. A platform-only preparation writes only that platform's native tree. Existing
+binaries need rebuilding to pick up a changed launcher icon.
+
 ## What each store wants
 
 The two specs **conflict**, so these are two derived files and neither can serve both:

package/guides/himi-json-output.md

@@ -32,6 +32,13 @@ keeps its existing fields and adds the code:
 }
 ```
 
+## `himi icon from-one-app` codes
+
+| Code | Meaning |
+| --- | --- |
+| `source_icon_unavailable` | Verified source evidence or its logo is missing, unreadable, unavailable, over the download/decoding budget, or cannot be normalized. |
+| `source_icon_unusable` | The prepared source mark fails mechanical launcher/store checks. Existing icon files and metadata are left unchanged. |
+
 ## Push codes
 
 | Code | Meaning |

package/guides/importable-sdks.md

@@ -39,6 +39,7 @@ package in one greppable file) or `GET /v1/sdk/<name>` over HTTP; in the CLI,
 - `@himalaya/iap-checkout` — @wix/himalaya/iap-checkout — the ONE shared flow that sells a digital Wix item through the App Store, for any screen: a vertical order, its `appleIAP` cashier charge, mobile-apps-wix-iap's payment, the managed StoreKit purchase and the vertical's own access read.
 - `@himalaya/keyboard` — Tier-5 typed binding for the platform's keyboard capability.
 - `@himalaya/kyber-api` — narrow Tier-5 binding for Kyber BO HTTP calls.
+- `@himalaya/l10n` — synchronous app-catalog copy (SDK foundation; requires host integration).
 - `@himalaya/live-activity` — Tier-5 typed binding to the platform's Live Activity capability.
 - `@himalaya/local-db` — Tier-5 typed binding to the platform's local-database capability: a per-entity on-device store (EntityStore) + an offline WriteQueue, so a worker bundle can persist and query real data on device.
 - `@himalaya/location` — Tier-5 typed binding for device location.

package/guides/one-app-to-himi-app.md

@@ -362,6 +362,20 @@ Rows cover source graph warnings and app-wide design values as well as routes an
 controls. This is an inventory of migration obligations, not proof that their target
 actions work.
 
+Preserve the existing app mark after scaffolding: run `himi icon from-one-app
+--content . --evidence-dir .himi/one-app`. This reads the hash-verified collected
+`settings.logoImageUrl`, downloads that mark and uses the existing icon normalizer
+to produce the opaque launcher master and Play listing icon. Animated marks use
+their fullest composited frame within bounded decoding limits. It does not run
+site analysis or generate new artwork. If the source mark is absent or unavailable,
+keep that migration obligation unresolved; obtain the existing mark and use
+`himi icon set <file>`. An already collected site's logo may be used with
+`himi icon from-site --book <dir>` only when it is the intended source identity.
+Run `himi icon check --content .` and visually compare the result with the source.
+For a marked One App migration, `himi validate --strict` fails when the icon is
+missing, still byte-identical to a bundled template, or its pixel checks cannot run. A passing mechanical check
+cannot establish ownership of arbitrary custom artwork; compare the real mark too.
+
 Map each row to a target screen and, for interactions or top-bar controls, a
 target control. A `design` row is app-wide, so it needs no screen or control: it is
 satisfied by the design check instead. Set its `status` to `supported`, `adapted`, `conditional`, or

package/guides/release-notes.md

@@ -14,6 +14,12 @@ areas, always in the same order, so you can skim for the one you care about.
 
 ---
 
+## 2026-11-04
+
+### Branded Lite & Owner Lite
+
+- When you tap **Enrol** as a guest, signing in resumes enrollment automatically after refreshing your participation; cancelling sign-in stops it. This requires updated iOS/macOS/Android binaries containing the core runtime and Wix auth SDK, or updated web-host assets. OTA content alone does not add this support to older hosts; no supporting binary version is assigned yet. (#5126)
+
 ## 2026-11-02
 
 ### Getting started & the CLI

package/guides/sdk-reference.json

@@ -2903,6 +2903,37 @@
       }
     ]
   },
+  {
+    "name": "@himalaya/l10n",
+    "source": "core/sdk/l10n/src/index.ts",
+    "description": "synchronous app-catalog copy (SDK foundation; requires host integration).",
+    "api": [
+      {
+        "name": "t",
+        "kind": "function",
+        "jsdoc": "/** Resolve app copy: active catalog, source catalog, then the key. Missing copy\n * stays visible. The host performs both lookups from resident data, without I/O.\n * Requires an l10n-capable host; the SDK foundation alone does not enable it. */",
+        "decl": "export function t(key: string, args?: Record<string, string | number>): string;"
+      },
+      {
+        "name": "locale",
+        "kind": "function",
+        "jsdoc": "/** The app's active resolved locale, including any region subtag. */",
+        "decl": "export function locale(): string;"
+      },
+      {
+        "name": "dir",
+        "kind": "function",
+        "jsdoc": "/** The active app locale's layout direction. */",
+        "decl": "export function dir(): \"ltr\" | \"rtl\";"
+      },
+      {
+        "name": "version",
+        "kind": "const",
+        "jsdoc": "",
+        "decl": "export const version = 1;"
+      }
+    ]
+  },
   {
     "name": "@himalaya/live-activity",
     "source": "core/sdk/live-activity/src/index.ts",
@@ -24006,6 +24037,14 @@
         "jsdoc": "",
         "decl": "export interface WixQueryParticipantsResponse {\n  participants?: WixParticipant[];\n  pagingMetadata?: { count?: number; total?: number; hasNext?: boolean };\n}"
       },
+      {
+        "name": "searchMemberParticipation",
+        "kind": "function",
+        "jsdoc": "/** Fresh member participation, matching Branded's member lookup (Search Participants).\n * Results are scoped by the caller's authorization; the worker also verifies returned identity.\n * @scope member\n */",
+        "decl": "export function searchMemberParticipation(programId: string, memberId: string): Promise<WixQueryParticipantsResponse>;",
+        "http": "POST /online-programs/v3/participants/search",
+        "scope": "member"
+      },
       {
         "name": "queryParticipants",
         "kind": "function",
@@ -24040,8 +24079,8 @@
       {
         "name": "joinProgram",
         "kind": "function",
-        "jsdoc": "/**\n * Join as the signed-in member through Join Applications. Read the current\n * application first so an existing application is resumed without another create.\n * Approved paid applications prepare\n * SINGLE_PAYMENT and return the Wix Payments order as paymentPendingOptions.orderId.\n * mayPreparePayment rechecks the caller's checkout guard before creating that order.\n * @scope member\n */",
-        "decl": "export async function joinProgram(programId: string, options?: { mayPreparePayment?: () => boolean }): Promise<WixJoinProgramResponse>;",
+        "jsdoc": "/**\n * Join as the signed-in member through Join Applications. Read the current\n * application first so an existing application is resumed without another create.\n * Approved paid applications prepare\n * SINGLE_PAYMENT and return the Wix Payments order as paymentPendingOptions.orderId.\n * mayPreparePayment rechecks the caller's checkout guard before creating that order.\n * beforeWrite lets a resumed caller revalidate its confirmed member after asynchronous reads.\n * @scope member\n */",
+        "decl": "export async function joinProgram(programId: string, options?: { mayPreparePayment?: () => boolean; beforeWrite?: () => Promise<void> }): Promise<WixJoinProgramResponse>;",
         "scope": "member"
       },
       {

package/guides/splash-screens.md

@@ -364,13 +364,165 @@ Note that the `splash` accessibility id / `testTag` on some apps today belongs t
 
 ### Branded-lite logo and handoff
 
+#### Branded-lite T5 splash (iOS, Android and macOS)
+
+When `splash.enabled` is true, the standalone Branded Lite native hosts can render
+`himi_branded_splash` above the existing native in-app splash. The system launch
+screen stays binary-owned. After seeding and artwork readiness, the hosts mount
+the T5 region first. Home mounts after the T5 presentation animation finishes, so
+its startup work cannot consume the entrance animation's first frames
+(JavaScriptCore on iOS and WebView construction/rendering on Android).
+Dismissal then waits for Home's first content.
+`maxHoldMs` always takes priority, including a missing or unresponsive worker.
+A failed descriptor/bundle keeps the native fallback and releases the T5 wait.
+The splash worker never marks Home ready.
+
+On Android the OS exit provider stays above Compose until the native splash
+has actually drawn. Composition alone is too early and can expose a blank icon gap.
+The pre-draw keep condition is released at composition so this cannot deadlock drawing.
+Before mounting the worker screens, the host awaits removal of the OS exit provider.
+Otherwise WebView startup can block Android's splash transfer past its deadline and
+trigger the default 20dp window-shift animation, even with identical icon bounds.
+The wait ends immediately on removal, skips Activity recreation, and has a one-second
+ceiling for launches with no system splash callback.
+The native surface remains visible while the region loads and if its descriptor
+or bundle fails. Set `splash.logoAsset: "branded_lite_app_icon"`, `logoWidth: 192`
+and `minVisibleMs: 0` for an immediate native icon that matches Android's OS crop.
+Once the worker is ready, the T5 screen paints its own opaque background and content.
+The native artwork cannot leak through when T5 hides its icon. The native hosts
+suppress the region's default spinner. The region tears its worker down on dismissal
+and does not occupy a warm-worker pool slot. The standalone macOS host uses the
+same T5 handoff. The web host keeps its existing startup surface and resolves the
+`branded_lite_app_icon` alias through the current app's web icon URL; it does not
+mount the native T5 handoff.
+
+#### Editing from an agent or Containers
+
+First check the app's screen registry. A T5-capable Branded Lite app contains the exact
+`himi_branded_splash` descriptor and the `himi-branded-lite-splash` worker. For this app,
+edit that descriptor and its referenced design tokens. Do not use the legacy native `splash`
+block as the primary appearance editor: it controls the underlying native fallback.
+Do not assume an older binary can mount a newly added T5 screen. Without the descriptor or
+T5 host support, retain the legacy contract and state the required native upgrade.
+
+In a generated content package, the descriptor lives in `SCREENS` in `dev/index.ts`.
+Its editable contract is:
+
+- `input.showIcon`: `true` shows the app icon; `false` fades it out. Preserve the existing
+  worker bindings, the 192-point native handoff icon, presentation marker and motion wiring.
+- Root node `splash_t5`: `modifiers.background.token` names an opaque colour token.
+- Node `splash_t5_gradient`: `modifiers.backgroundGradient.token` names a gradient in
+  `tokens.json`. Its `colors` are colour-token names; `angle` uses CSS degrees (`180`
+  top-to-bottom, `90` left-to-right, `135` diagonal); optional `locations` place its stops.
+  More than two colours are supported. Unlike the legacy native fallback, the T5 renderers
+  honour the gradient angle. Preserve light/dark token values that were not requested to change.
+
+An orientation-only request changes the gradient angle, preserving the colours and icon.
+An icon-visibility request changes `input.showIcon`, preserving background tokens. Keep
+`splash.enabled: true` for the native host and preserve the native launch/fallback colour
+and icon for ordinary T5 edits. In particular, hiding the T5 icon does not empty native
+`logoAsset`: Android's OS launch icon stays in the binary and the T5 icon fades away at handoff.
+A newly generated home-screen app icon is a different operation and still requires a native build.
+Generated Branded Lite templates also include `splash.json` with an `iconUrl` field. Set it to
+the app's approved public HTTPS image URL; AppSmith supplies the Plan's app icon when scaffolding
+under the splash experiment. Each app owns this source. Publishing a later URL change updates
+the T5 image without rebuilding or changing `config.ts` native splash settings. An empty URL
+keeps the bundled fallback. In source apps, `splashAppearance.iconUrl` reads the same file.
+The hosted icon uses the same `splash_t5_icon` circle and inner `splash_t5_icon_image` as the
+bundled icon: a 192-point frame with the central two-thirds crop. The native hosts prewarm its URL
+before presentation. Containers reads that same crop and size. Image fetch failure keeps the native
+fallback within the boot deadline. Neither this source nor a T5 update changes the launcher
+icon or the very first OS splash. Existing binaries require the T5 splash host to use it.
+
+A custom T5 splash logo can use a public HTTPS Media Manager/generated-image URL without replacing
+that home-screen icon. Source apps use `logoUrl` and `logoSize` (48–240 points) in `splashAppearance`.
+The builder keeps the initial 192-point app icon as `splash_t5_handoff_icon`, then cross-fades to the
+requested `splash_t5_icon` at the same centre. `input.customLogo: true` enables that worker path:
+`customLogoHidden` starts true and changes to the inverse of `showIcon` on `present`, while
+`iconHidden` hides the handoff icon. Keep the custom logo node while hidden so it can be restored.
+In raw descriptors, update the custom Image and wrapper dimensions together, and preserve the
+existing worker/motion wiring. Old splash workers need the matching content update.
+
+`backgroundImageUrl` adds a full-canvas layer above the gradient. Use a VStack containing a
+Spacer, with `fillMaxWidth: true` and `backgroundImagePath: "$service:splash.backgroundImageUrl"`.
+The worker exposes `input.backgroundImageUrl` as that state field. This existing bound-background
+renderer fills the canvas on iOS and Android. Do not size an Image with `onMeasure`, `$measure:`
+or `widthPath`/`heightPath`: those size bindings are decode-only on native. Image > gradient >
+colour remains the precedence. URLs must be public HTTPS without embedded credentials. The host
+keeps native launch artwork visible until remote splash images are cached; failed artwork leaves
+the native fallback within the original boot deadline. Neither URL changes the OS splash.
+
+For a solid T5 background, use the root colour token and omit the gradient layer. When adding
+one back, retain the existing fade transition and presentation marker's motion contract.
+Build and validate the content package, inspect the built splash descriptor and referenced
+gradient, then render `himi_branded_splash` in the requested colour scheme. Ship the change
+through the normal authorized draft release so Containers reads the descriptor and tokens
+from that same release. A chat acknowledgement alone is not evidence of an applied edit.
+
+In source apps, edit `splashAppearance` in the splash descriptor builder:
+
+```ts
+export const splashAppearance: SplashAppearance = {
+  showIcon: false,                  // true shows the app icon; false fades it out
+  backgroundColor: "accentPrimary", // opaque fallback underneath the gradient
+  backgroundGradient: "brand",      // key in tokens.json's gradients registry
+  // Optional: logoSize: 120, logoUrl: "https://static.wixstatic.com/media/logo.png",
+  // Optional: backgroundImageUrl: "https://static.wixstatic.com/media/background.jpg",
+};
+```
+
+Remove `backgroundGradient` for a solid background. To change gradient colors, edit
+the selected gradient's `colors` array in `tokens.json` (color token names), or add
+a dedicated gradient there and select its name above. Use a dark gradient with
+`textOnAccent` so the copy stays readable. The default is the `brand` gradient with
+the icon visible. The visible icon keeps the native fallback's 192-point circle,
+center and central-two-thirds crop. The copy stays in place when the icon hides.
+
+The gradient fades in over the opaque solid color using the existing `appearSoft`
+motion token (500 ms by default). Hiding the icon uses the same token for an
+exit fade. The copy stays still. A small presentation marker appears after the
+worker commits visibility and tells the host which motion to wait for. Once T5
+is presented, the host cross-fades the entire native surface directly into the T5
+appearance using the T5 motion duration (400 ms when none is specified). There is no
+intermediate solid-color stage or icon disappearance. Both icons keep the same
+192-point centre and crop; matching artwork stays steady, and changed artwork
+cross-fades in place. Home starts after the background handoff so its worker boot
+and first paint cannot cut across the animation. It then dismisses the splash
+when its content is ready. The initial color
+comes from the installed build's resources; the target appearance and motion
+come from T5. This handoff requires one host build; subsequent T5 edits use OTA
+content. The native cover cannot reappear during the final fade to Home.
+Native Reduced Motion skips these fades and the
+presentation wait. A solid-color splash has no gradient layer. These animations
+can delay an otherwise-ready Home, but never extend the hard startup deadline.
+
+These settings affect only the T5 layer. A new color or hidden icon becomes visible
+at the single native-to-T5 handoff. They do not change Android's OS launch screen or
+the native fallback; those keep their existing settings. The fallback can still be
+configured separately through the existing `splash` app-config. Changing the OS
+launch screen requires a native build.
+
+The descriptor and its `himi-branded-lite-splash` worker
+use existing components, tokens and `splash.title` / `splash.caption` copy keys. The
+worker makes no network or native capability calls. The exact-screen seed includes
+it for release/offline builds. Host integration requires one initial native build;
+later appearance, token and worker changes use the ordinary app release/OTA path.
+
+For local previews, enable `splash` through the local preview service's ephemeral
+`PUT /v1/admin/app-config`. Preview alternate descriptors with
+`PUT /v1/admin/screens/himi_branded_splash` and token changes with
+`PUT /v1/admin/tokens`; these overrides are not saved. A temporary
+`minVisibleMs: 2000` makes capture easier but adds a one-second native logo fade.
+Run the phone `splash/startup.yaml` flows to check the handoff to navigation.
+
 Use the baked branded-lite app icon as the in-app logo:
 
 ```ts
 splash: { enabled: true, logoAsset: "branded_lite_app_icon", logoWidth: 192 }
 ```
 
-Hide the logo on both Android splash layers with an **explicit empty string**:
+Hide the logo on Android's OS and native fallback layers with an **explicit empty
+string** (the T5 icon is controlled separately by `showIcon` above):
 
 ```ts
 splash: { enabled: true, logoAsset: "" }
@@ -408,10 +560,9 @@ within the same deadline. Once dismissed, the iOS splash stays dismissed even if
 OTA timing settings change. Branded-lite Android image splashes use translucent dark system-bar
 scrims with light icons for legibility; color and gradient splashes remain full-bleed.
 Web retains its current transitions and readiness.
-The standalone branded-lite macOS shell currently does not mount a boot splash
-overlay; `splash.enabled` does not enable one there. The shared SwiftUI background
-renderer is available on macOS, but this host handoff integration covers Android
-and iOS. macOS shell integration requires a separate change.
+The standalone branded-lite macOS shell mounts the same T5 splash with its native fallback,
+artwork readiness and bounded exit. AppKit has no OS launch splash. The shared artwork gate is
+used by the iOS and Mac shells; the Android host warms the same URLs through its renderer cache.
 
 Branded-lite builds expose the launcher artwork as the regular iOS image asset
 `branded_lite_app_icon`, so the same logo configuration works on Android and iOS.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1567.0",
+  "version": "0.1569.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "d2a011d086189478e1d755c94bd90263c9e13f797a11fb09eba96c1e"
+  "falconPackageHash": "666ab69b9997a9eb57284df9f6b9a084eea7adcc34322d3afa349a92"
 }

package/templates/beauty-salon/config.ts

@@ -52,6 +52,16 @@ export default defineApp({
     ]
   },
   designTokensPath: "./tokens.json",
+  // Native fallback; the T5 splash descriptor owns the editable launch appearance.
+  splash: {
+    "enabled": true,
+    "backgroundColor": "accentPrimary",
+    "logoAsset": "branded_lite_app_icon",
+    "logoWidth": 192,
+    "layout": "logoOnly",
+    "minVisibleMs": 0,
+    "maxHoldMs": 5000
+  },
   navigation: {
     "navKind": "responsive",
     "scheme": "himalaya-__HIMI_APP_SLUG__",
@@ -321,7 +331,8 @@ export default defineApp({
           "contextName",
           "returnScreenId",
           "returnId",
-          "returnChannelId"
+          "returnChannelId",
+          "authContinuation"
         ],
         "parentScreenId": "himi_account",
         "tabId": "profile"