@wix/himalaya-cli 0.1596.0 → 0.1598.0

package/guides/qa-builds.md

@@ -1136,7 +1136,7 @@ himi dist --app <app> --platform android --aab --wait --target bo
   any pool time is spent: `invalid_android_format` (anything but `apk` / `aab`),
   `android_format_requires_link` (any destination but `link`), `android_format_requires_android`
   (an iOS-only build, where the flag would be dropped in silence), and
-  `android_format_requires_wix_keystore` (any `--android-signing` other than `wix-keystore`), and
+  `android_format_requires_wix_keystore` (any `--android-signing` other than `wix-keystore` or `owner`), and
   `android_format_shell_unsupported` (the `owner-lite` shell, whose gradle build refuses a store
   bundle without a real Firebase config and customer identity). A mixed `--platform ios,android`
   applies it to the Android leg only.
@@ -1283,6 +1283,48 @@ updates come from Wix builds too; leaving Wix needs an upload-key reset through
 support. A pool machine without the key fails the build, naming the paths it searched, rather than
 signing with another key.
 
+### An unsigned bundle under the owner's own name — an owner bundle
+
+**Off by default.** A plane answers `501 owner_bundles_unconfigured` until `HIMI_DIST_OWNER_BUNDLES=1`
+is on its databag. It's the first half of a path for an owner who publishes to their own Google Play
+account with no WixOne link. The bundle isn't usable until it's signed, and nothing here signs it yet.
+
+```sh
+himi dist --app <app> --platform android --aab --android-signing owner \
+  --package-name com.acme.app --google-services ./google-services.json --version 1.0.0 --target wix
+```
+
+- **What you get:** an **unsigned** `.aab` as `artifact.downloadUrl`, with `androidSigning: "unsigned"`
+  and `ownerBundle` (`packageName`, `firebaseProjectId`, `configSha256`) on the job. No APK comes with
+  it, because that would be an installable file on a Wix link under any name the caller typed.
+- **Why unsigned, not QA-signed:** Google Play should refuse an unsigned file on upload, so forgetting
+  to sign costs nothing. A QA signature would be accepted, and would tie the listing to a key committed
+  to this repo.
+- **It runs on Linux.** It's the one brokered job that does: `linux:dist:android` runs
+  `native-ci/scripts/run-android.mjs`, which sets up the Android SDK and JDK before `run-dist`.
+- **The inputs come from the request:** `androidPackageName` and `googleServicesJson`, with nothing read
+  from Branded, the Firebase pool or mobile-apps-containers-builder. The package name can't be under
+  Wix's namespaces, but ownership isn't checked: Google Play binds a name at upload. The Firebase file is
+  stored apart from the job record, served by `GET /v1/dist/android-config` to that job's token, and
+  blanked when the job succeeds or is canceled, since Job Service may retry a failed one.
+- **It uses the self-serve quota tier**, like any other self-serve build.
+- **The pool proves the result.** `jarsigner` must say the file is unsigned, and the bundle's manifest
+  must carry the owner's package name. The name can't be changed once it reaches a Play listing.
+- **Version skew.** An older `run-dist` ignores the request and signs with WixOne, so two checks guard
+  this. The commit must carry `ownerBundle: 1` in `signing-protocol.json` (else
+  `409 release_predates_owner_bundles`), and the result callback fails anything not reported as
+  `unsigned` and drops its link (`android_format_wrong_signer`).
+- **A site-bound app is refused** (`409 owner_bundle_site_bound`). Its Google Play file is a store
+  build, whose plan check this path must not bypass.
+
+Other refusals, each with `code` equal to `error`: `android_signing_unsigned_requires_aab`,
+`owner_bundle_fields_unexpected` (the two fields on any other build), `owner_bundle_android_only`,
+`owner_bundle_incompatible_options` (`--signing`), `owner_bundle_shell_unsupported` (any shell but
+`branded-lite`), `owner_bundle_version_invalid`, `owner_bundle_package_invalid`,
+`owner_bundle_package_reserved` (Wix namespaces and the `himi.` prefix), `owner_bundle_firebase_required`, `owner_bundle_firebase_invalid` and
+`owner_bundle_firebase_package_mismatch` 400, and `owner_bundle_unavailable` 503. Design:
+[the design note](superpowers/specs/2026-11-07-owner-signed-play-bundle-design.md).
+
 ### The iOS lane lives in one shared place
 
 `fastlane dist` runs with `cwd = <app>/ios`, so it needs `<app>/ios/fastlane/Fastfile`. That file is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1596.0",
+  "version": "0.1598.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -72,5 +72,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "2258d7eeee921c4ccc25fd94a40d0f24b29ca71bfc2f363b5ca7fd3f"
+  "falconPackageHash": "96e1d99eb8f2d094da98bb99d996d441c41fcfa91bedade74520607a"
 }