@wix/himalaya-cli 0.1597.0 → 0.1599.0

package/guides/app-config.md

@@ -137,7 +137,7 @@ does not include answers `module_not_linked` on device. Some components need one
 and `himi validate` errors on a screen that uses one the app does not declare.
 `presigned_upload.putFile` also requires `files` on the calling screen.
 
-App-level capability vocabulary: `camera`, `barcode_scanner`, `biometrics`, `secure_storage`, `share`, `push`, `file_picker`, `files`, `open_url`, `pdf`, `clipboard`, `theme`, `l10n`, `photos`, `presigned_upload`, `ui`, `calendar`, `contacts`, `tasks`, `audio_record`, `audio_record_background`, `calls`, `location`, `location_background`, `motion`, `health`, `media_playback`, `webview`, `browser_auth`, `haptic`, `himi_apps`, `iap`, `keyboard`, `torch`, `network`, `wix_cashier`, `wix_chat`, `live_activity`, `local_database`, `speech`, `speaker_diarization`, `system_intents`, `on_device_ai`, `app_info`, `release_control`, `godot`, `base44`, `animation`.
+App-level capability vocabulary: `camera`, `barcode_scanner`, `biometrics`, `secure_storage`, `share`, `push`, `file_picker`, `files`, `open_url`, `pdf`, `clipboard`, `theme`, `l10n`, `photos`, `presigned_upload`, `ui`, `calendar`, `contacts`, `tasks`, `audio_record`, `audio_record_background`, `calls`, `location`, `location_background`, `motion`, `health`, `media_playback`, `webview`, `browser_auth`, `haptic`, `himi_apps`, `iap`, `keyboard`, `torch`, `network`, `wix_cashier`, `wix_chat`, `live_activity`, `local_database`, `speech`, `speaker_diarization`, `system_intents`, `on_device_ai`, `app_info`, `release_control`, `legacy_import`, `godot`, `base44`, `animation`.
 
 ## What `himi validate` checks (7 passes)
 

package/guides/capabilities.md

@@ -278,6 +278,7 @@ prompt.
   | `app_info` | the shell's boot has to configure it with the app id it reports |
   | `system_intents` | the shell has to wire the system-intents host (app identity, deep-link routing, refresh) |
   | `release_control` | the shell's boot has to configure it with the app id whose releases it switches |
+  | `legacy_import` | the shell's boot has to run the legacy importer before auth and feed it the signed-in principal |
   | `base44` | the shell's boot has to bind the Base44 app it talks to; the module links, the binding is the shell's |
   | `godot` | needs the shell's game surface view and, on Android, the shell's pick of the engine's C++ runtime |
 

package/guides/importable-sdks.md

@@ -40,6 +40,7 @@ package in one greppable file) or `GET /v1/sdk/<name>` over HTTP; in the CLI,
 - `@himalaya/keyboard` — Tier-5 typed binding for the platform's keyboard capability.
 - `@himalaya/kyber-api` — narrow Tier-5 binding for Kyber BO HTTP calls.
 - `@himalaya/l10n` — synchronous app-catalog copy (SDK foundation; requires host integration).
+- `@himalaya/legacy-import` — Tier-5 typed binding for the one-time legacy import report.
 - `@himalaya/live-activity` — Tier-5 typed binding to the platform's Live Activity capability.
 - `@himalaya/local-db` — Tier-5 typed binding to the platform's local-database capability: a per-entity on-device store (EntityStore) + an offline WriteQueue, so a worker bundle can persist and query real data on device.
 - `@himalaya/location` — Tier-5 typed binding for device location.

package/guides/qa-builds.md

@@ -1136,7 +1136,7 @@ himi dist --app <app> --platform android --aab --wait --target bo
   any pool time is spent: `invalid_android_format` (anything but `apk` / `aab`),
   `android_format_requires_link` (any destination but `link`), `android_format_requires_android`
   (an iOS-only build, where the flag would be dropped in silence), and
-  `android_format_requires_wix_keystore` (any `--android-signing` other than `wix-keystore`), and
+  `android_format_requires_wix_keystore` (any `--android-signing` other than `wix-keystore` or `owner`), and
   `android_format_shell_unsupported` (the `owner-lite` shell, whose gradle build refuses a store
   bundle without a real Firebase config and customer identity). A mixed `--platform ios,android`
   applies it to the Android leg only.
@@ -1283,6 +1283,48 @@ updates come from Wix builds too; leaving Wix needs an upload-key reset through
 support. A pool machine without the key fails the build, naming the paths it searched, rather than
 signing with another key.
 
+### An unsigned bundle under the owner's own name — an owner bundle
+
+**Off by default.** A plane answers `501 owner_bundles_unconfigured` until `HIMI_DIST_OWNER_BUNDLES=1`
+is on its databag. It's the first half of a path for an owner who publishes to their own Google Play
+account with no WixOne link. The bundle isn't usable until it's signed, and nothing here signs it yet.
+
+```sh
+himi dist --app <app> --platform android --aab --android-signing owner \
+  --package-name com.acme.app --google-services ./google-services.json --version 1.0.0 --target wix
+```
+
+- **What you get:** an **unsigned** `.aab` as `artifact.downloadUrl`, with `androidSigning: "unsigned"`
+  and `ownerBundle` (`packageName`, `firebaseProjectId`, `configSha256`) on the job. No APK comes with
+  it, because that would be an installable file on a Wix link under any name the caller typed.
+- **Why unsigned, not QA-signed:** Google Play should refuse an unsigned file on upload, so forgetting
+  to sign costs nothing. A QA signature would be accepted, and would tie the listing to a key committed
+  to this repo.
+- **It runs on Linux.** It's the one brokered job that does: `linux:dist:android` runs
+  `native-ci/scripts/run-android.mjs`, which sets up the Android SDK and JDK before `run-dist`.
+- **The inputs come from the request:** `androidPackageName` and `googleServicesJson`, with nothing read
+  from Branded, the Firebase pool or mobile-apps-containers-builder. The package name can't be under
+  Wix's namespaces, but ownership isn't checked: Google Play binds a name at upload. The Firebase file is
+  stored apart from the job record, served by `GET /v1/dist/android-config` to that job's token, and
+  blanked when the job succeeds or is canceled, since Job Service may retry a failed one.
+- **It uses the self-serve quota tier**, like any other self-serve build.
+- **The pool proves the result.** `jarsigner` must say the file is unsigned, and the bundle's manifest
+  must carry the owner's package name. The name can't be changed once it reaches a Play listing.
+- **Version skew.** An older `run-dist` ignores the request and signs with WixOne, so two checks guard
+  this. The commit must carry `ownerBundle: 1` in `signing-protocol.json` (else
+  `409 release_predates_owner_bundles`), and the result callback fails anything not reported as
+  `unsigned` and drops its link (`android_format_wrong_signer`).
+- **A site-bound app is refused** (`409 owner_bundle_site_bound`). Its Google Play file is a store
+  build, whose plan check this path must not bypass.
+
+Other refusals, each with `code` equal to `error`: `android_signing_unsigned_requires_aab`,
+`owner_bundle_fields_unexpected` (the two fields on any other build), `owner_bundle_android_only`,
+`owner_bundle_incompatible_options` (`--signing`), `owner_bundle_shell_unsupported` (any shell but
+`branded-lite`), `owner_bundle_version_invalid`, `owner_bundle_package_invalid`,
+`owner_bundle_package_reserved` (Wix namespaces and the `himi.` prefix), `owner_bundle_firebase_required`, `owner_bundle_firebase_invalid` and
+`owner_bundle_firebase_package_mismatch` 400, and `owner_bundle_unavailable` 503. Design:
+[the design note](superpowers/specs/2026-11-07-owner-signed-play-bundle-design.md).
+
 ### The iOS lane lives in one shared place
 
 `fastlane dist` runs with `cwd = <app>/ios`, so it needs `<app>/ios/fastlane/Fastfile`. That file is

package/guides/sdk-reference.json

@@ -3198,6 +3198,49 @@
       }
     ]
   },
+  {
+    "name": "@himalaya/legacy-import",
+    "source": "core/sdk/legacy-import/src/index.ts",
+    "description": "Tier-5 typed binding for the one-time legacy import report.",
+    "api": [
+      {
+        "name": "LegacyImportSourceReport",
+        "kind": "interface",
+        "jsdoc": "",
+        "decl": "export interface LegacyImportSourceReport {\n  id: string;\n  /** `done` | `empty` | `incomplete` | `failed` | `unregistered_kind` | `invalid_options` */\n  status: string;\n  /** Item counts — `items`, plus one per sink the source's items went to. */\n  counts: Record<string, number>;\n  error?: string;\n}"
+      },
+      {
+        "name": "LegacyImportReportItem",
+        "kind": "interface",
+        "jsdoc": "",
+        "decl": "export interface LegacyImportReportItem {\n  key: string;\n  /** The item's value — UTF-8 text, or base64 when `meta.encoding === \"base64\"`. */\n  value: string;\n  meta?: Record<string, string>;\n}"
+      },
+      {
+        "name": "LegacyImportReport",
+        "kind": "interface",
+        "jsdoc": "",
+        "decl": "export interface LegacyImportReport {\n  /** The `legacyImport.id` that produced it. */\n  id: string;\n  /** Epoch ms the import ran. */\n  extractedAt: number;\n  sources: LegacyImportSourceReport[];\n  /** Only the `report` sink's items. */\n  items: LegacyImportReportItem[];\n}"
+      },
+      {
+        "name": "read",
+        "kind": "function",
+        "jsdoc": "/** The import report for the signed-in principal, or null — none ran, it was acknowledged, it\n *  belongs to another account, or this host has nothing to import (web). */",
+        "decl": "export async function read(): Promise<LegacyImportReport | null>;"
+      },
+      {
+        "name": "ack",
+        "kind": "function",
+        "jsdoc": "/** Delete the report. Idempotent: acknowledging twice (or with nothing to acknowledge) is fine. */",
+        "decl": "export async function ack(): Promise<void>;"
+      },
+      {
+        "name": "version",
+        "kind": "const",
+        "jsdoc": "/** Capability version, for bundles that gate on min binary version. */",
+        "decl": "export const version = 1;"
+      }
+    ]
+  },
   {
     "name": "@himalaya/live-activity",
     "source": "core/sdk/live-activity/src/index.ts",

package/guides/web-page-native-sdk.md

@@ -39,7 +39,7 @@ Your page can only use capabilities the **app owner** turned on for your site. I
   `capabilities`, allowing **every** method the capability's page lists — except
   `presigned_upload.putFile`, which reads a device file and is allowed only when `files` is enabled
   too. So enabling a capability is enough; the owner does not list methods.
-- **What a Brandy app cannot enable:** `app_info`, `godot`, `himi_apps`, `live_activity`,
+- **What a Brandy app cannot enable:** `app_info`, `godot`, `himi_apps`, `legacy_import`, `live_activity`,
   `local_database`, `release_control`, `system_intents`, `ui` and `wix_platform` — most need wiring
   a website app's shell does not have, so plan your page without them. `base44` works only when the
   app also has a Base44 binding. Every other capability in the reference can be enabled; other Himi

package/guides/web-page-sdk-reference.md

@@ -32,6 +32,7 @@ the SDK sources, so it matches the shipped SDKs.
 - [`himi_apps`](https://apps.wix.com/_api/himi-serve/authoring/resource/web-sdk%2Fhimi_apps?format=md) — Cross-app open / host queries. 4 methods · not in Brandy.
 - [`iap`](https://apps.wix.com/_api/himi-serve/authoring/resource/web-sdk%2Fiap?format=md) — In-app-purchase capability. 9 methods.
 - [`keyboard`](https://apps.wix.com/_api/himi-serve/authoring/resource/web-sdk%2Fkeyboard?format=md) — Keyboard capability. 1 method.
+- [`legacy_import`](https://apps.wix.com/_api/himi-serve/authoring/resource/web-sdk%2Flegacy_import?format=md) — One-time legacy import report. 2 methods · not in Brandy.
 - [`live_activity`](https://apps.wix.com/_api/himi-serve/authoring/resource/web-sdk%2Flive_activity?format=md) — Live Activity capability. 3 methods · not in Brandy.
 - [`local_database`](https://apps.wix.com/_api/himi-serve/authoring/resource/web-sdk%2Flocal_database?format=md) — Local-database capability: a per-entity on-device store (EntityStore) + an offline WriteQueue, so a worker bundle can persist and query real data on device. 11 methods · not in Brandy.
 - [`location`](https://apps.wix.com/_api/himi-serve/authoring/resource/web-sdk%2Flocation?format=md) — Device location. 10 methods.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1597.0",
+  "version": "0.1599.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -72,5 +72,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "fdefbbbafc15c579e39464ec6f448cd09b9e8439934b586fb9f3a6ac"
+  "falconPackageHash": "0492bb475381b374bdbf2ac75086d487a090cf829cbbf6f254c6ddd1"
 }