@wix/himalaya-cli 0.1631.0 → 0.1633.0

package/fixtures/wix-canned.json

@@ -2323,5 +2323,8 @@
         "balance": 25
       }
     }
+  },
+  "POST /_api/referral-rewards/v1/referral-rewards/query": {
+    "referralRewards": []
   }
 }

package/guides/getting-started.md

@@ -495,7 +495,8 @@ select the deployed customer target explicitly:
 ```sh
 himi login --browser --target wix
 wix login
-# no browser? export WIX_API_KEY, then run himi login --wix --target wix instead of the two lines above
+# no browser here? pipe the owner's held Wix token: printf '%s' "$TOKEN" | himi login --wix --wix-token-stdin --target wix
+# (or export WIX_API_KEY on a server, then himi login --wix --target wix) instead of the two lines above
 himi dist --app <app> --release <release-id> --site <owned-site-id> \
   --platform ios,android --signing byo --android-signing qa-keystore --wait --target wix
 ```

package/guides/himi-json-output.md

@@ -14,6 +14,12 @@ require those fields. Existing error-only push refusals now also carry `ok: fals
 Output channels and process exit codes are unchanged. Read JSON failures on both
 stdout and stderr; progress/warnings are not failure envelopes.
 
+## `himi sdk unverified` codes
+
+| Code | Meaning |
+| --- | --- |
+| `sdk_verification_unknown` | A cached SDK reference has one or more exports without verification metadata (an older or mixed catalog), so the unverified list cannot be trusted. Refresh the catalog (unpin an older kit first if needed). Exit 2. |
+
 ## `himi store preflight` / `himi store upload` / `himi testflight` config failures
 
 | Code | Meaning |

package/guides/himi-skill.md

@@ -518,7 +518,8 @@ select the deployed customer target explicitly:
 ```sh
 himi login --browser --target wix
 wix login
-# no browser? export WIX_API_KEY, then run himi login --wix --target wix instead of the two lines above
+# no browser here? pipe the owner's held Wix token: printf '%s' "$TOKEN" | himi login --wix --wix-token-stdin --target wix
+# (or export WIX_API_KEY on a server, then himi login --wix --target wix) instead of the two lines above
 himi dist --app <app> --release <release-id> --site <owned-site-id> \
   --platform ios,android --signing byo --android-signing qa-keystore --wait --target wix
 ```

package/guides/iap-screen-adoption.md

@@ -14,7 +14,7 @@ and generated templates. Historical receipts retain their recorded amounts.
 | `himi-branded-lite-plans` | Pricing Plan ID; `priceLine` | Shared Apple pricing and existing Join action through `pricingPlanOrders`; only one-time unlimited Plans can start Apple checkout |
 | `wix-spaces-plan-detail` | Pricing Plan ID; `price` | Shared pricing; remains read-only |
 | `createCheckoutService` / `checkoutScreen` | Pricing Plan ID; `priceLine` | Same shared Plans pricing and purchase; existing options, copy, login destination and factory shape retained |
-| `himi-store-product` | Stores product ID; `price` | Shared pricing; physical options/add/save retained. With Stores Apple sales enabled, a mapped digital product without options offers Buy now through the app-owned eCom order; `STORES_ITEM_PAYMENT_ENABLED` selects StartItemPayment instead ([checkout](iap-wix-checkout.md#wix-stores-items-through-startitempayment-off)) |
+| `himi-store-product` | Stores product ID; `price` | Shared pricing; physical options/add/save retained. With Stores Apple sales enabled, a mapped digital product without options offers Buy now through wix-iap StartItemPayment, which places and charges the eCom order server-side ([checkout](iap-wix-checkout.md#wix-stores-items-through-startitempayment)) |
 | `himi-store-shop` | Stores product ID; price in `subtitle` | Batched visible pricing, including paged results; saved/cache metadata retains the commerce price rather than an Apple offer |
 | `himi-store-saved` | Stored product ID; `price` | Reprices saved rows through the shared source when shown; no added purchase action |
 | `himi-branded-lite-home` | Stores product IDs; hero and rail prices | Shared pricing on visible product offers; navigation-only Program cards remain unchanged |
@@ -44,9 +44,9 @@ withdraw the shared checkout's access state; reading existing access never creat
 The existing Stores adapter reads `paymentStatus: PAID` as granted. That proves payment,
 not usable delivery of a download or course. It also lacks a verified member-scoped
 existing-ownership read. Only the product screen installs `storesProductOrders` for sales, while
-`storesAppleSalesEnabled()` is true. As shipped, `STORES_APPLE_SALES_ENABLED` is on and
-`STORES_ITEM_PAYMENT_ENABLED` is off, so mapped digital products without options use the app-owned
-eCom checkout and order before the Apple charge. Live digital fulfillment remains unverified.
+`storesAppleSalesEnabled()` is true. As shipped, `STORES_APPLE_SALES_ENABLED` is on, so mapped digital
+products without options are paid through wix-iap StartItemPayment: the device opens no eCom checkout
+and makes no cashier charge. Live digital fulfillment remains unverified.
 The cart and list screens do not start Apple sales. A confirmed physical product retains its
 regular checkout.
 Unknown product facts, unsupported catalog apps and missing routing fail closed.

package/guides/importable-sdks.md

@@ -36,7 +36,7 @@ package in one greppable file) or `GET /v1/sdk/<name>` over HTTP; in the CLI,
 - `@himalaya/hhp` — —
 - `@himalaya/himi-apps` — Tier-5 typed binding for cross-app open / host queries.
 - `@himalaya/iap` — Tier-5 typed binding to the platform's in-app-purchase capability.
-- `@himalaya/iap-checkout` — @wix/himalaya/iap-checkout — the ONE shared flow that sells a digital Wix item through the App Store, for any screen: a vertical order, its `appleIAP` cashier charge, mobile-apps-wix-iap's payment, the managed StoreKit purchase and the vertical's own access read.
+- `@himalaya/iap-checkout` — @wix/himalaya/iap-checkout — the ONE shared flow that sells a digital Wix item through the App Store, for any screen: mobile-apps-wix-iap's payment, the managed StoreKit purchase and the vertical's own access read.
 - `@himalaya/keyboard` — Tier-5 typed binding for the platform's keyboard capability.
 - `@himalaya/kyber-api` — narrow Tier-5 binding for Kyber BO HTTP calls.
 - `@himalaya/l10n` — synchronous app-catalog copy (SDK foundation; requires host integration).

package/guides/one-app-section-mappings.md

@@ -159,8 +159,8 @@ carousel placement remain separate gaps; the mappings above stay Partial.
 
 | Source sectionDefinitionId | Source viewer component | Himalaya implementation | Placement / reuse | Class | Settings, actions and gaps |
 | --- | --- | --- | --- | --- | --- |
-| `loyalty_status_section` | `loyalty.components.StatusSection` | [himi_loyalty member card](https://github.com/wix-private/himalaya/blob/adf4c8b47fd237307b278a5dbb8198a94b7feb69/apps/himi-branded-lite/dev/index.ts) (`buildLoyalty` points card) + [loyalty worker](https://github.com/wix-private/himalaya/blob/adf4c8b47fd237307b278a5dbb8198a94b7feb69/core/dev-server/tier5-bundles-src/himi-branded-lite-loyalty/index.ts "audience-lint-ok: optional pinned upstream evidence, not a local authoring dependency") | Existing base; adaptation needed | Partial | The member card on `himi_loyalty` reads the signed-in member's balance (`getCurrentMemberLoyaltyAccount`) and, beside it, the tiers program and the claimed coupons; it shows the balance, the tier name, the points-expiry line and `Rewards available (N)` (rewards the balance covers on the member's tier + ACTIVE claimed coupons), each blank when its read fails. Visitors get the sign-in gate. Not carried over: the referral-coupon share of the count (no referral spec in codegen) and the one-app `View` link (the catalog it opens is on the same screen). |
-| `loyalty_offering_section` | `loyalty.components.OfferingSection` | [himi_loyalty](https://github.com/wix-private/himalaya/blob/97f1542f2f7d6e8cb7a902b912c87dcaa37e5a67/apps/himi-branded-lite/dev/index.ts) + [rewards worker](https://github.com/wix-private/himalaya/blob/97f1542f2f7d6e8cb7a902b912c87dcaa37e5a67/core/dev-server/tier5-bundles-src/himi-branded-lite-loyalty/index.ts "audience-lint-ok: optional pinned upstream evidence, not a local authoring dependency") | Existing base; adaptation needed | Partial | Reuse program/reward reads and required-points presentation. Preserve offering selection. Member earning/redemption operations are not established by this read-only rewards list. |
+| `loyalty_status_section` | `loyalty.components.StatusSection` | [himi_loyalty member card](https://github.com/wix-private/himalaya/blob/e5d1313654a200084499ec74eb68fa77992d096e/apps/himi-branded-lite/dev/index.ts) (`buildLoyalty` points card) + [loyalty worker](https://github.com/wix-private/himalaya/blob/e5d1313654a200084499ec74eb68fa77992d096e/core/dev-server/tier5-bundles-src/himi-branded-lite-loyalty/index.ts "audience-lint-ok: optional pinned upstream evidence, not a local authoring dependency") | Existing base; adaptation needed | Partial | Member-only points, tier, expiry and the reward count are implemented in the shared screen. The count includes affordable active rewards, active claimed loyalty coupons and active referral coupons; failed reads leave the total unknown. View opens `himi_loyalty_reward`, with current-member eligibility, a confirmation step, coupon redemption and balance refresh. Private fields never hydrate or persist. Source-widget placement still requires adaptation; successful member REST recordings remain required for migration acceptance. |
+| `loyalty_offering_section` | `loyalty.components.OfferingSection` | [himi_loyalty](https://github.com/wix-private/himalaya/blob/e5d1313654a200084499ec74eb68fa77992d096e/apps/himi-branded-lite/dev/index.ts) + [rewards worker](https://github.com/wix-private/himalaya/blob/e5d1313654a200084499ec74eb68fa77992d096e/core/dev-server/tier5-bundles-src/himi-branded-lite-loyalty/index.ts "audience-lint-ok: optional pinned upstream evidence, not a local authoring dependency") | Existing base; adaptation needed | Partial | Shared `himi_loyalty` supports base/custom tier offerings, exact tier configurations, benefit descriptions and Show all after three tier cards. Active birthday rules expose member birthday editing; active social-follow rules expose configured supported HTTPS channels. The published test app has four Loyalty instances with empty settings, and neither definition declares settingsData, so no offering-selection field is inferred. Source-widget placement and source rollout flags still need per-app review; the Himi controls follow active rule/channel configuration. |
 
 ### 8. referrals-section-definitions.json
 
@@ -425,7 +425,7 @@ These rows have reusable code, but their remaining requirements must not disappe
 - [Photo Albums worker](https://github.com/wix-private/himalaya/blob/97f1542f2f7d6e8cb7a902b912c87dcaa37e5a67/core/dev-server/tier5-bundles-src/wix-spaces-photo-albums/index.ts "audience-lint-ok: optional pinned upstream evidence, not a local authoring dependency") explicitly says no album API is wired and renders an empty state.
 - [Restaurant basket worker](https://github.com/wix-private/himalaya/blob/97f1542f2f7d6e8cb7a902b912c87dcaa37e5a67/core/dev-server/tier5-bundles-src/wix-spaces-food-orders/index.ts "audience-lint-ok: optional pinned upstream evidence, not a local authoring dependency") explicitly avoids the owner-capable Orders API and supplies no placed-order history.
 - [Saved products worker](https://github.com/wix-private/himalaya/blob/97f1542f2f7d6e8cb7a902b912c87dcaa37e5a67/core/dev-server/tier5-bundles-src/himi-store-saved/index.ts "audience-lint-ok: optional pinned upstream evidence, not a local authoring dependency") uses device-local saves; it does not establish an account-backed wishlist mapping.
-- [Loyalty worker](https://github.com/wix-private/himalaya/blob/97f1542f2f7d6e8cb7a902b912c87dcaa37e5a67/core/dev-server/tier5-bundles-src/himi-branded-lite-loyalty/index.ts "audience-lint-ok: optional pinned upstream evidence, not a local authoring dependency") reads the program and reward catalog, not the current member's points balance.
+- The shared Loyalty worker now includes member status and links to a separate member reward/coupon journey. This does not automatically implement an arbitrary source section placement; keep member credentials and rendered evidence in the migration acceptance record.
 - [Events detail worker](https://github.com/wix-private/himalaya/blob/97f1542f2f7d6e8cb7a902b912c87dcaa37e5a67/core/dev-server/tier5-bundles-src/himi-events-detail/index.ts "audience-lint-ok: optional pinned upstream evidence, not a local authoring dependency") documents the owner-scoped, best-effort attendee read; it does not supply a full consumer guest list.
 - [Groups feed worker](https://github.com/wix-private/himalaya/blob/97f1542f2f7d6e8cb7a902b912c87dcaa37e5a67/core/dev-server/tier5-bundles-src/himi-branded-lite-feed/index.ts "audience-lint-ok: optional pinned upstream evidence, not a local authoring dependency") chooses its group internally; it does not accept a fixed source group selection.
 - [Program detail worker](https://github.com/wix-private/himalaya/blob/97f1542f2f7d6e8cb7a902b912c87dcaa37e5a67/core/dev-server/tier5-bundles-src/himi-branded-lite-program/index.ts "audience-lint-ok: optional pinned upstream evidence, not a local authoring dependency") explicitly identifies the legacy CHALLENGES app ID, supporting the Online Programs family mapping; it does not provide the missing participating-program carousel.