@wix/himalaya-cli 0.1632.0 → 0.1634.0

package/guides/skill.md

@@ -178,12 +178,22 @@ Read `himi docs push-cli-onboarding` (also https://apps.wix.com/_api/himi-serve/
 setup for the required logins, credential fields and failure handling. The guide is bundled with the public npm package
 and is also served at the public URL above. No repository access is required.
 
+## Signing in when the owner's browser is not on this machine
+
+`himi login --browser` posts the sign-in back to a port on the machine that runs `himi`, so it only works when the owner's browser runs there too. In a sandbox, a cloud session or an agent platform it cannot finish — do not send the owner a link to it, and do not ask them to install the CLI and run the steps themselves.
+
+- **Your platform already holds the owner's Wix session or token** (they connected their Wix account to it): that token **is** the owner. Any valid Wix token can manage that account's apps, publishing included. Pipe it in — `printf '%s' "$TOKEN" | himi login --wix --wix-token-stdin --target wix` — or set `WIX_TOKEN` and run `himi login --wix --target wix`. Never put a token on the command line (argv shows in `ps` and transcripts) or in a file you commit, and never print it.
+- **A server or CI job** with an account API key: `WIX_API_KEY` + `himi login --wix --target wix`.
+- **None of these:** stop and say exactly what is missing. Do not improvise another route to a himi token.
+
+This replaces only the sign-in. The approval gates above still apply to every side effect.
+
 ## Headless / non-interactive agents
 
 When there is no human in the loop (QA runner, cron, dispatched agent), do not invent a turn-by-turn approval chat. Map each gate to what the invocation already supplied:
 
 - The issue / brief / `SPEC.md` + `MOBILE-UX.md` in the workspace **is** plan approval. Draft or complete those files without waiting for a spoken "yes".
-- Credentials already in the environment (`WIX_CLIENT_ID` / `WIX_SITE_URL`, a dpx session, `HIMI_CONTROL_TOKEN`) **are** consent to use that identity against the named target. Do not prompt for them again; do not mint a different site or account.
+- Credentials already in the environment (`WIX_CLIENT_ID` / `WIX_SITE_URL`, a dpx session, `HIMI_CONTROL_TOKEN`, `WIX_TOKEN`) **are** consent to use that identity against the named target. Do not prompt for them again; do not mint a different site or account.
 - An explicit `--draft` / publish-draft instruction in the brief **is** owner-private preview approval. Do **not** promote live unless the brief says to.
 - QA binary / store submission still needs the brief to name that step; absence means skip it.
 - **Progress still goes somewhere.** With nobody reading the chat, the pictures and postcards go to the journal (`himi progress`) and the build board instead — the steps below, in this session, while you build.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1632.0",
+  "version": "0.1634.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -30,7 +30,7 @@
     "himi": "node --import tsx src/cli.ts",
     "gen:guides": "npm --prefix ../.. run authoring:gen",
     "build": "node --import tsx ../authoring-kit/gen-templates.mts && node ../authoring-kit/bundle.mjs && npm run build:dist",
-    "build:dist": "node --import tsx ../html-to-t5/vocab-gen/gen-v2.ts && node scripts/bundle.mjs && node scripts/stage-authoring-runtime.mjs",
+    "build:dist": "node --import tsx ../html-to-t5/vocab-gen/gen-v2.ts && node scripts/bundle.mjs && node scripts/stage-authoring-runtime.mjs && node scripts/stage-browser-plane.mjs",
     "test": "node ../../tools/ci/run-tests.mjs --package tools/himi-cli --"
   },
   "dependencies": {
@@ -72,5 +72,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "1c969f8119c5dbbac0710e70c4bac2f5cc71b9e2d65a7261868e6255"
+  "falconPackageHash": "7e33d424d99d05998b91ee4390198d50459ab4ce4a5aec4d4c999ae1"
 }

package/templates/beauty-salon/tier5-src/_shared/branded-lite-hosted.ts

@@ -97,6 +97,7 @@ export const HOSTED_SCREEN_VERTICALS: Readonly<Record<string, readonly BrandedLi
   himi_gift_card: ["giftCards"],
   himi_gift_cards: ["giftCards"],
   himi_groups: ["groups"],
+  himi_inbox: ["inbox"],
   himi_group_about: ["groups"],
   himi_my_groups: ["groups"],
   himi_invoice: ["invoices"],

package/templates/beauty-salon/tier5-src/himi-store-product/index.ts

@@ -467,7 +467,7 @@ function derive(s: S): S {
 let cartBadgeEpoch = 0;
 
 // A digital product with no options sells through the App Store once the platform sells Wix Stores
-// items there (`storesAppleSalesEnabled`), through StartItemPayment or the app's own eCom order.
+// items there (`storesAppleSalesEnabled`): wix-iap StartItemPayment places and charges its order.
 // Until then, and for any other product, an App Store route only blocks the regular checkout.
 const SELLS_THROUGH_APPLE = storesAppleSalesEnabled();
 const WIX_STORES_APP = "215238eb-22a5-4c36-9e7b-e7c08025e04e";

package/templates/branded-lite/config.ts

@@ -371,6 +371,13 @@ export default defineApp({
         "parentScreenId": "himi_account",
         "tabId": "profile"
       },
+      {
+        "screenId": "himi_inbox",
+        "isPublic": true,
+        "paramKeys": [],
+        "parentScreenId": "",
+        "tabId": ""
+      },
       {
         "screenId": "himi_business_chat",
         "isPublic": true,