@wix/himalaya-cli 0.1633.0 → 0.1635.0

package/fixtures/wix-canned.json

@@ -1230,6 +1230,36 @@
       "count": 2
     }
   },
+  "POST /badges/v4/assignments/query": {
+    "badgeAssignments": [
+      {
+        "id": "asg-0001",
+        "badgeId": "bdg-0001",
+        "memberId": "mem-0001"
+      }
+    ],
+    "pagingMetadata": {
+      "count": 1,
+      "hasNext": false
+    }
+  },
+  "POST https://apps.wix.com/_api/members-one-app/api/members": {
+    "items": [
+      {
+        "id": "mem-0001",
+        "displayName": "Dana R.",
+        "member": {
+          "role": "MEMBER",
+          "online": false,
+          "lastOpenApp": {
+            "amount": 3,
+            "unit": "hour"
+          }
+        }
+      }
+    ],
+    "total": 1
+  },
   "POST /badges/v4/badges/query": {
     "badges": [
       {
@@ -1408,7 +1438,7 @@
       ]
     }
   },
-  "POST /members-feed-viewer/v1/members-viewer-feed-notifications/query": {
+  "POST /_api/members-feed-viewer/v1/members-viewer-feed-notifications/query": {
     "viewerFeedNotifications": [
       {
         "id": "ntf-0001",
@@ -2049,6 +2079,9 @@
       }
     ]
   },
+  "POST /wix-data/v2/items/count": {
+    "totalCount": 12
+  },
   "POST /wix-data/v2/items/query": {
     "dataItems": [
       {

package/guides/designing-himi-screens.md

@@ -334,7 +334,11 @@ scroll. *Reach for `SegmentedControl` for 2–4 in-content modes; `Tabs`/tab-bar
 **Feedback & overlays** — `Banner` for a persistent inline message (with a retry action when a refresh fails over content you kept; a screen with nothing to show uses an `ErrorState`, see §5);
 `Snackbar` for a transient confirmation; `AlertDialog` for a blocking decision (up to three `buttons`
 — "Save / Discard / Cancel" — with roles `default` / `cancel` / `destructive`; a worker's
-`ui.alert({ buttons })` resolves `{ buttonId }`); `BottomSheet` for
+`ui.alert({ buttons })` resolves `{ buttonId }`). Alerts share one slot: a second one replaces what
+is up, and a second worker `ui.alert` rejects `ui_busy`. If your app can raise alerts from several places at
+once (an error from a refresh while a first-run dialog is open), set `navigation: { presentationQueue: true }`
+in `config.ts`: then they show one at a time in order, each worker call waiting for its own answer
+(at most 5 wait — a 6th rejects `ui_queue_full` — and identical back-to-back alerts show once). `BottomSheet` for
 contextual actions/detail; `Tooltip`/`Popover` for a small anchored hint. *Reach for `Snackbar`, not
 `AlertDialog`, to confirm a completed action — don't block on success.* The `Snackbar` COMPONENT draws
 inline where you place it; for a transient toast that floats at the bottom of the screen — an app

package/guides/himi-json-output.md

@@ -6,7 +6,7 @@ repurposed when human wording changes. New codes may be added; consumers must
 handle an unknown code as a failure, without parsing prose.
 
 **Rollout:** this contract is enforced for **`himi push`**, including `--only`,
-first, for **`himi publish-size`**, for **`himi store iap connect`**, for **`himi site member-app`**, for **`himi fidelity`**, for the **`himi base44`** entity and function verbs, and for **`himi l10n import`**. Other subcommands still have legacy failures without codes and are a
+first, for **`himi publish-size`**, for **`himi store iap connect`**, for **`himi site member-app`**, for **`himi fidelity`**, for the **`himi base44`** entity and function verbs, for **`himi l10n import`**, and for **`himi login --device`**. Other subcommands still have legacy failures without codes and are a
 follow-up migration. This is an additive change: existing `error`, `errors`,
 `message`, `hint`, status, body, and gate-specific fields stay as they were.
 Some legacy envelopes have no singular `error` or `hint`; consumers must not
@@ -14,6 +14,19 @@ require those fields. Existing error-only push refusals now also carry `ok: fals
 Output channels and process exit codes are unchanged. Read JSON failures on both
 stdout and stderr; progress/warnings are not failure envelopes.
 
+## `himi login --device` codes
+
+| Code | Meaning |
+| --- | --- |
+| `device_issuer_unreachable` | The owner issuer could not be reached to start the device login. Exit 1. |
+| `device_start_failed` | The issuer answered the start request without a usable device grant (a closed or older plane, a rate limit, a store outage). `status`, `error` and `hint` say which. Exit 1. |
+| `device_timed_out` | Nobody approved within the code's lifetime (at most 10 minutes). Run `himi login --device` again. Exit 1. |
+| `device_access_denied` | The owner pressed Deny on the approve page. Exit 1. |
+| `device_code_expired` | The issuer reported the code expired before approval. Exit 1. |
+| `device_login_failed` | Any other poll failure; `status` and `error` carry the issuer's answer. Exit 1. |
+
+A `429` while polling is not a failure: the CLI backs off by the plane's `retryAfterSec` and keeps waiting.
+
 ## `himi sdk unverified` codes
 
 | Code | Meaning |
@@ -112,6 +125,7 @@ return an empty array.
 | `identity_source_unverified` | Collected source hashes or the business display name cannot be verified. Recollect older evidence that did not save business identity. |
 | `identity_target_unverified` | The technical app slug, target compilation or complete built descriptors are unavailable. |
 | `literal_slug_visible` | Built display text or the known business-chat identity seed contains the technical slug instead of the collected business identity, without matching exact authored source copy. |
+| `app_name_is_slug` | `config.ts`'s `name` (the launcher label and the screens that show the app name) is still the technical slug, while the built display text has no literal slug to report. The result carries `appName` with a `hint`; `--fix` writes the collected business name into `config.ts` (only a literal equal to the slug is rewritten, never a name the author chose). |
 
 The check reads built descriptors, not every possible runtime string. A passing
 result does not verify dynamic live data, translations, branding images or device
@@ -139,6 +153,7 @@ is a positional screen ID; use `--deep=<value>` to diagnose a nonnumeric depth.
 | `ux_evidence_unreadable` | The UX evidence artifact cannot be read. |
 | `lint_errors` | Build/lint validation found errors. |
 | `depth_budget_exceeded` | A screen or a bound list/grid row template nests deeper, or has more components, than the depth budget (`depth-budget` validator pass), or any of its JSON — props, modifiers, `input`, action `args` — nests past the raw-JSON ceiling of 256 levels. Each `issues[]` entry with `pass: "depth-budget"` carries the JSON `path` of the deepest node (the tree root for a node count, the first value past the ceiling for raw JSON), the `limit` and the `actual` value. Takes precedence over `lint_errors`, and `--force` does not override it: content over the budget overflows the renderer's stack on devices already in the field. Flatten the layout and push again. `himi patch screen` refuses an over-deep raw descriptor with the same code, before any network request, and `himi pack` / `himi template publish` refuse with it even under `--force`. |
+| `placeholder_site_binding` | The app declares `wix_api` and uses the `wix-consumer` auth provider, but its resolved auth still has the scaffold placeholder `clientId` (`YOUR_WIX_CLIENT_ID`) or `siteUrl` (`https://your-site.example.com`), and it is not bound to a source site through the One App identity. Nothing is published: every Wix call would fail. Bind the site (`himi one-app provision` for a One App migration; otherwise a real clientId and siteUrl). `--force` does not override it. |
 | `one_app_readiness_failed` | Reserved legacy refusal code. One App migration readiness is now advisory: publish and promotion report structured warnings instead. Other independent release checks may still refuse a push. |
 | `control_token_expired` | The selected control token has expired. |
 | `app_source_contains_secrets` | Source archiving detected a possible credential. |

package/guides/iap-products.md

@@ -207,6 +207,14 @@ himi store iap draft --site <msid> --purchases-app <registration-id> --catalog-r
   --bundle com.example.fitclub --base-territory USA --territories USA,CAN --out ./iap-products.json
 ```
 
+Leave `--territories` out to sell each product in every country the app itself is sold in.
+A product that is not sold in a country where the app is on sale shows "price unavailable"
+there. With `--profile`, `draft` reads the app's countries from App Store Connect. A note
+names every product that would still miss one of them, whether it got an explicit
+`--territories` or was kept by `--merge` with its own countries. If the countries can't be
+read (through `--purchases-app`, a failed read, or an app that is not on sale yet),
+products are sold in the base territory only, and the note says so.
+
 | Wix item | Drafted as |
 |---|---|
 | Digital store product, paid online program, one-time "unlimited" pricing plan | a non-consumable |

package/guides/one-app-to-himi-app.md

@@ -163,6 +163,7 @@ The CLI's versioned native-widget inventory supplies these rows automatically.
 | `achievements_carousel_section` | The same Program state/display rules, default limit 5 and page dots. |
 | `newBlog_postlist_vertical_section`, `newBlog_compact_post_list_vertical_section` | Row display options, unlimited paging or a limited count with See All Posts, and layout. Coverage derives these per placement from the authored settings: see "Generate blog post lists from their settings". |
 | `events_list_section` | Date badge, Share and the appropriate RSVP/ticket action. |
+| `platform_elements_image_section` | Press behavior. `onPressType: "openAsModal"` opens the image full screen: tap it with the reserved `himi.lightbox` action and `args.images` set to `[{ "url": <the image url>, "alt": <its accessibility label> }]`. `nothing` and a `none` action need no tap. Coverage derives the row per placement from the authored value. |
 | `platform_general_members_section`, `platform_general_members_section_bp` | Effective member strip and directory journey: totals/search, alphabetical sections, Follow, activity/privacy. Distinguish badge chips from actual viewed-member program progress. |
 | `file_share_section` | Signed-in-only file/folder section. Preserve access rules, instance settings and View All (`media.openFileShareListScreen`); a media gallery is not File Share. |
 | `events_guests_section` | Signed-in-only guests for the configured event, preserving the event selector, guest privacy and display settings; an avatar summary is not the full guest list. |
@@ -282,7 +283,10 @@ the same values:
 - **Row facts.** Every `displayOptions` key set to `true` is shown: `author` (avatar, name and the
   admin badge), `comments` (comment count), `likes`, `times_viewed`, `post_date`, `reading_time`,
   `cover_image`. Bind each from the post and its metrics. A row that shows a fixed subset such as
-  date, views and likes is a gap. A key that is `false` or absent stays hidden.
+  date, views and likes is a gap. A key that is `false` or absent stays hidden. Blog v3 `queryPosts` returns no
+  view, like or comment counts unless the request asks for `fieldsets: ["METRICS"]` (without it every count reads
+  0), and only the author's `memberId`: resolve the name and photo with `getMember` and show the author only when
+  the member resolves. A count the API did not return stays hidden, never 0.
 - **Unlimited.** `contentSettings.postsPerCategory: "unlimited"` follows the page cursor to the last
   post. Bind `pagination.cursor` and `pagination.onLoadMore` as described in `himi docs
   designing-himi-screens`; a fixed first page (for example 20 posts) is not an unlimited list.
@@ -427,7 +431,9 @@ Apply these interpretation rules:
   It resolves the effective source theme with the reader the source app instance
   actually uses, then compares the resolved primary, background and content colors,
   each button's `borderRadius` and `outlineWidth`, and resolved heading/body font families
-  against the app's `tokens.json`.
+  against the app's `tokens.json`. A Branded theme that stores only `primaryColor`
+  (no `colors`) is still compared: that value is the app's brand color, so the template's
+  default accent fails the check until `--fix` writes it.
   Hex case and shorthand are normalized; an absent button token is compared with the
   value the renderer draws (an outline only on `secondary`; a radius of `radius.pill`,
   else 24), not called a difference. A variant without its own radius must draw the
@@ -504,6 +510,22 @@ Apply these interpretation rules:
   list then shows no Ended label for a time without an offset, which is correct, and a
   `business_time_zone_unavailable` warning says so. A re-apply keeps the zone for the same site and
   drops it for another.
+- **Write the verified values with the CLI.** Run `himi one-app provision --evidence-dir .himi/one-app --content .`
+  after scaffolding. From the collected evidence it sets `currency` on `himi_loyalty` and `businessTimeZone` on
+  `himi_services`, `himi_service` and `himi_time` (a value it could not verify stays as the template ships it;
+  nothing is invented). It writes the business name into `config.ts`'s `name` and over the slug `himi init` baked
+  into displayed names (display slots only, never ids or URLs; a name you chose is kept), so the normal flow needs
+  no `validate-identity --fix`. It states the bottom bar as native (`navigation.tabBar.presentation: "native"`; an
+  explicit `"kit"` is kept; the output's `tabBar` reports `set`, `unchanged` or `absent`). When the collection
+  recorded `memberChat: true` (never a guess), it opens the member Inbox from every baked door (the top-bar chat
+  action, the drawer's Inbox item, the chat thread's parent and "Back to inbox", the Profile link) if the scaffold
+  contains `himi_inbox`; otherwise the output's `chat` says `unverified` and the doors keep opening
+  `himi_business_chat`. `himi one-app header-badges` writes the top-bar action, so run provision again after it.
+  It also **binds the app to the source site**: the scaffold's `WixConsumerAuthProvider` carries placeholders
+  (`YOUR_WIX_CLIENT_ID`, `your-site.example.com`) that make every Wix read fail, so provision writes
+  `visitorSource: "one-app"`, the collected `metaSiteId` and `siteUrl` (a real clientId you set is kept;
+  `siteBinding` reports `set`, `unchanged`, `unverified` or `absent`). `himi push` refuses a Wix-backed app that
+  still has the placeholders (code `placeholder_site_binding`, no `--force`). It is safe to run again.
 - **Native navigation is the migration target.** Use the shell's native top bar
   and, for bottom-tab navigation, `navigation.tabBar.presentation: "native"`.
   Do not recreate the source Detailed header, call `detailedHeader`, or insert a
@@ -536,6 +558,20 @@ Apply these interpretation rules:
   totals. A collected total is a source snapshot. Only use an injected live
   count reader when its public, site-bound permission path has been verified.
   See the screens SDK's downloadable business-contact guide for the full recipe.
+- **Chat opens the Inbox when the source allows member chat.** The source top-bar chat
+  button opens a member-to-business room only when the branded app's `inbox.chatType`
+  is `MEMBER_TO_BUSINESS`; in every other case, including an app whose config has no
+  `inbox` at all, it opens the Inbox: a list of the member's conversations with the
+  business and with other members, plus a way to start a new chat with a member.
+  `collect` reads that setting from the app's public mobile config, as a Visitor, and
+  records it in `inbox-settings.json` (`chatType` and its `source`) and `manifest.json`
+  `memberChat`: `true` or `false`, or `null` when it could not be read or the source is
+  a free One App (warning `inbox_chat_type_unknown`). Carry it: when `memberChat` is
+  `true`, set provisioning `memberChat: true` and point the top-bar chat action at
+  `himi_inbox`; every other Inbox entry (tab, drawer, Explore, Profile) follows the same
+  flag. When it is `false` or `null` leave `memberChat` unset and keep the top-bar chat
+  on `himi_business_chat`. Never turn member chat on from a guess: an owner who limited
+  the app to the business must not gain a member chat.
 - Emit resolved native actions in `navigation.topBarDefault` or a complete
   per-screen `topBar` override. The shell owns back/menu controls. Per-screen
   actions support `hiddenPath` when `navigation.topBarDefault.actions` declares
@@ -682,8 +718,9 @@ Apply these interpretation rules:
   output against the source. A persistent nav worker needs a supported refresh
   path; a screen-only load, page-row count or foreground push receipt count is
   insufficient. The source Member notification aggregate is MOBILE/UNSEEN, capped
-  at100. `countUnseenNotifications({ site: boundMetaSiteId })` reads that aggregate
-  through the source Member route. It requires the updated native core, rebuilt
+  at100. `countUnseenNotifications()` reads that aggregate through the source Member
+  route. Name no site: a bound host sends its own, and the multi-tenant Player (no
+  bound site) lets the Member credential decide and refuses any named one. It requires the updated native core, rebuilt
   consuming binaries and published SDK; default web and old binaries remain
   unavailable for this reader. Never replace that refusal with zero.
   Chat counts unread rooms, while legacy cart counters can include unsynced local
@@ -1257,6 +1294,24 @@ function call in the literal makes them fail with "expected a `"<screenId>": {`
 authored descriptor". Blank lines and whole-line `//` comments between entries are
 accepted.
 
+Do not write a generator of your own. `himi one-app generate --evidence-dir .himi/one-app --content .` turns each
+source page into a screen descriptor from the collected evidence alone: the screen id and title come from the page's
+source label, and styles, alignment, buttons, images and their tap (`openAsModal` opens full screen), the contact
+section and the business description are read from the source. A section it has no mapping for is reported with
+`sections_unmapped` and nothing stands in for it. Data sections use shared modules and recipes
+(`recipes/*.json`) when the scaffold ships them; the current starter ships none, so today they take the fallback
+below. A page with such modules gets ONE worker, `tier5-src/page-<screen>/index.ts`, that registers the modules
+its sections use (blog list, programs carousel, inline events). A page that is only a template vertical (programs list,
+members, loyalty, shop, groups feed) opens the template's screen, and a groups feed passes the source's own title,
+"Group list" label and post count. A data section never vanishes: when the shared modules cannot honor its settings
+(featured-only lists, another post layout, events or groups limited to a chosen set) or its recipe is missing from the
+scaffold, it keeps its place as the source's title and a "See All" button that opens the page showing that data,
+and the reason is listed in `gaps`, never approximated as the real list. Only a section with no mapping at all stays
+in `unmapped`. The first four visible pages become the bottom tabs and the rest the More screen. The output names the
+published `revision` and `fetchedAt` of the evidence it read, so a migration generated from older evidence shows the
+old value: run `himi one-app migrate` again to refresh it before the final check. The file it writes is the
+`--upsert` input below.
+
 So generate descriptors as data and write them with the CLI:
 
 ```sh
@@ -1266,11 +1321,27 @@ himi template screens --upsert --from .himi/one-app/gen/screens.json
 The file is one JSON object, `{ "<screenId>": <ScreenDescriptor>, … }`. Each existing
 id is replaced in place; each new id is added and registered in
 `navigation.linkableScreens`. One invalid entry refuses the batch and restores every
-file. A builder call such as `detailedHeader(...)` written inline in `dev/index.ts`
+file. A screen that starts with an empty slot (a `Spacer`, a container with no children, an
+`Image` with no url) is refused: when a source header is dropped, do not leave its place behind,
+because the slot paints a blank band under the toolbar. A builder call such as `detailedHeader(...)` written inline in `dev/index.ts`
 cannot be inspected: call the builder in your generator and serialize the value it
 returns. Run the generator inside the app (after `npm install`), so
 `@wix/himalaya/screens` resolves to the app's own dependency.
 
+### Repoint the template's tab ids
+
+The template's `navigation.linkableScreens` entries and its home and profile tabs carry its own tab ids (`"home"`,
+`"profile"`, the vertical tabs). Your `navigation.tabBar` replaces those tabs, so every entry whose `tabId` is not
+one of yours is a leftover. `himi validate --strict` reports each as `nav-linkable-tab-unknown` and lists your real
+ids; nothing repoints them, because the right tab depends on where the source shows the screen:
+
+- a screen the source opens from a tab keeps that tab's id;
+- a screen reached from the overflow list takes the id of the **More** tab only if you created one; a template with no More tab uses `""`;
+- a screen with no tab owner takes `""`, the default stack.
+
+Check `homeScreenId` and any `himi.open` target that still names a template screen (`"home"`, `"profile"`) the same
+way: it must be a screen your `SCREENS` map defines.
+
 ### Preserve the template features the source exposes
 
 Treat trimming as a source-feature decision, not a list of screens reached during
@@ -1292,6 +1363,11 @@ After applying identity and before claiming completion, run:
 himi one-app validate-identity --evidence-dir .himi/one-app --content . --json
 ```
 
+`himi init` names a scaffold after its technical slug, and `config.ts`'s `name` is the app's
+display name (launcher label and the screens that show it). The command also fails with
+`app_name_is_slug` while that name is still the slug; `--fix` writes the collected business
+name into it (only a literal equal to the slug is rewritten, never a name you chose).
+
 The command verifies the collected business-name hash, builds the current content,
 and checks emitted screen titles, supported component display fields and the known
 business-chat identity seed for accidental literal slugs. It ignores route IDs,

package/guides/sdk-reference.json

@@ -1471,7 +1471,7 @@
         "name": "NavigationConfig",
         "kind": "interface",
         "jsdoc": "/** Per-app navigation/deep-link config, served OTA at GET /v1/app-config/:appName. */",
-        "decl": "export interface NavigationConfig {\n  /** Tab-bar structure (which tabs; their icons/labels/badges). */\n  tabBar?: TabBarConfig;\n  /** Slide-in drawer / hamburger-menu destinations. */\n  drawer?: DrawerConfig;\n  /** Navigation chrome the shell draws.\n   *  Omitted ⇒ \"bottomTabs\". The shell (not the descriptor) reads this. */\n  navKind?: NavKind;\n  /** Destinations for \"sidebar\" mode.\n   *  Absent ⇒ the shell derives the rail from `tabBar.items`. */\n  sidebar?: SidebarConfig;\n  /** App-level default top bar; a per-screen\n   *  `ScreenDescriptor.topBar` fully replaces it (override, not merge). */\n  topBarDefault?: TopBarConfig;\n  /** The post-OS-splash brand surface (see `SplashConfig`). Absent / not enabled\n   * ⇒ today's behavior. Operational per (live-flippable). */\n  splash?: SplashConfig;\n  /** App-level default locale. Operational per so a Hebrew (or Spanish)\n   *  branded app can pin RTL/l10n OTA without a launch flag. `default` is a\n   *  BCP-47 primary subtag; clients coerce unknown tags rather than failing the\n   *  envelope. `pin: true` skips the device/browser language; in-app `locale.set`\n   *  still wins. Absent ⇒ today's device-then-en behavior. */\n  locale?: LocaleConfig;\n  /** Effective orientations, resolved INSIDE\n   *  the binary's build-time envelope (config.ts `orientationEnvelope`). The\n   *  envelope is the ceiling and can never be OTA (iOS reads the plist before\n   *  any app code runs); this narrows within it. Always intersected with the\n   *  envelope — it can never widen it. Absent/empty ⇒ the envelope itself. */\n  orientation?: OrientationConfig;\n  /** Per-surface nav projection, keyed by catalog\n   *  surface id (`phone` | `tablet` | `desktop` | `mac` | `watch` | `wear` | `rn`).\n   *  Keyed the way `orientation` is keyed by device family and narrowed the same\n   *  way: a key outside the app's `platforms.json` envelope is DROPPED, never\n   *  honored (see `resolveSurfaceNav`). Absent key ⇒ that surface uses the default\n   *  projection, so an app that never thinks about surfaces is unaffected. */\n  surfaces?: Record<string, SurfaceNavConfig>;\n  /** The APP-LEVEL nav worker\n   *  that feeds every `*Path` binding on `NavTabItem` / `DrawerItem` /\n   *  `TopBarAction`. App-level, not a screen's worker, because chrome outlives\n   *  every screen: a cart badge must survive leaving the cart, and a flag-hidden\n   *  tab must stay hidden three pushes deep in another stack. Absent ⇒ paths stay\n   *  unresolved and the literals render — the worker enriches, it never gates. */\n  navLogicBundle?: LogicBundleRef;\n  /** Which nav badges ALSO drive the OS app-icon\n   *  badge. Each entry is `\"<kind>:<id>\"` (`tab` | `drawer` | `topBarAction`, the\n   *  spelling `navKey` uses); the icon shows the SUM of those slots' resolved counts.\n   *  Empty/absent ⇒ no mirroring. An entry naming a slot this build does not have is\n   *  ignored, never a blanked badge. Requires the `push` capability — `defineApp`\n   *  rejects the combination, because the badge would be set and never shown. */\n  appIconBadgeSources?: string[];\n  /** Signed release allowlist for contained browser Tier-5 `_stream` requests. */\n  streamPolicy?: StreamPolicy;\n  /** A site shell's URL space. A push tap, app link or\n   *  custom-scheme link whose URL is an https page on one of `site.origins` opens the\n   *  screen owning its path, and that screen's WebView loads the full URL. Absent ⇒\n   *  links resolve as before. Build it with `siteNavConfig()` from\n   *  `@himalaya/core/site-shell`; resolution is `resolveSiteLink()`. */\n  site?: SiteNavConfig;\n  /** amendment \"top-bar gap items\" — app-wide logo for tab-stack roots. */\n  topBarLogo?: TopBarLogo;\n  scheme: string;\n  deepLinkPatterns: DeepLinkPattern[];\n  linkableScreens: LinkableScreen[];\n}",
+        "decl": "export interface NavigationConfig {\n  /** Tab-bar structure (which tabs; their icons/labels/badges). */\n  tabBar?: TabBarConfig;\n  /** Slide-in drawer / hamburger-menu destinations. */\n  drawer?: DrawerConfig;\n  /** Navigation chrome the shell draws.\n   *  Omitted ⇒ \"bottomTabs\". The shell (not the descriptor) reads this. */\n  navKind?: NavKind;\n  /** Destinations for \"sidebar\" mode.\n   *  Absent ⇒ the shell derives the rail from `tabBar.items`. */\n  sidebar?: SidebarConfig;\n  /** App-level default top bar; a per-screen\n   *  `ScreenDescriptor.topBar` fully replaces it (override, not merge). */\n  topBarDefault?: TopBarConfig;\n  /** The post-OS-splash brand surface (see `SplashConfig`). Absent / not enabled\n   * ⇒ today's behavior. Operational per (live-flippable). */\n  splash?: SplashConfig;\n  /** App-level default locale. Operational per so a Hebrew (or Spanish)\n   *  branded app can pin RTL/l10n OTA without a launch flag. `default` is a\n   *  BCP-47 primary subtag; clients coerce unknown tags rather than failing the\n   *  envelope. `pin: true` skips the device/browser language; in-app `locale.set`\n   *  still wins. Absent ⇒ today's device-then-en behavior. */\n  locale?: LocaleConfig;\n  /** Effective orientations, resolved INSIDE\n   *  the binary's build-time envelope (config.ts `orientationEnvelope`). The\n   *  envelope is the ceiling and can never be OTA (iOS reads the plist before\n   *  any app code runs); this narrows within it. Always intersected with the\n   *  envelope — it can never widen it. Absent/empty ⇒ the envelope itself. */\n  orientation?: OrientationConfig;\n  /** Per-surface nav projection, keyed by catalog\n   *  surface id (`phone` | `tablet` | `desktop` | `mac` | `watch` | `wear` | `rn`).\n   *  Keyed the way `orientation` is keyed by device family and narrowed the same\n   *  way: a key outside the app's `platforms.json` envelope is DROPPED, never\n   *  honored (see `resolveSurfaceNav`). Absent key ⇒ that surface uses the default\n   *  projection, so an app that never thinks about surfaces is unaffected. */\n  surfaces?: Record<string, SurfaceNavConfig>;\n  /** The APP-LEVEL nav worker\n   *  that feeds every `*Path` binding on `NavTabItem` / `DrawerItem` /\n   *  `TopBarAction`. App-level, not a screen's worker, because chrome outlives\n   *  every screen: a cart badge must survive leaving the cart, and a flag-hidden\n   *  tab must stay hidden three pushes deep in another stack. Absent ⇒ paths stay\n   *  unresolved and the literals render — the worker enriches, it never gates. */\n  navLogicBundle?: LogicBundleRef;\n  /** Which nav badges ALSO drive the OS app-icon\n   *  badge. Each entry is `\"<kind>:<id>\"` (`tab` | `drawer` | `topBarAction`, the\n   *  spelling `navKey` uses); the icon shows the SUM of those slots' resolved counts.\n   *  Empty/absent ⇒ no mirroring. An entry naming a slot this build does not have is\n   *  ignored, never a blanked badge. Requires the `push` capability — `defineApp`\n   *  rejects the combination, because the badge would be set and never shown. */\n  appIconBadgeSources?: string[];\n  /** Signed release allowlist for contained browser Tier-5 `_stream` requests. */\n  streamPolicy?: StreamPolicy;\n  /** A site shell's URL space. A push tap, app link or\n   *  custom-scheme link whose URL is an https page on one of `site.origins` opens the\n   *  screen owning its path, and that screen's WebView loads the full URL. Absent ⇒\n   *  links resolve as before. Build it with `siteNavConfig()` from\n   *  `@himalaya/core/site-shell`; resolution is `resolveSiteLink()`. */\n  site?: SiteNavConfig;\n  /** amendment \"top-bar gap items\" — app-wide logo for tab-stack roots. */\n  topBarLogo?: TopBarLogo;\n  /** Opt-in alert queue. `true` ⇒ every presented alert (worker `ui.alert`, the descriptor nav\n   *  `alert` verb, app services) shows one at a time in FIFO order per shell, instead of replacing\n   *  each other or rejecting `ui_busy`. At most 5 wait (a 6th worker call rejects `ui_queue_full`);\n   *  identical consecutive alerts show once. An inline `AlertDialog` component never enters the\n   *  queue. Absent ⇒ today's behaviour. */\n  presentationQueue?: boolean;\n  scheme: string;\n  deepLinkPatterns: DeepLinkPattern[];\n  linkableScreens: LinkableScreen[];\n}",
         "verificationChecked": true
       },
       {
@@ -2913,7 +2913,7 @@
         "name": "WixIapOperation",
         "kind": "type",
         "jsdoc": "",
-        "decl": "export type WixIapOperation = \"startPayment\" | \"startItemPayment\" | \"completePayment\" | \"getPayment\";",
+        "decl": "export type WixIapOperation = \"startPayment\" | \"startItemPayment\" | \"completePayment\" | \"cancelPayment\" | \"getPayment\";",
         "verificationChecked": true
       },
       {
@@ -2927,7 +2927,7 @@
         "name": "StartItemPaymentErrorCode",
         "kind": "type",
         "jsdoc": "",
-        "decl": "export type StartItemPaymentErrorCode = \"PRODUCT_NOT_AVAILABLE\" | \"ALREADY_OWNED\" | \"ITEM_NOT_AVAILABLE\"\n  | \"SITE_NOT_ACCEPTING_PAYMENTS\" | \"UNSUPPORTED_ORDER\";",
+        "decl": "export type StartItemPaymentErrorCode = \"PRODUCT_NOT_AVAILABLE\" | \"ALREADY_OWNED\" | \"ITEM_NOT_AVAILABLE\"\n  | \"SITE_NOT_ACCEPTING_PAYMENTS\" | \"UNSUPPORTED_ORDER\" | \"CATALOG_NOT_SUPPORTED\" | \"VERTICAL_ACCESS_DENIED\"\n  | \"EVENT_CHECKOUT_NOT_ECOM\" | \"ALREADY_SUBSCRIBED\" | \"SUBSCRIPTION_NOT_IN_APP\" | \"BILLING_COUNTRY_REQUIRED\"\n  | \"APP_NOT_CONFIGURED\" | \"NOT_BOOKING_OWNER\" | \"BOOKING_PAYMENT_PENDING\";",
         "verificationChecked": true
       },
       {
@@ -2944,6 +2944,13 @@
         "decl": "export type GetPaymentErrorCode = \"NOT_FOUND\";",
         "verificationChecked": true
       },
+      {
+        "name": "CancelPaymentErrorCode",
+        "kind": "type",
+        "jsdoc": "",
+        "decl": "export type CancelPaymentErrorCode = \"NOT_PENDING\" | \"APP_NOT_CONFIGURED\" | \"NOT_FOUND\";",
+        "verificationChecked": true
+      },
       {
         "name": "WixIapFailureKind",
         "kind": "type",
@@ -2968,8 +2975,8 @@
       {
         "name": "EcomCatalogReference",
         "kind": "interface",
-        "jsdoc": "/** One item a Wix catalog sells through eCom, as eCom's `catalogReference` names it: for Wix Stores,\n *  the product id and the Stores app id. The purchases catalog sells it under `catalogItemId` as its\n *  `appProductId`. Variants and options are not supported, and the quantity is always 1. */",
-        "decl": "export interface EcomCatalogReference {\n  catalogItemId: string;\n  catalogAppId: string;\n}",
+        "jsdoc": "/** One item a Wix catalog sells, as eCom's `catalogReference` names it: the item id and its catalog\n *  app. The purchases catalog sells it under `catalogItemId` as its `appProductId`. `options` go to\n *  eCom unchanged and are each vertical's own: a plan's `{type: \"PLAN\", planOptions: {pricingVariantId}}`,\n *  a booking's `{bookingId}`, a ticket's `{eventId}`, a Stores variant's `{variantId}`. Plain JSON only.\n *  The quantity is always 1. */",
+        "decl": "export interface EcomCatalogReference {\n  catalogItemId: string;\n  catalogAppId: string;\n  options?: Record<string, unknown>;\n}",
         "verificationChecked": true
       },
       {
@@ -2982,8 +2989,8 @@
       {
         "name": "StartItemPaymentResult",
         "kind": "type",
-        "jsdoc": "/** StartItemPayment places the member's eCom order for one catalog item, charges it with\n *  `appleIAP` and starts its Payment, all server-side. Four different ids come back: the eCom\n *  order (`ecomOrderId`), the Wix Payments charge (`payment.wixTransactionId`), the wix-iap\n *  Payment (`payment.paymentId`) and the StoreKit `appAccountToken`. Keep them out of screen state. */",
-        "decl": "export type StartItemPaymentResult =\n  | { status: \"started\"; payment: WixIapPayment; storeProductId: string; appAccountToken: string; ecomOrderId: string }\n  | WixIapFailure<StartItemPaymentErrorCode>\n  | StartItemPaymentOutcomeUnknown;",
+        "jsdoc": "/** StartItemPayment places the member's order for one catalog item, charges it with `appleIAP` and\n *  starts its Payment, all server-side. Four different ids come back: the vertical's record (the eCom\n *  order, `ecomOrderId`; for Online Programs the join application, `joinApplicationId`, and no eCom\n *  order), the Wix Payments charge (`payment.wixTransactionId`), the wix-iap Payment\n *  (`payment.paymentId`) and the StoreKit `appAccountToken`. Keep them out of screen state. */",
+        "decl": "export type StartItemPaymentResult =\n  | { status: \"started\"; payment: WixIapPayment; storeProductId: string; appAccountToken: string; ecomOrderId?: string; joinApplicationId?: string }\n  | WixIapFailure<StartItemPaymentErrorCode>\n  | StartItemPaymentOutcomeUnknown;",
         "verificationChecked": true
       },
       {
@@ -3000,6 +3007,13 @@
         "decl": "export type GetPaymentResult = { status: \"found\"; payment: WixIapPayment } | WixIapFailure<GetPaymentErrorCode>;",
         "verificationChecked": true
       },
+      {
+        "name": "CancelPaymentResult",
+        "kind": "type",
+        "jsdoc": "/** `answered`: the Payment as CancelPayment left it, `canceling`, `canceled`, or `approved` when a\n *  purchase the store already reported paid it instead. Only `canceled` means nothing was paid. */",
+        "decl": "export type CancelPaymentResult = { status: \"answered\"; payment: WixIapPayment } | WixIapFailure<CancelPaymentErrorCode>;",
+        "verificationChecked": true
+      },
       {
         "name": "WixIapClientDependencies",
         "kind": "interface",
@@ -3012,7 +3026,7 @@
         "name": "WixIapClient",
         "kind": "interface",
         "jsdoc": "",
-        "decl": "export interface WixIapClient {\n  /** StartPayment for a pending `appleIAP` Wix Payments transaction the member placed. Returns the\n   *  store product to sell and this payment's `appAccountToken` to pass to StoreKit. */\n  startPayment(input: { wixTransactionId: string }): Promise<StartPaymentResult>;\n  /** StartItemPayment for one catalog item: the service places the member's eCom order, charges it\n   *  and starts its Payment. Every call places a new order, so `outcomeUnknown` must never be\n   *  resent as if nothing happened. Returns the store product, the token and the eCom order. */\n  startItemPayment(input: { item: EcomCatalogReference }): Promise<StartItemPaymentResult>;\n  /** CompletePayment with held Apple proof, sent unchanged: the service pays the payment whose\n   *  token the transaction carries. Success can still be `approving`. */\n  completePayment(transaction: AppleTransaction): Promise<CompletePaymentResult>;\n  /** GetPayment: one of the member's own Payments. */\n  getPayment(input: { paymentId: string }): Promise<GetPaymentResult>;\n}",
+        "decl": "export interface WixIapClient {\n  /** StartPayment for a pending `appleIAP` Wix Payments transaction the member placed. Returns the\n   *  store product to sell and this payment's `appAccountToken` to pass to StoreKit. */\n  startPayment(input: { wixTransactionId: string }): Promise<StartPaymentResult>;\n  /** StartItemPayment for one catalog item: the service places the member's order, charges it and\n   *  starts its Payment. Every call places a new order, so `outcomeUnknown` must never be resent as\n   *  if nothing happened. `storeCountryCode` is StoreKit's storefront country (alpha-3), sent when\n   *  known. Returns the store product, the token and the eCom order or join application. */\n  startItemPayment(input: { item: EcomCatalogReference; storeCountryCode?: string }): Promise<StartItemPaymentResult>;\n  /** CompletePayment with held Apple proof, sent unchanged: the service pays the payment whose\n   *  token the transaction carries. Success can still be `approving`. */\n  completePayment(transaction: AppleTransaction): Promise<CompletePaymentResult>;\n  /** GetPayment: one of the member's own Payments. */\n  getPayment(input: { paymentId: string }): Promise<GetPaymentResult>;\n  /** CancelPayment: the member dismissed the store sheet. The service cancels the pending Payment and\n   *  releases what its vertical held, unless a purchase the store already reported paid it. */\n  cancelPayment(input: { paymentId: string }): Promise<CancelPaymentResult>;\n}",
         "verificationChecked": true,
         "verified": false
       },
@@ -28162,6 +28176,37 @@
         "decl": "export async function isFollowingMember(targetId: string): Promise<boolean>;",
         "http": "POST /members/v3/followers/my/connections",
         "verificationChecked": true
+      },
+      {
+        "name": "WixMemberLastOpenApp",
+        "kind": "interface",
+        "jsdoc": "/** When a member last opened the app, as the One App computes it: `unit` is \"min\", \"hour\" or \"day\", and `ts`\n *  (epoch milliseconds, as a string) is there for a day count the One App prints as a date. */",
+        "decl": "export interface WixMemberLastOpenApp {\n  amount?: number;\n  unit?: string;\n  ts?: string;\n}",
+        "verificationChecked": true
+      },
+      {
+        "name": "WixMemberActivity",
+        "kind": "interface",
+        "jsdoc": "/** One member's activity from the One App members service. */",
+        "decl": "export interface WixMemberActivity {\n  id: string;\n  /** Server role, e.g. \"MEMBER\". */\n  role?: string;\n  online: boolean;\n  /** `null` for a member who never opened the app. */\n  lastOpenApp: WixMemberLastOpenApp | null;\n}",
+        "verificationChecked": true
+      },
+      {
+        "name": "queryMemberActivity",
+        "kind": "function",
+        "jsdoc": "/** Role and last-active for up to 100 members by id — POST apps.wix.com/_api/members-one-app/api/members.\n *  Public Members v1 carries neither: `lastLoginDate` is a login time and needs the owner-only FULL field\n *  set. The One App service answers a Visitor with this, so a members list can show \"Active 11h ago\".\n *  A member id the service does not know is left out of the answer.\n *\n *  Pinned One App member source, like the notification count: it needs a native runtime that allows this\n *  one route for the bound business. Older native builds and web reject, so callers treat a rejection as\n *  \"no activity to show\", never as an error in their own list.\n *\n * @scope visitor — a Visitor reads it as well as a signed-in member; the native runtime allows only the bound business's route. */",
+        "decl": "export async function queryMemberActivity(ids: string[]): Promise<WixMemberActivity[]>;",
+        "scope": "visitor",
+        "verificationChecked": true
+      },
+      {
+        "name": "listFollowedMembers",
+        "kind": "function",
+        "jsdoc": "/** Which of `targetIds` the signed-in member follows, in ONE call — POST\n *  /members/v3/followers/my/connections. For a members list that shows a Follow control per row.\n *  A Visitor gets an empty answer (no connections), so nothing here needs a sign-in; callers still\n *  skip the call for a Visitor.\n *\n * @scope visitor — an anonymous visitor session is enough; it answers an empty list when nobody is signed in. */",
+        "decl": "export async function listFollowedMembers(targetIds: string[]): Promise<string[]>;",
+        "http": "POST /members/v3/followers/my/connections",
+        "scope": "visitor",
+        "verificationChecked": true
       }
     ]
   },
@@ -28208,15 +28253,15 @@
       {
         "name": "queryNotifications",
         "kind": "function",
-        "jsdoc": "/** List the signed-in member's notifications, newest first. MOBILE channel. */",
+        "jsdoc": "/** List the signed-in member's notifications, newest first. MOBILE channel. Needs a Member\n *  transport: a Visitor is refused (403) and an old native build refuses the route, so both\n *  reject. The bound site is stamped by the host, so no site argument is needed. */",
         "decl": "export async function queryNotifications(limit = 25, options?: WixCallOptions): Promise<MfvNotification[]>;",
         "verificationChecked": true
       },
       {
         "name": "countUnseenNotifications",
         "kind": "function",
-        "jsdoc": "/** Source member-app MOBILE/UNSEEN aggregate, capped at 100. Requires a bound\n * single-site Member transport; old native binaries and web reject. A missing,\n * malformed or failed result is unavailable, never an authoritative zero. */",
-        "decl": "export async function countUnseenNotifications(options: { site: string }): Promise<number>;",
+        "jsdoc": "/** Source member-app MOBILE/UNSEEN aggregate, capped at 100. Needs a Member transport; old native\n * binaries and web reject. A missing, malformed or failed result is unavailable, never an\n * authoritative zero. The host fixes the business: a bound capability sends its own site, and the\n * multi-tenant Player (no bound site) lets the Member credential decide. `site` is optional and only\n * ever names the bound site: native refuses any other, and an unbound host refuses every named one. */",
+        "decl": "export async function countUnseenNotifications(options?: { site?: string }): Promise<number>;",
         "verificationChecked": true
       },
       {

package/guides/skill.md

@@ -184,6 +184,7 @@ and is also served at the public URL above. No repository access is required.
 
 - **Your platform already holds the owner's Wix session or token** (they connected their Wix account to it): that token **is** the owner. Any valid Wix token can manage that account's apps, publishing included. Pipe it in — `printf '%s' "$TOKEN" | himi login --wix --wix-token-stdin --target wix` — or set `WIX_TOKEN` and run `himi login --wix --target wix`. Never put a token on the command line (argv shows in `ps` and transcripts) or in a file you commit, and never print it.
 - **A server or CI job** with an account API key: `WIX_API_KEY` + `himi login --wix --target wix`.
+- **You hold no token at all:** run `himi login --device --target wix`. It prints a link and a short code. Show the owner both, ask them to open the link on any device where they are signed in to wix.com, check the code matches and approve, then wait: the command returns once they approve (up to 10 minutes).
 - **None of these:** stop and say exactly what is missing. Do not improvise another route to a himi token.
 
 This replaces only the sign-in. The approval gates above still apply to every side effect.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1633.0",
+  "version": "0.1635.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -30,7 +30,7 @@
     "himi": "node --import tsx src/cli.ts",
     "gen:guides": "npm --prefix ../.. run authoring:gen",
     "build": "node --import tsx ../authoring-kit/gen-templates.mts && node ../authoring-kit/bundle.mjs && npm run build:dist",
-    "build:dist": "node --import tsx ../html-to-t5/vocab-gen/gen-v2.ts && node scripts/bundle.mjs && node scripts/stage-authoring-runtime.mjs",
+    "build:dist": "node --import tsx ../html-to-t5/vocab-gen/gen-v2.ts && node scripts/bundle.mjs && node scripts/stage-authoring-runtime.mjs && node scripts/stage-browser-plane.mjs",
     "test": "node ../../tools/ci/run-tests.mjs --package tools/himi-cli --"
   },
   "dependencies": {
@@ -72,5 +72,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "cfec110399d1528f327a0ca1caf2543b95efba31f33781fa136164a8"
+  "falconPackageHash": "2eb0ec4acfa6663413f592cc6ba30c8888d6a7e736cb32e119b1f8ca"
 }

package/templates/beauty-salon/tier5-src/_shared/branded-lite-hosted.ts

@@ -97,6 +97,7 @@ export const HOSTED_SCREEN_VERTICALS: Readonly<Record<string, readonly BrandedLi
   himi_gift_card: ["giftCards"],
   himi_gift_cards: ["giftCards"],
   himi_groups: ["groups"],
+  himi_inbox: ["inbox"],
   himi_group_about: ["groups"],
   himi_my_groups: ["groups"],
   himi_invoice: ["invoices"],

package/templates/beauty-salon/tier5-src/_shared/collection-contract.ts

@@ -92,7 +92,6 @@ export const COLLECTIONS: Record<string, CollectionConfig> = {
     searchPlaceholder: 'Customer name, email or order #', sortLabels: { default: 'Newest', az: 'Customer A–Z', za: 'Customer Z–A' },
     filterValues: ['Recent 7 days', 'Paid', 'Unpaid', 'Partially paid', 'Pending', 'Refunded', 'Partly refunded'] },
   himiBrandedGroups: { rows: 'rows', title: 'name', subtitle: 'description', image: 'image', view: 'grid' },
-  himiBrandedCms: { rows: 'rows', title: 'name', subtitle: 'subtitle', view: 'grid' },
   himiBrandedCmsCollection: { instanceInput: 'collection', rows: 'rows', title: 'title', subtitle: 'subtitle', view: 'list' },
   himiBrandedOrders: { rows: 'rows', title: 'title', subtitle: 'subtitle', image: 'image', metadata: ['status', 'meta'], rowStyle: 'flat', view: 'list', backendQuery: true,
     searchPlaceholder: 'Search by order number', countNoun: ['order', 'orders'], filterValues: ['Not fulfilled', 'Partially fulfilled', 'Fulfilled'],

package/templates/beauty-salon-owner/tier5-src/_shared/collection-contract.ts

@@ -92,7 +92,6 @@ export const COLLECTIONS: Record<string, CollectionConfig> = {
     searchPlaceholder: 'Customer name, email or order #', sortLabels: { default: 'Newest', az: 'Customer A–Z', za: 'Customer Z–A' },
     filterValues: ['Recent 7 days', 'Paid', 'Unpaid', 'Partially paid', 'Pending', 'Refunded', 'Partly refunded'] },
   himiBrandedGroups: { rows: 'rows', title: 'name', subtitle: 'description', image: 'image', view: 'grid' },
-  himiBrandedCms: { rows: 'rows', title: 'name', subtitle: 'subtitle', view: 'grid' },
   himiBrandedCmsCollection: { instanceInput: 'collection', rows: 'rows', title: 'title', subtitle: 'subtitle', view: 'list' },
   himiBrandedOrders: { rows: 'rows', title: 'title', subtitle: 'subtitle', image: 'image', metadata: ['status', 'meta'], rowStyle: 'flat', view: 'list', backendQuery: true,
     searchPlaceholder: 'Search by order number', countNoun: ['order', 'orders'], filterValues: ['Not fulfilled', 'Partially fulfilled', 'Fulfilled'],

package/templates/branded-lite/config.ts

@@ -371,6 +371,13 @@ export default defineApp({
         "parentScreenId": "himi_account",
         "tabId": "profile"
       },
+      {
+        "screenId": "himi_inbox",
+        "isPublic": true,
+        "paramKeys": [],
+        "parentScreenId": "",
+        "tabId": ""
+      },
       {
         "screenId": "himi_business_chat",
         "isPublic": true,