@wix/himalaya-cli 0.1635.0 → 0.1637.0

package/dist/cli.mjs

@@ -29065,8 +29065,177 @@ var init_screen_map = __esm({
   }
 });
 
+// ../../core/schema/bi/wix-api-rules.json
+var wix_api_rules_default;
+var init_wix_api_rules = __esm({
+  "../../core/schema/bi/wix-api-rules.json"() {
+    wix_api_rules_default = {
+      _comment: "#4977 (epic #4973) \u2014 the Wix API bridge BI rules: a successful Wix API call -> the vertical outcome event the equivalent RN module sends. Evaluated by the host where every wixApi.call lands (iOS/Android WixApiCapability, the web host's transport), so a worker can neither strip nor fake them. `rn` cites the RN source (wix-private/bookings-mobile @ ef441378); `needs` lists fields RN sends that the API call does not carry (UI origin and the like: layer 4/5, never faked); `differs` says where firing on API success departs from RN. Served, without those three, as telemetryConfig.frog.apiRules. The bookings-data v2 loggers have endpoint '' (the frog root), written here as \"/\". RN's v2 logger adds businessId = the msid to every event (createEngineFacade.ts:166-188); the catalog's own logger, used for 358, adds only msid (useBILogger.ts:10-14). Every rule sends `msid` = the site the call was addressed at, so a call to another business than the active one is attributed to the business it changed (a Branded app's forced msid still wins in the oneapp builder). Host-stamped identity fields (contactId, member_id, uuid\u2026) are never sent from a rule: the oneapp builder owns them, as RN's engine does.",
+      rules: [
+        {
+          id: "bookings.booking-created",
+          method: "POST",
+          path: "/bookings/v2/bookings",
+          src: 16,
+          endpoint: "/",
+          evid: 526,
+          module: "bookings",
+          fields: {
+            bookingId: "$res.booking.id",
+            serviceId: "$req.booking.bookedEntity.slot.serviceId",
+            sessionId: "$req.booking.bookedEntity.slot.sessionId",
+            businessId: "$msid",
+            bookingsPlatform: "mobile",
+            msid: "$msid"
+          },
+          rn: "bookingsAppointmentBookedSrc16Evid526 (@wix/bi-logger-bookings-data v2): bookings-mobile-member/src/bookings/presentation/BookButton/viewModel/BookButtonViewModel.ts:1460 -> waitlist-actions/log-waitlist-actions-bi/LogWaitlistActionsBIInteractor.ts:111-126",
+          needs: [
+            "referal_info",
+            "IsQuickBook",
+            "isSkipEnanbled",
+            "addOnIds",
+            "type",
+            "logged",
+            "numParticipants"
+          ],
+          differs: "RN sends it after the eCom checkout succeeds; a paid booking here sends it when the booking is created, before its checkout. RN's legacy appointment success screen builds a 526 it never sends (SuccessfullyBookedScreen.tsx:174). `type` is a hard-coded 'class' and `numParticipants` the slot's booked count in RN, so neither is copied."
+        },
+        {
+          id: "bookings.booking-created-v1",
+          method: "POST",
+          path: "/bookings/v1/bookings",
+          src: 16,
+          endpoint: "/",
+          evid: 526,
+          module: "bookings",
+          fields: {
+            bookingId: "$res.booking.id",
+            serviceId: "$req.booking.bookedEntity.slot.serviceId",
+            sessionId: "$req.booking.bookedEntity.slot.sessionId",
+            businessId: "$msid",
+            bookingsPlatform: "mobile",
+            msid: "$msid"
+          },
+          rn: "bookingsAppointmentBookedSrc16Evid526 (@wix/bi-logger-bookings-data v2): bookings-mobile-member/src/bookings/presentation/BookButton/viewModel/BookButtonViewModel.ts:1460 -> waitlist-actions/log-waitlist-actions-bi/LogWaitlistActionsBIInteractor.ts:111-126",
+          needs: [
+            "referal_info",
+            "IsQuickBook",
+            "isSkipEnanbled",
+            "addOnIds",
+            "type",
+            "logged",
+            "numParticipants"
+          ],
+          differs: "The typed SDK's legacy createBooking (stdlib/wix-sdk/bookings-v2 index.ts) posts here; no Himi flow uses it today. Same event and fields as bookings.booking-created, with the same departures from RN."
+        },
+        {
+          id: "bookings.booking-confirmed",
+          method: "POST",
+          path: "/bookings/v2/bookings/:bookingId/confirm",
+          src: 16,
+          endpoint: "/",
+          evid: 360,
+          module: "bookings",
+          fields: {
+            bookingId: "$path.bookingId",
+            action: "approve",
+            service_id: "$res.booking.bookedEntity.slot.serviceId",
+            appointmentId: "$res.booking.bookedEntity.slot.sessionId",
+            businessId: "$msid",
+            msid: "$msid"
+          },
+          rn: "bookingsAppointmentPendingApprovalDeclineApproveReschedule (@wix/bi-logger-bookings-data v2): bookings-mobile-owner/src/bookings/presentation/BookingList/BookingItem/components/BookingItemLabels/viewModel/BookingItemLabelsViewModel.ts:351 -> LogBookingListInteractor.ts:202; ViewAppointment PendingApprovalButtonsViewModel.ts:30 -> LogViewAppointmentInteractor.ts:311",
+          needs: [
+            "referral_info",
+            "type",
+            "contactId"
+          ],
+          differs: "RN sends it on the tap, before the API answers, so a confirm that then fails still counts there. `action` takes the schema's spelling (approve/decline); RN's list sends 'approved', its appointment page 'approve'. RN's `contactId` is the booking's contact; that name is a host-stamped identity field here (the oneapp builder sets it to the signed-in member's own), so it is not sent."
+        },
+        {
+          id: "bookings.booking-declined",
+          method: "POST",
+          path: "/bookings/v2/bookings/:bookingId/decline",
+          src: 16,
+          endpoint: "/",
+          evid: 360,
+          module: "bookings",
+          fields: {
+            bookingId: "$path.bookingId",
+            action: "decline",
+            service_id: "$res.booking.bookedEntity.slot.serviceId",
+            appointmentId: "$res.booking.bookedEntity.slot.sessionId",
+            businessId: "$msid",
+            msid: "$msid"
+          },
+          rn: "bookingsAppointmentPendingApprovalDeclineApproveReschedule (@wix/bi-logger-bookings-data v2): BookingItemLabelsViewModel.ts:410 -> LogBookingListInteractor.ts:224; PendingApprovalButtonsViewModel.ts:92 -> LogViewAppointmentInteractor.ts:335",
+          needs: [
+            "referral_info",
+            "type",
+            "contactId"
+          ],
+          differs: "RN's booking list sends it before the confirmation dialog, so an owner who backs out still counts there; here only a decline Wix accepted is sent. RN's list spells it 'decline', its appointment page 'declined'. RN's `contactId` is the booking's contact; that name is a host-stamped identity field here (the oneapp builder sets it to the signed-in member's own), so it is not sent."
+        },
+        {
+          id: "bookings.service-created",
+          method: "POST",
+          path: "/bookings/v2/services",
+          src: 16,
+          endpoint: "/",
+          evid: 358,
+          module: "bookings",
+          fields: {
+            service_id: "$res.service.id",
+            success: "true",
+            save_type: "create_new",
+            bookingsPlatform: "mobile",
+            saveOrigin: "mobile_service_form",
+            msid: "$msid"
+          },
+          rn: "bookingsSaveServiceX (@wix/bi-logger-bookings-data v2): bookings-mobile-catalog/src/adapters/api/services/create.ts:26-34, after the create request returns",
+          needs: [],
+          differs: "None: RN also sends it only after the API returns, and never on failure."
+        },
+        {
+          id: "bookings.service-updated",
+          method: "PATCH",
+          path: "/bookings/v2/services/:serviceId",
+          src: 16,
+          endpoint: "/",
+          evid: 358,
+          module: "bookings",
+          fields: {
+            service_id: "$path.serviceId",
+            success: "true",
+            save_type: "save_changes",
+            bookingsPlatform: "mobile",
+            saveOrigin: "mobile_service_form",
+            msid: "$msid"
+          },
+          rn: "bookingsSaveServiceX (@wix/bi-logger-bookings-data v2): bookings-mobile-catalog/src/adapters/api/services/update.ts:41-49, after the update request returns",
+          needs: [],
+          differs: "RN's image picker and visibility toggle reach the same update and send 'mobile_service_form' too; so does every update here."
+        }
+      ]
+    };
+  }
+});
+
 // ../../core/dev-server/src/app-config.ts
 import { createHash as createHash8 } from "node:crypto";
+function servedWixApiRules() {
+  return wix_api_rules_default.rules.map((r3) => ({
+    id: r3.id,
+    method: r3.method,
+    path: r3.path,
+    ...r3.status ? { status: r3.status } : {},
+    src: r3.src,
+    evid: r3.evid,
+    ...r3.endpoint ? { endpoint: r3.endpoint } : {},
+    ...r3.module ? { module: r3.module } : {},
+    fields: r3.fields
+  }));
+}
 function servedScreenMap(app) {
   const entries = screen_map_default.apps[app];
   if (!entries) return void 0;
@@ -29099,6 +29268,7 @@ function deriveTelemetryConfig(app) {
       cfg.frog.lv = wp.bi.lv || "1.0.0|Himi";
       const screenMap = servedScreenMap(app.name);
       if (screenMap) cfg.frog.screenMap = screenMap;
+      cfg.frog.apiRules = servedWixApiRules();
     }
   }
   if (wp?.real?.monitoring === true) {
@@ -29338,6 +29508,7 @@ var init_app_config = __esm({
     init_preview_surfaces();
     init_wix_push_links();
     init_screen_map();
+    init_wix_api_rules();
     SHARED_WIX_SENTRY_DSN = "https://5dfa4f23057c43149b6219c07d177472@sentry.io/84240";
     NAV_OVERRIDES = {
       reference: {
@@ -36082,7 +36253,7 @@ async function resolveAccountCredential(auth, fetchImpl) {
   }
   const account = toWixAccount(parsed && typeof parsed === "object" ? parsed.account : void 0);
   if (!account) return { ok: false, reason: "upstream_failed", status: res.status, detail: "no_account" };
-  return { ok: true, accounts: [account] };
+  return { ok: true, accounts: [account], accountCredential: true };
 }
 var ACCOUNT_SERVER;
 var init_wix_account = __esm({
@@ -177100,6 +177271,14 @@ async function appDir2(args, deps) {
 function loginResult(s2) {
   switch (s2.state) {
     case "pending":
+      if (s2.via === "wix") {
+        return json4({
+          ok: true,
+          state: "pending",
+          via: "wix",
+          message: "Signing in with the Wix token held in WIX_TOKEN \u2014 no browser. Call himi_login again to confirm, or just retry the push."
+        });
+      }
       return json4({
         ok: true,
         state: "pending",
@@ -177107,9 +177286,9 @@ function loginResult(s2) {
         message: "A browser window opened for the user to sign in to Wix. If it did not open, give them `loginUrl`. Once they have signed in, call himi_login again to confirm, or just retry the push."
       });
     case "signed_in":
-      return json4({ ok: true, state: "signed_in", account: s2.account, scope: s2.scope, expiresAt: s2.expiresAt });
+      return json4({ ok: true, state: "signed_in", account: s2.account, scope: s2.scope, expiresAt: s2.expiresAt, ...s2.via ? { via: s2.via } : {} });
     case "failed":
-      return { ...json4({ ok: false, state: "failed", error: s2.error, hint: "Call himi_login again to retry, or ask the user to run `himi login --browser` in a terminal." }), isError: true };
+      return { ...json4({ ok: false, state: "failed", error: s2.error, hint: `Call himi_login again to retry, or ask the user to run \`himi login --browser\` in a terminal. ${HELD_TOKEN_ROUTE}` }), isError: true };
     default:
       return json4({ ok: true, state: "idle" });
   }
@@ -177349,7 +177528,7 @@ ${log}` : ""}`, true);
     {
       name: "himi_login",
       title: "Sign in to Wix",
-      description: "Open a browser window where the USER signs in to Wix, so himi_push and himi_share can publish. Returns at once with the sign-in link; call again to see whether the sign-in finished. Already signed in: says who, and opens nothing unless `switchAccount` is true. This server never sees the credential \u2014 the sign-in stores a scoped token on this machine.",
+      description: "Open a browser window where the USER signs in to Wix, so himi_push and himi_share can publish. Returns at once with the sign-in link; call again to see whether the sign-in finished. Already signed in: says who, and opens nothing unless `switchAccount` is true. This server never sees the credential \u2014 the sign-in stores a scoped token on this machine. When the server was started with WIX_TOKEN (the owner's Wix token, held by the agent platform), it signs in with that instead and opens no browser.",
       annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
       inputSchema: z4.object({
         target: z4.string().optional().describe("Serve target. Default: the CLI's default."),
@@ -177496,7 +177675,7 @@ ${log}` : ""}`, true);
     }
   ];
 }
-var MAX_TEXT2, clip2, text7, json4, opt, sw, DIR2, LEARN, CHECK, LOCAL_WRITE, PUBLISH, READ_PLANE, APP_ID, RELEASE_ID, LOG_LEVEL, SINCE, LIMIT, PREVIEW_HINT, LOGIN_HINT, PATH_ARGS;
+var MAX_TEXT2, clip2, text7, json4, opt, sw, DIR2, LEARN, CHECK, LOCAL_WRITE, PUBLISH, READ_PLANE, APP_ID, RELEASE_ID, LOG_LEVEL, SINCE, LIMIT, PREVIEW_HINT, LOGIN_HINT, HELD_TOKEN_ROUTE, PATH_ARGS;
 var init_tools = __esm({
   "src/mcp/tools.ts"() {
     init_define_HHP_CATALOG();
@@ -177522,6 +177701,7 @@ var init_tools = __esm({
     LIMIT = z4.number().int().min(1).max(2e3).optional().describe("At most this many rows.");
     PREVIEW_HINT = "The preview is already running: open `url` in your built-in browser \u2014 Claude Code desktop's browser pane, Cursor's Browser tool, the Browser in Codex inside the ChatGPT desktop app, VS Code's integrated browser. Do not also start the `himi-preview` launch configuration: it serves the same port, and is the way to start a preview only when none is running. A terminal-only agent should show the owner `himi_render` PNGs instead. `board` (when present) is the build board on the same origin.";
     LOGIN_HINT = "Not signed in to the himi serve plane. Call himi_login: it opens a browser window where the user signs in to Wix (this server never sees the credential). A user with a terminal can run `himi login --browser` instead. Then retry.";
+    HELD_TOKEN_ROUTE = "No browser on this machine (a sandbox, a cloud session)? An agent that holds the owner's Wix token signs in without one: run `printf '%s' \"$TOKEN\" | himi login --wix --wix-token-stdin` in a shell, or restart this MCP server with WIX_TOKEN set and call himi_login again. Never pass the token as a tool argument.";
     PATH_ARGS = ["dir", "parentDir", "file", "out", "manifest", "plan", "merge", "report", "outDir", "plist"];
   }
 });
@@ -177540,8 +177720,10 @@ function createLoginSession(deps) {
     start(target) {
       if (current.state === "pending") return Promise.resolve(current);
       const self2 = deps.selfCommand();
-      const args = [...self2.args, "login", "--browser", "--skip-version-check", ...target ? ["--target", target] : []];
-      const pending = { state: "pending", startedAt: deps.now() };
+      const env = deps.env ?? process.env;
+      const held = heldWixToken(env) !== void 0;
+      const args = [...self2.args, "login", held ? "--wix" : "--browser", "--skip-version-check", ...target ? ["--target", target] : []];
+      const pending = { state: "pending", startedAt: deps.now(), ...held ? { via: "wix" } : {} };
       current = pending;
       const out2 = [];
       const err = [];
@@ -177554,7 +177736,7 @@ function createLoginSession(deps) {
         };
         let child;
         try {
-          child = deps.spawn(self2.cmd, args, { stdio: ["ignore", "pipe", "pipe"], env: { ...process.env, HIMI_NO_UPDATE_CHECK: "1" } });
+          child = deps.spawn(self2.cmd, args, { stdio: ["ignore", "pipe", "pipe"], env: { ...env, HIMI_NO_UPDATE_CHECK: "1" } });
         } catch (e2) {
           current = { state: "failed", error: `could not start himi login: ${e2.message}` };
           answer();
@@ -177576,7 +177758,7 @@ function createLoginSession(deps) {
         child.once("exit", (code) => {
           if (code === 0) {
             const r3 = lastJson([out2.join("")]) ?? {};
-            current = { state: "signed_in", account: r3.sub, scope: r3.scope, expiresAt: r3.exp };
+            current = { state: "signed_in", account: r3.sub, scope: r3.scope, expiresAt: r3.exp, ...held ? { via: "wix" } : {} };
             signedInTarget = target;
           } else {
             const e2 = lastJson(err.join("").split("\n"));
@@ -177594,6 +177776,7 @@ var init_login = __esm({
   "src/mcp/login.ts"() {
     init_define_HHP_CATALOG();
     init_cli_bridge();
+    init_wix_owner();
     defaultLoginDeps = {
       spawn: (cmd, args, opts) => nodeSpawn2(cmd, args, opts),
       now: () => Date.now()
@@ -187274,47 +187457,48 @@ var init_preview_assets_generated = __esm({
     init_define_HHP_CATALOG();
     init_preview_assets_format();
     PREVIEW_ASSET_MANIFEST = [
-      { key: "assets/DashboardHost-CD7lmr0F.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 2971, sha256: "a96de76d7be0569af5a7898f658a732e74c1cc03ce7fed45741b37479c279a6f" },
-      { key: "assets/DevDrawer-CLrFE_UR.js", contentType: "application/javascript; charset=utf-8", offset: 2979, length: 16783, sha256: "7bd2827e9a1ce09dca579880a9e41075edfc477550d6a678a69dc8cdad1b4fdb" },
-      { key: "assets/IdiomCompare-B-neb9Jh.js", contentType: "application/javascript; charset=utf-8", offset: 19762, length: 1926, sha256: "d86de900ee50a7b906b8df6f7b00f65848306d6645594678b6ce98d9a75769fd" },
-      { key: "assets/LightboxViewer-D7j6qiy9.js", contentType: "application/javascript; charset=utf-8", offset: 21688, length: 8171, sha256: "2881666b58e496a1f4201ca5ac1f96c976c69645fc9c8f85ff064804c8b596f4" },
-      { key: "assets/OfflineReadingBar-DPNGmXG3.js", contentType: "application/javascript; charset=utf-8", offset: 29859, length: 1707, sha256: "b99aee67ce83fe0ea925325b714234a38aec224c8166b99eb96e5a17fcd249ff" },
-      { key: "assets/PhonePreviewControl-JXbSx9rk.js", contentType: "application/javascript; charset=utf-8", offset: 31566, length: 37851, sha256: "99a9a3fdd28714518ba1ba5bce0440a49fff6f514b4a726ec5ec8b00aa5350b6" },
-      { key: "assets/SchemeCompare-CbA_U3Bc.js", contentType: "application/javascript; charset=utf-8", offset: 69417, length: 1858, sha256: "e3633216cc3899655bd08471f0ae6c7ce33dfcd9a197b41dba95d3bfef130a1c" },
-      { key: "assets/WixFrogTelemetrySink-DIjmBS2_.js", contentType: "application/javascript; charset=utf-8", offset: 71275, length: 4475, sha256: "b1e403c85aa46aeb15b4b0e20500ce6269bdc3e148468e6a327093028e480c81" },
-      { key: "assets/calendar-ics-BvfIYWjG.js", contentType: "application/javascript; charset=utf-8", offset: 75750, length: 2192, sha256: "1636167041e9829ceccd3544297b86b8475c38bd2f759c4dbc17c813dc6e9254" },
-      { key: "assets/catalog-CAoUWITw.js", contentType: "application/javascript; charset=utf-8", offset: 77942, length: 26046, sha256: "4c270ca3051f77d761aef1297125e02339d48493dd2b84a0cacf0faf41aa8cb3" },
-      { key: "assets/catalogFontFaces-Cz02eabC.js", contentType: "application/javascript; charset=utf-8", offset: 103988, length: 1111, sha256: "77677eae00c43a43a150df921b0e4314ee521e017b010285835a7891669c507f" },
-      { key: "assets/contacts-vcard-BcohPQ0m.js", contentType: "application/javascript; charset=utf-8", offset: 105099, length: 2567, sha256: "c4ff75e96cd909bbb9182c5dc78794fcebc65139fbddef2537711d774fb33ad0" },
-      { key: "assets/files-transfer-BquypNGx.js", contentType: "application/javascript; charset=utf-8", offset: 107666, length: 6446, sha256: "a5442cbd19086336924f9ec4d930bd7fa34dfdf07485cd15e01bd83ddefddf23" },
-      { key: "assets/glassPreviewBrowser-DONaOehd.js", contentType: "application/javascript; charset=utf-8", offset: 114112, length: 6578, sha256: "4402c4cddd2a564e7466cdf1e12a0e0277c0400b288e1e5eda1d23e797599d31" },
-      { key: "assets/image-preparation-Cj4gldm6.js", contentType: "application/javascript; charset=utf-8", offset: 120690, length: 2704, sha256: "32944ea587c2f3b84389b66b50a850437560238f1c8d33b6275973ee04eee865" },
-      { key: "assets/index-CKvuV_lt.js", contentType: "application/javascript; charset=utf-8", offset: 123394, length: 1531022, sha256: "903349bb14d1ddbfe8c2bbc7657e66d6b5d9ab56d547927ee2f3437e9fea5620" },
-      { key: "assets/jsx-runtime-CdvZGgm7.js", contentType: "application/javascript; charset=utf-8", offset: 1654416, length: 7751, sha256: "42a78b508d0f309f6a4a6efbb8669015211b3c26574c5b0929884c4d9d20b806" },
-      { key: "assets/pdf-CDxdgL1u.js", contentType: "application/javascript; charset=utf-8", offset: 1662167, length: 488215, sha256: "67feb362281a3040ee05592769227c58a98ec3c8073dac95ecb5629141c67061" },
-      { key: "assets/pdf.worker.min-BGnVRhRG.js", contentType: "application/javascript; charset=utf-8", offset: 2150382, length: 90, sha256: "521a0e528916d678d7588b2cddf3dadd3bb959a6d62426382f61c77a82017e35" },
-      { key: "assets/pdf.worker.min-BmVo14Nb.mjs", contentType: "application/javascript; charset=utf-8", offset: 2150472, length: 1317034, sha256: "a33cfe728c584fdba4fcc1fd54bcdc2f9f2f13889ddbb5b2bd1d0f8cbe49b84e" },
-      { key: "assets/pdfDocument-Bv-5sGuW.js", contentType: "application/javascript; charset=utf-8", offset: 3467506, length: 3470, sha256: "da81670cfe6c857ec27a623eb6c54d8dcfe854ef3891dba0d8026bdb7f117c3c" },
-      { key: "assets/pdfFetch-Cc8i1I1h.js", contentType: "application/javascript; charset=utf-8", offset: 3470976, length: 2266, sha256: "1d21ad008921942217c9eac0c35b1713773b9d89c71e3ab4412781f7bb88f463" },
-      { key: "assets/webviewBridgeHost-IwGs3z1v.js", contentType: "application/javascript; charset=utf-8", offset: 3473242, length: 9888, sha256: "2c09e4685ca617bf9f0e657f3bf720bac86269f9783a3e897b305371d97d0815" },
-      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 3483130, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
-      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 3487740, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
-      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 3976324, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
-      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 4067248, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
-      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 4158232, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
-      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 4249212, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
-      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 4340084, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
-      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 4431064, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
-      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 4539700, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
-      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 4648784, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
-      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 4757832, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
-      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 4865532, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
-      { key: "himi-sw.js", contentType: "application/javascript; charset=utf-8", offset: 4953640, length: 6818, sha256: "835250c3d8004f27c2b67f9b471984351ba6df07b916d97e33b43c691200a18c" },
-      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 4960458, length: 4924, sha256: "9429b13de7b744e75748bef05ab32abd32b55db36648879b16c6b6425e7e7c57" },
-      { key: "ios-glass-preview.css", contentType: "text/css; charset=utf-8", offset: 4965382, length: 11457, sha256: "6cb2b75264fa5fa2b4d28851878a5eab0712900e8b3a6c2370cc661d6d820805" },
-      { key: "kit-tab-bar.css", contentType: "text/css; charset=utf-8", offset: 4976839, length: 1171, sha256: "9e2c3a0faaf05d5471badf167a4d3bdf1c4e6dd65c432eea6d254158bfd99585" },
-      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 4978010, length: 23047, sha256: "20d1459e3f896f344e478e613d0c979a0de02e81a929a45d3a0ef6a53af36441" },
-      { key: "t5-worker-frame.html", contentType: "text/html; charset=utf-8", offset: 5001057, length: 23064, sha256: "8655cfe9c74212ec5dafecb49d2fdeb48b19f1bd8a710091e3e55631f9b4ab06" }
+      { key: "assets/DashboardHost-BqjjcyT-.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 2971, sha256: "e0cb957636a5dd916b2469b8b647d86afb868dd28fca54cfa61ee4f195c8e9fe" },
+      { key: "assets/DevDrawer-Cjzv-FvQ.js", contentType: "application/javascript; charset=utf-8", offset: 2979, length: 16783, sha256: "99befc70cf324dd083e34e3c70d304977d105cef503712ed3cc63887a9d5b2ee" },
+      { key: "assets/IdiomCompare-DBGm0Wja.js", contentType: "application/javascript; charset=utf-8", offset: 19762, length: 1926, sha256: "d410b4c06ee68992b37b261916770c45eb1af5cb93c74805063e9013aaa2729c" },
+      { key: "assets/LightboxViewer-Dphq5knI.js", contentType: "application/javascript; charset=utf-8", offset: 21688, length: 8171, sha256: "6ef75763658a9700f3763eb5502032e1d1ea84d7becef2f77efeb2de96fa0db9" },
+      { key: "assets/OfflineReadingBar-DMW03-8I.js", contentType: "application/javascript; charset=utf-8", offset: 29859, length: 1707, sha256: "ac3b65cb1fb3ef7be7e6a8a2d4c3532d218e0d4e177c8a2d116a70ed661c956d" },
+      { key: "assets/PhonePreviewControl-BWixiIFS.js", contentType: "application/javascript; charset=utf-8", offset: 31566, length: 37851, sha256: "19ece66a686149acb428c95274b64c98c9da2266418f6b636a06f1f82b138b7d" },
+      { key: "assets/SchemeCompare-D9py7OCL.js", contentType: "application/javascript; charset=utf-8", offset: 69417, length: 1858, sha256: "cd1b79d61068792bd739b31dfa4865f61c81d695b88acd805f4bda4866a251fa" },
+      { key: "assets/WixFrogTelemetrySink-aWa_O0yq.js", contentType: "application/javascript; charset=utf-8", offset: 71275, length: 4492, sha256: "6ab97269284623bfc6d94e3421ecc12f34746f08ad4cd79dc4a1a8689dc610c9" },
+      { key: "assets/calendar-ics-BvfIYWjG.js", contentType: "application/javascript; charset=utf-8", offset: 75767, length: 2192, sha256: "1636167041e9829ceccd3544297b86b8475c38bd2f759c4dbc17c813dc6e9254" },
+      { key: "assets/catalog-CAoUWITw.js", contentType: "application/javascript; charset=utf-8", offset: 77959, length: 26046, sha256: "4c270ca3051f77d761aef1297125e02339d48493dd2b84a0cacf0faf41aa8cb3" },
+      { key: "assets/catalogFontFaces-YS_x6BnU.js", contentType: "application/javascript; charset=utf-8", offset: 104005, length: 1111, sha256: "51225a7ec2863063668a6f516fee879fbc3ecdfdbde12a09608b1930802a968b" },
+      { key: "assets/contacts-vcard-BcohPQ0m.js", contentType: "application/javascript; charset=utf-8", offset: 105116, length: 2567, sha256: "c4ff75e96cd909bbb9182c5dc78794fcebc65139fbddef2537711d774fb33ad0" },
+      { key: "assets/files-transfer-CFlcuqbO.js", contentType: "application/javascript; charset=utf-8", offset: 107683, length: 6446, sha256: "79953712f40e37a8f63daf9cf78977e42818994c88fa37ec7f549c44cebef347" },
+      { key: "assets/frogApiRules-BAUMr0ae.js", contentType: "application/javascript; charset=utf-8", offset: 114129, length: 2207, sha256: "b75fc21bc1c57d05a4e943c23529c54d212c9970cb0fc66104f4150d090d51b6" },
+      { key: "assets/glassPreviewBrowser-DONaOehd.js", contentType: "application/javascript; charset=utf-8", offset: 116336, length: 6578, sha256: "4402c4cddd2a564e7466cdf1e12a0e0277c0400b288e1e5eda1d23e797599d31" },
+      { key: "assets/image-preparation-Cj4gldm6.js", contentType: "application/javascript; charset=utf-8", offset: 122914, length: 2704, sha256: "32944ea587c2f3b84389b66b50a850437560238f1c8d33b6275973ee04eee865" },
+      { key: "assets/index-CJV5xVZz.js", contentType: "application/javascript; charset=utf-8", offset: 125618, length: 1531875, sha256: "878956588e6190cc8813913fca8398d52246bea95fd423798c687611e9f90ed4" },
+      { key: "assets/jsx-runtime-CdvZGgm7.js", contentType: "application/javascript; charset=utf-8", offset: 1657493, length: 7751, sha256: "42a78b508d0f309f6a4a6efbb8669015211b3c26574c5b0929884c4d9d20b806" },
+      { key: "assets/pdf-D1ZDeakq.js", contentType: "application/javascript; charset=utf-8", offset: 1665244, length: 488215, sha256: "289b89dc660fa050af31f8ce5f22ffd7332a60c7b80b8ffd2b141ec074fb2e22" },
+      { key: "assets/pdf.worker.min-BGnVRhRG.js", contentType: "application/javascript; charset=utf-8", offset: 2153459, length: 90, sha256: "521a0e528916d678d7588b2cddf3dadd3bb959a6d62426382f61c77a82017e35" },
+      { key: "assets/pdf.worker.min-BmVo14Nb.mjs", contentType: "application/javascript; charset=utf-8", offset: 2153549, length: 1317034, sha256: "a33cfe728c584fdba4fcc1fd54bcdc2f9f2f13889ddbb5b2bd1d0f8cbe49b84e" },
+      { key: "assets/pdfDocument-B5Sfjn1z.js", contentType: "application/javascript; charset=utf-8", offset: 3470583, length: 3470, sha256: "bd8324751a60c6833afde4191293558bb2b800c4e3307e9481dd86cf6d7c6ff1" },
+      { key: "assets/pdfFetch-Cc8i1I1h.js", contentType: "application/javascript; charset=utf-8", offset: 3474053, length: 2266, sha256: "1d21ad008921942217c9eac0c35b1713773b9d89c71e3ab4412781f7bb88f463" },
+      { key: "assets/webviewBridgeHost-DrWioY2t.js", contentType: "application/javascript; charset=utf-8", offset: 3476319, length: 9888, sha256: "f7f7c35743b6beaee8175e7fa7294d2c9b01d2f29d40a12d7a107dad7e09ff39" },
+      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 3486207, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
+      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 3490817, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
+      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 3979401, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
+      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 4070325, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
+      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 4161309, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
+      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 4252289, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
+      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 4343161, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
+      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 4434141, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
+      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 4542777, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
+      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 4651861, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
+      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 4760909, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
+      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 4868609, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
+      { key: "himi-sw.js", contentType: "application/javascript; charset=utf-8", offset: 4956717, length: 6818, sha256: "835250c3d8004f27c2b67f9b471984351ba6df07b916d97e33b43c691200a18c" },
+      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 4963535, length: 4924, sha256: "7245f0df134ddb3af03d6f7560e79d48913ae431553c580e92e3f1c4dabeecdc" },
+      { key: "ios-glass-preview.css", contentType: "text/css; charset=utf-8", offset: 4968459, length: 11457, sha256: "6cb2b75264fa5fa2b4d28851878a5eab0712900e8b3a6c2370cc661d6d820805" },
+      { key: "kit-tab-bar.css", contentType: "text/css; charset=utf-8", offset: 4979916, length: 1171, sha256: "9e2c3a0faaf05d5471badf167a4d3bdf1c4e6dd65c432eea6d254158bfd99585" },
+      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 4981087, length: 23047, sha256: "20d1459e3f896f344e478e613d0c979a0de02e81a929a45d3a0ef6a53af36441" },
+      { key: "t5-worker-frame.html", contentType: "text/html; charset=utf-8", offset: 5004134, length: 23064, sha256: "8655cfe9c74212ec5dafecb49d2fdeb48b19f1bd8a710091e3e55631f9b4ab06" }
     ];
   }
 });

package/guides/himi-mcp.md

@@ -146,9 +146,11 @@ see, so they stay commands a person runs. Publishing needs a sign-in first: `him
 browser sign-in for the user, or run `himi login --browser` in a terminal. Either way the server
 never asks for or sees a credential — the browser hands a scoped token to a separate `himi login`
 process, which stores it on this machine. On a server with no browser, `himi login --wix` is the
-exception to that guarantee: the CLI reads a Wix account API key from `WIX_API_KEY` in its own
-environment and sends it to the owner plane to mint the token, so keep that key a secret of the
-job, not of the MCP client. A tool input that starts with `-` is refused, so nothing
+exception to that guarantee: the CLI reads the owner's held Wix token from `WIX_TOKEN`, or a Wix
+account API key from `WIX_API_KEY`, in its own environment and sends it to the owner plane to mint
+the token, so keep it a secret of the job, not of the MCP client. Started with `WIX_TOKEN` set,
+`himi_login` runs that `himi login --wix` itself instead of opening a browser; the token still
+never passes through a tool input or result. A tool input that starts with `-` is refused, so nothing
 can be passed through to a flag no tool offers.
 
 ## See the app inside your IDE

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1635.0",
+  "version": "0.1637.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -72,5 +72,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "2eb0ec4acfa6663413f592cc6ba30c8888d6a7e736cb32e119b1f8ca"
+  "falconPackageHash": "21c6c964d718871e94853190ba896eec52be97501402d21da7cdf4c9"
 }