@wix/himalaya-cli 0.807.0 → 0.808.0

package/dist/cli.mjs

@@ -11170,6 +11170,7 @@ function shouldRevealError(args) {
 var EMAIL_RE, URL_HOST_RE, INTEGER_RE, NUMBER_RE;
 var init_validation = __esm({
   "../../core/ts/src/validation.ts"() {
+    "use strict";
     EMAIL_RE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/;
     URL_HOST_RE = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(:[0-9]+)?$/;
     INTEGER_RE = /^[+-]?[0-9]+$/;
@@ -14515,6 +14516,7 @@ function validateWorkerSubtree(raw, slotId, policy, actionCatalog) {
 var WORKER_SUBTREE_CEILINGS, ID_PART, ACTION_ID;
 var init_worker_subtree = __esm({
   "../../core/ts/src/worker-subtree.ts"() {
+    "use strict";
     init_worker_subtree_safe_types_generated();
     WORKER_SUBTREE_CEILINGS = Object.freeze({
       maxEncodedBytes: 65536,

package/guides/release-notes.md

@@ -14,8 +14,60 @@ areas, always in the same order, so you can skim for the one you care about.
 
 ---
 
+## 2026-09-17
+
+### Getting started & the CLI
+
+- **`npm i -g @wix/himalaya-cli@latest` now works from anywhere — no `--registry`, no VPN.** The CLI
+  publishes to public npm, so the install that used to answer `E404` off the Wix network simply
+  works, and the guides, the skill documents and the starter-template READMEs dropped the
+  internal-registry flag with it. The optional `@wix/himalaya` editor-types umbrella is still
+  internal — and you do not need it to build, because the CLI ships the runtime it compiles
+  against. (#2429)
+
+### Logic, data & SDKs
+
+- **Both `@himalaya/*` and `@wix/himalaya/*` build off-repo, and the guides now say which one your
+  editor resolves.** `himi init` scaffolds `@wix/himalaya/*`, which is the spelling `tsc` and your
+  editor resolve from the installed umbrella; the CLI accepts either and resolves both from the
+  runtime staged inside it. `himi docs wix-api-usage` carries the full mapping. (#2434)
+
+### Validate & test
+
+- **`himi validate` now reports the four `MOBILE-UX.md` markers** that `himi ux audit --strict`
+  requires. The authoring guidance tells you to replace the scaffold's boilerplate with your own
+  content, which silently drops those strings — and nothing said so until `--strict` printed seven
+  errors long after the rewrite. (#2433)
+
+### Preview, push & release
+
+- **Your app's source now travels with its release.** `himi push` archives the content package
+  alongside the built output and `himi pull` brings it back editable, so an app authored in a
+  container that no longer exists can be changed again instead of only re-run. (#2430)
+- **`himi validate` and `himi push` now warn when your app declares no web surface.** `"web": true`
+  in `platforms.json` gates the public `/app/a/<slug>` mount and the desktop surface, and without it
+  that URL refused the app with nothing explaining why. The warning names the key, the consequence
+  and the fix — and never fails `--strict`, because a phone-only app is a legitimate app. The
+  authoring preview `/preview/a/<app>` was never gated by that flag and renders either way. (#2432)
+
+### Shipping binaries
+
+- **`himi icon generate` no longer guesses a business when you have not named one.** With no glyph
+  specified it picked one of 37 marks by hashing your app name, and all 37 are business metaphors —
+  so the fallback confidently claimed "mail" or "music" on the one surface that is not
+  over-the-air. It now draws `emblem`, a neutral frame, and per-app distinctness stays in the tile
+  colour. `book` and `graduation` are new, so an education app has a mark of its own, and
+  `himi icon glyphs` names the default. (#2431)
+
 ## 2026-09-16
 
+### Authoring screens
+
+- **The component reference now says that `modifiers.boxShadow.color` names a token.** It is not the
+  same field as `shadows.<name>.color` in your design tokens, which holds a literal `#RRGGBB` — so a
+  validator error about that one ("the native runtimes parse only `#RRGGBB`") is not the reference
+  contradicting itself. (#2421)
+
 ### Logic, data & SDKs
 
 - **A web sign-in that cannot succeed now says so, instead of resolving as a visitor.**
@@ -24,6 +76,14 @@ areas, always in the same order, so you can skim for the one you care about.
   app with correct four-state handling had nothing to branch on and its sign-in button appeared
   dead. On a hosted preview that was the only outcome available. It also reports the real member
   when the bridge already holds one, rather than a fixed demo user. (#2388)
+- **`himi cms query` / `create` / `seed` load a TypeScript `config.ts` like every other command.**
+  They imported it with bare Node, which cannot read TypeScript, cannot resolve the config's
+  `@himalaya/*` imports, and takes a relative `./x.js` specifier literally instead of finding
+  `./x.ts` — so the CMS verbs failed on configs the rest of the CLI reads fine. (#2398)
+- **A collection id is capped at 36 characters**, and the cap was documented nowhere. It is a Wix
+  Data limit and it applies to `himi_<appSlug>_<name>` in full, so a long app id and a long
+  collection name together overflow it; `himi docs cms-collections` now spells out the
+  arithmetic. (#2421)
 
 ### Validate & test
 
@@ -48,17 +108,25 @@ areas, always in the same order, so you can skim for the one you care about.
   reading the wrong key off a response or a total off by one, are caught 0 of 34 times. A green run
   means no invariant fired, not that your app is correct. The figure comes from that benchmark, not
   from your own runs — `himi test` output is unchanged. (#2402)
+- **`himi validate` no longer answers `ok: true` after a CMS check that never ran.** An unloadable
+  `config.ts` was swallowed, the CMS pass returned nothing, and validation reported success. (#2389)
 
 ### Preview, push & release
 
 - The hosted preview can frame a tablet in **landscape**. If your app ships on an iPad mounted
   sideways at a front desk, you can now review it in the orientation it runs in. (#2390)
+- **An app whose releases are all drafts now shows itself instead of looking broken.** The owner
+  grid painted a dark slab with a letter in it and `/preview/?app=<slug>` said "No published
+  release" — for 94 of the 150 apps on the production owner account, whose bytes were in the store
+  the whole time. (#2396)
 
 ### Branded Lite & Owner Lite
 
 - **Owner Lite has analytics.** A highlights screen with six live measures, a range selector, and a
   per-measure detail screen, all reading your site's real figures — with a Home KPI that agrees with
   them. Nothing on these screens is a placeholder number. (#2387)
+- **Owner Lite has Aria, the real Wix assistant**, as a screen — the same chat service behind the
+  Wix Owner app's Aria tab, with each turn painted while it runs. (#2408)
 
 ## 2026-09-15
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.807.0",
+  "version": "0.808.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -63,5 +63,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "169f524111b79b2ca18f438146b740e80b6318c877f00a2f5f3970b5"
+  "falconPackageHash": "dc5a7f5795e7fd8644710a8cc8bae9b5f1a66b7c5f55ff66cf165cea"
 }