@wix/himalaya-cli 0.821.0 → 0.823.0

package/dist/cli.mjs

@@ -36897,7 +36897,12 @@ async function handleWebWix(req, res, state) {
     const target = new URL(requestedPath, "https://www.wixapis.com");
     const query = Object.fromEntries(target.searchParams.entries());
     const started = Date.now();
-    const match = state.wix.mode === "mock" ? matchRuleEx(state.wix.rules, method, target.pathname, { host: target.host, query, body }) : void 0;
+    const matchCtx = { host: target.host, query, headers: forwardedHeaders, body };
+    let match = state.wix.mode === "mock" ? matchRuleEx(state.wix.rules, method, target.pathname, matchCtx) : void 0;
+    if (match && (match.rule.kind ?? "mock") !== "mock") {
+      console.error(`[himalaya-dev] net-mocks: rule "${match.rule.id}" is kind:"${match.rule.kind}", which the web bridge cannot apply \u2014 ignoring it for ${method} ${target.pathname}`);
+      match = matchRuleEx(state.wix.rules.filter((r) => (r.kind ?? "mock") === "mock"), method, target.pathname, matchCtx);
+    }
     if (match && (match.rule.kind ?? "mock") === "mock") {
       const mocked = match.rule.response;
       if (mocked.delayMs) await new Promise((resolve41) => setTimeout(resolve41, mocked.delayMs));

package/guides/release-notes.md

@@ -14,6 +14,28 @@ areas, always in the same order, so you can skim for the one you care about.
 
 ---
 
+## 2026-09-18
+
+### Logic, data & SDKs
+
+- **The Tier-5 guide now states the right payload for every control, and names the ones the
+  renderers disagree about.** `himi docs tier-5-add-a-screen` was wrong about three controls. It
+  now carries one table of what each control puts in the action it dispatches — the key, and that
+  it rides in `args` — followed by an explicit warning that several arms do not honour it yet:
+  web's `Toggle`, `Slider` and `SelectionControl` inject nothing, `DatePicker` differs on three
+  arms, and `Rating` ships three encodings. So a defensive reducer
+  (`String(p?.value ?? p?.text ?? "")`) is still the safe way to read a payload. The divergence is
+  documented and held from growing, not fixed — no renderer's behaviour changed. (#2462)
+
+### Preview, push & release
+
+- **A `.himi` package can carry your app's source, so the whole codebase travels as one file.**
+  `himi pack --dev` writes the package with the sources included, and `himi import <pkg>.himi`
+  turns it back into an editable content package — no account, no network, nothing to upload.
+  `--name` re-substitutes the app identity, so what you import is a new app rather than a second
+  copy of the one it came from. Plain `himi pack` is unchanged and still ships built output only;
+  a source-carrying package is always labelled, and the web host will not open one. (#2448)
+
 ## 2026-09-17
 
 ### Getting started & the CLI
@@ -31,6 +53,13 @@ areas, always in the same order, so you can skim for the one you care about.
   editor resolves.** `himi init` scaffolds `@wix/himalaya/*`, which is the spelling `tsc` and your
   editor resolve from the installed umbrella; the CLI accepts either and resolves both from the
   runtime staged inside it. `himi docs wix-api-usage` carries the full mapping. (#2434)
+- **`himi cms create` was refusing collection ids that Wix accepts.** The cap was enforced at 36
+  characters, and the real limit on `DataCollection.id` is 256 — so a descriptive id came back
+  rejected with nothing actually wrong with it. (#2447)
+- **Wix member login now completes with an `https` redirect URI.** The callback was recognised by
+  comparing only the redirect URI's *scheme*, which happens to be exact for a native custom scheme
+  and far too loose for every `https://` one — so the token exchange ran against a URL that was not
+  the callback and the sign-in never finished. (#2452)
 
 ### Validate & test
 
@@ -49,6 +78,20 @@ areas, always in the same order, so you can skim for the one you care about.
   that URL refused the app with nothing explaining why. The warning names the key, the consequence
   and the fix — and never fails `--strict`, because a phone-only app is a legitimate app. The
   authoring preview `/preview/a/<app>` was never gated by that flag and renders either way. (#2432)
+- **`himi pull --force` now names the files it kept, and `--replace` removes them instead.**
+  `--force` wrote the archive over a non-empty directory and left anything the release did not
+  carry silently in place, so you could end up holding — and pushing — a tree that matched no
+  release you ever published. Those files are now reported as `left: [...]`, and `--replace`
+  removes them first and reports `removed: [...]`. Both consider only the paths a push would have
+  archived, so your `.git`, `node_modules`, `dist` and `.env*` are out of reach by construction —
+  and out of the report. `--replace` refuses a directory holding no `himalaya.content.json`, so a
+  mistyped `--out` cannot clear an unrelated tree, and an archive carrying a path today's rules
+  refuse is reported as `refused` rather than written. (#2444)
+- **A push too large to be accepted now fails locally, naming the size.** `himi push` sends your
+  bundles, assets, icon and source archive in one request, so two artifacts that each passed their
+  own limit could still exceed the request limit together — and the answer was a bare `413` with
+  nothing in it to act on. The refusal now names the measured body size, the limit, and
+  `--no-source`. (#2449)
 
 ### Shipping binaries
 
@@ -59,6 +102,14 @@ areas, always in the same order, so you can skim for the one you care about.
   colour. `book` and `graduation` are new, so an education app has a mark of its own, and
   `himi icon glyphs` names the default. (#2431)
 
+### Branded Lite & Owner Lite
+
+- **Owner Lite can hold several Wix businesses open at once.** Site scope was process-wide, so an
+  owner with three restaurants could only ever look at one of them, and "which of my businesses
+  needs me right now" was not a question the app could answer. A per-call site now moves the signed
+  credential rather than only the request header, so asking for another business no longer answers
+  `403` with nothing to explain it. (#2460)
+
 ## 2026-09-16
 
 ### Authoring screens

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.821.0",
+  "version": "0.823.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -63,5 +63,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "77f831085aaa84f0bcae8d29c6fd268cf0c9977636e6f80f2a389eb5"
+  "falconPackageHash": "8d426f4512e281bd2df75c8be16c73e28ca527e78ef39e81086b5bc1"
 }