@wix/himalaya-cli 0.866.0 → 0.868.0

package/dist/cli.mjs

@@ -5241,6 +5241,7 @@ function resolveTranslation(value, catalog, sourceCatalog) {
 var BINDING_SIGILS, BINDING_SIGIL_RE, TRANSLATION_PREFIX, TRANSLATION_KEY_RE;
 var init_bindings = __esm({
   "../../core/ts/src/bindings.ts"() {
+    "use strict";
     BINDING_SIGILS = ["service", "flag", "item", "t"];
     BINDING_SIGIL_RE = new RegExp(
       `^\\$(?:${BINDING_SIGILS.filter((s) => s !== "t").join("|")})\\b|^\\$t:`
@@ -27347,7 +27348,6 @@ function shouldRevealError(args) {
 var EMAIL_RE, URL_HOST_RE, INTEGER_RE, NUMBER_RE;
 var init_validation = __esm({
   "../../core/ts/src/validation.ts"() {
-    "use strict";
     EMAIL_RE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/;
     URL_HOST_RE = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(:[0-9]+)?$/;
     INTEGER_RE = /^[+-]?[0-9]+$/;
@@ -30771,7 +30771,6 @@ function validateWorkerSubtree(raw, slotId, policy, actionCatalog) {
 var WORKER_SUBTREE_CEILINGS, ID_PART, ACTION_ID;
 var init_worker_subtree = __esm({
   "../../core/ts/src/worker-subtree.ts"() {
-    "use strict";
     init_worker_subtree_safe_types_generated();
     WORKER_SUBTREE_CEILINGS = Object.freeze({
       maxEncodedBytes: 65536,
@@ -62971,7 +62970,7 @@ var COMMANDS = [
   { name: "sdk", summary: "list importable @himalaya SDKs + descriptions; a name = that SDK's typed API (offline)", required: "[<name>] [--json]" },
   { name: "skills", summary: "list the authoring topics you can learn, grouped by category (offline)", required: "[--json]" },
   { name: "agent-init", summary: "seed a dir with HIMALAYA.md + component reference + the counter example so a coding agent can author Himi apps", required: "[--dir <dir>]" },
-  { name: "apps", summary: "the owner app registry (public dev loop). `list` (default) prints the apps your Wix identity owns; `claim <slug>` takes ownership of a slug so `himi push` can publish under it \u2014 though `himi push` now claims a brand-new app's slug for you (namespaced per owner as `<ownerPrefix>.<name>`, composed offline from the token \u2014 himalaya.content.json is not rewritten), so this is mostly for taking a name ahead of time. Auth is the control token `himi login --browser` stored, or an explicitly forwarded Wix session (--cookie / HIMI_WIX_COOKIE) for a scripted call with no browser \u2014 a write through the public gateway needs the XSRF-TOKEN cookie too. Reads (list) work with either.", required: "[list] | claim <slug> [--display-name <n>] [--account-id <id>] [--target <t>] [--cookie <c>] [--control-token <t>]" },
+  { name: "apps", summary: "the owner app registry (public dev loop). `list` (default) prints the apps your Wix identity owns; `claim <slug>` takes ownership of a slug so `himi push` can publish under it \u2014 though `himi push` now claims a brand-new app's slug for you (namespaced per owner as `<ownerPrefix>.<name>`, composed offline from the token \u2014 himalaya.content.json is not rewritten), so this is mostly for taking a name ahead of time. `release <slug> --yes` gives a name BACK, freeing it for anyone to claim \u2014 refused for an app that has ever been published (devices may still resolve it), owner-only, and it signs you out everywhere because your token carries the app in its frozen scope. Auth is the control token `himi login --browser` stored, or an explicitly forwarded Wix session (--cookie / HIMI_WIX_COOKIE) for a scripted call with no browser \u2014 a write through the public gateway needs the XSRF-TOKEN cookie too. Reads (list) work with either.", required: "[list] | claim <slug> [--display-name <n>] [--account-id <id>] | release <slug> --yes [--target <t>] [--cookie <c>] [--control-token <t>]" },
   { name: "fonts", summary: "the curated font vocabulary an app may name, and what THIS app will actually ship. `list` (default) prints every family with its category, weights, byte cost and licence \u2014 `--licenses` adds the notice text OFL requires travel with the font. `check` is OFFLINE and runs the same computation the release build and the CI gate do: which faces pack into the binary, which are declared for OTA fetch, and any family that would silently render as the system font (a non-zero exit, because that degrade is invisible at runtime). `add <Family>` resolves a name (exact, normalized or alias) and reports the licence being accepted.", required: "[list] [--licenses] | check [--content <dir>] | add <Family>" },
   { name: "assets", summary: "app-owned resources declared under assets/ \u2014 images, Godot content packs, fonts, Rive files, video. `list` (default) reports each with hash, size, whether it bakes into the binary, and any budget problem that would make `himi push` refuse; reference one from a descriptor as `asset:<name>`. `verify` diffs assets/ on disk against what a release carries, flagging CLI-uploaded assets as DRIFT (they work at runtime but are not in git). `add <file>` uploads one imperatively (origin=cli, NOT baked, NOT in git \u2014 prefer committing to assets/); `rm <name>` drops the record so the next resolve falls back to the baked copy.", required: "[list] [--content <dir>] | verify [--app <a>] [--release <id>] | add <file> [--name <n>] [--live] | rm <name> [--live]" },
   { name: "secrets", summary: "manage encrypted secret metadata for an app's server functions. `set`/`rotate` read the secret value from stdin (never an argv); `list` shows names + environments, never values. Preview and production are separate scopes. Remote (BO) mode reads the DPX session; local mode uses the operator functions plane.", required: "set|list|rotate --app <app> --name <name> [--environment preview|production] [--target <t>] [--functions-url <url>] [--release <id>]" },
@@ -63153,6 +63152,18 @@ function previewPlayerLink(app, release, screenId) {
 function previewPlayerDebugLink(app, release, screenId, previewToken) {
   return buildHimiPreviewUrl({ app, releaseId: release, screenId, previewToken, source: "cli" });
 }
+function releaseHint(error) {
+  if (error === "app_published_cannot_release") {
+    return { hint: "a name that has been published keeps its owner, because devices may still resolve it \u2014 ask an operator if it really must be freed" };
+  }
+  if (error === "release_unavailable") {
+    return { hint: "this plane cannot release safely right now (it cannot prove the app was never published, or cannot revoke your token) \u2014 nothing changed, so retrying later is safe" };
+  }
+  if (error === "release_unsupported") return { hint: "this plane's store has no atomic swap, so it will not release a name \u2014 nothing changed" };
+  if (error === "conflict") return { hint: "the app changed while releasing it \u2014 nothing was released, so re-run to pick up the new state" };
+  if (error === "forbidden_requires_owner") return { hint: "only the app's OWNER may give its name away \u2014 an editor cannot" };
+  return {};
+}
 function claimHint(status, error) {
   if (error === "slug_published") return { hint: "that app already exists on the serve plane and is not yours \u2014 pick another slug" };
   if (error === "slug_taken") return { hint: "someone else already claimed that slug \u2014 pick another" };
@@ -67740,8 +67751,41 @@ ${label2}`);
             print({ ok: true, ...j2 });
             return 0;
           }
+          if (sub === "release") {
+            const slug = pos[2];
+            if (!slug) {
+              io.error(JSON.stringify({ error: "usage: himi apps release <slug> --yes" }));
+              return 2;
+            }
+            if (flags.yes !== true) {
+              io.error(JSON.stringify({
+                error: "confirmation_required",
+                hint: `releasing "${slug}" frees the name for anyone to claim and signs you out everywhere \u2014 re-run with --yes`
+              }));
+              return 2;
+            }
+            const r2 = await fetch(`${base}/v1/owner/apps/release`, {
+              method: "POST",
+              headers: { ...headers2, "content-type": "application/json" },
+              body: JSON.stringify({ slug })
+            });
+            const j2 = await r2.json().catch(() => ({}));
+            if (!r2.ok) {
+              const err = j2.error;
+              io.error(JSON.stringify({
+                ok: false,
+                status: r2.status,
+                ...j2,
+                ...ownerPlaneHint(r2.status, err, target),
+                ...releaseHint(err)
+              }));
+              return 1;
+            }
+            print({ ok: true, ...j2 });
+            return 0;
+          }
           if (sub && sub !== "list") {
-            io.error(JSON.stringify({ error: `unknown subcommand "${sub}" \u2014 usage: himi apps [list] | himi apps claim <slug>` }));
+            io.error(JSON.stringify({ error: `unknown subcommand "${sub}" \u2014 usage: himi apps [list] | himi apps claim <slug> | himi apps release <slug> --yes` }));
             return 2;
           }
           const r = await fetch(`${base}/v1/owner/apps`, { headers: headers2 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.866.0",
+  "version": "0.868.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -63,5 +63,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "98ba041ef766b8e46a4e19ae0189d8f4e8efcd98f374de34bd5c4504"
+  "falconPackageHash": "8fbad929c25341a6f5c5c7eea5279a98f7729861f603b37bff5b9465"
 }