@wix/himalaya-cli 0.891.0 → 0.893.0

package/dist/cli.mjs

@@ -5241,7 +5241,6 @@ function resolveTranslation(value, catalog, sourceCatalog) {
 var BINDING_SIGILS, BINDING_SIGIL_RE, TRANSLATION_PREFIX, TRANSLATION_KEY_RE;
 var init_bindings = __esm({
   "../../core/ts/src/bindings.ts"() {
-    "use strict";
     BINDING_SIGILS = ["service", "flag", "item", "t"];
     BINDING_SIGIL_RE = new RegExp(
       `^\\$(?:${BINDING_SIGILS.filter((s) => s !== "t").join("|")})\\b|^\\$t:`
@@ -28784,6 +28783,7 @@ __export(widgets_exports, {
   MAX_PRODUCE_CACHE_ENTRIES: () => MAX_PRODUCE_CACHE_ENTRIES,
   PRODUCE_CACHE_TTL_MS: () => PRODUCE_CACHE_TTL_MS,
   WIDGET_BUDGET_MS: () => WIDGET_BUDGET_MS,
+  WidgetRealmUnavailableError: () => WidgetRealmUnavailableError,
   buildViewSnapshot: () => buildViewSnapshot,
   buildWidgetSnapshot: () => buildWidgetSnapshot,
   describeThrown: () => describeThrown,
@@ -28811,9 +28811,7 @@ async function widgetRealm() {
   try {
     return await realmPromise;
   } catch (err) {
-    throw new Error(
-      "the widget producer's isolated realm (QuickJS-in-WASM) could not be loaded, so widget bundles would have been evaluated in node:vm (which is not a security boundary): " + (err instanceof Error ? err.message : String(err))
-    );
+    throw new WidgetRealmUnavailableError(err);
   }
 }
 function resetWidgetRealm() {
@@ -29433,7 +29431,7 @@ function freezeOverrideSnapshot(input, opts = {}) {
   }
   return snapshot2;
 }
-var MAX_TIMELINE_FRAMES, WIDGET_BUDGET_MS, realmPromise, PRODUCE_CACHE_TTL_MS, MAX_PRODUCE_CACHE_ENTRIES, MAX_PRODUCE_ENTRY_BYTES, MAX_PRODUCE_CACHE_BYTES, produceCache, produceCacheGeneration, CAPTURE_SLOT, READBACK_SERVICE;
+var MAX_TIMELINE_FRAMES, WIDGET_BUDGET_MS, realmPromise, WidgetRealmUnavailableError, PRODUCE_CACHE_TTL_MS, MAX_PRODUCE_CACHE_ENTRIES, MAX_PRODUCE_ENTRY_BYTES, MAX_PRODUCE_CACHE_BYTES, produceCache, produceCacheGeneration, CAPTURE_SLOT, READBACK_SERVICE;
 var init_widgets = __esm({
   "../../core/dev-server/src/widgets.ts"() {
     init_validator();
@@ -29441,6 +29439,15 @@ var init_widgets = __esm({
     MAX_TIMELINE_FRAMES = 48;
     WIDGET_BUDGET_MS = 5e3;
     realmPromise = null;
+    WidgetRealmUnavailableError = class extends Error {
+      constructor(cause) {
+        super(
+          "the widget producer's isolated realm (QuickJS-in-WASM) could not be loaded, so widget bundles would have been evaluated in node:vm (which is not a security boundary): " + describeThrown(cause)
+        );
+        this.cause = cause;
+        this.name = "WidgetRealmUnavailableError";
+      }
+    };
     PRODUCE_CACHE_TTL_MS = 6e4;
     MAX_PRODUCE_CACHE_ENTRIES = 2048;
     MAX_PRODUCE_ENTRY_BYTES = 4 * 1024 * 1024;
@@ -31871,18 +31878,32 @@ async function scanWidgets(dir) {
         out.push({ ...e, bundle: name });
       }
     } catch (err) {
+      if (err instanceof WidgetRealmUnavailableError) throw err;
       console.warn(`[widgets] skipped bundle "${name}": ${describeThrown(err)}`);
     }
   }
   return out;
 }
 async function handleWidgetList(res, dir) {
-  sendJson(res, 200, { widgets: await scanWidgets(dir) });
+  try {
+    sendJson(res, 200, { widgets: await scanWidgets(dir) });
+  } catch (err) {
+    if (!(err instanceof WidgetRealmUnavailableError)) throw err;
+    console.error(`[widgets] ${err.message}`);
+    sendJson(res, 503, { error: "widget_realm_unavailable", message: err.message });
+  }
 }
 async function buildSnapshotForId(widgetId, dir) {
   const override = widgetOverrides.get(widgetId);
   if (override) return { ok: true, snapshot: override };
-  const entry = (await scanWidgets(dir)).find((w) => w.widgetId === widgetId);
+  let entry;
+  try {
+    entry = (await scanWidgets(dir)).find((w) => w.widgetId === widgetId);
+  } catch (err) {
+    if (!(err instanceof WidgetRealmUnavailableError)) throw err;
+    console.error(`[widgets] ${err.message}`);
+    return { ok: false, status: 503, error: "widget_realm_unavailable", message: err.message };
+  }
   if (!entry) return { ok: false, status: 404, error: "widget_not_found" };
   const loaded = await readBundleFile(entry.bundle, dir);
   if (!loaded) return { ok: false, status: 404, error: "widget_not_found" };
@@ -54301,7 +54322,7 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
   himi deeplinks --app <app> --release <id>
                                            nav map + web/player deeplinks for a release
   himi logs --app <app> [--release <id>] [--screen <id>] [--level <l>] [--follow]   worker console read-back
-  himi promote --app <app> --release <id> [--force]  flip a draft LIVE (then ring-promote via himi-serve)
+  himi promote --app <app> --release <id> [--ring <r>] [--percent 0-100] [--force]  flip a draft LIVE; --ring also points a rollout ring at it
   himi patch screen <id> --app <a> --file <descriptor.json> [--bundle <sha256|none>]
   himi patch bundle --app <a> --file <bundle.js> (--for-screen <id>[,<id>] | --no-rebind)
   himi patch tokens --app <a> --file <tokens.json>
@@ -54601,7 +54622,7 @@ var COMMANDS = [
   { name: "diagnose", summary: "remote screen triage against a pushed release (GET /v1/preview/\u2026/diagnose) \u2014 bindings/schema/boot; exit 1 if ok:false", required: "<screenId> --app --release" },
   { name: "deeplinks", summary: "nav map + web/player deeplinks for a release (GET /v1/preview/\u2026/deeplinks)", required: "--app --release" },
   { name: "logs", summary: "worker console read-back (GET /v1/telemetry/logs); --follow tails via the seq cursor", required: "--app [--release] [--screen] [--level] [--follow]" },
-  { name: "promote", summary: "flip a stored draft LIVE (POST /v1/admin/release/activate); a release pushed past errors needs an explicit --force override", required: "--app --release [--force] (--control-token)" },
+  { name: "promote", summary: "flip a stored draft LIVE (POST /v1/admin/release/activate); --ring also points a rollout ring at it in the same command (POST /v1/admin/promote), which ring-based clients need in order to resolve at all \u2014 without it they stay unresolved and the warning goes to stderr; --percent sets that ring's rollout share; a release pushed past errors needs an explicit --force override", required: "--app --release [--ring <ring>] [--percent 0-100] [--force] (--control-token)" },
   { name: "patch", summary: 'change ONE item of a published app \u2014 a screen descriptor, a Tier-5 bundle, tokens, or the app-config baseline \u2014 from a RAW FILE, with no content package and no build. The low-level door: it does not lint your package, because there is no package here; `himi push --only <selector>` is the same edit with the full build + lint gate and is what to reach for when the package is in hand. Derives a new release from the app\'s current LIVE release, or from `--from-release <id>`. An explicit `--draft` or `--live` is REQUIRED \u2014 a patch has no default blast radius \u2014 and `--notes` is required with `--live` on a screen or app-config patch, because off-repo `gitSha` is "dev" and the ledger notes are then the only durable record of bytes that correspond to no commit. A branch does not merge: activating one derived from an older release reverts every item the patch does not move, so that case is refused until `--accept-regressions`. A bundle patch must repoint a screen (`--for-screen`) or the bytes land under a manifest key nothing reads. It cannot ADD a screen (screens are git-only, RFC 0012), never claims a slug \u2014 the app must already be published \u2014 and carries no attestation, source archive, assets, icon or minBinaryVersion, each named in the output.', required: "screen <id> --file <descriptor.json> [--bundle <sha256|none>] | bundle --file <bundle.js> (--for-screen <id>[,<id>] | --no-rebind) | tokens --file <tokens.json> | app-config --file <app-config.json> ; (--draft|--live) --app <a> [--from-release <id>] [--accept-regressions] [--label <n>] [--notes <t>] [--force] [--target <t>] (--control-token)" },
   { name: "visibility", summary: "read (no value) or set whether the public registry (/v1/apps + the Himi Player picker) LISTS the app. `public` lists it for everyone; `unlisted` hides it from listings while direct reads by app id \u2014 deep links, previews \u2014 keep working. App from --app or the content dir. Setting it needs no republish.", required: "[public|unlisted] [--app <a>] [--content <dir>] (--control-token)" },
   { name: "dist", summary: "build an INSTALLABLE QA binary (signed IPA / APK) on the Wix Job Service Mac pool and return an install link \u2014 the serve plane brokers the job, the pool builds it. WAITS for the build by default (~4 min) and prints the install link; `--no-wait` returns a jobId immediately instead. Omitting `--release` builds whatever is LIVE for the app. A named draft is refused unless `--allow-draft` makes that exceptional build explicit. `status <jobId>` / `watch <jobId>` / `list --app <a>` / `cancel <jobId>` inspect and stop builds (`watch` reports up front whether the job mints its own signing identity or borrows one, so a doomed iOS build is cancellable in seconds rather than after the archive). Off-repo, name a target \u2014 `--target wix` for a self-serve Wix login or `--target bo` for the internal employee path (the in-repo default is a local dev plane that isn't reachable off-repo); self-serve callers may build their OWN apps under a tighter budget (2 in flight / 5 per 24h), while a manage-only owner-role credential is refused. `--shell` picks the native host to sign into (branded-lite | owner-lite | player | demo-app). `--signing` defaults to `wix-managed` \u2014 the Wix Apple account mints a per-app signing identity for the build, so the caller provisions no Apple credentials of their own; `--signing byo` (sign with your own Apple account) is reserved and 501s. `--android-signing` is the Android counterpart and a SEPARATE axis (a keystore, not an Apple account): `qa-keystore` (default \u2014 the repo's committed QA key, identical on every pool machine, so a build installs over the previous one), `wix-keystore` (the Wix key the pool machine carries; the build FAILS naming the paths searched if it carries none, rather than quietly signing with something else), or `debug` (the old per-machine key \u2014 QA must uninstall any previous build first). NOT the normal way to ship: screens, Tier-5 bundles, tokens and app-config all go over the air with `himi push` in seconds \u2014 a binary trip is only needed for a NATIVE delta (a new SDUI component, a new declared capability/entitlement, a new bundle id, or a minBinaryVersion floor bump). Refuses to build an app whose launcher icon is missing, a placeholder, or one a store would reject \u2014 the one thing a binary carries that no later OTA push can fix; `--force` builds anyway", required: "[--app <a>] [--platform ios,android] [--release <id>] [--allow-draft] [--target <t>] [--shell branded-lite|owner-lite|player|demo-app] [--signing wix-managed|byo] [--android-signing qa-keystore|wix-keystore|debug] [--borrow-ios-id <bundleId>] [--no-wait] [--force] | status <jobId> [--target <t>] | watch <jobId> [--target <t>] [--interval <ms>] | list --app <a> [--target <t>] | cancel <jobId> [--target <t>]" },
@@ -55581,7 +55602,10 @@ async function producedWidgetFamilies(dir) {
     let extracted;
     try {
       extracted = await widgetsModule.extractWidgets(js);
-    } catch {
+    } catch (err) {
+      if (err instanceof widgetsModule.WidgetRealmUnavailableError) {
+        return { families: void 0, source: "producer-unavailable" };
+      }
       continue;
     }
     for (const [widgetId, def] of Object.entries(extracted.widgets)) {
@@ -58539,18 +58563,86 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           return 2;
         }
         const target = targetName();
-        const r = await client2().activateRelease(app, release, flags.force === true);
+        const force = flags.force === true;
+        const ringGiven = flags.ring !== void 0;
+        const ring = str5(flags.ring);
+        if (ringGiven && !ring) {
+          io.error(JSON.stringify({ error: "--ring needs a ring name, e.g. --ring ga" }));
+          return 2;
+        }
+        const percentGiven = flags.percent !== void 0;
+        const percent = num(flags.percent);
+        if (percentGiven && (percent === void 0 || percent < 0 || percent > 100)) {
+          io.error(JSON.stringify({ error: `--percent must be 0..100, got ${String(flags.percent)}` }));
+          return 2;
+        }
+        if (percentGiven && !ring) {
+          io.error(JSON.stringify({ error: "--percent sets a ring's rollout share, so it needs --ring" }));
+          return 2;
+        }
+        const r = await client2().activateRelease(app, release, force);
+        if (!r.ok || !ring) {
+          if (r.ok) {
+            io.error(JSON.stringify({
+              warning: "no rollout ring was promoted \u2014 ring-based clients stay unresolved",
+              next: `himi promote --app ${app} --release ${release} --ring <ring>${force ? " --force" : ""} --target ${target}`
+            }));
+          }
+          print({
+            status: r.status,
+            ...r.json ?? {},
+            ...r.ok ? {
+              ringPromoted: false,
+              note: "activation updates the live release but does not select a rollout ring; ring-based clients remain unresolved until a ring is promoted",
+              // No `nextAuth` here: this `next` is a plain `himi promote`, which resolves its own
+              // credential. It used to name `$TOK` because the hint was a `himi-serve` command.
+              next: `himi promote --app ${app} --release ${release} --ring <ring>${force ? " --force" : ""} --target ${target}`
+            } : {}
+          });
+          return r.ok ? 0 : 1;
+        }
+        const flagsFor = (o = {}) => `${o.percent !== void 0 ? ` --percent ${o.percent}` : ""}${force ? " --force" : ""} --target ${target}`;
+        if (!percentGiven) {
+          io.error(JSON.stringify({
+            warning: `no --percent given: an existing ring "${ring}" keeps its current share, and a NEW one is created at the plane's default (100% on the hosted plane)`,
+            next: `himi promote --app ${app} --release ${release} --ring ${ring}${flagsFor({ percent: "<0-100>" })}`
+          }));
+        }
+        let p;
+        const ringOnlyRetry = `himi-serve release promote --app ${app} --ring ${ring} --release ${release}${percent !== void 0 ? ` --percent ${percent}` : ""}${force ? " --force" : ""} --target ${target} --control-token "$TOK"`;
+        try {
+          p = await client2().promote(app, ring, release, percent, force);
+        } catch (e) {
+          io.error(JSON.stringify({
+            error: `the release was ACTIVATED, but the ring request did not complete: ${e.message}`,
+            activated: true,
+            ringPromoted: false,
+            ring,
+            next: ringOnlyRetry,
+            nextAuth: `set TOK to a serve-control token for target ${target}`
+          }));
+          return 1;
+        }
         print({
-          status: r.status,
+          status: p.status,
+          // BOTH responses: the activation's own fields (`visibility`, any warning it carries)
+          // are part of what happened and were being dropped on this path.
           ...r.json ?? {},
-          ...r.ok ? {
-            ringPromoted: false,
-            note: "activation updates the live release but does not select a rollout ring; ring-based clients remain unresolved until a ring is promoted",
-            next: `himi-serve release promote --app ${app} --ring <ring> --release ${release}${flags.force === true ? " --force" : ""} --target ${target} --control-token "$TOK"`,
+          ...p.json ?? {},
+          activated: true,
+          ringPromoted: p.ok,
+          ring,
+          // REQUESTED, not applied. The git-backed `applyPromote` takes no percent at all
+          // (promote.ts), so echoing `percent` as fact would report a share that plane never
+          // set. Only the hosted CloudStore path honours it.
+          ...percent !== void 0 ? { percentRequested: percent } : {},
+          ...p.ok ? {} : {
+            note: `the release was ACTIVATED, but promoting ring "${ring}" failed \u2014 retry the RING half alone with \`himi-serve release promote\`, which does not re-activate`,
+            next: ringOnlyRetry,
             nextAuth: `set TOK to a serve-control token for target ${target}`
-          } : {}
+          }
         });
-        return r.ok ? 0 : 1;
+        return p.ok ? 0 : 1;
       }
       // The RAW-FILE patch door. No content package, no build, no package lint — that is the whole
       // reason it exists, and the reason `himi push --only` is the one to reach for when a package

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.891.0",
+  "version": "0.893.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -64,5 +64,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "1043e5fb989a028cf5dffffc6f8a9aef5487b1e6464b630da5270431"
+  "falconPackageHash": "f38e92c2fdf1c758a5d00cb4fa45c3ff0f9945647a1ef9932642c7f0"
 }