@wix/himalaya-cli 0.916.0 → 0.918.0

package/guides/releasing-with-himi-serve.md

@@ -106,6 +106,39 @@ template with no current release, or a release with no bundles, is **refused** r
 reported as a successful revocation — a kill-switch that silently switched nothing off is the
 one failure mode worth being loud about.
 
+### Attributing already-published apps (operator only)
+
+Publishing a release and owning the slug are two different writes, and they have not always
+coincided. A self-serve `himi push` claims the slug for you today, but an app published before
+auto-claiming existed — or published by an operator or CI credential, whose scope already covers
+the slug so it claims nothing on anyone's behalf — has a live release and **no owner**. That owner cannot
+fix it themselves either: `claim` refuses a slug that is already published. `apps backfill` is
+the operator door that binds those slugs to the account that should have them:
+
+```
+himi-serve apps backfill --subject <accountGuid> --target bo --control-token "$TOK"
+himi-serve apps backfill --subject <accountGuid> --slugs todo,notes --apply --target bo --control-token "$TOK"
+```
+
+**It rehearses unless you pass `--apply`, and there is no undo.** The ownership store has no
+delete and no transfer, and `claim` never reassigns — so a slug bound to the wrong subject stays
+bound, and its real owner gets `slug_taken` from then on. The safe outcome is therefore the one
+you get by forgetting a flag: without `--apply` the route reports exactly what it *would* claim
+and writes nothing. Omitting `--slugs` means every app the release store lists (bounded
+server-side); an empty or valueless `--slugs` is refused rather than read as "everything", and so
+is any argument the command does not recognise — a stray word or a mistyped flag is usually a
+`--slugs` that went missing, and missing is the spelling that means every app.
+
+It bypasses exactly one refusal — `slug_published` — and keeps every other: reserved names
+(`wix-*`, `himi-template-*`, the platform names) stay unclaimable, an app someone else already
+owns is reported `slug_taken` rather than moved, and a slug nothing has published is reported
+`not_published` rather than reserved. The backfilled claims do not spend the owner's own
+self-serve quota.
+
+The route (`POST /v1/admin/registry/backfill`) is gated on **scope, not role**: a self-serve or
+narrower-than-`*` credential is refused `operator_only_backfill`, which means no cookie caller
+can reach it. That is the difference between a backfill and a land-grab.
+
 ### Registry visibility (public | unlisted)
 
 Whether `GET /v1/apps` (and so the **Himi Player picker**) lists the app is a per-app,

package/guides/sdk-reference.json

@@ -12881,7 +12881,7 @@
       {
         "name": "isEmptyCurrentCartError",
         "kind": "function",
-        "jsdoc": "/** True when a thrown bridge/HTTP error means \"no current cart yet\" — Wix's\n *  empty-cart signal. `GET /ecom/v1/carts/current` returns 404 with\n *  `OWNED_CART_NOT_FOUND` until the visitor/member adds an item (a current cart\n *  is created on first add-to-cart). Native surfaces `HTTP 404 [OWNED_CART_NOT_FOUND]: …`;\n *  the web `__webwix` bridge surfaces `HTTP 404: {\"message\":\"Cart not found\",…}`. */",
+        "jsdoc": "/** True when a thrown bridge/HTTP error means \"no current cart yet\" — Wix's\n *  empty-cart signal. `GET /ecom/v1/carts/current` answers 404\n *  `OWNED_CART_NOT_FOUND` until the visitor/member adds an item (a current cart\n *  is created on first add-to-cart), and Wix's own description calls that the\n *  expected pre-first-add state.\n *\n *  DELIBERATELY NARROW — it keys on the typed application error code, never on the\n *  404 status and no longer on the human message \"Cart not found\". A bare\n *  404 with no code, a 403, a 500, a transport failure and every other cart error\n *  code stay real failures and still throw. */",
         "decl": "export function isEmptyCurrentCartError(error: unknown): boolean;"
       },
       {
@@ -12893,7 +12893,7 @@
       {
         "name": "getCurrentCart",
         "kind": "function",
-        "jsdoc": "/** Read the current cart — GET /ecom/v1/carts/current. The API wraps the cart in\n *  `{ cart: {...} }`; this unwraps it so callers get the cart (line items +\n *  subtotal) directly. Verified live. An `OWNED_CART_NOT_FOUND` 404 is the empty\n *  cart (never added an item) — returned as `{ lineItems: [] }`, not thrown. */",
+        "jsdoc": "/** Read the current cart — GET /ecom/v1/carts/current. The API wraps the cart in\n *  `{ cart: {...} }`; this unwraps it so callers get the cart (line items +\n *  subtotal) directly. Verified live. An `OWNED_CART_NOT_FOUND` 404 is the empty\n *  cart (never added an item) — resolved as `{ lineItems: [] }`, not thrown, so a\n *  signed-out visitor's first mount is a successful read of an empty cart.\n *  `{ lineItems: [] }` is the shape every caller already handles: the badge readers\n *  sum `(cart.lineItems ?? [])` and the cart screen additionally takes\n *  `cart.subtotal?.formattedAmount ?? \"\"` and `(await getCurrentCart()).id || \"\"` —\n *  all three degrade to empty/0 on an absent field, so no caller special-cases it. */",
         "decl": "export async function getCurrentCart(): Promise<WixCartDetail>;",
         "http": "GET /ecom/v1/carts/current"
       },
@@ -18923,10 +18923,16 @@
         "jsdoc": "",
         "decl": "export interface MfvNotification {\n  id?: string;\n  type?: string;\n  title?: string;\n  message?: string;\n  action?: string;\n  sentDate?: string;\n  /** UNSEEN | SEEN_BUT_UNREAD | READ | … */\n  status?: string;\n  deeplink?: MfvLink;\n  icon?: MfvIcon;\n  memberId?: string;\n}"
       },
+      {
+        "name": "__resetMfvRouteForTests",
+        "kind": "function",
+        "jsdoc": "/** Reset the learned route. Tests only — there is no runtime caller. */",
+        "decl": "export function __resetMfvRouteForTests(): void;"
+      },
       {
         "name": "queryNotifications",
         "kind": "function",
-        "jsdoc": "/** List the signed-in member's notifications, newest first. MOBILE channel.\n *  verify-live: bare gateway path; _api proxy is the documented fallback. */",
+        "jsdoc": "/** List the signed-in member's notifications, newest first. MOBILE channel. */",
         "decl": "export async function queryNotifications(limit = 25): Promise<MfvNotification[]>;"
       },
       {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.916.0",
+  "version": "0.918.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -64,5 +64,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "06722d722ae5e9aac6226d4368df1778666b7b83737f0c449a0af142"
+  "falconPackageHash": "c1b47ea3d5bf730113aa0b5871851e82b129947c5c28bdd9911344a1"
 }

package/templates/branded-lite/tier5-src/himi-branded-lite-forms/index.ts

@@ -1,21 +1,29 @@
 // himi-branded-lite-forms — branded-lite "Forms" worker with a SAMPLE-DATA fallback
 // (same pattern as the other branded-lite verticals). Reads the site's real Wix Forms
-// (queryForms); when the site has no Forms app / no forms (the query errors — e.g.
-// 403/404/428 — or returns empty), it substitutes representative SAMPLE forms and flags
-// `isMock`, so the screen shows a clearly-labelled "Sample content" banner. Real forms
-// always win the moment any exist.
+// (queryForms, which REQUIRES a namespace filter — a bare query is answered
+// `400 MISSING_NAMESPACE_FILTER` for every site, #2769); when the site has no Forms
+// app (403/404/428) or has no forms, it substitutes representative SAMPLE forms and
+// flags `isMock`, so the screen shows a clearly-labelled "Sample content" banner.
+// A query that FAILS for any other reason is reported as a failure — sample content
+// there would state "this site has none yet", which the app never established.
+// Real forms always win the moment any exist.
 import { defineService } from "../_shared/collection-service.js";
+import { copyParam } from "../_shared/himi-copy.js";
 import { queryForms, type WixForm } from "@himalaya/wix-forms";
 
 interface Row { id: string; title: string; subtitle: string }
 interface S {
-  status: "loading" | "ready";
+  status: "loading" | "ready" | "error";
   forms: Row[]; emptyText: string;
   isMock: boolean; notMock: boolean; mockBanner: string;
 }
 
 const STATUS_LABEL: Record<string, string> = { PUBLISHED: "Published", DRAFT: "Draft" };
 
+/** The Wix Forms namespace the Forms app owns. Booking/event registration forms live
+ *  in their own namespaces and are not this screen's subject. */
+const FORMS_NAMESPACE = "wix.form_app.form";
+
 function norm(f: WixForm): Row {
   const title = (f.name || "Form").trim() || "Form";
   const fieldCount = Array.isArray(f.formFields) ? f.formFields.length : 0;
@@ -24,15 +32,25 @@ function norm(f: WixForm): Row {
   return { id: f.id || "form", title, subtitle: parts.join(" · ") };
 }
 
-const MOCK_BANNER = "Sample content — this site has no forms yet.";
+/** Two banners, because the sample rows answer two different questions and only one of
+ *  them is a statement about the customer's site.
+ *
+ *  There used to be one banner, "this site has no forms yet", shown whenever the rows were
+ *  samples — including when the query had FAILED. A site WITH forms got told it had none.
+ *  The sample fallback itself is deliberate and covered by the renderer's offline test,
+ *  which keeps these verticals showing labelled sample content rather than a blank screen.
+ *  So what was wrong was never the samples — it was claiming to know something the app had
+ *  not established. */
+const MOCK_BANNER_EMPTY = "Sample content — this site has no forms yet.";
+const MOCK_BANNER_UNAVAILABLE = "Sample content — this site's forms couldn't be loaded.";
 const MOCK: Row[] = [
   { id: "sample-contact",   title: "Contact Us",       subtitle: "4 fields · Published" },
   { id: "sample-subscribe", title: "Newsletter Signup", subtitle: "2 fields · Published" },
   { id: "sample-feedback",  title: "Feedback",          subtitle: "5 fields · Published" },
 ];
 
-function mockState(s: S): S {
-  return { ...s, status: "ready", forms: MOCK.map((r) => ({ ...r })), emptyText: "", isMock: true, notMock: false, mockBanner: MOCK_BANNER };
+function mockState(s: S, banner: string): S {
+  return { ...s, status: "ready", forms: MOCK.map((r) => ({ ...r })), emptyText: "", isMock: true, notMock: false, mockBanner: banner };
 }
 
 const svc = defineService<S, { load: (s: S) => Promise<S> }>("himiBrandedForms", {
@@ -40,12 +58,15 @@ const svc = defineService<S, { load: (s: S) => Promise<S> }>("himiBrandedForms",
   actions: {
     load: async (s) => {
       try {
-        const r = await queryForms({ paging: { limit: 50 } });
+        const r = await queryForms({ filter: { namespace: FORMS_NAMESPACE }, paging: { limit: 50 } });
         const forms = (r.forms ?? []).map(norm);
         if (forms.length) return { ...s, status: "ready", forms, emptyText: "", isMock: false, notMock: true, mockBanner: "" };
-        return mockState(s);
+        return mockState(s, copyParam("forms.emptyBanner", MOCK_BANNER_EMPTY));
       } catch {
-        return mockState(s);
+        // The samples still render — a blank screen helps nobody and this vertical
+        // deliberately ships a fallback — but the banner no longer asserts the site is
+        // empty, because a failed query established no such thing.
+        return mockState(s, copyParam("forms.unavailableBanner", MOCK_BANNER_UNAVAILABLE));
       }
     },
   },