@wix/himalaya-cli 0.947.0 → 0.949.0

package/dist/cli.mjs

@@ -21494,12 +21494,13 @@ var init_listGestures = __esm({
         } else setOffset(Math.abs(offset) >= SWIPE_OPEN * 0.5 ? Math.sign(offset) * SWIPE_OPEN : 0);
         startX.current = null;
       };
-      const actionBtn = (a, i, edge) => /* @__PURE__ */ jsx5(
+      const actionBtn = (a, i, edge, hidden) => /* @__PURE__ */ jsx5(
         "button",
         {
           type: "button",
           "data-himalaya-swipe-action": true,
           "data-himalaya-swipe-edge": edge,
+          tabIndex: hidden ? -1 : void 0,
           onClick: () => fireAndClose(a.action),
           style: {
             border: "none",
@@ -21517,8 +21518,8 @@ var init_listGestures = __esm({
         `${edge}-${i}`
       );
       return /* @__PURE__ */ jsxs2("div", { style: { position: "relative", overflow: "hidden" }, children: [
-        leading.length > 0 && /* @__PURE__ */ jsx5("div", { "aria-hidden": offset <= 0, style: { position: "absolute", inset: 0, display: "flex", justifyContent: "flex-start" }, children: leading.map((a, i) => actionBtn(a, i, "leading")) }),
-        trailing.length > 0 && /* @__PURE__ */ jsx5("div", { "aria-hidden": offset >= 0, style: { position: "absolute", inset: 0, display: "flex", justifyContent: "flex-end" }, children: trailing.map((a, i) => actionBtn(a, i, "trailing")) }),
+        leading.length > 0 && /* @__PURE__ */ jsx5("div", { "aria-hidden": offset <= 0, style: { position: "absolute", inset: 0, display: "flex", justifyContent: "flex-start" }, children: leading.map((a, i) => actionBtn(a, i, "leading", offset <= 0)) }),
+        trailing.length > 0 && /* @__PURE__ */ jsx5("div", { "aria-hidden": offset >= 0, style: { position: "absolute", inset: 0, display: "flex", justifyContent: "flex-end" }, children: trailing.map((a, i) => actionBtn(a, i, "trailing", offset >= 0)) }),
         /* @__PURE__ */ jsx5(
           "div",
           {
@@ -22076,6 +22077,14 @@ function ensurePressStyles() {
   '[data-himalaya-press]{transition:transform var(--hm-press-dur,160ms) var(--hm-press-ease,cubic-bezier(0.2,0,0,1)),filter var(--hm-press-dur,160ms) var(--hm-press-ease,cubic-bezier(0.2,0,0,1))}[data-himalaya-press="scale"]:active,[data-himalaya-press="auto"]:active,[data-himalaya-press="scaleHighlight"]:active{transform:scale(0.96)}[data-himalaya-press="scaleHighlight"]:active,[data-himalaya-press="highlight"]:active{filter:brightness(1.08)}[data-himalaya-press="lift"]:active{transform:translateY(-4px) scale(1.02)}@media (hover:hover){[data-himalaya-tap]{transition:filter 120ms ease}[data-himalaya-tap]:hover{filter:brightness(0.97)}[data-himalaya-press="scale"]:hover,[data-himalaya-press="auto"]:hover,[data-himalaya-press="scaleHighlight"]:hover{transform:scale(0.985)}[data-himalaya-press="lift"]:hover{transform:translateY(-2px) scale(1.01)}}';
   document.head.appendChild(el);
 }
+function ensureFocusStyles() {
+  if (focusStylesInjected || typeof document === "undefined") return;
+  focusStylesInjected = true;
+  const el = document.createElement("style");
+  el.setAttribute("data-himalaya-focus-ring", "");
+  el.textContent = FOCUS_RING_CSS;
+  document.head.appendChild(el);
+}
 function ensureHListStyles() {
   if (hListStylesInjected || typeof document === "undefined") return;
   hListStylesInjected = true;
@@ -23219,6 +23228,13 @@ function renderNodeInner(node, ctx) {
       extra["data-hm-measure-bind"] = JSON.stringify(bind);
     }
   }
+  {
+    const accessibilityLabel = node?.modifiers?.accessibilityLabel ?? node?.modifiers?.accessibility_label;
+    if (accessibilityLabel != null) {
+      const resolved2 = resolveScalarStatic(accessibilityLabel, ctx);
+      if (resolved2 != null && String(resolved2).trim()) extra["aria-label"] = String(resolved2);
+    }
+  }
   const tap = node?.modifiers?.onTap ?? node?.modifiers?.on_tap;
   const tapDisabled = normalize(node).props?.disabled === true || normalize(node).props?.loading === true || node?.modifiers?.disabled === true || node?.modifiers?.hitTestable === false || node?.modifiers?.hit_testable === false;
   if (tap && ctx.onAction && !tapDisabled) {
@@ -23242,11 +23258,6 @@ function renderNodeInner(node, ctx) {
         ctx.onAction(resolveItemDeep2(tap, ctx));
       };
     }
-    const accessibilityLabel = node?.modifiers?.accessibilityLabel ?? node?.modifiers?.accessibility_label;
-    if (accessibilityLabel != null) {
-      const resolved2 = resolveScalarStatic(accessibilityLabel, ctx);
-      if (resolved2 != null && String(resolved2).trim()) extra["aria-label"] = String(resolved2);
-    }
     ensurePressStyles();
     extra["data-himalaya-tap"] = "1";
   }
@@ -23304,6 +23315,7 @@ function boundPaddingInsets(modifiers, ctx) {
   return out;
 }
 function renderNode(node, ctx) {
+  ensureFocusStyles();
   const bindings = directServiceBindings(node);
   return bindings.length > 0 && ctx.provider ? /* @__PURE__ */ jsx6(ReactiveDirectScalars, { node, ctx, bindings }) : renderNodeInner(node, ctx);
 }
@@ -23979,7 +23991,7 @@ function renderInner(node, ctx) {
     }
   }
 }
-var useIsomorphicLayoutEffect, ResponsiveGrid, SPLIT_EXPANDED_MIN_WIDTH, SPLIT_COLUMN_GAP, ResponsiveSplitView, ABSOLUTE_URL_RE, appearKeyframesInjected, pressStylesInjected, hListStylesInjected, listAnimateRuntimeInstalled, transitionKeyframesInjected, countUpRuntimeInjected, MEASURE_PREFIX, measureRuntimeInjected, revealRuntimeInjected, vectorAnimStylesInjected, scrollProgressRuntimeInjected, confettiRuntimeInjected, lottieRuntimeInjected, riveRuntimeInjected, gradientKeyframesInjected, parallaxRuntimeInjected, spinKeyframesInjected, marqueeKeyframesInjected, alignItems, zJustifyItems, hAlignItems, bodyFont, kids, rowKids, staggeredKids, asTextL10n, asBoundText, useBoundString, InterpolatedTextView, txt, selectFragmentCase, fragmentValueHash, fragmentSlotContent, FragmentSlotNode, WorkerSubtreeNode, resolveItemDeep2, resolveSwipeActions, resolveModBindings, resolvedComponentId, directServiceBindings, ReactiveDirectScalars, HiddenGate, KEYBOARD_INPUT_MODES, AUTOCAPITALIZE_VALUES, ENTER_KEY_HINTS, AUTOGROW_CEILING, EditableField, MenuNode, LoadMoreSentinel, FieldErrorNode, FormView, MediaSlotProvider, MEDIA_ITEM_BINDABLE, MediaPlayerView, VideoNode, PdfViewNode, WebViewNode, InteractivePicker, InteractiveDatePicker, InteractiveSearchField, InteractiveStepper, INTERACTIVE_ROLES, ALWAYS_INTERACTIVE_COMPONENT_TYPES, controlNode, ToggleNode, SliderNode, SelectionControlNode, TabsNode, SegmentedControlNode, DisclosureGroupNode, GridNode, SplitViewNode, TextNode, ImageNode, AvatarNode, IconNode, ButtonNode, OtpInputNode, ProgressBarNode, ActivityIndicatorNode, BottomSheetNode, ChipsInputNode, ChipNode, TableNode, GaugeRing, GaugeNode, RatingNode, AvatarStripNode, CHART_STROKE_CYCLE, chartStrokeAt, chartBarCenter, ChartNode, donutSliceOpacity, DonutChartNode, LegendMarker, LegendNode, cellAlign, DataTableNode, voiceNoteState, voiceNoteDelivery, VOICE_NOTE_DEFAULT_BARS, clampBarCount, VoiceNoteNode, TimelineNode, WheelPickerNode, ColorPickerNode, FilterChipsNode, TILE_PX, MAX_MERCATOR_LAT, DEFAULT_TILE_MAX_ZOOM, CIRCLE_SEGMENTS, METRES_PER_DEG_LAT, MARKER_HIT_RADIUS, SHAPE_HIT_RADIUS, MapNode, CollapsingHeaderNode, UnsupportedOnSurface, CALENDAR_DATE_ONLY_RE, CAL_DEFAULT_MAX_DOTS, CAL_AGENDA_INITIAL_DAYS, CAL_AGENDA_PAGE_DAYS, CAL_DEFAULT_SNAP_MINUTES, CAL_UNASSIGNED_LANE_ID, MonthCalendarNode, TimeGridNode, AgendaNode, WebRenderer;
+var useIsomorphicLayoutEffect, ResponsiveGrid, SPLIT_EXPANDED_MIN_WIDTH, SPLIT_COLUMN_GAP, ResponsiveSplitView, ABSOLUTE_URL_RE, appearKeyframesInjected, pressStylesInjected, FOCUS_RING_CSS, focusStylesInjected, hListStylesInjected, listAnimateRuntimeInstalled, transitionKeyframesInjected, countUpRuntimeInjected, MEASURE_PREFIX, measureRuntimeInjected, revealRuntimeInjected, vectorAnimStylesInjected, scrollProgressRuntimeInjected, confettiRuntimeInjected, lottieRuntimeInjected, riveRuntimeInjected, gradientKeyframesInjected, parallaxRuntimeInjected, spinKeyframesInjected, marqueeKeyframesInjected, alignItems, zJustifyItems, hAlignItems, bodyFont, kids, rowKids, staggeredKids, asTextL10n, asBoundText, useBoundString, InterpolatedTextView, txt, selectFragmentCase, fragmentValueHash, fragmentSlotContent, FragmentSlotNode, WorkerSubtreeNode, resolveItemDeep2, resolveSwipeActions, resolveModBindings, resolvedComponentId, directServiceBindings, ReactiveDirectScalars, HiddenGate, KEYBOARD_INPUT_MODES, AUTOCAPITALIZE_VALUES, ENTER_KEY_HINTS, AUTOGROW_CEILING, EditableField, MenuNode, LoadMoreSentinel, FieldErrorNode, FormView, MediaSlotProvider, MEDIA_ITEM_BINDABLE, MediaPlayerView, VideoNode, PdfViewNode, WebViewNode, InteractivePicker, InteractiveDatePicker, InteractiveSearchField, InteractiveStepper, INTERACTIVE_ROLES, ALWAYS_INTERACTIVE_COMPONENT_TYPES, controlNode, ToggleNode, SliderNode, SelectionControlNode, TabsNode, SegmentedControlNode, DisclosureGroupNode, GridNode, SplitViewNode, TextNode, ImageNode, AvatarNode, IconNode, ButtonNode, OtpInputNode, ProgressBarNode, ActivityIndicatorNode, BottomSheetNode, ChipsInputNode, ChipNode, TableNode, GaugeRing, GaugeNode, RatingNode, AvatarStripNode, CHART_STROKE_CYCLE, chartStrokeAt, chartBarCenter, ChartNode, donutSliceOpacity, DonutChartNode, LegendMarker, LegendNode, cellAlign, DataTableNode, voiceNoteState, voiceNoteDelivery, VOICE_NOTE_DEFAULT_BARS, clampBarCount, VoiceNoteNode, TimelineNode, WheelPickerNode, ColorPickerNode, FilterChipsNode, TILE_PX, MAX_MERCATOR_LAT, DEFAULT_TILE_MAX_ZOOM, CIRCLE_SEGMENTS, METRES_PER_DEG_LAT, MARKER_HIT_RADIUS, SHAPE_HIT_RADIUS, MapNode, CollapsingHeaderNode, UnsupportedOnSurface, CALENDAR_DATE_ONLY_RE, CAL_DEFAULT_MAX_DOTS, CAL_AGENDA_INITIAL_DAYS, CAL_AGENDA_PAGE_DAYS, CAL_DEFAULT_SNAP_MINUTES, CAL_UNASSIGNED_LANE_ID, MonthCalendarNode, TimeGridNode, AgendaNode, WebRenderer;
 var init_renderNode = __esm({
   "../../core/web-renderer/src/renderNode.tsx"() {
     "use strict";
@@ -24063,6 +24075,8 @@ var init_renderNode = __esm({
     ABSOLUTE_URL_RE = /^([a-zA-Z][a-zA-Z0-9+.-]*:|\/\/)/;
     appearKeyframesInjected = false;
     pressStylesInjected = false;
+    FOCUS_RING_CSS = ':where(button,a,[href],input,select,textarea,[role="button"],[tabindex]):focus-visible{outline:2px solid var(--himi-accent,#116DFF);outline-offset:2px;border-radius:4px}';
+    focusStylesInjected = false;
     hListStylesInjected = false;
     listAnimateRuntimeInstalled = false;
     transitionKeyframesInjected = false;
@@ -27324,11 +27338,13 @@ function renderDescriptorToHtml(payload, tokens, scheme = "light", provider = nu
     ...typeof width === "number" && Number.isFinite(width) && width > 0 ? { sizeClass: sizeClassFromWidth(width), containerWidth: width } : {},
     ...rtl ? { isRTL: true } : {}
   });
+  const FOCUS_STYLE_MARKUP = `<style data-himalaya-focus-ring>${FOCUS_RING_CSS}</style>`;
+  const withFocusRing = (markup) => markup ? FOCUS_STYLE_MARKUP + markup : markup;
   const header = chrome?.stickyHeader;
   const footer = chrome?.stickyFooter;
   const dir = rtl ? { dir: "rtl" } : {};
   if (header || footer) {
-    return renderToStaticMarkup(
+    return withFocusRing(renderToStaticMarkup(
       React6.createElement(
         "div",
         { "data-testid": "screen-host", ...dir },
@@ -27344,16 +27360,16 @@ function renderDescriptorToHtml(payload, tokens, scheme = "light", provider = nu
           renderNode(footer, ctx)
         ) : null
       )
-    );
+    ));
   }
   if (rtl) {
-    return renderToStaticMarkup(
+    return withFocusRing(renderToStaticMarkup(
       React6.createElement("div", dir, renderNode(payload, ctx))
-    );
+    ));
   }
-  return renderToStaticMarkup(
+  return withFocusRing(renderToStaticMarkup(
     React6.createElement(React6.Fragment, null, renderNode(payload, ctx))
-  );
+  ));
 }
 var init_renderToHtml = __esm({
   "../../core/web-renderer/src/renderToHtml.tsx"() {
@@ -43283,19 +43299,19 @@ var init_preview_assets_generated = __esm({
   "../../packages/serve/src/preview-assets.generated.ts"() {
     init_preview_assets_format();
     PREVIEW_ASSET_MANIFEST = [
-      { key: "assets/index-C40lmxo4.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 983092, sha256: "919193db2182eb6a481f3729dda29af2441d6c46027c7fab508c2abb78f8fc0f" },
-      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 983100, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
-      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1074024, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
-      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1165008, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
-      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1255988, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
-      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1346860, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
-      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 1437840, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
-      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 1546476, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
-      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 1655560, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
-      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 1764608, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
-      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 1872308, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
-      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 1960416, length: 4448, sha256: "4cff52eaf77b0c3c09effb2dd0447d78d2b03ecaa68893281b1637510b93d8ad" },
-      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 1964864, length: 13784, sha256: "cfb9465254fab84f0e084bb4542c282758ea29774b5f172840cc0b9e4194ef89" }
+      { key: "assets/index-DlRHv5p2.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 983492, sha256: "89f6530bb02d868a8d28e7a93103bef7e7b83904a5e0fcf4f813c06872191b48" },
+      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 983500, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
+      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1074424, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
+      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1165408, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
+      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1256388, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
+      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1347260, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
+      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 1438240, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
+      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 1546876, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
+      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 1655960, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
+      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 1765008, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
+      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 1872708, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
+      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 1960816, length: 4448, sha256: "2a2e413e18bb4b278f1f4daee79dce764a17f65f6567a734a69e9a895bc85f70" },
+      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 1965264, length: 13784, sha256: "cfb9465254fab84f0e084bb4542c282758ea29774b5f172840cc0b9e4194ef89" }
     ];
   }
 });
@@ -51134,6 +51150,18 @@ var ServeCliClient = class {
   removeRelease(app) {
     return this.request("control", "POST", "/v1/admin/release/remove", { body: { app }, headers: this.ctrlHeaders() });
   }
+  /**
+   * Undo a `removeRelease` inside its retention window (POST /v1/admin/release/restore).
+   *
+   * The route is as privileged as the remove was — same scope + role gates — and it is the reason
+   * `removeRelease`'s response advertises `restorable` + `restoreBy`. Shipping the remove without
+   * this leaves that promise unreachable from the CLI, which is how an un-publish starts reading
+   * as final. Refuses with 404 `no_tombstone`, 409 `nothing_to_restore`, or 410 once the window
+   * has closed; the CLI turns each into a named refusal rather than a bare status.
+   */
+  restoreRelease(app) {
+    return this.request("control", "POST", "/v1/admin/release/restore", { body: { app }, headers: this.ctrlHeaders() });
+  }
   /** Write-through an OTA app-config patch (POST /v1/admin/app-config). */
   setAppConfig(app, patch) {
     return this.request("control", "POST", "/v1/admin/app-config", { body: { app, patch }, headers: this.ctrlHeaders() });
@@ -55295,6 +55323,37 @@ function tokenCoversApp(token, app) {
   if (!claims || claims.apps === "*" || !Array.isArray(claims.apps)) return true;
   return claims.apps.includes(app);
 }
+function credentialKind(token) {
+  const claims = decodeControlTokenClaims(token);
+  if (!claims) return null;
+  if (claims.selfServe) return "self-serve";
+  return claims.sub ? "operator" : "shared";
+}
+var KIND_LABEL = {
+  "self-serve": "self-serve",
+  shared: "shared",
+  operator: "operator/provisioned"
+};
+var KIND_TIER = {
+  "self-serve": "self-serve",
+  shared: "shared",
+  operator: "employee"
+};
+var kindLoginBack = (kind, target) => {
+  if (kind === "self-serve") return `himi login --browser --target ${target}`;
+  if (kind === "operator") return `himi login --dpx --target ${target}`;
+  return void 0;
+};
+function credentialSwapNotice(prevToken, nextToken, target) {
+  if (!prevToken) return void 0;
+  const prev = credentialKind(prevToken);
+  const next = credentialKind(nextToken);
+  if (!prev || !next || prev === next) return void 0;
+  const tierLine = `\`himi dist\` will now charge the ${KIND_TIER[next]} tier instead of the ${KIND_TIER[prev]} one.`;
+  const back = kindLoginBack(prev, target);
+  const backLine = back ? ` \`${back}\` switches back.` : "";
+  return `replacing the ${KIND_LABEL[prev]} credential for target "${target}" with a ${KIND_LABEL[next]} one. ${tierLine}${backLine}`;
+}
 var HARD_CLAIM_REFUSALS = /* @__PURE__ */ new Set(["slug_reserved", "invalid_slug", "account_ambiguous", "not_your_account"]);
 var AUTO_CLAIM_TIMEOUT_MS = 15e3;
 async function autoClaimSlug(opts) {
@@ -59882,6 +59941,7 @@ ${label2}`);
       }
       case "login": {
         const target = targetName();
+        const prevControlToken = loadTargetsFile().targets?.[target]?.controlToken;
         let issue2;
         let ownerIssue;
         try {
@@ -59967,6 +60027,7 @@ ${label2}`);
             exp = JSON.parse(Buffer.from(body2.token.split(".")[0], "base64url").toString("utf8")).exp;
           } catch {
           }
+          const swap2 = credentialSwapNotice(prevControlToken, body2.token, target);
           print({
             ok: true,
             via: "wix",
@@ -59975,6 +60036,7 @@ ${label2}`);
             exp,
             scope: body2.scope,
             storedAt: storedAt2,
+            ...swap2 ? { notice: swap2 } : {},
             ...Array.isArray(body2.scope) && body2.scope.length === 0 ? { hint: "you own no apps yet \u2014 claim one with `himi apps claim <slug>`" } : {}
           });
           return 0;
@@ -60030,6 +60092,7 @@ ${label2}`);
             sub = c.sub;
           } catch {
           }
+          const swap2 = credentialSwapNotice(prevControlToken, result.token, target);
           print({
             ok: true,
             via: "browser",
@@ -60038,6 +60101,7 @@ ${label2}`);
             exp,
             scope,
             storedAt: storedAt2,
+            ...swap2 ? { notice: swap2 } : {},
             ...Array.isArray(scope) && scope.length === 0 ? { hint: "you own no apps yet \u2014 claim one with `himi apps claim <slug>`" } : {}
           });
           return 0;
@@ -60073,7 +60137,8 @@ ${label2}`);
           return 1;
         }
         const storedAt = saveControlToken(target, body.token);
-        print({ ok: true, target, exp: body.exp, scope: body.scope, storedAt });
+        const swap = credentialSwapNotice(prevControlToken, body.token, target);
+        print({ ok: true, target, exp: body.exp, scope: body.scope, storedAt, ...swap ? { notice: swap } : {} });
         return 0;
       }
       // --- #814 Stage 3: self-serve app ownership + local token introspection -------
@@ -60726,6 +60791,8 @@ export {
   autoClaimSlug,
   buildDoctorReport,
   compareVersions2 as compareVersions,
+  credentialKind,
+  credentialSwapNotice,
   decodeControlTokenClaims,
   defaultTargetForCommand,
   diagnoseBody,

package/guides/releasing-with-himi-serve.md

@@ -80,6 +80,49 @@ traffic until its gateway route was deleted on 2026-09-05; it now 404s with no r
    ```
    Kill-switch a bad bundle: `himi-serve release revoke --app <app> --integrity <sri> --target bo --control-token "$TOK"`.
 
+### Retiring an app
+
+`release revoke` kills one bundle; `release remove` unpublishes the **app** — it drops the
+manifest and takes the app out of the `/v1/apps` registry, so devices resolving it stop getting
+a release:
+
+```
+himi-serve release remove  --app <app> --yes --target bo --control-token "$TOK"
+himi-serve release restore --app <app>       --target bo --control-token "$TOK"
+```
+
+**`--yes` is required**, and nothing is sent without it. Every other release verb is narrower —
+`revoke` needs an integrity, `promote` needs a release, and both leave the app resolvable — so
+this is the one where a typo'd `--app` unpublishes whatever it names.
+
+**Whether a remove can be undone is the BACKEND's answer, not a property of the verb.** A store
+that implements `restore` (the cloud store) records a tombstone and the remove reports
+`restorable: true` with a `restoreBy` deadline. A store that does not — including the
+`FileReleaseStore` a local serve-stack runs on, which implements `remove` and no `restore` —
+reports `restorable: false`, and `release restore` answers `501 restore_unsupported`. **There the
+un-publish is permanent.** So read the `restorable` field in the response before treating a remove
+as reversible; the CLI prints the `restoreWith` command line only when the plane says the undo
+exists, and stays silent when it does not.
+
+That is also why the confirmation is `--yes` rather than `apps backfill`'s
+rehearse-unless-`--apply`: on a store with restore the cost of getting it wrong is a restore rather
+than a permanent loss, and on a store without one the confirmation is the only thing standing in
+front of an irreversible write.
+
+`restore` replays the tombstone inside that window. It takes no `--yes`, since making the recovery
+harder to type than the destructive verb has the asymmetry backwards. It is **not** gated
+identically to `remove`: `remove` is in serve-control's `PUBLISH_CONTENT_PATHS`, so an `owner`-role
+token is refused, while `restore` is not in that set and an owner-scoped token may restore an app
+it owns. Both still require control-plane scope authentication. Past the window it refuses, and each refusal says which case it
+is — nothing recorded (404), recorded but carrying no release to put back (409), or the window
+closed (410, the only way back being `release push`).
+
+**This is the general door; `template remove` is the same route narrowed to the
+`himi-template-` namespace.** An app with an *owner* can also be retired owner-side with
+`himi apps release <slug> --yes`, but that needs ownership — so an **unclaimed** app (a QA
+scaffold, anything published before auto-claiming) has nobody to supply it and this is the only
+command that reaches it.
+
 ### Curating templates
 
 A starter template is an app in the reserved `himi-template-<name>` namespace, so it is
@@ -110,7 +153,9 @@ name may legally begin with `himi-template-` (the name pattern is lowercase alph
 inner hyphens), and such a name publishes to a **doubly** prefixed app id — so `--name` cannot
 express it without becoming ambiguous. The CLI refuses the ambiguous form and points at `--app`. `--app` only accepts ids inside the
 reserved namespace: a non-template id is refused, so this group cannot unpublish or
-kill-switch an ordinary app by mistake — use the `release` group for those.
+kill-switch an ordinary app by mistake — use the `release` group for those, which the refusal
+names by the verb you asked for (`release remove --app <app> --yes` for a remove, `release
+revoke … --integrity <sri>` for a revoke).
 
 `remove` unpublishes the app; `revoke` is the reversible kill-switch, and it resolves the
 bundle integrities from the template's current release manifest so you never paste an SRI. A

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.947.0",
+  "version": "0.949.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -64,5 +64,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "e6f6c45f77b9ba2728e1098c0c46b7d7eb3e6fb922394d52a0797dd7"
+  "falconPackageHash": "0449b6185090a3685450f4bf6e21424bd545c01791d527f37625af8c"
 }