@wix/himalaya-cli 0.948.0 → 0.949.0

package/dist/cli.mjs

@@ -51150,6 +51150,18 @@ var ServeCliClient = class {
   removeRelease(app) {
     return this.request("control", "POST", "/v1/admin/release/remove", { body: { app }, headers: this.ctrlHeaders() });
   }
+  /**
+   * Undo a `removeRelease` inside its retention window (POST /v1/admin/release/restore).
+   *
+   * The route is as privileged as the remove was — same scope + role gates — and it is the reason
+   * `removeRelease`'s response advertises `restorable` + `restoreBy`. Shipping the remove without
+   * this leaves that promise unreachable from the CLI, which is how an un-publish starts reading
+   * as final. Refuses with 404 `no_tombstone`, 409 `nothing_to_restore`, or 410 once the window
+   * has closed; the CLI turns each into a named refusal rather than a bare status.
+   */
+  restoreRelease(app) {
+    return this.request("control", "POST", "/v1/admin/release/restore", { body: { app }, headers: this.ctrlHeaders() });
+  }
   /** Write-through an OTA app-config patch (POST /v1/admin/app-config). */
   setAppConfig(app, patch) {
     return this.request("control", "POST", "/v1/admin/app-config", { body: { app, patch }, headers: this.ctrlHeaders() });
@@ -55311,6 +55323,37 @@ function tokenCoversApp(token, app) {
   if (!claims || claims.apps === "*" || !Array.isArray(claims.apps)) return true;
   return claims.apps.includes(app);
 }
+function credentialKind(token) {
+  const claims = decodeControlTokenClaims(token);
+  if (!claims) return null;
+  if (claims.selfServe) return "self-serve";
+  return claims.sub ? "operator" : "shared";
+}
+var KIND_LABEL = {
+  "self-serve": "self-serve",
+  shared: "shared",
+  operator: "operator/provisioned"
+};
+var KIND_TIER = {
+  "self-serve": "self-serve",
+  shared: "shared",
+  operator: "employee"
+};
+var kindLoginBack = (kind, target) => {
+  if (kind === "self-serve") return `himi login --browser --target ${target}`;
+  if (kind === "operator") return `himi login --dpx --target ${target}`;
+  return void 0;
+};
+function credentialSwapNotice(prevToken, nextToken, target) {
+  if (!prevToken) return void 0;
+  const prev = credentialKind(prevToken);
+  const next = credentialKind(nextToken);
+  if (!prev || !next || prev === next) return void 0;
+  const tierLine = `\`himi dist\` will now charge the ${KIND_TIER[next]} tier instead of the ${KIND_TIER[prev]} one.`;
+  const back = kindLoginBack(prev, target);
+  const backLine = back ? ` \`${back}\` switches back.` : "";
+  return `replacing the ${KIND_LABEL[prev]} credential for target "${target}" with a ${KIND_LABEL[next]} one. ${tierLine}${backLine}`;
+}
 var HARD_CLAIM_REFUSALS = /* @__PURE__ */ new Set(["slug_reserved", "invalid_slug", "account_ambiguous", "not_your_account"]);
 var AUTO_CLAIM_TIMEOUT_MS = 15e3;
 async function autoClaimSlug(opts) {
@@ -59898,6 +59941,7 @@ ${label2}`);
       }
       case "login": {
         const target = targetName();
+        const prevControlToken = loadTargetsFile().targets?.[target]?.controlToken;
         let issue2;
         let ownerIssue;
         try {
@@ -59983,6 +60027,7 @@ ${label2}`);
             exp = JSON.parse(Buffer.from(body2.token.split(".")[0], "base64url").toString("utf8")).exp;
           } catch {
           }
+          const swap2 = credentialSwapNotice(prevControlToken, body2.token, target);
           print({
             ok: true,
             via: "wix",
@@ -59991,6 +60036,7 @@ ${label2}`);
             exp,
             scope: body2.scope,
             storedAt: storedAt2,
+            ...swap2 ? { notice: swap2 } : {},
             ...Array.isArray(body2.scope) && body2.scope.length === 0 ? { hint: "you own no apps yet \u2014 claim one with `himi apps claim <slug>`" } : {}
           });
           return 0;
@@ -60046,6 +60092,7 @@ ${label2}`);
             sub = c.sub;
           } catch {
           }
+          const swap2 = credentialSwapNotice(prevControlToken, result.token, target);
           print({
             ok: true,
             via: "browser",
@@ -60054,6 +60101,7 @@ ${label2}`);
             exp,
             scope,
             storedAt: storedAt2,
+            ...swap2 ? { notice: swap2 } : {},
             ...Array.isArray(scope) && scope.length === 0 ? { hint: "you own no apps yet \u2014 claim one with `himi apps claim <slug>`" } : {}
           });
           return 0;
@@ -60089,7 +60137,8 @@ ${label2}`);
           return 1;
         }
         const storedAt = saveControlToken(target, body.token);
-        print({ ok: true, target, exp: body.exp, scope: body.scope, storedAt });
+        const swap = credentialSwapNotice(prevControlToken, body.token, target);
+        print({ ok: true, target, exp: body.exp, scope: body.scope, storedAt, ...swap ? { notice: swap } : {} });
         return 0;
       }
       // --- #814 Stage 3: self-serve app ownership + local token introspection -------
@@ -60742,6 +60791,8 @@ export {
   autoClaimSlug,
   buildDoctorReport,
   compareVersions2 as compareVersions,
+  credentialKind,
+  credentialSwapNotice,
   decodeControlTokenClaims,
   defaultTargetForCommand,
   diagnoseBody,

package/guides/releasing-with-himi-serve.md

@@ -80,6 +80,49 @@ traffic until its gateway route was deleted on 2026-09-05; it now 404s with no r
    ```
    Kill-switch a bad bundle: `himi-serve release revoke --app <app> --integrity <sri> --target bo --control-token "$TOK"`.
 
+### Retiring an app
+
+`release revoke` kills one bundle; `release remove` unpublishes the **app** — it drops the
+manifest and takes the app out of the `/v1/apps` registry, so devices resolving it stop getting
+a release:
+
+```
+himi-serve release remove  --app <app> --yes --target bo --control-token "$TOK"
+himi-serve release restore --app <app>       --target bo --control-token "$TOK"
+```
+
+**`--yes` is required**, and nothing is sent without it. Every other release verb is narrower —
+`revoke` needs an integrity, `promote` needs a release, and both leave the app resolvable — so
+this is the one where a typo'd `--app` unpublishes whatever it names.
+
+**Whether a remove can be undone is the BACKEND's answer, not a property of the verb.** A store
+that implements `restore` (the cloud store) records a tombstone and the remove reports
+`restorable: true` with a `restoreBy` deadline. A store that does not — including the
+`FileReleaseStore` a local serve-stack runs on, which implements `remove` and no `restore` —
+reports `restorable: false`, and `release restore` answers `501 restore_unsupported`. **There the
+un-publish is permanent.** So read the `restorable` field in the response before treating a remove
+as reversible; the CLI prints the `restoreWith` command line only when the plane says the undo
+exists, and stays silent when it does not.
+
+That is also why the confirmation is `--yes` rather than `apps backfill`'s
+rehearse-unless-`--apply`: on a store with restore the cost of getting it wrong is a restore rather
+than a permanent loss, and on a store without one the confirmation is the only thing standing in
+front of an irreversible write.
+
+`restore` replays the tombstone inside that window. It takes no `--yes`, since making the recovery
+harder to type than the destructive verb has the asymmetry backwards. It is **not** gated
+identically to `remove`: `remove` is in serve-control's `PUBLISH_CONTENT_PATHS`, so an `owner`-role
+token is refused, while `restore` is not in that set and an owner-scoped token may restore an app
+it owns. Both still require control-plane scope authentication. Past the window it refuses, and each refusal says which case it
+is — nothing recorded (404), recorded but carrying no release to put back (409), or the window
+closed (410, the only way back being `release push`).
+
+**This is the general door; `template remove` is the same route narrowed to the
+`himi-template-` namespace.** An app with an *owner* can also be retired owner-side with
+`himi apps release <slug> --yes`, but that needs ownership — so an **unclaimed** app (a QA
+scaffold, anything published before auto-claiming) has nobody to supply it and this is the only
+command that reaches it.
+
 ### Curating templates
 
 A starter template is an app in the reserved `himi-template-<name>` namespace, so it is
@@ -110,7 +153,9 @@ name may legally begin with `himi-template-` (the name pattern is lowercase alph
 inner hyphens), and such a name publishes to a **doubly** prefixed app id — so `--name` cannot
 express it without becoming ambiguous. The CLI refuses the ambiguous form and points at `--app`. `--app` only accepts ids inside the
 reserved namespace: a non-template id is refused, so this group cannot unpublish or
-kill-switch an ordinary app by mistake — use the `release` group for those.
+kill-switch an ordinary app by mistake — use the `release` group for those, which the refusal
+names by the verb you asked for (`release remove --app <app> --yes` for a remove, `release
+revoke … --integrity <sri>` for a revoke).
 
 `remove` unpublishes the app; `revoke` is the reversible kill-switch, and it resolves the
 bundle integrities from the template's current release manifest so you never paste an SRI. A

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.948.0",
+  "version": "0.949.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -64,5 +64,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "c8b30ba70c8fce59bdc7ac8a6ca63b0f2f35e34869de1e880606f116"
+  "falconPackageHash": "0449b6185090a3685450f4bf6e21424bd545c01791d527f37625af8c"
 }