@wix/agent-skills 1.26.0 → 1.27.0

package/skills/wix-headless-templates/members/app/components/members/LoginForm.tsx

@@ -0,0 +1,165 @@
+// Shipped custom login form — the member signs in on THIS site's page, never on a Wix login page.
+// On managed Astro a SUCCESS navigates through Wix's authorization step and returns to `returnTo`
+// (the store does that); elsewhere the tokens land in place and this form navigates itself.
+import { type FormEvent, useState } from "react";
+import { useMember } from "../../hooks/members/useMember";
+import { PROFILE_ON_SIGNUP } from "../../wix/members/auth";
+
+export interface LoginFormProps {
+  onSuccess?: () => void;
+}
+
+export default function LoginForm({ onSuccess }: LoginFormProps) {
+  const { login, register, verifyEmail, error } = useMember();
+  const [mode, setMode] = useState<"login" | "register">("login");
+  const [email, setEmail] = useState("");
+  const [password, setPassword] = useState("");
+  const [firstName, setFirstName] = useState("");
+  const [lastName, setLastName] = useState("");
+  const [code, setCode] = useState("");
+  const [verification, setVerification] = useState(false);
+  const [pending, setPending] = useState(false);
+  const [busy, setBusy] = useState(false);
+
+  // Where a SUCCESS lands: ?returnTo when it is a same-site path, else /account. With onSuccess the
+  // form stays put on manual auth; on managed Astro the round trip returns to this very page.
+  function returnTo(): string {
+    const wanted = new URLSearchParams(window.location.search).get("returnTo");
+    if (wanted?.startsWith("/") && !wanted.startsWith("//")) return wanted;
+    return onSuccess ? window.location.pathname + window.location.search : "/account";
+  }
+
+  function done() {
+    if (onSuccess) return onSuccess();
+    window.location.assign(returnTo());
+  }
+
+  async function submit(event: FormEvent) {
+    event.preventDefault();
+    setBusy(true);
+    try {
+      const options = { returnTo: returnTo() };
+      const result =
+        mode === "login"
+          ? await login(email, password, options)
+          : await register(email, password, PROFILE_ON_SIGNUP ? { firstName, lastName } : undefined, options);
+      if (result.state === "SUCCESS" && result.redirectUrl) return; // navigating to Wix and back
+      if (result.state === "SUCCESS") done();
+      if (result.state === "EMAIL_VERIFICATION_REQUIRED") setVerification(true);
+      if (result.state === "OWNER_APPROVAL_REQUIRED") setPending(true);
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  async function submitCode(event: FormEvent) {
+    event.preventDefault();
+    setBusy(true);
+    try {
+      const result = await verifyEmail(code);
+      if (result.state === "SUCCESS" && result.redirectUrl) return; // navigating to Wix and back
+      if (result.state === "SUCCESS") done();
+      if (result.state === "OWNER_APPROVAL_REQUIRED") setPending(true);
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  if (pending)
+    return (
+      <p className="rounded-lg border border-border p-4 text-sm">
+        Your account is awaiting approval.
+      </p>
+    );
+  if (verification) {
+    return (
+      <form onSubmit={submitCode} className="space-y-4">
+        <label className="block text-sm">
+          Verification code
+          <input
+            required
+            value={code}
+            onChange={(event) => setCode(event.target.value)}
+            className="mt-1 w-full rounded border border-border bg-background p-2"
+          />
+        </label>
+        {error && <p className="text-sm text-destructive">{error}</p>}
+        <button
+          disabled={busy}
+          className="rounded bg-primary px-4 py-2 text-primary-foreground"
+        >
+          {busy ? "Verifying…" : "Verify"}
+        </button>
+      </form>
+    );
+  }
+  return (
+    <form onSubmit={submit} className="space-y-4">
+      <div className="flex gap-2">
+        <button
+          type="button"
+          onClick={() => setMode("login")}
+          className="text-sm underline"
+        >
+          Sign in
+        </button>
+        <button
+          type="button"
+          onClick={() => setMode("register")}
+          className="text-sm underline"
+        >
+          Sign up
+        </button>
+      </div>
+      {mode === "register" && PROFILE_ON_SIGNUP && (
+        <div className="grid gap-3 sm:grid-cols-2">
+          <label className="text-sm">
+            First name
+            <input
+              value={firstName}
+              onChange={(event) => setFirstName(event.target.value)}
+              className="mt-1 w-full rounded border border-border bg-background p-2"
+            />
+          </label>
+          <label className="text-sm">
+            Last name
+            <input
+              value={lastName}
+              onChange={(event) => setLastName(event.target.value)}
+              className="mt-1 w-full rounded border border-border bg-background p-2"
+            />
+          </label>
+        </div>
+      )}
+      <label className="block text-sm">
+        Email
+        <input
+          required
+          type="email"
+          autoComplete="email"
+          value={email}
+          onChange={(event) => setEmail(event.target.value)}
+          className="mt-1 w-full rounded border border-border bg-background p-2"
+        />
+      </label>
+      <label className="block text-sm">
+        Password
+        <input
+          required
+          type="password"
+          autoComplete={mode === "login" ? "current-password" : "new-password"}
+          value={password}
+          onChange={(event) => setPassword(event.target.value)}
+          className="mt-1 w-full rounded border border-border bg-background p-2"
+        />
+      </label>
+      {error && <p className="text-sm text-destructive">{error}</p>}
+      <button
+        disabled={busy}
+        className="rounded bg-primary px-4 py-2 text-primary-foreground"
+      >
+        {busy ? "Working…" : mode === "login" ? "Sign in" : "Create account"}
+      </button>
+    </form>
+  );
+}

package/skills/wix-headless-templates/members/app/components/members/MemberMenu.tsx

@@ -0,0 +1,78 @@
+// REFERENCE header account control on the @theme tokens: "Log in" for a visitor; account
+// link + log-out for a member. Correct and complete; per the skill's model you design your
+// own on useMember. Mount client:only="react" — it reads browser session state.
+import type { ComponentType, ReactNode } from "react";
+import { useMember } from "../../hooks/members/useMember";
+
+export interface LinkLikeProps {
+  href: string;
+  className?: string;
+  children?: ReactNode;
+}
+
+const PlainLink = ({ href, className, children }: LinkLikeProps) => (
+  <a href={href} className={className}>
+    {children}
+  </a>
+);
+
+export interface MemberMenuProps {
+  accountHref?: string;
+  LinkComponent?: ComponentType<LinkLikeProps>;
+}
+
+export default function MemberMenu({
+  accountHref = "/account",
+  LinkComponent = PlainLink,
+}: MemberMenuProps) {
+  const { member, loggedIn, loading, logout } = useMember();
+
+  if (loading) {
+    return (
+      <span
+        className="inline-block h-8 w-16 animate-pulse rounded-control bg-secondary"
+        aria-hidden="true"
+      />
+    );
+  }
+
+  if (!loggedIn) {
+    return (
+      <a
+        href="/login"
+        className="rounded-control bg-primary px-4 py-1.5 text-sm font-medium text-primary-foreground transition-opacity hover:opacity-90"
+      >
+        Log in
+      </a>
+    );
+  }
+
+  return (
+    <span className="flex items-center gap-3">
+      <LinkComponent
+        href={accountHref}
+        className="flex items-center gap-2 text-sm font-medium text-foreground no-underline transition-colors hover:text-muted-foreground"
+      >
+        {member?.photoUrl ? (
+          <img
+            src={member.photoUrl}
+            alt=""
+            className="h-7 w-7 rounded-full object-cover"
+          />
+        ) : (
+          <span className="flex h-7 w-7 items-center justify-center rounded-full bg-secondary text-xs font-semibold">
+            {(member?.displayName ?? "M").slice(0, 1).toUpperCase()}
+          </span>
+        )}
+        {member?.displayName ?? "My account"}
+      </LinkComponent>
+      <button
+        type="button"
+        onClick={() => void logout()}
+        className="text-sm text-muted-foreground transition-colors hover:text-foreground"
+      >
+        Log out
+      </button>
+    </span>
+  );
+}

package/skills/wix-headless-templates/members/app/components/members/RequireAuth.tsx

@@ -0,0 +1,47 @@
+// REFERENCE gate for member-only surfaces on the REACT stack — on Astro, gate server-side
+// in frontmatter instead (pages/account.astro shows the shape); a client-side check there
+// flashes gated UI. Renders children only for a logged-in member; a visitor gets a login
+// prompt in place (routing-free — no router or redirect assumptions).
+import type { ReactNode } from "react";
+import { useMember } from "../../hooks/members/useMember";
+
+export interface RequireAuthProps {
+  children: ReactNode;
+  /** Rendered for an anonymous visitor instead of the default login prompt. */
+  fallback?: ReactNode;
+}
+
+export default function RequireAuth({ children, fallback }: RequireAuthProps) {
+  const { loggedIn, loading } = useMember();
+
+  // Wait for the initial session read — deciding early bounces a logged-in member on first paint.
+  if (loading) {
+    return (
+      <div className="py-16 text-center text-muted-foreground" aria-busy="true">
+        Loading…
+      </div>
+    );
+  }
+
+  if (!loggedIn) {
+    return (
+      <>
+        {fallback ?? (
+          <div className="mx-auto max-w-md rounded-lg border border-border p-8 text-center">
+            <p className="text-sm text-muted-foreground">
+              This page is for members.
+            </p>
+            <a
+              href={`/login?returnTo=${encodeURIComponent(window.location.pathname)}`}
+              className="mt-6 inline-block rounded-control bg-primary px-5 py-2 text-sm font-medium text-primary-foreground transition-opacity hover:opacity-90"
+            >
+              Log in / Sign up
+            </a>
+          </div>
+        )}
+      </>
+    );
+  }
+
+  return <>{children}</>;
+}

package/skills/wix-headless-templates/members/app/hooks/members/useMember.ts

@@ -0,0 +1,67 @@
+// React binding for the member store. Works in any React root — Astro islands (several on
+// one page share the same session) and SPAs alike. SSR-friendly: pass a server-resolved
+// member as `initialMember` (Astro island props) and no client re-fetch happens.
+import { useRef, useSyncExternalStore } from "react";
+import {
+  getMemberState,
+  hydrateMember,
+  login,
+  register,
+  logout,
+  refreshMember,
+  subscribeMember,
+  verifyEmail,
+  type MemberState,
+} from "../../wix/members/member-store";
+import type { LoginOptions, LoginResult } from "../../wix/members/auth";
+import type { CurrentMember } from "../../wix/members/types";
+
+export interface UseMemberOptions {
+  /** Server-resolved member (null = a known-anonymous visitor); omit to resolve client-side. */
+  initialMember?: CurrentMember | null;
+}
+
+export interface UseMember extends MemberState {
+  /** Submit the shipped in-app credential form; `returnTo` is where a SUCCESS lands. */
+  login: (email: string, password: string, options?: LoginOptions) => Promise<LoginResult>;
+  register: (
+    email: string,
+    password: string,
+    profile?: { firstName?: string; lastName?: string },
+    options?: LoginOptions,
+  ) => Promise<LoginResult>;
+  verifyEmail: (code: string) => Promise<LoginResult>;
+  /** Log out through the Wix logout flow; navigates away. */
+  logout: (returnTo?: string) => Promise<void>;
+  refresh: () => Promise<void>;
+}
+
+export function useMember({ initialMember }: UseMemberOptions = {}): UseMember {
+  // Adopt SSR props into the shared store before the first subscription (a no-op once any
+  // island has settled the session).
+  if (typeof window !== "undefined" && initialMember !== undefined)
+    hydrateMember(initialMember);
+  const server = useRef<MemberState | null>(null);
+  server.current ??=
+    initialMember !== undefined
+      ? {
+          member: initialMember,
+          loggedIn: initialMember !== null,
+          loading: false,
+          error: null,
+        }
+      : getMemberState();
+  const state = useSyncExternalStore(
+    subscribeMember,
+    getMemberState,
+    () => server.current as MemberState,
+  );
+  return {
+    ...state,
+    login,
+    register,
+    verifyEmail,
+    logout,
+    refresh: refreshMember,
+  };
+}

package/skills/wix-headless-templates/members/app/wix/members/auth-core.ts

@@ -0,0 +1,160 @@
+// Authentication rules — transport-agnostic, imported by EVERY transport: ./auth.ts (the SDK's
+// OAuthStrategy, or the managed-Astro built-in auth routes) and the REST twin in
+// templates/members/rest/auth.ts (the IAM authentication API over fetch). What a login/registration
+// response MEANS — the four states, when a session token is expected, which Wix error code is which
+// failure — lives HERE, once. No imports: a strip to JS emits a plain module.
+
+/** The four outcomes every credential operation resolves to; the shipped LoginForm renders each. */
+export type LoginState = "SUCCESS" | "EMAIL_VERIFICATION_REQUIRED" | "OWNER_APPROVAL_REQUIRED" | "FAILURE";
+
+export interface LoginResult {
+  state: LoginState;
+  /** Continues an EMAIL_VERIFICATION_REQUIRED flow (the transport keeps it too — verifyMemberEmail needs no argument). */
+  stateToken?: string;
+  /** A stable name for a FAILURE: invalidPassword, invalidEmail, emailAlreadyExists, resetPassword, missingCaptchaToken, invalidCaptchaToken. */
+  errorCode?: string;
+  /** Wix's message for a FAILURE — render it. */
+  error?: string;
+  /**
+   * Managed Astro only: a SUCCESS is not a session yet — the browser must navigate here (the Wix
+   * authorization step), which returns through /api/auth/callback and lands on the requested page.
+   */
+  redirectUrl?: string;
+}
+
+/** A raw login/register/verify response as either transport returns it. */
+export type RawAuth = Record<string, any>;
+
+/** A LoginResult plus the one-shot session token a SUCCESS carries (5-minute life; exchanged, never shown). */
+export interface AuthOutcome extends LoginResult {
+  sessionToken: string | null;
+}
+
+// REST spells the states differently from the SDK; both map onto LoginState.
+const REST_STATES: Record<string, LoginState> = {
+  SUCCESS: "SUCCESS",
+  REQUIRE_EMAIL_VERIFICATION: "EMAIL_VERIFICATION_REQUIRED",
+  REQUIRE_OWNER_APPROVAL: "OWNER_APPROVAL_REQUIRED",
+};
+
+/**
+ * Normalize either transport's response — SDK `{ loginState, data: { sessionToken | stateToken },
+ * error?, errorCode? }` or REST `{ state, sessionToken?, stateToken? }`. Anything else is a FAILURE.
+ */
+export function authOutcome(raw: RawAuth | null | undefined): AuthOutcome {
+  const state: LoginState = raw?.loginState ?? REST_STATES[raw?.state ?? ""] ?? "FAILURE";
+  const stateToken: string | undefined = raw?.stateToken ?? raw?.data?.stateToken;
+  return {
+    state,
+    sessionToken: raw?.data?.sessionToken ?? raw?.sessionToken ?? null,
+    ...(stateToken ? { stateToken } : {}),
+    ...(raw?.errorCode ? { errorCode: raw.errorCode } : {}),
+    ...(raw?.error ? { error: raw.error } : {}),
+  };
+}
+
+/** The outcome as callers see it — without the session token, which the transport has consumed. */
+export function toLoginResult({ sessionToken: _consumed, ...result }: AuthOutcome): LoginResult {
+  return result;
+}
+
+export function failure(error: string, errorCode?: string): LoginResult {
+  return { state: "FAILURE", error, ...(errorCode ? { errorCode } : {}) };
+}
+
+/** A SUCCESS without a session token — the exchange can't run; surfaced as a FAILURE with this text. */
+export const NO_SESSION_ERROR = "Wix did not return a member session.";
+
+// The built-in auth routes' request-level error codes (body `{ error }`), in the words a form can show.
+const AUTH_ROUTE_ERRORS: Record<string, string> = {
+  ALREADY_LOGGED_IN: "You are already signed in.",
+  AUTH_SERVICE_ERROR: "Wix could not process the sign-in right now. Try again.",
+  VERIFICATION_FAILED: "That code did not match. Check the email and try again.",
+  VERIFICATION_STATE_EXPIRED: "The verification code expired. Sign in again to get a new one.",
+  INVALID_REQUEST: "The form sent something Wix did not accept.",
+  FORBIDDEN: "This request was refused.",
+};
+
+/**
+ * A managed-Astro auth route answer → LoginResult. Success: `{ loginState: "SUCCESS", redirectUrl }`
+ * (200). Challenges: `{ loginState }` with 403 — verification and owner approval pass through; a
+ * CAPTCHA challenge (the site owner turned reCAPTCHA on) is a FAILURE the form cannot clear without
+ * a widget. Failure: `{ loginState: "FAILURE", errorCode }` (422, or 403 for resetPassword). Request
+ * errors: `{ error: CODE }` without a loginState.
+ */
+export function fromAuthRoute(status: number, body: RawAuth | null): LoginResult {
+  const loginState: string | undefined = body?.loginState;
+  switch (loginState) {
+    case "SUCCESS":
+      return body?.redirectUrl ? { state: "SUCCESS", redirectUrl: body.redirectUrl } : failure(NO_SESSION_ERROR);
+    case "EMAIL_VERIFICATION_REQUIRED":
+    case "OWNER_APPROVAL_REQUIRED":
+      return { state: loginState };
+    case "SILENT_CAPTCHA_REQUIRED":
+    case "USER_CAPTCHA_REQUIRED":
+      return failure("This site requires a CAPTCHA to sign up; the form has no CAPTCHA widget yet.", "captchaRequired");
+    case "FAILURE":
+      return failure(body?.error ?? FAILURE_TEXT[body?.errorCode ?? ""] ?? "Could not sign in.", body?.errorCode ?? "unknown");
+    default: {
+      // No route at all: the project's @wix/astro predates the built-in credential routes (2.75).
+      if (status === 404 || status === 405) return failure("This site's @wix/astro has no /api/auth credential routes; update it to 2.75 or later.", "authRoutesMissing");
+      const code: string | undefined = body?.error;
+      return failure(AUTH_ROUTE_ERRORS[code ?? ""] ?? `Sign-in request failed (${status}).`, code);
+    }
+  }
+}
+
+/** Default wording per errorCode when the route sends none (the SDK sends none either). */
+const FAILURE_TEXT: Record<string, string> = {
+  invalidCredentials: "Wrong email or password.",
+  invalidEmail: "That email is not valid here.",
+  invalidPassword: "Wrong password.",
+  emailAlreadyExists: "An account with this email already exists. Sign in instead.",
+  resetPassword: "You need to reset your password before signing in.",
+  missingCaptchaToken: "This site requires a CAPTCHA to sign up.",
+  invalidCaptchaToken: "The CAPTCHA check failed. Try again.",
+};
+
+// Wix IAM application-error codes, named as the SDK names them.
+export const AUTH_ERROR_CODES = {
+  MISSING_CAPTCHA: "-19971",
+  INVALID_CAPTCHA: "-19970",
+  EMAIL_EXISTS: "-19995",
+  INVALID_PASSWORD: "-19976",
+  RESET_PASSWORD: "-19973",
+} as const;
+
+/** A failed login's applicationError code → the SDK's errorCode name (anything unrecognized is `invalidEmail`, as the SDK does). */
+export function loginErrorCode(code: string | undefined): string {
+  switch (code) {
+    case AUTH_ERROR_CODES.MISSING_CAPTCHA:
+      return "missingCaptchaToken";
+    case AUTH_ERROR_CODES.INVALID_CAPTCHA:
+      return "invalidCaptchaToken";
+    case AUTH_ERROR_CODES.INVALID_PASSWORD:
+      return "invalidPassword";
+    case AUTH_ERROR_CODES.RESET_PASSWORD:
+      return "resetPassword";
+    default:
+      return "invalidEmail";
+  }
+}
+
+/**
+ * A failed registration's applicationError code (+ the response `details`) → the SDK's errorCode
+ * name; undefined when the SDK would name none. A validation error on the EMAIL field is `invalidEmail`.
+ */
+export function registerErrorCode(code: string | undefined, details?: RawAuth): string | undefined {
+  const violations: RawAuth[] = details?.validationError?.fieldViolations ?? [];
+  if (violations.some((v) => v?.data?.type === "EMAIL")) return "invalidEmail";
+  switch (code) {
+    case AUTH_ERROR_CODES.MISSING_CAPTCHA:
+      return "missingCaptchaToken";
+    case AUTH_ERROR_CODES.EMAIL_EXISTS:
+      return "emailAlreadyExists";
+    case AUTH_ERROR_CODES.INVALID_CAPTCHA:
+      return "invalidCaptchaToken";
+    default:
+      return undefined;
+  }
+}

package/skills/wix-headless-templates/members/app/wix/members/auth.ts

@@ -0,0 +1,117 @@
+// Member authentication — the transport only; what a response MEANS lives in ./auth-core (shared
+// with the REST twin in templates/members/rest/auth.ts). Two transports behind one export list,
+// switched by AMBIENT_AUTH from ./client:
+//
+//   ambient (Wix-managed Astro): the integration's built-in auth routes. Credentials go to
+//     POST /api/auth/login or /api/auth/signup as JSON; a SUCCESS answers with `redirectUrl`, the
+//     Wix authorization step that the browser MUST navigate to — it bounces straight back through
+//     /api/auth/callback, which writes the member session cookie server-side (HttpOnly) and lands
+//     on `returnTo`. Email verification continues through POST /api/auth/verify-email (the pending
+//     state is a server cookie, nothing to keep here). Logout is a POST to /api/auth/logout.
+//     docs: @wix/astro docs/custom-login.md, docs/custom-signup.md, docs/email-verification.md
+//
+//   manual (any other React setup): the SDK's OAuthStrategy in the browser — login/register/verify,
+//     then the one-shot session token is exchanged for member tokens that the client persists.
+//     docs: https://dev.wix.com/docs/go-headless/authentication/members/custom-login-page/build-a-custom-login-page-js-sdk.md
+//
+// Copy as-is; extend by adding functions, never by editing the exchange.
+import { AMBIENT_AUTH, membersAuth } from "./client";
+import {
+  NO_SESSION_ERROR,
+  authOutcome,
+  failure,
+  fromAuthRoute,
+  toLoginResult,
+  type LoginResult,
+  type LoginState,
+  type RawAuth,
+} from "./auth-core";
+
+export type { LoginResult, LoginState };
+
+export interface LoginOptions {
+  /** Same-site path to land on after a SUCCESS (ambient: the callback's destination). Default "/". */
+  returnTo?: string;
+}
+
+/** Whether register() can carry first/last name. The built-in signup route takes credentials only. */
+export const PROFILE_ON_SIGNUP = !AMBIENT_AUTH;
+
+/**
+ * Session hint without a network call: manual mode knows from its tokens; ambient mode returns
+ * null — the current-member read IS the session check there (the store handles both).
+ */
+export function loggedInHint(): boolean | null {
+  return membersAuth ? membersAuth.loggedIn() : null;
+}
+
+// ---- ambient: the built-in routes ----------------------------------------------------------------
+
+function safeReturnTo(returnTo: string | undefined): string {
+  return returnTo && returnTo.startsWith("/") && !returnTo.startsWith("//") ? returnTo : "/";
+}
+
+async function postAuthRoute(path: string, body: Record<string, string>): Promise<LoginResult> {
+  const res = await fetch(path, {
+    method: "POST",
+    headers: { Accept: "application/json", "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+    credentials: "same-origin",
+  });
+  const json = (await res.json().catch(() => null)) as RawAuth | null;
+  return fromAuthRoute(res.status, json);
+}
+
+// ---- manual: the SDK strategy ----------------------------------------------------------------------
+
+// A SUCCESS carries a one-shot session token; the strategy exchanges it for member tokens
+// (getMemberTokensForDirectLogin) and setTokens persists them, so every later call runs as the member.
+async function finish(raw: RawAuth): Promise<LoginResult> {
+  const outcome = authOutcome(raw);
+  if (outcome.state === "SUCCESS") {
+    if (!outcome.sessionToken || !membersAuth) return failure(NO_SESSION_ERROR);
+    const tokens = await membersAuth.getMemberTokensForDirectLogin(outcome.sessionToken);
+    membersAuth.setTokens(tokens);
+    return { state: "SUCCESS" };
+  }
+  return toLoginResult(outcome);
+}
+
+// ---- the exports (same on both transports) ---------------------------------------------------------
+
+export async function loginMember(email: string, password: string, options: LoginOptions = {}): Promise<LoginResult> {
+  if (!membersAuth) return postAuthRoute("/api/auth/login", { email, password, returnToUrl: safeReturnTo(options.returnTo) });
+  return finish((await membersAuth.login({ email, password })) as RawAuth);
+}
+
+export async function registerMember(
+  email: string,
+  password: string,
+  profile?: { firstName?: string; lastName?: string },
+  options: LoginOptions = {},
+): Promise<LoginResult> {
+  if (!membersAuth) return postAuthRoute("/api/auth/signup", { email, password, returnToUrl: safeReturnTo(options.returnTo) });
+  return finish((await membersAuth.register({ email, password, ...(profile ? { profile } : {}) })) as RawAuth);
+}
+
+/** Continue an EMAIL_VERIFICATION_REQUIRED flow with the code from the email; the transport holds the state. */
+export async function verifyMemberEmail(verificationCode: string): Promise<LoginResult> {
+  if (!membersAuth) return postAuthRoute("/api/auth/verify-email", { verificationCode });
+  return finish((await membersAuth.processVerification({ verificationCode })) as RawAuth);
+}
+
+/** Log out through Wix (clears the session) and land on `returnTo` — navigates away. */
+export async function logoutMember(returnTo = "/"): Promise<void> {
+  const target = safeReturnTo(returnTo);
+  if (!membersAuth) {
+    // The built-in logout is a POST that answers with a redirect; a real form submit navigates.
+    const form = document.createElement("form");
+    form.method = "post";
+    form.action = `/api/auth/logout?returnToUrl=${encodeURIComponent(target)}`;
+    document.body.appendChild(form);
+    form.submit();
+    return;
+  }
+  const { logoutUrl } = await membersAuth.logout(new URL(target, window.location.origin).href);
+  window.location.assign(logoutUrl);
+}

package/skills/wix-headless-templates/members/app/wix/members/client.ts

@@ -0,0 +1,27 @@
+// The members auth seam — no client of its own. It reuses the shared seam in ../sdk, so the member
+// identity and the app's data identity are the same thing:
+//
+//   ambient (WIX_CLIENT_ID null — a Wix-managed Astro project): `membersAuth` is null. The raw
+//     `members` module is authenticated by `@wix/astro` in islands and on the server, and the
+//     credential flow runs through the integration's built-in routes (/api/auth/login, /signup,
+//     /verify-email, /logout, /callback — see ./auth.ts), which write the member session cookie
+//     server-side (HttpOnly). Nothing here touches cookies or tokens.
+//
+//   manual (WIX_CLIENT_ID set — a Vite SPA, another framework): `membersAuth` is the shared
+//     client's OAuthStrategy. login/register/verify run on it in the browser and the one-shot
+//     session token is exchanged for member tokens that the SAME strategy persists — so the cart,
+//     the member's own records, everything the app reads, runs as the member from then on.
+//
+// Copy as-is; never instantiate another client, never one per component.
+import type { IOAuthStrategy } from "@wix/sdk";
+import { members } from "@wix/members";
+import { wixAuth, wixModule } from "../sdk";
+
+/** The manual-mode auth strategy (the shared client's); null under ambient auth, where the routes own the session. */
+export const membersAuth: IOAuthStrategy | null = wixAuth();
+
+/** True in a Wix-managed Astro project: the built-in auth routes carry the credential flow. */
+export const AMBIENT_AUTH = membersAuth === null;
+
+/** The members module under the app's auth, either mode. */
+export const membersApi: typeof members = wixModule(members);