@wix/himalaya-cli 0.1141.0 → 0.1143.0

package/templates/events-meetups/tier5-src/himi-events-rsvp/index.ts

@@ -179,9 +179,9 @@ const svc = defineService<S, {
       try {
         await dispatch("himi.wix.signInDirect", { email: s.email, password: s.password });
         const p = await probeMember({ ...s, isMember: true, identityLine: s.email });
-        return derive({ ...p, message: p.isMember ? copyParam("rsvp.signedInReady", "Signed in. You can RSVP now.") : copyParam("rsvp.signInCheckDetails", "Sign in failed. Check your details.") });
+        return derive({ ...p, password: "", message: p.isMember ? copyParam("rsvp.signedInReady", "Signed in. You can RSVP now.") : copyParam("rsvp.signInCheckDetails", "Sign in failed. Check your details.") });
       } catch {
-        return derive({ ...s, message: copyParam("rsvp.signInFailed", "Sign in failed. Try again.") });
+        return derive({ ...s, password: "", message: copyParam("rsvp.signInFailed", "Sign in failed. Try again.") });
       }
     },
     rsvp: async (s) => {

package/templates/events-meetups/tier5-src/himi-store-account/index.ts

@@ -77,7 +77,10 @@ async function authenticate(s: S, submit: () => Promise<unknown>, notMemberMessa
     if (!next.isMember) return derive({ ...next, message: notMemberMessage });
     return resumeAfterAuth(derive({ ...next, message: "" }));
   } catch {
-    return derive({ ...s, message: failedMessage });
+    // Clear the password: service state is snapshotted to disk (the worker-state
+    // store), so a failed attempt must not leave it there in cleartext. The Password
+    // field binds `valuePath` to it, so the field empties too and a retry re-types.
+    return derive({ ...s, password: "", message: failedMessage });
   } finally {
     authInFlight = false;
   }
@@ -168,6 +171,9 @@ interface S {
   noReturnPath: boolean;
   returnCta: string;
   email: string;
+  /** Held only from typing to the submit. Service state is persisted, so every
+   *  submitted sign-in/register clears it (success, not-a-member, and failure), as
+   *  do recovery and sign-out. Sign-in <-> register keeps it: the field stays up. */
   password: string;
   firstName: string;
   lastName: string;

package/templates/gym-fitness/dev/index.ts

@@ -2581,6 +2581,7 @@ const SCREENS = runtimeSetting({
                         "type": "TextField",
                         "props": {
                           "placeholder": "Password",
+                          "valuePath": "$service:himiStoreAccount.password",
                           "secure": true,
                           "autoCapitalization": "none",
                           "onChange": {
@@ -31169,6 +31170,7 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
                                         "type": "TextField",
                                         "props": {
                                           "placeholder": "Password",
+                                          "valuePath": "$service:himiBookingTime.password",
                                           "secure": true,
                                           "autoCapitalization": "none",
                                           "onChange": {
@@ -32923,7 +32925,7 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
                                 "type": "TextField",
                                 "props": {
                                   "placeholder": "Password",
-                                  "value": "",
+                                  "valuePath": "$service:himiEventsRsvp.password",
                                   "secure": true,
                                   "autoCapitalization": "none",
                                   "onChange": {

package/templates/gym-fitness/tier5-src/himi-booking-time/index.ts

@@ -603,7 +603,7 @@ const svc = defineService<S, {
           message: copyParam("time.signedInReady", "Signed in. You can book this time now."),
         });
       } catch {
-        return derive({ ...s, message: copyParam("time.signInFailed", "Sign in failed. Try again.") });
+        return derive({ ...s, password: "", message: copyParam("time.signInFailed", "Sign in failed. Try again.") });
       }
     },
     register: async (s) => {
@@ -626,7 +626,7 @@ const svc = defineService<S, {
           message: copyParam("time.registerReady", "Account created. You can book this time now."),
         });
       } catch {
-        return derive({ ...s, message: copyParam("time.registerFailed", "Account creation failed. Try another email.") });
+        return derive({ ...s, password: "", message: copyParam("time.registerFailed", "Account creation failed. Try another email.") });
       }
     },
     bookSelected: async (s) => {

package/templates/gym-fitness/tier5-src/himi-events-rsvp/index.ts

@@ -179,9 +179,9 @@ const svc = defineService<S, {
       try {
         await dispatch("himi.wix.signInDirect", { email: s.email, password: s.password });
         const p = await probeMember({ ...s, isMember: true, identityLine: s.email });
-        return derive({ ...p, message: p.isMember ? copyParam("rsvp.signedInReady", "Signed in. You can RSVP now.") : copyParam("rsvp.signInCheckDetails", "Sign in failed. Check your details.") });
+        return derive({ ...p, password: "", message: p.isMember ? copyParam("rsvp.signedInReady", "Signed in. You can RSVP now.") : copyParam("rsvp.signInCheckDetails", "Sign in failed. Check your details.") });
       } catch {
-        return derive({ ...s, message: copyParam("rsvp.signInFailed", "Sign in failed. Try again.") });
+        return derive({ ...s, password: "", message: copyParam("rsvp.signInFailed", "Sign in failed. Try again.") });
       }
     },
     rsvp: async (s) => {

package/templates/gym-fitness/tier5-src/himi-store-account/index.ts

@@ -77,7 +77,10 @@ async function authenticate(s: S, submit: () => Promise<unknown>, notMemberMessa
     if (!next.isMember) return derive({ ...next, message: notMemberMessage });
     return resumeAfterAuth(derive({ ...next, message: "" }));
   } catch {
-    return derive({ ...s, message: failedMessage });
+    // Clear the password: service state is snapshotted to disk (the worker-state
+    // store), so a failed attempt must not leave it there in cleartext. The Password
+    // field binds `valuePath` to it, so the field empties too and a retry re-types.
+    return derive({ ...s, password: "", message: failedMessage });
   } finally {
     authInFlight = false;
   }
@@ -168,6 +171,9 @@ interface S {
   noReturnPath: boolean;
   returnCta: string;
   email: string;
+  /** Held only from typing to the submit. Service state is persisted, so every
+   *  submitted sign-in/register clears it (success, not-a-member, and failure), as
+   *  do recovery and sign-out. Sign-in <-> register keeps it: the field stays up. */
   password: string;
   firstName: string;
   lastName: string;

package/templates/nonprofit-cause/dev/index.ts

@@ -2235,6 +2235,7 @@ const SCREENS = runtimeSetting({
                         "type": "TextField",
                         "props": {
                           "placeholder": "Password",
+                          "valuePath": "$service:himiStoreAccount.password",
                           "secure": true,
                           "autoCapitalization": "none",
                           "onChange": {
@@ -19612,7 +19613,7 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
                                 "type": "TextField",
                                 "props": {
                                   "placeholder": "Password",
-                                  "value": "",
+                                  "valuePath": "$service:himiEventsRsvp.password",
                                   "secure": true,
                                   "autoCapitalization": "none",
                                   "onChange": {

package/templates/nonprofit-cause/tier5-src/himi-events-rsvp/index.ts

@@ -179,9 +179,9 @@ const svc = defineService<S, {
       try {
         await dispatch("himi.wix.signInDirect", { email: s.email, password: s.password });
         const p = await probeMember({ ...s, isMember: true, identityLine: s.email });
-        return derive({ ...p, message: p.isMember ? copyParam("rsvp.signedInReady", "Signed in. You can RSVP now.") : copyParam("rsvp.signInCheckDetails", "Sign in failed. Check your details.") });
+        return derive({ ...p, password: "", message: p.isMember ? copyParam("rsvp.signedInReady", "Signed in. You can RSVP now.") : copyParam("rsvp.signInCheckDetails", "Sign in failed. Check your details.") });
       } catch {
-        return derive({ ...s, message: copyParam("rsvp.signInFailed", "Sign in failed. Try again.") });
+        return derive({ ...s, password: "", message: copyParam("rsvp.signInFailed", "Sign in failed. Try again.") });
       }
     },
     rsvp: async (s) => {

package/templates/nonprofit-cause/tier5-src/himi-store-account/index.ts

@@ -77,7 +77,10 @@ async function authenticate(s: S, submit: () => Promise<unknown>, notMemberMessa
     if (!next.isMember) return derive({ ...next, message: notMemberMessage });
     return resumeAfterAuth(derive({ ...next, message: "" }));
   } catch {
-    return derive({ ...s, message: failedMessage });
+    // Clear the password: service state is snapshotted to disk (the worker-state
+    // store), so a failed attempt must not leave it there in cleartext. The Password
+    // field binds `valuePath` to it, so the field empties too and a retry re-types.
+    return derive({ ...s, password: "", message: failedMessage });
   } finally {
     authInFlight = false;
   }
@@ -168,6 +171,9 @@ interface S {
   noReturnPath: boolean;
   returnCta: string;
   email: string;
+  /** Held only from typing to the submit. Service state is persisted, so every
+   *  submitted sign-in/register clears it (success, not-a-member, and failure), as
+   *  do recovery and sign-out. Sign-in <-> register keeps it: the field stays up. */
   password: string;
   firstName: string;
   lastName: string;

package/templates/podcast-creator/dev/index.ts

@@ -2173,6 +2173,7 @@ const SCREENS = runtimeSetting({
                         "type": "TextField",
                         "props": {
                           "placeholder": "Password",
+                          "valuePath": "$service:himiStoreAccount.password",
                           "secure": true,
                           "autoCapitalization": "none",
                           "onChange": {
@@ -19965,7 +19966,7 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
                                 "type": "TextField",
                                 "props": {
                                   "placeholder": "Password",
-                                  "value": "",
+                                  "valuePath": "$service:himiEventsRsvp.password",
                                   "secure": true,
                                   "autoCapitalization": "none",
                                   "onChange": {

package/templates/podcast-creator/tier5-src/himi-events-rsvp/index.ts

@@ -179,9 +179,9 @@ const svc = defineService<S, {
       try {
         await dispatch("himi.wix.signInDirect", { email: s.email, password: s.password });
         const p = await probeMember({ ...s, isMember: true, identityLine: s.email });
-        return derive({ ...p, message: p.isMember ? copyParam("rsvp.signedInReady", "Signed in. You can RSVP now.") : copyParam("rsvp.signInCheckDetails", "Sign in failed. Check your details.") });
+        return derive({ ...p, password: "", message: p.isMember ? copyParam("rsvp.signedInReady", "Signed in. You can RSVP now.") : copyParam("rsvp.signInCheckDetails", "Sign in failed. Check your details.") });
       } catch {
-        return derive({ ...s, message: copyParam("rsvp.signInFailed", "Sign in failed. Try again.") });
+        return derive({ ...s, password: "", message: copyParam("rsvp.signInFailed", "Sign in failed. Try again.") });
       }
     },
     rsvp: async (s) => {

package/templates/podcast-creator/tier5-src/himi-store-account/index.ts

@@ -77,7 +77,10 @@ async function authenticate(s: S, submit: () => Promise<unknown>, notMemberMessa
     if (!next.isMember) return derive({ ...next, message: notMemberMessage });
     return resumeAfterAuth(derive({ ...next, message: "" }));
   } catch {
-    return derive({ ...s, message: failedMessage });
+    // Clear the password: service state is snapshotted to disk (the worker-state
+    // store), so a failed attempt must not leave it there in cleartext. The Password
+    // field binds `valuePath` to it, so the field empties too and a retry re-types.
+    return derive({ ...s, password: "", message: failedMessage });
   } finally {
     authInFlight = false;
   }
@@ -168,6 +171,9 @@ interface S {
   noReturnPath: boolean;
   returnCta: string;
   email: string;
+  /** Held only from typing to the submit. Service state is persisted, so every
+   *  submitted sign-in/register clears it (success, not-a-member, and failure), as
+   *  do recovery and sign-out. Sign-in <-> register keeps it: the field stays up. */
   password: string;
   firstName: string;
   lastName: string;

package/templates/portfolio-creative/dev/index.ts

@@ -2043,6 +2043,7 @@ const SCREENS = runtimeSetting({
                         "type": "TextField",
                         "props": {
                           "placeholder": "Password",
+                          "valuePath": "$service:himiStoreAccount.password",
                           "secure": true,
                           "autoCapitalization": "none",
                           "onChange": {
@@ -24332,7 +24333,7 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
                                 "type": "TextField",
                                 "props": {
                                   "placeholder": "Password",
-                                  "value": "",
+                                  "valuePath": "$service:himiEventsRsvp.password",
                                   "secure": true,
                                   "autoCapitalization": "none",
                                   "onChange": {

package/templates/portfolio-creative/tier5-src/himi-events-rsvp/index.ts

@@ -179,9 +179,9 @@ const svc = defineService<S, {
       try {
         await dispatch("himi.wix.signInDirect", { email: s.email, password: s.password });
         const p = await probeMember({ ...s, isMember: true, identityLine: s.email });
-        return derive({ ...p, message: p.isMember ? copyParam("rsvp.signedInReady", "Signed in. You can RSVP now.") : copyParam("rsvp.signInCheckDetails", "Sign in failed. Check your details.") });
+        return derive({ ...p, password: "", message: p.isMember ? copyParam("rsvp.signedInReady", "Signed in. You can RSVP now.") : copyParam("rsvp.signInCheckDetails", "Sign in failed. Check your details.") });
       } catch {
-        return derive({ ...s, message: copyParam("rsvp.signInFailed", "Sign in failed. Try again.") });
+        return derive({ ...s, password: "", message: copyParam("rsvp.signInFailed", "Sign in failed. Try again.") });
       }
     },
     rsvp: async (s) => {

package/templates/portfolio-creative/tier5-src/himi-store-account/index.ts

@@ -77,7 +77,10 @@ async function authenticate(s: S, submit: () => Promise<unknown>, notMemberMessa
     if (!next.isMember) return derive({ ...next, message: notMemberMessage });
     return resumeAfterAuth(derive({ ...next, message: "" }));
   } catch {
-    return derive({ ...s, message: failedMessage });
+    // Clear the password: service state is snapshotted to disk (the worker-state
+    // store), so a failed attempt must not leave it there in cleartext. The Password
+    // field binds `valuePath` to it, so the field empties too and a retry re-types.
+    return derive({ ...s, password: "", message: failedMessage });
   } finally {
     authInFlight = false;
   }
@@ -168,6 +171,9 @@ interface S {
   noReturnPath: boolean;
   returnCta: string;
   email: string;
+  /** Held only from typing to the submit. Service state is persisted, so every
+   *  submitted sign-in/register clears it (success, not-a-member, and failure), as
+   *  do recovery and sign-out. Sign-in <-> register keeps it: the field stays up. */
   password: string;
   firstName: string;
   lastName: string;

package/templates/restaurant/dev/index.ts

@@ -2099,6 +2099,7 @@ const SCREENS = runtimeSetting({
                         "type": "TextField",
                         "props": {
                           "placeholder": "Password",
+                          "valuePath": "$service:himiStoreAccount.password",
                           "secure": true,
                           "autoCapitalization": "none",
                           "onChange": {
@@ -17408,7 +17409,7 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
                                 "type": "TextField",
                                 "props": {
                                   "placeholder": "Password",
-                                  "value": "",
+                                  "valuePath": "$service:himiEventsRsvp.password",
                                   "secure": true,
                                   "autoCapitalization": "none",
                                   "onChange": {

package/templates/restaurant/tier5-src/himi-events-rsvp/index.ts

@@ -179,9 +179,9 @@ const svc = defineService<S, {
       try {
         await dispatch("himi.wix.signInDirect", { email: s.email, password: s.password });
         const p = await probeMember({ ...s, isMember: true, identityLine: s.email });
-        return derive({ ...p, message: p.isMember ? copyParam("rsvp.signedInReady", "Signed in. You can RSVP now.") : copyParam("rsvp.signInCheckDetails", "Sign in failed. Check your details.") });
+        return derive({ ...p, password: "", message: p.isMember ? copyParam("rsvp.signedInReady", "Signed in. You can RSVP now.") : copyParam("rsvp.signInCheckDetails", "Sign in failed. Check your details.") });
       } catch {
-        return derive({ ...s, message: copyParam("rsvp.signInFailed", "Sign in failed. Try again.") });
+        return derive({ ...s, password: "", message: copyParam("rsvp.signInFailed", "Sign in failed. Try again.") });
       }
     },
     rsvp: async (s) => {

package/templates/restaurant/tier5-src/himi-store-account/index.ts

@@ -77,7 +77,10 @@ async function authenticate(s: S, submit: () => Promise<unknown>, notMemberMessa
     if (!next.isMember) return derive({ ...next, message: notMemberMessage });
     return resumeAfterAuth(derive({ ...next, message: "" }));
   } catch {
-    return derive({ ...s, message: failedMessage });
+    // Clear the password: service state is snapshotted to disk (the worker-state
+    // store), so a failed attempt must not leave it there in cleartext. The Password
+    // field binds `valuePath` to it, so the field empties too and a retry re-types.
+    return derive({ ...s, password: "", message: failedMessage });
   } finally {
     authInFlight = false;
   }
@@ -168,6 +171,9 @@ interface S {
   noReturnPath: boolean;
   returnCta: string;
   email: string;
+  /** Held only from typing to the submit. Service state is persisted, so every
+   *  submitted sign-in/register clears it (success, not-a-member, and failure), as
+   *  do recovery and sign-out. Sign-in <-> register keeps it: the field stays up. */
   password: string;
   firstName: string;
   lastName: string;

package/templates/retail-store/dev/index.ts

@@ -1576,6 +1576,7 @@ const SCREENS = runtimeSetting({
                         "type": "TextField",
                         "props": {
                           "placeholder": "Password",
+                          "valuePath": "$service:himiStoreAccount.password",
                           "secure": true,
                           "autoCapitalization": "none",
                           "onChange": {

package/templates/retail-store/tier5-src/himi-store-account/index.ts

@@ -77,7 +77,10 @@ async function authenticate(s: S, submit: () => Promise<unknown>, notMemberMessa
     if (!next.isMember) return derive({ ...next, message: notMemberMessage });
     return resumeAfterAuth(derive({ ...next, message: "" }));
   } catch {
-    return derive({ ...s, message: failedMessage });
+    // Clear the password: service state is snapshotted to disk (the worker-state
+    // store), so a failed attempt must not leave it there in cleartext. The Password
+    // field binds `valuePath` to it, so the field empties too and a retry re-types.
+    return derive({ ...s, password: "", message: failedMessage });
   } finally {
     authInFlight = false;
   }
@@ -168,6 +171,9 @@ interface S {
   noReturnPath: boolean;
   returnCta: string;
   email: string;
+  /** Held only from typing to the submit. Service state is persisted, so every
+   *  submitted sign-in/register clears it (success, not-a-member, and failure), as
+   *  do recovery and sign-out. Sign-in <-> register keeps it: the field stays up. */
   password: string;
   firstName: string;
   lastName: string;

package/templates/yoga-studio/dev/index.ts

@@ -2507,6 +2507,7 @@ const SCREENS = runtimeSetting({
                         "type": "TextField",
                         "props": {
                           "placeholder": "Password",
+                          "valuePath": "$service:himiStoreAccount.password",
                           "secure": true,
                           "autoCapitalization": "none",
                           "onChange": {
@@ -24951,6 +24952,7 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
                                         "type": "TextField",
                                         "props": {
                                           "placeholder": "Password",
+                                          "valuePath": "$service:himiBookingTime.password",
                                           "secure": true,
                                           "autoCapitalization": "none",
                                           "onChange": {
@@ -27133,7 +27135,7 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
                                 "type": "TextField",
                                 "props": {
                                   "placeholder": "Password",
-                                  "value": "",
+                                  "valuePath": "$service:himiEventsRsvp.password",
                                   "secure": true,
                                   "autoCapitalization": "none",
                                   "onChange": {

package/templates/yoga-studio/tier5-src/himi-booking-time/index.ts

@@ -603,7 +603,7 @@ const svc = defineService<S, {
           message: copyParam("time.signedInReady", "Signed in. You can book this time now."),
         });
       } catch {
-        return derive({ ...s, message: copyParam("time.signInFailed", "Sign in failed. Try again.") });
+        return derive({ ...s, password: "", message: copyParam("time.signInFailed", "Sign in failed. Try again.") });
       }
     },
     register: async (s) => {
@@ -626,7 +626,7 @@ const svc = defineService<S, {
           message: copyParam("time.registerReady", "Account created. You can book this time now."),
         });
       } catch {
-        return derive({ ...s, message: copyParam("time.registerFailed", "Account creation failed. Try another email.") });
+        return derive({ ...s, password: "", message: copyParam("time.registerFailed", "Account creation failed. Try another email.") });
       }
     },
     bookSelected: async (s) => {

package/templates/yoga-studio/tier5-src/himi-events-rsvp/index.ts

@@ -179,9 +179,9 @@ const svc = defineService<S, {
       try {
         await dispatch("himi.wix.signInDirect", { email: s.email, password: s.password });
         const p = await probeMember({ ...s, isMember: true, identityLine: s.email });
-        return derive({ ...p, message: p.isMember ? copyParam("rsvp.signedInReady", "Signed in. You can RSVP now.") : copyParam("rsvp.signInCheckDetails", "Sign in failed. Check your details.") });
+        return derive({ ...p, password: "", message: p.isMember ? copyParam("rsvp.signedInReady", "Signed in. You can RSVP now.") : copyParam("rsvp.signInCheckDetails", "Sign in failed. Check your details.") });
       } catch {
-        return derive({ ...s, message: copyParam("rsvp.signInFailed", "Sign in failed. Try again.") });
+        return derive({ ...s, password: "", message: copyParam("rsvp.signInFailed", "Sign in failed. Try again.") });
       }
     },
     rsvp: async (s) => {

package/templates/yoga-studio/tier5-src/himi-store-account/index.ts

@@ -77,7 +77,10 @@ async function authenticate(s: S, submit: () => Promise<unknown>, notMemberMessa
     if (!next.isMember) return derive({ ...next, message: notMemberMessage });
     return resumeAfterAuth(derive({ ...next, message: "" }));
   } catch {
-    return derive({ ...s, message: failedMessage });
+    // Clear the password: service state is snapshotted to disk (the worker-state
+    // store), so a failed attempt must not leave it there in cleartext. The Password
+    // field binds `valuePath` to it, so the field empties too and a retry re-types.
+    return derive({ ...s, password: "", message: failedMessage });
   } finally {
     authInFlight = false;
   }
@@ -168,6 +171,9 @@ interface S {
   noReturnPath: boolean;
   returnCta: string;
   email: string;
+  /** Held only from typing to the submit. Service state is persisted, so every
+   *  submitted sign-in/register clears it (success, not-a-member, and failure), as
+   *  do recovery and sign-out. Sign-in <-> register keeps it: the field stays up. */
   password: string;
   firstName: string;
   lastName: string;