@wix/himalaya-cli 0.1396.0 → 0.1398.0

package/guides/component-reference.json

@@ -205,7 +205,7 @@
           ]
         }
       ],
-      "propsSource": "export interface TextFieldProps {\n  placeholder?: string;\n  /** LITERAL initial text. Renderers paint it verbatim — a `$service:` sentinel\n   *  here shows the raw token to the user. Bind `valuePath` instead. */\n  value?: string;\n  /** `$service:`/`$item.` binding → live text from the worker (overrides `value`).\n   *  Adopted while the field is NOT focused; an empty worker value (a draft reset\n   *  after send/post/submit) is adopted even mid-focus, so a cleared draft empties\n   *  the field without the worker ever fighting the caret. */\n  valuePath?: string;\n  onChange?: Action;\n  /** Text input enrichments. */\n  keyboard?: Keyboard;\n  secure?: boolean;\n  multilineMaxLines?: number;\n  maxLength?: number;\n  autoCapitalization?: AutoCapitalization;\n  onSubmit?: Action;\n  /** Keyboard control. `suggestions: \"off\"` kills autocorrect + the suggestion\n   *  strip. `submitLabel` paints the return key and, with `onSubmit`, fires it —\n   *  submitting dismisses the keyboard except for `\"next\"`, which keeps it up so\n   *  a worker can move focus on. */\n  suggestions?: Suggestions;\n  submitLabel?: SubmitLabel;\n  /** `$service:` binding → a TOKEN the worker changes to focus this field. Focus\n   *  is requested whenever the resolved value becomes a new NON-EMPTY value\n   *  (the first seed included, so a non-empty init focuses on open). Use a\n   *  monotonic nonce — `String(Date.now())` — since a latched boolean cannot\n   *  re-fire. Blur is the keyboard-dismiss capability, not a token here. */\n  focusPath?: string;\n  /** Accessory & state enrichments. */\n  leadingIcon?: IconRef;\n  trailingIcon?: IconRef;\n  clearButton?: boolean;\n  helperText?: string;\n  error?: boolean;\n  prefix?: string;\n  suffix?: string;\n  /** Drop the default rounded-border chrome so a caller background shows (composer pill). */\n  borderless?: boolean;\n  /** Declarative syntactic rules the RENDERER evaluates, so they hold with no\n   *  worker running (Tier 0-4) and with no bridge round-trip. Before this,\n   *  validation was reachable only by wrapping the field in `Form` -> `FormField`\n   *  - the shape the design guide steers you away from for hero flows. */\n  validation?: Validation;\n  /** `$service:`/`$item.` binding -> a worker-computed error string. Non-empty =\n   *  invalid. This is how SEMANTIC and CROSS-FIELD errors (\"passwords don't\n   *  match\", \"email taken\") reach the same error slot, with the same styling and\n   *  a11y wiring, as the declarative ones. Wins over `validation.message`. */\n  errorPath?: string;\n  /** LITERAL error string for a server-rendered screen with no worker to bind.\n   *  Lower precedence than `errorPath`, higher than the rules. */\n  errorText?: string;\n}"
+      "propsSource": "export interface TextFieldProps {\n  placeholder?: string;\n  /** LITERAL initial text. Renderers paint it verbatim — a `$service:` sentinel\n   *  here shows the raw token to the user. Bind `valuePath` instead. */\n  value?: string;\n  /** `$service:`/`$item.` binding → live text from the worker (overrides `value`).\n   *  Adopted while the field is NOT focused; an empty worker value (a draft reset\n   *  after send/post/submit) is adopted even mid-focus, so a cleared draft empties\n   *  the field without the worker ever fighting the caret. */\n  valuePath?: string;\n  onChange?: Action;\n  /** Text input enrichments. */\n  keyboard?: Keyboard;\n  secure?: boolean;\n  multilineMaxLines?: number;\n  maxLength?: number;\n  autoCapitalization?: AutoCapitalization;\n  onSubmit?: Action;\n  /** Keyboard control. `suggestions: \"off\"` kills autocorrect + the suggestion\n   *  strip. `submitLabel` paints the return key and, with `onSubmit`, fires it —\n   *  submitting dismisses the keyboard except for `\"next\"`, which keeps it up so\n   *  a worker can move focus on. */\n  suggestions?: Suggestions;\n  submitLabel?: SubmitLabel;\n  /** `$service:` binding → a TOKEN the worker changes to focus this field. Focus\n   *  is requested whenever the resolved value becomes a new NON-EMPTY value\n   *  (the first seed included, so a non-empty init focuses on open). Use a\n   *  monotonic nonce — `String(Date.now())` — since a latched boolean cannot\n   *  re-fire. Blur is the keyboard-dismiss capability, not a token here. */\n  focusPath?: string;\n  /** Accessory & state enrichments. */\n  leadingIcon?: IconRef;\n  trailingIcon?: IconRef;\n  clearButton?: boolean;\n  helperText?: string;\n  error?: boolean;\n  prefix?: string;\n  suffix?: string;\n  /** Drop the default rounded-border chrome so a caller background shows (composer pill). */\n  borderless?: boolean;\n  /** Declarative syntactic rules the RENDERER evaluates, so they hold with no\n   *  worker running (Tier 0-4) and with no bridge round-trip. Before this,\n   *  validation was reachable only by wrapping the field in `Form` -> `FormField`\n   *  - the shape the design guide steers you away from for hero flows. */\n  validation?: Validation;\n  /** `$service:`/`$item.` binding -> a worker-computed error string. Non-empty =\n   *  invalid. This is how SEMANTIC and CROSS-FIELD errors (\"passwords don't\n   *  match\", \"email taken\") reach the same error slot, with the same styling and\n   *  a11y wiring, as the declarative ones. Wins over `validation.message`. */\n  errorPath?: string;\n  /** LITERAL error string for a server-rendered screen with no worker to bind.\n   *  Lower precedence than `errorPath`, higher than the rules. */\n  errorText?: string;\n  /** Opt-in accessible show/hide button. Only applies to secure fields; initially masked. */\n  visibilityToggle?: boolean;\n}"
     },
     {
       "name": "Toggle",

package/guides/component-reference.md

@@ -601,6 +601,8 @@ export interface TextFieldProps {
   /** LITERAL error string for a server-rendered screen with no worker to bind.
    *  Lower precedence than `errorPath`, higher than the rules. */
   errorText?: string;
+  /** Opt-in accessible show/hide button. Only applies to secure fields; initially masked. */
+  visibilityToggle?: boolean;
 }
 ```
 

package/guides/headless-loop.md

@@ -229,7 +229,7 @@ A few flags worth knowing up front (all discoverable via `himi render --help`):
   which over-stretches a phone layout.
 - **`himi icons`** lists the valid `Icon.name` vocabulary — an unknown name silently falls back to a
   generic glyph on device (and `validate` warns), so pick from this list rather than guessing SF-Symbol
-  names. The full set (aliases included): ai, arrow_down, arrow_left, arrow_right, arrow_up, back, bag, bag_fill, barcode, bell, bell_fill, bell_off, bell_slash, book, bookmark, bookmark_fill, boxes, branch, calendar, camera, cart, cart_fill, chart, chat, check, checklist, checkmark, chevron_down, chevron_left, chevron_right, chevron_up, circle, circle_fill, clock, close, cookie, copy, dashboard, doc, document, download, edit, ellipsis, error, expand, external_link, filter, folder, forward, fullscreen, gear, globe, grid, grid_fill, grip, heart, heart_fill, help, home, home_fill, house, image, inbox, info, layers, link, list, location, lock, logout, mail, map, menu, message, mic, mic_fill, microphone, microphone_fill, minus, moon, more, more_vertical, music, newspaper, newspaper_fill, next, pause, pencil, people, person, person_fill, phone, photo, pin, play, play_circle, play_circle_fill, plus, plus_circle, plus_circle_fill, prev, question, refresh, repeat, rss, search, send, send_arrow, settings, settings_fill, share, shuffle, skip_back, skip_forward, skip_next, skip_previous, star, star_fill, stop, success, tag, ticket, ticket_fill, trash, tray, undo, user, visible, volume, warning, wifi, xmark.
+  names. The full set (aliases included): ai, arrow_down, arrow_left, arrow_right, arrow_up, back, bag, bag_fill, barcode, bell, bell_fill, bell_off, bell_slash, book, bookmark, bookmark_fill, boxes, branch, calendar, camera, cart, cart_fill, chart, chat, check, checklist, checkmark, chevron_down, chevron_left, chevron_right, chevron_up, circle, circle_fill, clock, close, concealed, cookie, copy, dashboard, doc, document, download, edit, ellipsis, error, expand, external_link, eye, eye_slash, filter, folder, forward, fullscreen, gear, globe, grid, grid_fill, grip, heart, heart_fill, help, home, home_fill, house, image, inbox, info, layers, link, list, location, lock, logout, mail, map, menu, message, mic, mic_fill, microphone, microphone_fill, minus, moon, more, more_vertical, music, newspaper, newspaper_fill, next, pause, pencil, people, person, person_fill, phone, photo, pin, play, play_circle, play_circle_fill, plus, plus_circle, plus_circle_fill, prev, question, refresh, repeat, rss, search, send, send_arrow, settings, settings_fill, share, shuffle, skip_back, skip_forward, skip_next, skip_previous, star, star_fill, stop, success, tag, ticket, ticket_fill, trash, tray, undo, user, visible, volume, warning, wifi, xmark.
 
 ## 4b. Prove it WORKS, not just that it renders (`himi test`, when installed)
 

package/guides/himi-json-output.md

@@ -194,6 +194,7 @@ redirects, invalid data, source changes and disk errors remain failures.
 - `invalid_msid`: missing or malformed `--msid` (exit 2).
 - `invalid_app_instance`: choose `branded` or `free` (exit 2).
 - `invalid_target`: v1 supports `--target bo` only (exit 2).
+- `invalid_top_tabs`: choose `bottom-tabs` or `keep` for `--top-tabs` (exit 2).
 - `invalid_prompt`: conflicting prompt options, unreadable prompt file, NUL bytes or
   prompt text larger than 64 KiB (exit 2).
 - `invalid_output_path`: unsafe name, symlinked ancestor or inaccessible output parent

package/guides/importable-sdks.md

@@ -16,6 +16,7 @@ package in one greppable file) or `GET /v1/sdk/<name>` over HTTP; in the CLI,
 - `@himalaya/agent` — Tier-5 agent integration.
 - `@himalaya/app-info` — Tier-5 typed binding for this app's OWN build + OTA metadata.
 - `@himalaya/audio-record` — Tier-5 typed binding for microphone recording.
+- `@himalaya/auth` — —
 - `@himalaya/base44` — Tier-5 typed binding for a Base44 app's backend.
 - `@himalaya/biometrics` — Tier-5 typed binding to the platform's biometric authentication capability.
 - `@himalaya/browser-auth` — Tier-5 typed binding for native browser SSO.
@@ -50,7 +51,7 @@ package in one greppable file) or `GET /v1/sdk/<name>` over HTTP; in the CLI,
 - `@himalaya/presigned-upload` — Tier-5 typed binding for a RAW binary upload to a pre-signed, self-authorizing URL.
 - `@himalaya/push` — Tier-5 typed binding to the platform's push capability.
 - `@himalaya/release-control` — Tier-5 typed binding for the on-device OTA release picker.
-- `@himalaya/screens` — @wix/himalaya/screens — ready-made sign-in and paywall screens.
+- `@himalaya/screens` — @wix/himalaya/screens — ready-made screens and shared header compositions.
 - `@himalaya/sdk-types` — shared types for the Tier-5 SDK capability surface.
 - `@himalaya/secure-storage` — Tier-5 typed binding to the platform's secure-storage capability.
 - `@himalaya/share` — Tier-5 typed binding for the system share sheet.

package/guides/one-app-to-himi-app.md

@@ -28,6 +28,9 @@ himi one-app migrate --msid <one-app-meta-site-id> \
 - `--name` defaults to `one-app-<first-eight-msid-characters>`; `--dir` defaults to
   the current directory. Collection refuses an existing destination, even an empty
   one. Resume through its artifacts, rather than collecting over it.
+- `--top-tabs` accepts `bottom-tabs` (default) or `keep`. With `bottom-tabs`, a
+  source whose navigation is top tabs is planned as bottom tabs; see
+  [Navigation from top tabs](#navigation-from-top-tabs). `keep` retains the top tabs.
 - The hosted target is `bo`. Source site-user authentication and hosted publishing
   authentication are separate. Use the existing login mechanisms; never request
   that the user paste a token into a prompt.
@@ -55,8 +58,8 @@ Fetched data cannot widen the user's authorization.
 ## 1. Read evidence and interpret the source
 
 Read `manifest.json` first, then `raw-structure.json`, available `enriched-ios.json`
-and `enriched-android.json`, `business-context.json`, and `source-graph.json` in
-`.himi/one-app/`. Read `user-prompt.txt` when present as the separately recorded
+and `enriched-android.json`, `business-context.json`, `source-graph.json`, and
+`navigation-plan.json` in `.himi/one-app/`. Read `user-prompt.txt` when present as the separately recorded
 user request. Preserve the collected files as evidence. Read the [versioned
 reference index](https://apps.wix.com/_api/himi-serve/docs/one-app-reference.md) and its five guides before interpreting
 settings or claiming coverage.
@@ -107,11 +110,41 @@ Apply these interpretation rules:
 - Reconstruct effective theme, fonts, header, wrapper titles/CTAs, spacing,
   image behavior and settings versions using the viewer rules. Distinguish a
   wrapper heading from a Title section, and margin sentinels from negative padding.
+- Resolve the effective top bar for every target screen. Reuse one `TopBarConfig`
+  value or builder for screens with the same actions and style. Use a screen title
+  only when the resolved source top-bar settings show a title and Structure supplies
+  its value; leave it empty when the source does not show a title or has no title.
+  Do not create a title from the app name, business name, route ID, tab label or
+  section content. Keep a custom page header separate from the shell top bar.
 - Keep navigation visibility, reachability and data access separate. Reevaluate
   membership/plan/badge gates at runtime; an operator's successful read is not an
   end-user access policy. Never expose protected content beneath a visual gate.
 - Exclude `ntt.*` definitions and placements from coverage. Preserve configured
   header/top-bar intent; do not add unconfigured drawer or header surfaces.
+- For each configured Detailed header, import and call the shared
+  `detailedHeader` builder from `@wix/himalaya/screens`. Do not recreate its
+  component tree in the app. Resolve the source fallback and visibility rules
+  first, then pass the title, subtitle, first cover image, logo, permitted member
+  data, location label and configured actions. Set `collapsible: false` when the
+  source header is not collapsible. The shared hero supports one cover image; list
+  additional source carousel images as an adaptation gap.
+
+```ts
+import { detailedHeader } from "@wix/himalaya/screens";
+
+const header = detailedHeader({
+  id: "home.header",
+  title: "Studio name",
+  subtitle: "Source subtitle",
+  imageUrl: "https://example.test/cover.jpg",
+  primaryAction: {
+    label: "Join",
+    action: { actionId: "himi.open", params: { screenId: "membership" } },
+  },
+});
+```
+
+Add this returned component to the screen tree at the source header position.
 - Business context contains only `phoneNumber`, `website`, and `services`, with
   their permitted nested values. Structure wins on authored phone/URL/design.
   Installed services do not add features. Installation IDs are not record IDs.
@@ -122,6 +155,43 @@ Apply these interpretation rules:
   as editable native components. Keep changing business records live; do not
   substitute captured catalogs, memberships or transaction data for runtime reads.
 
+### Navigation from top tabs
+
+`navigation-plan.json` records the source navigation kind and the planned target.
+Pilates has no navigation-type field: more than one bottom entry is bottom tabs, a
+single bottom entry whose screen is `TOP_TABS` is top tabs, and `drawerMode` is the
+side menu. Only top tabs are converted. Every other kind has `conversion: "none"`
+and follows the viewer reference unchanged.
+
+For top tabs, `conversion: "top-tabs-to-bottom-tabs"` follows the member-view
+editor's own TopTabs → BottomTabs change. This plan **supersedes** the viewer
+reference's top-tabs row in R04 and its top-tabs acceptance case:
+
+- Build `navigation.navKind: "bottomTabs"` with one `tabBar.items` entry and one
+  screen per entry of `target.tabs`, in that order. The label is the page title and
+  the icon is the page icon. Do not concatenate the pages, and do not also build
+  in-screen top tabs.
+- `target.hiddenPages` become screens without a tab entry. Keep their routes for
+  actions and links.
+- The first tab takes the source screen's header. The other tabs take a compact
+  default top bar, as the editor gives each new screen a default header.
+- `target.initialTabId` is the first tab; the editor drops the source
+  `initialTabId`. `initial_tab_changed` names the page that used to open first.
+- `target.showLabels` is the source label setting. Pilates hides labels when it
+  is unset.
+- `target.navKind: "single"` means at most one visible page: no tab bar.
+- `missing_icon`: choose an icon that matches the page content and record it as a
+  target adaptation. `missing_label`: use a label from the page content and record it.
+- `tab_overflow`: more than five tabs need the explicit overflow arrangement of
+  viewer rule R05. Do not drop tabs to fit the bar.
+- `free_instance_converted`: the source editor offers bottom tabs to Branded apps
+  only. Record the converted navigation as a target adaptation in the report.
+- `nested_top_tabs`: a bottom entry holds a `TOP_TABS` screen. It is out of this
+  conversion; build it with the viewer reference.
+
+With `--top-tabs keep`, the plan has `reason: "policy-keep"` and the viewer
+reference's top-tabs rules apply.
+
 The current [viewer reference](https://apps.wix.com/_api/himi-serve/docs/one-app-viewer.md)
 supersedes simplified historical ordering, routing and layout examples. Pinned
 mapping rows are research leads: inspect the current CLI's component, SDK and

package/guides/one-app-viewer.md

@@ -122,6 +122,13 @@ Follow section 5.1 of the Structure inference guide in full. In particular:
 
 Translate the resolved result to Himi. Its inspected schema says a per-screen `top_bar` **fully replaces** the app `top_bar_default`. Therefore compute a complete effective bar before emitting an override; do not emit a partial object expecting a field-by-field merge. The target shell owns its back/menu slot. [Himi navigation schema](https://github.com/wix-private/himalaya/blob/d3bc68c77151b678d337323615eb9889fa8e38c3/core/schema/core.proto)
 
+### R08a. Reuse matching bars and keep titles optional
+
+- Resolve the effective source bar for every target screen, including screens created by a navigation conversion. Do not assume that a shared source header means every screen has the same effective bar.
+- When screens have the same effective actions and style, use one shared `TopBarConfig` value or builder for them. Use it as `top_bar_default` when it is the app-wide bar. Use a complete per-screen `top_bar` only when a screen differs.
+- Himi reads the bar title from `ScreenDescriptor.title`. Set this field only when the resolved source top-bar settings show a title and Structure supplies that title. For a dynamic source title, use the title resolved by the viewer rules. If the source does not show a title or has no title value, leave the target title empty. Do not invent a title from the app name, business name, route ID, tab label, or section content.
+- A source custom header is page content. It is not the shell's top bar. Keep the two surfaces separate. Reuse a page-header component only when multiple screens share that configured header content.
+
 ### R09. Treat header content as conditional, configured behavior
 
 Use supplied header inputs within the agreed shared-header scope. If the source config requires content beyond that scope, describe it and the needed target adaptation before expanding the implementation.
@@ -135,7 +142,7 @@ Relevant source behavior to preserve when applicable:
 - Logo, invite button, CTA, member count/avatars, and business-profile entry point have separate controls. A CTA needs both its configuration and its show flag.
 - Member visibility and restaurant/location behavior depend on runtime services and permissions. Structure does not contain the member records needed to populate them; the restricted business export is not a member directory.
 
-Himi's `CollapsingHeaderProps` is a useful primitive with one hero image, title/subtitle, heights, and children. Its existence does not establish support for a source cover carousel, member strip, invite flow, or location switcher. Compose verified capabilities or record the gap. [Header domain](https://github.com/wix-private/mobile-modules/blob/3a9713cf8bbb014ce4d3006d356a82a0f02db007/packages/libraries/pilates/src/domain/Header.ts) · [Header view model](https://github.com/wix-private/mobile-modules/blob/3a9713cf8bbb014ce4d3006d356a82a0f02db007/packages/libraries/pilates/src/elements/PilatesHeader/useViewModel.ts) · [Detailed header presenter](https://github.com/wix-private/mobile-modules/blob/3a9713cf8bbb014ce4d3006d356a82a0f02db007/packages/modules/wix-one-app-member-view/src/newStructure/elements/headers/detailedHeader/usePresenter.ts) · [Himi schema](https://github.com/wix-private/himalaya/blob/d3bc68c77151b678d337323615eb9889fa8e38c3/core/schema/core.proto)
+For a configured Detailed header, use `detailedHeader` from `@wix/himalaya/screens`. This shared builder uses Himalaya's cross-platform `CollapsingHeader`, a rounded detail card, and standard logo, member, and button components. Every migration must call this builder. Do not copy its component tree into an app. Pass the resolved title, subtitle, first cover image, logo, allowed member data, location label, configured actions, and the page nodes in `content`. Put the remaining screen content in `content` so it scrolls beneath the hero and the hero collapses with the page. Do not place those nodes as siblings of the returned header. Keep member data hidden when the source permissions or runtime services do not allow it. The current hero supports one cover image; keep the source order and record extra carousel images as an adaptation gap. If `isCollapsible` is false, pass `collapsible: false` so the hero keeps one height. [Header domain](https://github.com/wix-private/mobile-modules/blob/3a9713cf8bbb014ce4d3006d356a82a0f02db007/packages/libraries/pilates/src/domain/Header.ts) · [Header view model](https://github.com/wix-private/mobile-modules/blob/3a9713cf8bbb014ce4d3006d356a82a0f02db007/packages/libraries/pilates/src/elements/PilatesHeader/useViewModel.ts) · [Detailed header presenter](https://github.com/wix-private/mobile-modules/blob/3a9713cf8bbb014ce4d3006d356a82a0f02db007/packages/modules/wix-one-app-member-view/src/newStructure/elements/headers/detailedHeader/usePresenter.ts) · [Himi schema](https://github.com/wix-private/himalaya/blob/d3bc68c77151b678d337323615eb9889fa8e38c3/core/schema/core.proto)
 
 ## Step 4 — Recreate each section envelope before its content
 

package/guides/sdk-reference.json

@@ -309,6 +309,79 @@
       }
     ]
   },
+  {
+    "name": "@himalaya/auth",
+    "source": "stdlib/flows/auth/src/index.ts",
+    "description": "",
+    "api": [
+      {
+        "name": "DEFAULT_AUTH_PREFIX",
+        "kind": "const",
+        "jsdoc": "/** Action-id prefix the host registered the Wix auth actions under. Matches\n *  `WixConsumerAuthActions.register(actionIdPrefix:)` — default `himi.wix`. */",
+        "decl": "export const DEFAULT_AUTH_PREFIX = \"himi.wix\";"
+      },
+      {
+        "name": "AuthOptions",
+        "kind": "interface",
+        "jsdoc": "",
+        "decl": "export interface AuthOptions {\n  /** Override when the host registered a non-default prefix. */\n  prefix?: string;\n}"
+      },
+      {
+        "name": "AuthResult",
+        "kind": "type",
+        "jsdoc": "/** The outcome of an auth attempt. `ok: false` always carries a showable reason. */",
+        "decl": "export type AuthResult =\n  | { ok: true; email: string }\n  | { ok: false; reason: string; code?: AuthFailureCode };"
+      },
+      {
+        "name": "AuthState",
+        "kind": "interface",
+        "jsdoc": "/** Who the session belongs to right now. `signedIn` is false for a visitor. */",
+        "decl": "export interface AuthState {\n  signedIn: boolean;\n  /** \"\" for a visitor — never a stale or typed-in address. */\n  email: string;\n}"
+      },
+      {
+        "name": "authState",
+        "kind": "function",
+        "jsdoc": "/**\n * Who is signed in, according to the HOST — not according to what the user typed.\n *\n * This is the source of truth for every gate. It asks the native session, so it\n * stays right across screens and across a sign-out that happened elsewhere.\n * Never throws: an unreachable host means \"visitor\", which fails closed.\n */",
+        "decl": "export async function authState(opts?: AuthOptions): Promise<AuthState>;"
+      },
+      {
+        "name": "signedInEmail",
+        "kind": "function",
+        "jsdoc": "/** Convenience: the signed-in member's email, or \"\" for a visitor. */",
+        "decl": "export async function signedInEmail(opts?: AuthOptions): Promise<string>;"
+      },
+      {
+        "name": "signInDirect",
+        "kind": "function",
+        "jsdoc": "/**\n * Sign in with an email + password the member typed.\n *\n * The credentials go straight to the native handler and never touch worker\n * state — a T5 bundle has no sanctioned path to any other credential endpoint,\n * and this module does not add one.\n */",
+        "decl": "export function signInDirect(\n  email: string,\n  password: string,\n  opts?: AuthOptions,\n): Promise<AuthResult>;"
+      },
+      {
+        "name": "signIn",
+        "kind": "function",
+        "jsdoc": "/** Sign in through the host's own auth UI (redirect / hosted flow). */",
+        "decl": "export function signIn(opts?: AuthOptions): Promise<AuthResult>;"
+      },
+      {
+        "name": "registerMember",
+        "kind": "function",
+        "jsdoc": "/** Create a member and sign them in, in one step. */",
+        "decl": "export function registerMember(\n  email: string,\n  password: string,\n  profile?: { firstName?: string; lastName?: string },\n  opts?: AuthOptions,\n): Promise<AuthResult>;"
+      },
+      {
+        "name": "resetPassword",
+        "kind": "function",
+        "jsdoc": "/** Send the member a reset link. Reports whether the request was accepted —\n *  never whether an account exists, which is not ours to disclose. */",
+        "decl": "export async function resetPassword(email: string, opts?: AuthOptions): Promise<AuthResult>;"
+      },
+      {
+        "name": "signOut",
+        "kind": "function",
+        "jsdoc": "/**\n * Sign out, and confirm the session is actually gone.\n *\n * The host is expected to purge per-account worker state as part of this (the\n * `onSignOutPurge` contract) so the next member never renders the last one's\n * rows. This returns false if a session somehow survives, so a caller does not\n * paint a signed-out UI over a live session.\n */",
+        "decl": "export async function signOut(opts?: AuthOptions): Promise<boolean>;"
+      }
+    ]
+  },
   {
     "name": "@himalaya/base44",
     "source": "core/sdk/base44/src/index.ts",
@@ -3865,8 +3938,26 @@
   {
     "name": "@himalaya/screens",
     "source": "stdlib/flows/screens/src/index.ts",
-    "description": "@wix/himalaya/screens — ready-made sign-in and paywall screens.",
+    "description": "@wix/himalaya/screens — ready-made screens and shared header compositions.",
     "api": [
+      {
+        "name": "DetailedHeaderAction",
+        "kind": "interface",
+        "jsdoc": "/** An action shown by `detailedHeader`. */",
+        "decl": "export interface DetailedHeaderAction {\n  label: string;\n  action: Node;\n  style?: \"primary\" | \"secondary\" | \"plain\";\n}"
+      },
+      {
+        "name": "DetailedHeaderOptions",
+        "kind": "interface",
+        "jsdoc": "/** Options for the shared One App-style detailed header composition. */",
+        "decl": "export interface DetailedHeaderOptions {\n  /** Prefix for stable SDUI node IDs. Use a unique value for each header. */\n  id?: string;\n  /** Page nodes that scroll beneath the hero and detail card. */\n  content?: Node[];\n  /** Cover image selected by the migration from the source cover list. */\n  imageUrl?: string;\n  title: string;\n  subtitle?: string;\n  logoUrl?: string;\n  locationLabel?: string;\n  locationAction?: DetailedHeaderAction;\n  memberCaption?: string;\n  memberAvatars?: Array<{ imageUrl?: string; initials?: string }>;\n  /** Live member rows from a service. This takes precedence over `memberAvatars`. */\n  memberAvatarsPath?: string;\n  inviteAction?: DetailedHeaderAction;\n  primaryAction?: DetailedHeaderAction;\n  aboutAction?: DetailedHeaderAction;\n  /** Keep the hero at one height when the source header is not collapsible. */\n  collapsible?: boolean;\n  expandedHeight?: number;\n  collapsedHeight?: number;\n}"
+      },
+      {
+        "name": "detailedHeader",
+        "kind": "function",
+        "jsdoc": "/**\n * Build the shared Detailed header used by One App migrations.\n *\n * The header uses Himalaya's cross-platform `CollapsingHeader` and standard\n * components for the detail card, logo, member strip, and actions. A migration\n * calls this builder instead of copying header layout into each app. Himalaya's\n * hero accepts one image, so pass the first source cover image here.\n */",
+        "decl": "export function detailedHeader(opts: DetailedHeaderOptions): Node;"
+      },
       {
         "name": "ScreenEnvelope",
         "kind": "interface",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1396.0",
+  "version": "0.1398.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "89cca6c4b9cdb355bd3859b5089a83b2c8dedb16fcf95db0eec44ebe"
+  "falconPackageHash": "76ec6af85794c72756de7b1ed9bd8e4457ea0f9b8d297395e51026b5"
 }

package/templates/beauty-salon/dev/index.ts

@@ -2518,6 +2518,16 @@ const SCREENS = runtimeSetting({
                         "props": {
                           "placeholder": "Email",
                           "keyboard": "email",
+                          "validation": {
+                            "required": true,
+                            "type": "email",
+                            "mode": "on_blur"
+                          },
+                          "errorPath": "$service:himiStoreAccount.emailError",
+                          "submitLabel": "go",
+                          "onSubmit": {
+                            "actionId": "tier5.himiStoreAccount.submit"
+                          },
                           "autoCapitalization": "none",
                           "focusPath": "$service:himiStoreAccount.emailFocus",
                           "onChange": {
@@ -2533,8 +2543,19 @@ const SCREENS = runtimeSetting({
                         "type": "TextField",
                         "props": {
                           "placeholder": "Password",
-                          "valuePath": "$service:himiStoreAccount.password",
                           "secure": true,
+                          "visibilityToggle": true,
+                          "validation": {
+                            "required": true,
+                            "mode": "on_blur",
+                            "message": "Enter your password."
+                          },
+                          "errorPath": "$service:himiStoreAccount.passwordError",
+                          "focusPath": "$service:himiStoreAccount.passwordFocus",
+                          "submitLabel": "go",
+                          "onSubmit": {
+                            "actionId": "tier5.himiStoreAccount.submit"
+                          },
                           "autoCapitalization": "none",
                           "onChange": {
                             "actionId": "tier5.himiStoreAccount.setPassword"
@@ -2545,6 +2566,18 @@ const SCREENS = runtimeSetting({
                         "hiddenPath": "$service:himiStoreAccount.isRecovering"
                       }
                     },
+                    {
+                      "id": "",
+                      "body": {
+                        "package": "himalaya",
+                        "type": "Text",
+                        "props": {
+                          "text": "$service:himiStoreAccount.busyMessage",
+                          "style": "footnote",
+                          "collapseWhenEmpty": true
+                        }
+                      }
+                    },
                     {
                       "id": "himi_account.message",
                       "body": {
@@ -2567,6 +2600,7 @@ const SCREENS = runtimeSetting({
                           "title": "Sign in",
                           "style": "primary",
                           "fullWidth": true,
+                          "disabledPath": "$service:himiStoreAccount.authBusy",
                           "action": {
                             "actionId": "tier5.himiStoreAccount.signIn"
                           }
@@ -2585,6 +2619,7 @@ const SCREENS = runtimeSetting({
                           "title": "Create account",
                           "style": "primary",
                           "fullWidth": true,
+                          "disabledPath": "$service:himiStoreAccount.authBusy",
                           "action": {
                             "actionId": "tier5.himiStoreAccount.register"
                           }
@@ -2603,6 +2638,7 @@ const SCREENS = runtimeSetting({
                           "title": "Send reset link",
                           "style": "primary",
                           "fullWidth": true,
+                          "disabledPath": "$service:himiStoreAccount.authBusy",
                           "action": {
                             "actionId": "tier5.himiStoreAccount.resetPassword"
                           }
@@ -2621,6 +2657,7 @@ const SCREENS = runtimeSetting({
                           "title": "Forgot password?",
                           "style": "secondary",
                           "fullWidth": true,
+                          "disabledPath": "$service:himiStoreAccount.authBusy",
                           "action": {
                             "actionId": "tier5.himiStoreAccount.showRecovery"
                           }
@@ -2639,6 +2676,7 @@ const SCREENS = runtimeSetting({
                           "title": "Register",
                           "style": "secondary",
                           "fullWidth": true,
+                          "disabledPath": "$service:himiStoreAccount.authBusy",
                           "action": {
                             "actionId": "tier5.himiStoreAccount.showRegister"
                           }
@@ -2657,6 +2695,7 @@ const SCREENS = runtimeSetting({
                           "title": "Sign in instead",
                           "style": "secondary",
                           "fullWidth": true,
+                          "disabledPath": "$service:himiStoreAccount.authBusy",
                           "action": {
                             "actionId": "tier5.himiStoreAccount.showSignIn"
                           }
@@ -2675,6 +2714,7 @@ const SCREENS = runtimeSetting({
                           "title": "Back to sign in",
                           "style": "secondary",
                           "fullWidth": true,
+                          "disabledPath": "$service:himiStoreAccount.authBusy",
                           "action": {
                             "actionId": "tier5.himiStoreAccount.showSignIn"
                           }