@wix/himalaya-cli 0.1397.0 → 0.1399.0

package/guides/component-reference.json

@@ -205,7 +205,7 @@
           ]
         }
       ],
-      "propsSource": "export interface TextFieldProps {\n  placeholder?: string;\n  /** LITERAL initial text. Renderers paint it verbatim — a `$service:` sentinel\n   *  here shows the raw token to the user. Bind `valuePath` instead. */\n  value?: string;\n  /** `$service:`/`$item.` binding → live text from the worker (overrides `value`).\n   *  Adopted while the field is NOT focused; an empty worker value (a draft reset\n   *  after send/post/submit) is adopted even mid-focus, so a cleared draft empties\n   *  the field without the worker ever fighting the caret. */\n  valuePath?: string;\n  onChange?: Action;\n  /** Text input enrichments. */\n  keyboard?: Keyboard;\n  secure?: boolean;\n  multilineMaxLines?: number;\n  maxLength?: number;\n  autoCapitalization?: AutoCapitalization;\n  onSubmit?: Action;\n  /** Keyboard control. `suggestions: \"off\"` kills autocorrect + the suggestion\n   *  strip. `submitLabel` paints the return key and, with `onSubmit`, fires it —\n   *  submitting dismisses the keyboard except for `\"next\"`, which keeps it up so\n   *  a worker can move focus on. */\n  suggestions?: Suggestions;\n  submitLabel?: SubmitLabel;\n  /** `$service:` binding → a TOKEN the worker changes to focus this field. Focus\n   *  is requested whenever the resolved value becomes a new NON-EMPTY value\n   *  (the first seed included, so a non-empty init focuses on open). Use a\n   *  monotonic nonce — `String(Date.now())` — since a latched boolean cannot\n   *  re-fire. Blur is the keyboard-dismiss capability, not a token here. */\n  focusPath?: string;\n  /** Accessory & state enrichments. */\n  leadingIcon?: IconRef;\n  trailingIcon?: IconRef;\n  clearButton?: boolean;\n  helperText?: string;\n  error?: boolean;\n  prefix?: string;\n  suffix?: string;\n  /** Drop the default rounded-border chrome so a caller background shows (composer pill). */\n  borderless?: boolean;\n  /** Declarative syntactic rules the RENDERER evaluates, so they hold with no\n   *  worker running (Tier 0-4) and with no bridge round-trip. Before this,\n   *  validation was reachable only by wrapping the field in `Form` -> `FormField`\n   *  - the shape the design guide steers you away from for hero flows. */\n  validation?: Validation;\n  /** `$service:`/`$item.` binding -> a worker-computed error string. Non-empty =\n   *  invalid. This is how SEMANTIC and CROSS-FIELD errors (\"passwords don't\n   *  match\", \"email taken\") reach the same error slot, with the same styling and\n   *  a11y wiring, as the declarative ones. Wins over `validation.message`. */\n  errorPath?: string;\n  /** LITERAL error string for a server-rendered screen with no worker to bind.\n   *  Lower precedence than `errorPath`, higher than the rules. */\n  errorText?: string;\n}"
+      "propsSource": "export interface TextFieldProps {\n  placeholder?: string;\n  /** LITERAL initial text. Renderers paint it verbatim — a `$service:` sentinel\n   *  here shows the raw token to the user. Bind `valuePath` instead. */\n  value?: string;\n  /** `$service:`/`$item.` binding → live text from the worker (overrides `value`).\n   *  Adopted while the field is NOT focused; an empty worker value (a draft reset\n   *  after send/post/submit) is adopted even mid-focus, so a cleared draft empties\n   *  the field without the worker ever fighting the caret. */\n  valuePath?: string;\n  onChange?: Action;\n  /** Text input enrichments. */\n  keyboard?: Keyboard;\n  secure?: boolean;\n  multilineMaxLines?: number;\n  maxLength?: number;\n  autoCapitalization?: AutoCapitalization;\n  onSubmit?: Action;\n  /** Keyboard control. `suggestions: \"off\"` kills autocorrect + the suggestion\n   *  strip. `submitLabel` paints the return key and, with `onSubmit`, fires it —\n   *  submitting dismisses the keyboard except for `\"next\"`, which keeps it up so\n   *  a worker can move focus on. */\n  suggestions?: Suggestions;\n  submitLabel?: SubmitLabel;\n  /** `$service:` binding → a TOKEN the worker changes to focus this field. Focus\n   *  is requested whenever the resolved value becomes a new NON-EMPTY value\n   *  (the first seed included, so a non-empty init focuses on open). Use a\n   *  monotonic nonce — `String(Date.now())` — since a latched boolean cannot\n   *  re-fire. Blur is the keyboard-dismiss capability, not a token here. */\n  focusPath?: string;\n  /** Accessory & state enrichments. */\n  leadingIcon?: IconRef;\n  trailingIcon?: IconRef;\n  clearButton?: boolean;\n  helperText?: string;\n  error?: boolean;\n  prefix?: string;\n  suffix?: string;\n  /** Drop the default rounded-border chrome so a caller background shows (composer pill). */\n  borderless?: boolean;\n  /** Declarative syntactic rules the RENDERER evaluates, so they hold with no\n   *  worker running (Tier 0-4) and with no bridge round-trip. Before this,\n   *  validation was reachable only by wrapping the field in `Form` -> `FormField`\n   *  - the shape the design guide steers you away from for hero flows. */\n  validation?: Validation;\n  /** `$service:`/`$item.` binding -> a worker-computed error string. Non-empty =\n   *  invalid. This is how SEMANTIC and CROSS-FIELD errors (\"passwords don't\n   *  match\", \"email taken\") reach the same error slot, with the same styling and\n   *  a11y wiring, as the declarative ones. Wins over `validation.message`. */\n  errorPath?: string;\n  /** LITERAL error string for a server-rendered screen with no worker to bind.\n   *  Lower precedence than `errorPath`, higher than the rules. */\n  errorText?: string;\n  /** Opt-in accessible show/hide button. Only applies to secure fields; initially masked. */\n  visibilityToggle?: boolean;\n}"
     },
     {
       "name": "Toggle",

package/guides/component-reference.md

@@ -601,6 +601,8 @@ export interface TextFieldProps {
   /** LITERAL error string for a server-rendered screen with no worker to bind.
    *  Lower precedence than `errorPath`, higher than the rules. */
   errorText?: string;
+  /** Opt-in accessible show/hide button. Only applies to secure fields; initially masked. */
+  visibilityToggle?: boolean;
 }
 ```
 

package/guides/headless-loop.md

@@ -229,7 +229,7 @@ A few flags worth knowing up front (all discoverable via `himi render --help`):
   which over-stretches a phone layout.
 - **`himi icons`** lists the valid `Icon.name` vocabulary — an unknown name silently falls back to a
   generic glyph on device (and `validate` warns), so pick from this list rather than guessing SF-Symbol
-  names. The full set (aliases included): ai, arrow_down, arrow_left, arrow_right, arrow_up, back, bag, bag_fill, barcode, bell, bell_fill, bell_off, bell_slash, book, bookmark, bookmark_fill, boxes, branch, calendar, camera, cart, cart_fill, chart, chat, check, checklist, checkmark, chevron_down, chevron_left, chevron_right, chevron_up, circle, circle_fill, clock, close, cookie, copy, dashboard, doc, document, download, edit, ellipsis, error, expand, external_link, filter, folder, forward, fullscreen, gear, globe, grid, grid_fill, grip, heart, heart_fill, help, home, home_fill, house, image, inbox, info, layers, link, list, location, lock, logout, mail, map, menu, message, mic, mic_fill, microphone, microphone_fill, minus, moon, more, more_vertical, music, newspaper, newspaper_fill, next, pause, pencil, people, person, person_fill, phone, photo, pin, play, play_circle, play_circle_fill, plus, plus_circle, plus_circle_fill, prev, question, refresh, repeat, rss, search, send, send_arrow, settings, settings_fill, share, shuffle, skip_back, skip_forward, skip_next, skip_previous, star, star_fill, stop, success, tag, ticket, ticket_fill, trash, tray, undo, user, visible, volume, warning, wifi, xmark.
+  names. The full set (aliases included): ai, arrow_down, arrow_left, arrow_right, arrow_up, back, bag, bag_fill, barcode, bell, bell_fill, bell_off, bell_slash, book, bookmark, bookmark_fill, boxes, branch, calendar, camera, cart, cart_fill, chart, chat, check, checklist, checkmark, chevron_down, chevron_left, chevron_right, chevron_up, circle, circle_fill, clock, close, concealed, cookie, copy, dashboard, doc, document, download, edit, ellipsis, error, expand, external_link, eye, eye_slash, filter, folder, forward, fullscreen, gear, gift, globe, grid, grid_fill, grip, heart, heart_fill, help, home, home_fill, house, image, inbox, info, layers, link, list, location, lock, logout, mail, map, menu, message, mic, mic_fill, microphone, microphone_fill, minus, moon, more, more_vertical, music, newspaper, newspaper_fill, next, paper_plane, pause, pencil, people, person, person_fill, phone, photo, pin, play, play_circle, play_circle_fill, plus, plus_circle, plus_circle_fill, prev, question, refresh, repeat, rss, search, send, send_arrow, settings, settings_fill, share, shuffle, skip_back, skip_forward, skip_next, skip_previous, star, star_fill, stop, success, tag, ticket, ticket_fill, trash, tray, undo, user, visible, volume, warning, wifi, xmark.
 
 ## 4b. Prove it WORKS, not just that it renders (`himi test`, when installed)
 

package/guides/importable-sdks.md

@@ -16,6 +16,7 @@ package in one greppable file) or `GET /v1/sdk/<name>` over HTTP; in the CLI,
 - `@himalaya/agent` — Tier-5 agent integration.
 - `@himalaya/app-info` — Tier-5 typed binding for this app's OWN build + OTA metadata.
 - `@himalaya/audio-record` — Tier-5 typed binding for microphone recording.
+- `@himalaya/auth` — —
 - `@himalaya/base44` — Tier-5 typed binding for a Base44 app's backend.
 - `@himalaya/biometrics` — Tier-5 typed binding to the platform's biometric authentication capability.
 - `@himalaya/browser-auth` — Tier-5 typed binding for native browser SSO.
@@ -50,7 +51,7 @@ package in one greppable file) or `GET /v1/sdk/<name>` over HTTP; in the CLI,
 - `@himalaya/presigned-upload` — Tier-5 typed binding for a RAW binary upload to a pre-signed, self-authorizing URL.
 - `@himalaya/push` — Tier-5 typed binding to the platform's push capability.
 - `@himalaya/release-control` — Tier-5 typed binding for the on-device OTA release picker.
-- `@himalaya/screens` — @wix/himalaya/screens — ready-made sign-in and paywall screens.
+- `@himalaya/screens` — @wix/himalaya/screens — ready-made screens and shared header compositions.
 - `@himalaya/sdk-types` — shared types for the Tier-5 SDK capability surface.
 - `@himalaya/secure-storage` — Tier-5 typed binding to the platform's secure-storage capability.
 - `@himalaya/share` — Tier-5 typed binding for the system share sheet.

package/guides/one-app-to-himi-app.md

@@ -110,11 +110,41 @@ Apply these interpretation rules:
 - Reconstruct effective theme, fonts, header, wrapper titles/CTAs, spacing,
   image behavior and settings versions using the viewer rules. Distinguish a
   wrapper heading from a Title section, and margin sentinels from negative padding.
+- Resolve the effective top bar for every target screen. Reuse one `TopBarConfig`
+  value or builder for screens with the same actions and style. Use a screen title
+  only when the resolved source top-bar settings show a title and Structure supplies
+  its value; leave it empty when the source does not show a title or has no title.
+  Do not create a title from the app name, business name, route ID, tab label or
+  section content. Keep a custom page header separate from the shell top bar.
 - Keep navigation visibility, reachability and data access separate. Reevaluate
   membership/plan/badge gates at runtime; an operator's successful read is not an
   end-user access policy. Never expose protected content beneath a visual gate.
 - Exclude `ntt.*` definitions and placements from coverage. Preserve configured
   header/top-bar intent; do not add unconfigured drawer or header surfaces.
+- For each configured Detailed header, import and call the shared
+  `detailedHeader` builder from `@wix/himalaya/screens`. Do not recreate its
+  component tree in the app. Resolve the source fallback and visibility rules
+  first, then pass the title, subtitle, first cover image, logo, permitted member
+  data, location label and configured actions. Set `collapsible: false` when the
+  source header is not collapsible. The shared hero supports one cover image; list
+  additional source carousel images as an adaptation gap.
+
+```ts
+import { detailedHeader } from "@wix/himalaya/screens";
+
+const header = detailedHeader({
+  id: "home.header",
+  title: "Studio name",
+  subtitle: "Source subtitle",
+  imageUrl: "https://example.test/cover.jpg",
+  primaryAction: {
+    label: "Join",
+    action: { actionId: "himi.open", params: { screenId: "membership" } },
+  },
+});
+```
+
+Add this returned component to the screen tree at the source header position.
 - Business context contains only `phoneNumber`, `website`, and `services`, with
   their permitted nested values. Structure wins on authored phone/URL/design.
   Installed services do not add features. Installation IDs are not record IDs.

package/guides/one-app-viewer.md

@@ -122,6 +122,13 @@ Follow section 5.1 of the Structure inference guide in full. In particular:
 
 Translate the resolved result to Himi. Its inspected schema says a per-screen `top_bar` **fully replaces** the app `top_bar_default`. Therefore compute a complete effective bar before emitting an override; do not emit a partial object expecting a field-by-field merge. The target shell owns its back/menu slot. [Himi navigation schema](https://github.com/wix-private/himalaya/blob/d3bc68c77151b678d337323615eb9889fa8e38c3/core/schema/core.proto)
 
+### R08a. Reuse matching bars and keep titles optional
+
+- Resolve the effective source bar for every target screen, including screens created by a navigation conversion. Do not assume that a shared source header means every screen has the same effective bar.
+- When screens have the same effective actions and style, use one shared `TopBarConfig` value or builder for them. Use it as `top_bar_default` when it is the app-wide bar. Use a complete per-screen `top_bar` only when a screen differs.
+- Himi reads the bar title from `ScreenDescriptor.title`. Set this field only when the resolved source top-bar settings show a title and Structure supplies that title. For a dynamic source title, use the title resolved by the viewer rules. If the source does not show a title or has no title value, leave the target title empty. Do not invent a title from the app name, business name, route ID, tab label, or section content.
+- A source custom header is page content. It is not the shell's top bar. Keep the two surfaces separate. Reuse a page-header component only when multiple screens share that configured header content.
+
 ### R09. Treat header content as conditional, configured behavior
 
 Use supplied header inputs within the agreed shared-header scope. If the source config requires content beyond that scope, describe it and the needed target adaptation before expanding the implementation.
@@ -135,7 +142,7 @@ Relevant source behavior to preserve when applicable:
 - Logo, invite button, CTA, member count/avatars, and business-profile entry point have separate controls. A CTA needs both its configuration and its show flag.
 - Member visibility and restaurant/location behavior depend on runtime services and permissions. Structure does not contain the member records needed to populate them; the restricted business export is not a member directory.
 
-Himi's `CollapsingHeaderProps` is a useful primitive with one hero image, title/subtitle, heights, and children. Its existence does not establish support for a source cover carousel, member strip, invite flow, or location switcher. Compose verified capabilities or record the gap. [Header domain](https://github.com/wix-private/mobile-modules/blob/3a9713cf8bbb014ce4d3006d356a82a0f02db007/packages/libraries/pilates/src/domain/Header.ts) · [Header view model](https://github.com/wix-private/mobile-modules/blob/3a9713cf8bbb014ce4d3006d356a82a0f02db007/packages/libraries/pilates/src/elements/PilatesHeader/useViewModel.ts) · [Detailed header presenter](https://github.com/wix-private/mobile-modules/blob/3a9713cf8bbb014ce4d3006d356a82a0f02db007/packages/modules/wix-one-app-member-view/src/newStructure/elements/headers/detailedHeader/usePresenter.ts) · [Himi schema](https://github.com/wix-private/himalaya/blob/d3bc68c77151b678d337323615eb9889fa8e38c3/core/schema/core.proto)
+For a configured Detailed header, use `detailedHeader` from `@wix/himalaya/screens`. This shared builder uses Himalaya's cross-platform `CollapsingHeader`, a rounded detail card, and standard logo, member, and button components. Every migration must call this builder. Do not copy its component tree into an app. Pass the resolved title, subtitle, first cover image, logo, allowed member data, location label, configured actions, and the page nodes in `content`. Put the remaining screen content in `content` so it scrolls beneath the hero and the hero collapses with the page. Do not place those nodes as siblings of the returned header. Keep member data hidden when the source permissions or runtime services do not allow it. The current hero supports one cover image; keep the source order and record extra carousel images as an adaptation gap. If `isCollapsible` is false, pass `collapsible: false` so the hero keeps one height. [Header domain](https://github.com/wix-private/mobile-modules/blob/3a9713cf8bbb014ce4d3006d356a82a0f02db007/packages/libraries/pilates/src/domain/Header.ts) · [Header view model](https://github.com/wix-private/mobile-modules/blob/3a9713cf8bbb014ce4d3006d356a82a0f02db007/packages/libraries/pilates/src/elements/PilatesHeader/useViewModel.ts) · [Detailed header presenter](https://github.com/wix-private/mobile-modules/blob/3a9713cf8bbb014ce4d3006d356a82a0f02db007/packages/modules/wix-one-app-member-view/src/newStructure/elements/headers/detailedHeader/usePresenter.ts) · [Himi schema](https://github.com/wix-private/himalaya/blob/d3bc68c77151b678d337323615eb9889fa8e38c3/core/schema/core.proto)
 
 ## Step 4 — Recreate each section envelope before its content
 

package/guides/sdk-reference.json

@@ -309,6 +309,79 @@
       }
     ]
   },
+  {
+    "name": "@himalaya/auth",
+    "source": "stdlib/flows/auth/src/index.ts",
+    "description": "",
+    "api": [
+      {
+        "name": "DEFAULT_AUTH_PREFIX",
+        "kind": "const",
+        "jsdoc": "/** Action-id prefix the host registered the Wix auth actions under. Matches\n *  `WixConsumerAuthActions.register(actionIdPrefix:)` — default `himi.wix`. */",
+        "decl": "export const DEFAULT_AUTH_PREFIX = \"himi.wix\";"
+      },
+      {
+        "name": "AuthOptions",
+        "kind": "interface",
+        "jsdoc": "",
+        "decl": "export interface AuthOptions {\n  /** Override when the host registered a non-default prefix. */\n  prefix?: string;\n}"
+      },
+      {
+        "name": "AuthResult",
+        "kind": "type",
+        "jsdoc": "/** The outcome of an auth attempt. `ok: false` always carries a showable reason. */",
+        "decl": "export type AuthResult =\n  | { ok: true; email: string }\n  | { ok: false; reason: string; code?: AuthFailureCode };"
+      },
+      {
+        "name": "AuthState",
+        "kind": "interface",
+        "jsdoc": "/** Who the session belongs to right now. `signedIn` is false for a visitor. */",
+        "decl": "export interface AuthState {\n  signedIn: boolean;\n  /** \"\" for a visitor — never a stale or typed-in address. */\n  email: string;\n}"
+      },
+      {
+        "name": "authState",
+        "kind": "function",
+        "jsdoc": "/**\n * Who is signed in, according to the HOST — not according to what the user typed.\n *\n * This is the source of truth for every gate. It asks the native session, so it\n * stays right across screens and across a sign-out that happened elsewhere.\n * Never throws: an unreachable host means \"visitor\", which fails closed.\n */",
+        "decl": "export async function authState(opts?: AuthOptions): Promise<AuthState>;"
+      },
+      {
+        "name": "signedInEmail",
+        "kind": "function",
+        "jsdoc": "/** Convenience: the signed-in member's email, or \"\" for a visitor. */",
+        "decl": "export async function signedInEmail(opts?: AuthOptions): Promise<string>;"
+      },
+      {
+        "name": "signInDirect",
+        "kind": "function",
+        "jsdoc": "/**\n * Sign in with an email + password the member typed.\n *\n * The credentials go straight to the native handler and never touch worker\n * state — a T5 bundle has no sanctioned path to any other credential endpoint,\n * and this module does not add one.\n */",
+        "decl": "export function signInDirect(\n  email: string,\n  password: string,\n  opts?: AuthOptions,\n): Promise<AuthResult>;"
+      },
+      {
+        "name": "signIn",
+        "kind": "function",
+        "jsdoc": "/** Sign in through the host's own auth UI (redirect / hosted flow). */",
+        "decl": "export function signIn(opts?: AuthOptions): Promise<AuthResult>;"
+      },
+      {
+        "name": "registerMember",
+        "kind": "function",
+        "jsdoc": "/** Create a member and sign them in, in one step. */",
+        "decl": "export function registerMember(\n  email: string,\n  password: string,\n  profile?: { firstName?: string; lastName?: string },\n  opts?: AuthOptions,\n): Promise<AuthResult>;"
+      },
+      {
+        "name": "resetPassword",
+        "kind": "function",
+        "jsdoc": "/** Send the member a reset link. Reports whether the request was accepted —\n *  never whether an account exists, which is not ours to disclose. */",
+        "decl": "export async function resetPassword(email: string, opts?: AuthOptions): Promise<AuthResult>;"
+      },
+      {
+        "name": "signOut",
+        "kind": "function",
+        "jsdoc": "/**\n * Sign out, and confirm the session is actually gone.\n *\n * The host is expected to purge per-account worker state as part of this (the\n * `onSignOutPurge` contract) so the next member never renders the last one's\n * rows. This returns false if a session somehow survives, so a caller does not\n * paint a signed-out UI over a live session.\n */",
+        "decl": "export async function signOut(opts?: AuthOptions): Promise<boolean>;"
+      }
+    ]
+  },
   {
     "name": "@himalaya/base44",
     "source": "core/sdk/base44/src/index.ts",
@@ -3865,8 +3938,26 @@
   {
     "name": "@himalaya/screens",
     "source": "stdlib/flows/screens/src/index.ts",
-    "description": "@wix/himalaya/screens — ready-made sign-in and paywall screens.",
+    "description": "@wix/himalaya/screens — ready-made screens and shared header compositions.",
     "api": [
+      {
+        "name": "DetailedHeaderAction",
+        "kind": "interface",
+        "jsdoc": "/** An action shown by `detailedHeader`. */",
+        "decl": "export interface DetailedHeaderAction {\n  label: string;\n  action: Node;\n  style?: \"primary\" | \"secondary\" | \"plain\";\n}"
+      },
+      {
+        "name": "DetailedHeaderOptions",
+        "kind": "interface",
+        "jsdoc": "/** Options for the shared One App-style detailed header composition. */",
+        "decl": "export interface DetailedHeaderOptions {\n  /** Prefix for stable SDUI node IDs. Use a unique value for each header. */\n  id?: string;\n  /** Page nodes that scroll beneath the hero and detail card. */\n  content?: Node[];\n  /** Cover image selected by the migration from the source cover list. */\n  imageUrl?: string;\n  title: string;\n  subtitle?: string;\n  logoUrl?: string;\n  locationLabel?: string;\n  locationAction?: DetailedHeaderAction;\n  memberCaption?: string;\n  memberAvatars?: Array<{ imageUrl?: string; initials?: string }>;\n  /** Live member rows from a service. This takes precedence over `memberAvatars`. */\n  memberAvatarsPath?: string;\n  inviteAction?: DetailedHeaderAction;\n  primaryAction?: DetailedHeaderAction;\n  aboutAction?: DetailedHeaderAction;\n  /** Keep the hero at one height when the source header is not collapsible. */\n  collapsible?: boolean;\n  expandedHeight?: number;\n  collapsedHeight?: number;\n}"
+      },
+      {
+        "name": "detailedHeader",
+        "kind": "function",
+        "jsdoc": "/**\n * Build the shared Detailed header used by One App migrations.\n *\n * The header uses Himalaya's cross-platform `CollapsingHeader` and standard\n * components for the detail card, logo, member strip, and actions. A migration\n * calls this builder instead of copying header layout into each app. Himalaya's\n * hero accepts one image, so pass the first source cover image here.\n */",
+        "decl": "export function detailedHeader(opts: DetailedHeaderOptions): Node;"
+      },
       {
         "name": "ScreenEnvelope",
         "kind": "interface",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1397.0",
+  "version": "0.1399.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "753d96dbe50af40fa4d14f676d64000cbc0d6e3510f65668e958c3e4"
+  "falconPackageHash": "5602cafea0f9e92feb51eb02932446cafa4658b6e7397be9ae1377cb"
 }

package/templates/beauty-salon/dev/index.ts

@@ -2518,6 +2518,16 @@ const SCREENS = runtimeSetting({
                         "props": {
                           "placeholder": "Email",
                           "keyboard": "email",
+                          "validation": {
+                            "required": true,
+                            "type": "email",
+                            "mode": "on_blur"
+                          },
+                          "errorPath": "$service:himiStoreAccount.emailError",
+                          "submitLabel": "go",
+                          "onSubmit": {
+                            "actionId": "tier5.himiStoreAccount.submit"
+                          },
                           "autoCapitalization": "none",
                           "focusPath": "$service:himiStoreAccount.emailFocus",
                           "onChange": {
@@ -2533,8 +2543,19 @@ const SCREENS = runtimeSetting({
                         "type": "TextField",
                         "props": {
                           "placeholder": "Password",
-                          "valuePath": "$service:himiStoreAccount.password",
                           "secure": true,
+                          "visibilityToggle": true,
+                          "validation": {
+                            "required": true,
+                            "mode": "on_blur",
+                            "message": "Enter your password."
+                          },
+                          "errorPath": "$service:himiStoreAccount.passwordError",
+                          "focusPath": "$service:himiStoreAccount.passwordFocus",
+                          "submitLabel": "go",
+                          "onSubmit": {
+                            "actionId": "tier5.himiStoreAccount.submit"
+                          },
                           "autoCapitalization": "none",
                           "onChange": {
                             "actionId": "tier5.himiStoreAccount.setPassword"
@@ -2545,6 +2566,18 @@ const SCREENS = runtimeSetting({
                         "hiddenPath": "$service:himiStoreAccount.isRecovering"
                       }
                     },
+                    {
+                      "id": "",
+                      "body": {
+                        "package": "himalaya",
+                        "type": "Text",
+                        "props": {
+                          "text": "$service:himiStoreAccount.busyMessage",
+                          "style": "footnote",
+                          "collapseWhenEmpty": true
+                        }
+                      }
+                    },
                     {
                       "id": "himi_account.message",
                       "body": {
@@ -2567,6 +2600,7 @@ const SCREENS = runtimeSetting({
                           "title": "Sign in",
                           "style": "primary",
                           "fullWidth": true,
+                          "disabledPath": "$service:himiStoreAccount.authBusy",
                           "action": {
                             "actionId": "tier5.himiStoreAccount.signIn"
                           }
@@ -2585,6 +2619,7 @@ const SCREENS = runtimeSetting({
                           "title": "Create account",
                           "style": "primary",
                           "fullWidth": true,
+                          "disabledPath": "$service:himiStoreAccount.authBusy",
                           "action": {
                             "actionId": "tier5.himiStoreAccount.register"
                           }
@@ -2603,6 +2638,7 @@ const SCREENS = runtimeSetting({
                           "title": "Send reset link",
                           "style": "primary",
                           "fullWidth": true,
+                          "disabledPath": "$service:himiStoreAccount.authBusy",
                           "action": {
                             "actionId": "tier5.himiStoreAccount.resetPassword"
                           }
@@ -2621,6 +2657,7 @@ const SCREENS = runtimeSetting({
                           "title": "Forgot password?",
                           "style": "secondary",
                           "fullWidth": true,
+                          "disabledPath": "$service:himiStoreAccount.authBusy",
                           "action": {
                             "actionId": "tier5.himiStoreAccount.showRecovery"
                           }
@@ -2639,6 +2676,7 @@ const SCREENS = runtimeSetting({
                           "title": "Register",
                           "style": "secondary",
                           "fullWidth": true,
+                          "disabledPath": "$service:himiStoreAccount.authBusy",
                           "action": {
                             "actionId": "tier5.himiStoreAccount.showRegister"
                           }
@@ -2657,6 +2695,7 @@ const SCREENS = runtimeSetting({
                           "title": "Sign in instead",
                           "style": "secondary",
                           "fullWidth": true,
+                          "disabledPath": "$service:himiStoreAccount.authBusy",
                           "action": {
                             "actionId": "tier5.himiStoreAccount.showSignIn"
                           }
@@ -2675,6 +2714,7 @@ const SCREENS = runtimeSetting({
                           "title": "Back to sign in",
                           "style": "secondary",
                           "fullWidth": true,
+                          "disabledPath": "$service:himiStoreAccount.authBusy",
                           "action": {
                             "actionId": "tier5.himiStoreAccount.showSignIn"
                           }

package/templates/beauty-salon/tier5-src/himi-store-account/index.ts

@@ -1,3 +1,4 @@
+import { authFailure, authMessage, identityErrors, type AuthOperation } from "@himalaya/auth";
 // Tier-5 bundle: himi-store — visitor/member account state.
 //
 // SINGLE-SITE BY DESIGN. A Branded Lite build talks to exactly one Wix site, and the
@@ -75,23 +76,50 @@ function resumeAfterAuth(next: S): S {
 // Actions are not serialized: two quick Sign in taps both run against the pre-tap
 // state, so without this both would submit credentials and both would resume.
 let authInFlight = false;
+// Never projected or persisted. The renderer retains its own masked draft for retry.
+let passwordDraft = "";
+let editRevision = 0;
+// Descriptor configuration belongs to the worker session. Keep it even when a
+// delayed profile probe is discarded because the user edited the form.
+let memberAccountLinksRequested = false;
+const translated = (key: string) => copyParam(key, authMessage(key));
 
-async function authenticate(s: S, submit: () => Promise<unknown>, notMemberMessage: string, failedMessage: string): Promise<S | undefined> {
+function validateAuth(s: S, operation: AuthOperation): S {
+  const errors = identityErrors({ email: s.email, password: passwordDraft }, operation);
+  return derive({ ...s, emailError: errors.email ? translated(errors.email) : "",
+    passwordError: errors.password ? translated(errors.password) : "",
+    emailFocus: errors.email ? bumpToken(s.emailFocus) : s.emailFocus,
+    passwordFocus: !errors.email && errors.password ? bumpToken(s.passwordFocus) : s.passwordFocus,
+    message: "" });
+}
+function rejectResult(raw: unknown, operation: AuthOperation) {
+  const value = raw as { status?: string; error?: unknown; payload?: { error?: unknown } } | null;
+  if (value?.status === "error" || value?.error || value?.payload?.error) throw authFailure(raw, operation, translated);
+}
+async function authenticate(s: S, operation: "signIn" | "register"): Promise<S | undefined> {
   if (authInFlight) return undefined;
+  const checked = validateAuth(s, operation);
+  if (checked.emailError || checked.passwordError) return checked;
   authInFlight = true;
+  const revision = editRevision;
+  const password = passwordDraft;
   try {
-    await submit();
-    const next = await probe(optimisticMember(s, s.email));
-    if (!next.isMember) return derive({ ...next, message: notMemberMessage });
-    return resumeAfterAuth(derive({ ...next, message: "" }));
-  } catch {
-    // Clear the password: service state is snapshotted to disk (the worker-state
-    // store), so a failed attempt must not leave it there in cleartext. The Password
-    // field binds `valuePath` to it, so the field empties too and a retry re-types.
-    return derive({ ...s, password: "", message: failedMessage });
-  } finally {
-    authInFlight = false;
-  }
+    await svc.beginAuth(); // publish busy before waiting for the network
+    const raw = await dispatch(operation === "signIn" ? "himi.wix.signInDirect" : "himi.wix.registerDirect", {
+      email: s.email.trim(), password,
+      ...(operation === "register" ? { firstName: s.firstName, lastName: s.lastName } : {}),
+    });
+    rejectResult(raw, operation);
+    if (revision !== editRevision) return derive({ ...svc.getState(), authBusy: false });
+    const next = await probe(svc.getState());
+    if (revision !== editRevision) return derive({ ...svc.getState(), authBusy: false });
+    if (!next.isMember) throw { code: "unknown" };
+    passwordDraft = "";
+    return resumeAfterAuth(completedAuth(next));
+  } catch (error) {
+    return derive({ ...svc.getState(), authBusy: false,
+      message: revision === editRevision ? authFailure(error, operation, translated).reason : "" });
+  } finally { authInFlight = false; }
 }
 
 // Next value of a focus token: monotonic, and never empty once requested. A counter
@@ -180,10 +208,14 @@ interface S extends IapRestoreFields {
   noReturnPath: boolean;
   returnCta: string;
   email: string;
-  /** Held only from typing to the submit. Service state is persisted, so every
-   *  submitted sign-in/register clears it (success, not-a-member, and failure), as
-   *  do recovery and sign-out. Sign-in <-> register keeps it: the field stays up. */
+  /** Legacy snapshot slot, always empty. The active form keeps its password in
+   *  transient memory for retry; hydration never restores a persisted secret. */
   password: string;
+  authBusy: boolean;
+  busyMessage?: string;
+  emailError: string;
+  passwordError: string;
+  passwordFocus: string;
   firstName: string;
   lastName: string;
   // Focus TOKENS (`TextFieldProps.focus_path`), not flags: the bound field focuses
@@ -247,6 +279,8 @@ function derive(s: S): S {
   const hasReturnPath = !!s.isMember && !!s.returnScreenId;
   return {
     ...s,
+    password: "",
+    busyMessage: s.authBusy ? translated("auth.feedback.busy") : "",
     isLoading: s.status === "loading",
     notLoading: s.status !== "loading",
     notMember: !s.isMember,
@@ -309,9 +343,10 @@ async function orderRows(memberEmail: string): Promise<AccountActivityRow[]> {
 }
 
 async function probe(s: S, arg?: unknown): Promise<S> {
+  memberAccountLinksRequested ||= s.memberAccountLinks || strField(arg, "memberAccountLinks") === "1";
   const intent = authIntentFromArg(arg, s);
   const profile = await loadMemberProfile(copyParam("storeAccount.guestDetail", "Sign in to keep your cart and orders connected."));
-  const memberAccountLinks = s.memberAccountLinks || strField(arg, "memberAccountLinks") === "1";
+  const memberAccountLinks = memberAccountLinksRequested;
   const restorePurchases = s.restorePurchases || strField(arg, "restorePurchases") === "1";
   if (restorePurchases) enterCommerce();
   const routes = memberAccountLinks ? await memberAccountRoutes() : { addresses: false, wallet: false };
@@ -353,21 +388,11 @@ async function probe(s: S, arg?: unknown): Promise<S> {
   });
 }
 
-function optimisticMember(s: S, email: string): S {
+function completedAuth(s: S): S {
   return derive({
     ...s,
-    status: "ready",
-    isMember: true,
-    identityLine: copyParam("storeAccount.signedIn", "Signed in"),
-    detailLine: email,
-    memberName: email,
-    memberEmail: email,
-    memberImage: "",
-    memberInitials: "M",
-    hasMemberImage: false,
-    noMemberImage: true,
-    email,
     password: "",
+    authBusy: false, emailError: "", passwordError: "", passwordFocus: "",
     firstName: "",
     lastName: "",
     isRegistering: false,
@@ -377,6 +402,8 @@ function optimisticMember(s: S, email: string): S {
 }
 
 const svc = defineService<S, {
+  beginAuth: (s: S) => S;
+  submit: (s: S) => Promise<S | undefined>;
   load: (s: S, arg?: unknown) => Promise<S>;
   refresh: (s: S, arg?: unknown) => Promise<S>;
   setEmail: (s: S, arg?: unknown) => S;
@@ -395,7 +422,7 @@ const svc = defineService<S, {
   restorePublish: (s: S) => S;
   iapRestore: (s: S) => Promise<undefined>;
 }>("himiStoreAccount", {
-  notHydrated: [...IAP_RESTORE_KEYS],
+  notHydrated: ["password", "authBusy", "emailError", "passwordError", "passwordFocus", ...IAP_RESTORE_KEYS],
   state: derive({
     status: "loading",
     isMember: false,
@@ -420,6 +447,7 @@ const svc = defineService<S, {
     returnCta: "Continue",
     email: "",
     password: "",
+    authBusy: false, emailError: "", passwordError: "", passwordFocus: "",
     firstName: "",
     lastName: "",
     lastNameFocus: "",
@@ -445,12 +473,14 @@ const svc = defineService<S, {
     ...NO_IAP_RESTORE,
   }),
   actions: {
-    load: (s, arg) => { stashCopy(arg); return probe(s, arg); },
-    refresh: (s, arg) => { stashCopy(arg); return probe(s, arg); },
-    setEmail: (s, arg) => derive({ ...s, email: strOf(arg), message: "" }),
-    setPassword: (s, arg) => derive({ ...s, password: strOf(arg), message: "" }),
-    setFirstName: (s, arg) => derive({ ...s, firstName: strOf(arg), message: "" }),
-    setLastName: (s, arg) => derive({ ...s, lastName: strOf(arg), message: "" }),
+    submit: (s): Promise<S | undefined> => s.isRecovering ? svc.resetPassword() : authenticate(s, s.isRegistering ? "register" : "signIn"),
+    beginAuth: (s) => derive({ ...s, authBusy: true, message: "", emailError: "", passwordError: "" }),
+    load: async (s, arg): Promise<S> => { stashCopy(arg); const revision = editRevision; const next = await probe(s, arg); return authInFlight || revision !== editRevision ? svc.getState() : next; },
+    refresh: async (s, arg): Promise<S> => { stashCopy(arg); const revision = editRevision; const next = await probe(s, arg); return authInFlight || revision !== editRevision ? svc.getState() : next; },
+    setEmail: (s, arg) => { editRevision++; const next = { ...s, email: strOf(arg).trim(), message: "" }; return derive({ ...next, emailError: s.emailError ? (identityErrors({ email: next.email }, "reset").email ? translated(identityErrors({ email: next.email }, "reset").email!) : "") : "" }); },
+    setPassword: (s, arg) => { editRevision++; passwordDraft = strOf(arg); return derive({ ...s, message: "", passwordError: s.passwordError && !passwordDraft ? translated("auth.validation.passwordRequired") : "" }); },
+    setFirstName: (s, arg) => { editRevision++; return derive({ ...s, firstName: strOf(arg), message: "" }); },
+    setLastName: (s, arg) => { editRevision++; return derive({ ...s, lastName: strOf(arg), message: "" }); },
     // The register form's Next keys. Only first/last name carry one: they share a
     // single visibility gate (notRegistering) so their target is always on screen.
     // Email deliberately does NOT chain to password — see the comment on the
@@ -463,48 +493,32 @@ const svc = defineService<S, {
     // register and coming back would open focused on Last name, skipping First name.
     // Only the tokens whose fields actually unmount here are cleared: see
     // NO_FOCUS_MODE_SWITCH for why Email's is deliberately NOT among them.
-    showRegister: (s) => derive({ ...s, isRegistering: true, isRecovering: false, message: "", ...NO_FOCUS_MODE_SWITCH }),
-    showSignIn: (s) => derive({ ...s, isRegistering: false, isRecovering: false, message: "", ...NO_FOCUS_MODE_SWITCH }),
-    showRecovery: (s) => derive({ ...s, isRegistering: false, isRecovering: true, password: "", message: "", ...NO_FOCUS_MODE_SWITCH }),
-    resetPassword: async (s) => {
-      const email = s.email.trim();
-      if (!email || !email.includes("@")) return derive({ ...s, message: copyParam("storeAccount.validationEmail", "Enter a valid email address.") });
+    showRegister: (s) => { if (authInFlight) return s; editRevision++; return derive({ ...s, isRegistering: true, isRecovering: false, message: "", emailError: "", passwordError: "", ...NO_FOCUS_MODE_SWITCH }) },
+    showSignIn: (s) => { if (authInFlight) return s; editRevision++; return derive({ ...s, isRegistering: false, isRecovering: false, message: "", emailError: "", passwordError: "", ...NO_FOCUS_MODE_SWITCH }) },
+    showRecovery: (s) => { if (authInFlight) return s; editRevision++; return derive({ ...s, isRegistering: false, isRecovering: true, password: "", message: "", emailError: "", passwordError: "", ...NO_FOCUS_MODE_SWITCH }) },
+    resetPassword: async (s): Promise<S> => {
+      if (authInFlight) return s;
+      const checked = validateAuth(s, "reset");
+      if (checked.emailError) return checked;
+      authInFlight = true;
+      const revision = editRevision;
       try {
-        await dispatch("himi.wix.resetPassword", { email });
-        return derive({
-          ...s,
-          email,
-          isRecovering: false,
-          message: copyParam("storeAccount.resetSent", "If that email is registered, a reset link is on its way."),
-        });
-      } catch {
-        return derive({ ...s, message: copyParam("storeAccount.resetFailed", "Reset email could not be sent. Try again.") });
-      }
-    },
-    signIn: async (s) => {
-      if (!s.email || !s.password) return derive({ ...s, message: copyParam("storeAccount.validationEmailPassword", "Enter your email and password.") });
-      return authenticate(
-        s,
-        () => dispatch("himi.wix.signInDirect", { email: s.email, password: s.password }),
-        copyParam("storeAccount.signInCheckDetails", "Sign in failed. Check your details."),
-        copyParam("storeAccount.signInFailed", "Sign in failed. Try again."),
-      );
-    },
-    register: async (s) => {
-      if (!s.email || !s.password) return derive({ ...s, message: copyParam("storeAccount.validationEmailPassword", "Enter your email and password.") });
-      return authenticate(
-        s,
-        () => dispatch("himi.wix.registerDirect", {
-          email: s.email,
-          password: s.password,
-          firstName: s.firstName,
-          lastName: s.lastName,
-        }),
-        copyParam("storeAccount.registerTrySignIn", "Account creation failed. Try signing in."),
-        copyParam("storeAccount.registerFailed", "Account creation failed. Try another email."),
-      );
+        await svc.beginAuth();
+        const raw = await dispatch("himi.wix.resetPassword", { email: s.email.trim() });
+        rejectResult(raw, "reset");
+        if (revision !== editRevision) return derive({ ...svc.getState(), authBusy: false });
+        return derive({ ...svc.getState(), authBusy: false, isRecovering: false,
+          message: copyParam("storeAccount.resetSent", "If that email is registered, a reset link is on its way.") });
+      } catch (error) {
+        return derive({ ...svc.getState(), authBusy: false,
+          message: revision === editRevision ? authFailure(error, "reset", translated).reason : "" });
+      } finally { authInFlight = false; }
     },
-    signOut: async (s) => {
+    signIn: (s) => authenticate(s, "signIn"),
+    register: (s) => authenticate(s, "register"),
+    signOut: async (s): Promise<S> => {
+      if (authInFlight) return svc.getState();
+      passwordDraft = ""; editRevision++;
       routeInputConsumed = true;
       try { await dispatch("himi.wix.signOut"); } catch { /* ignore */ }
       // Do NOT re-probe via getMyData after logout — visitor-scoped my-data can