@wix/himalaya-cli 0.1440.0 → 0.1441.0

package/templates/nonprofit-cause/himalaya.content.json

@@ -64,6 +64,9 @@
     "himi_saved": {
       "displayName": "Saved"
     },
+    "himi_sign_in": {
+      "displayName": "Sign In"
+    },
     "himi_subscription": {
       "displayName": "Subscription"
     },

package/templates/nonprofit-cause/tier5-src/himi-store-account/index.ts

@@ -9,16 +9,18 @@ import { authFailure, authMessage, identityErrors, type AuthOperation } from "@h
 // `wix-site-id` header and nothing else, so every read stayed on the baked site while the
 // UI claimed otherwise. Managing several businesses is Owner Lite's job (account auth, a
 // real Sites List, and per-call site scope via `site.forSite`).
-import { defineService, navigate, type NavDirective } from "@himalaya/state";
+import { defineService, navigate } from "@himalaya/state";
 import { dispatch } from "@himalaya/dispatch";
-import { searchOrders, type WixOrder } from "@himalaya/wix-ecom";
-import { guestProfile, loadMemberProfile, strOf, fmtDate, titleCase, type AccountActivityRow } from "../_shared/himi-account";
+import { getCurrentCart, searchOrders, type WixOrder } from "@himalaya/wix-ecom";
+import { guestProfile, loadMemberProfile, signedInEmail, strOf, fmtDate, titleCase, type AccountActivityRow } from "../_shared/himi-account";
 import { stashCopy, copyParam, copyTemplate } from "../_shared/himi-copy.js";
 import { memberAccountRoutes } from "../_shared/member-account-routes.js";
 import { createIapCommerce, onlineProgramOrders, pricingPlanOrders, storesAppleSalesEnabled, storesProductOrders } from "@himalaya/iap-checkout";
 import { IAP_RESTORE_KEYS, NO_IAP_RESTORE, createIapRestore, resetUnhydratedKeysOnOlderRuntime, type IapRestoreFields } from "../_shared/iap-worker.js";
 
 interface AuthRouteInput {
+  /** Standalone sign-in only: `register` opens the form on Create account. */
+  mode?: string;
   intent?: string;
   contextName?: string;
   returnScreenId?: string;
@@ -28,6 +30,9 @@ interface AuthRouteInput {
 
 // The screen's boot input survives refresh; consuming it must survive too.
 let routeInputConsumed = false;
+// The form's heading has its copy: a copy pack was stashed, a probe (not the boot load)
+// finished without one, or the visitor switched mode — the form is in use by then.
+let headingReady = false;
 
 /** Mid-flow open params land on `himalaya.input` (paramKeys on himi_account). */
 function routeInput(): AuthRouteInput {
@@ -35,6 +40,9 @@ function routeInput(): AuthRouteInput {
   return input && typeof input === "object" ? input : {};
 }
 
+/** The route opened the standalone form on Create account. Read once, before any probe. */
+const ROUTE_ASKS_REGISTER = routeInput().mode === "register";
+
 function strField(arg: unknown, key: string): string {
   if (!arg || typeof arg !== "object") return "";
   const raw = (arg as Record<string, unknown>)[key];
@@ -55,7 +63,7 @@ function authIntentFromArg(arg: unknown, prev: Pick<S, "authIntent" | "authConte
 
 /** Where a successful sign-in returns to, or null. Never Account itself — that would
  *  only push a second copy of the screen the member is already on. */
-function resumeTarget(s: Pick<S, "returnScreenId" | "returnId" | "returnChannelId">): NavDirective | null {
+function resumeTarget(s: Pick<S, "returnScreenId" | "returnId" | "returnChannelId">): { screenId: string; args?: Record<string, string> } | null {
   if (!s.returnScreenId || s.returnScreenId === "himi_account") return null;
   return s.returnId || s.returnChannelId ? {
     screenId: s.returnScreenId,
@@ -65,23 +73,204 @@ function resumeTarget(s: Pick<S, "returnScreenId" | "returnId" | "returnChannelI
 
 /** Resume the member-only screen that sent the visitor here, once. The return path is
  *  consumed so a later refresh cannot fire it again; the host opens the target only if
- *  it is linkable, the same check an authored `himi.open` gets. */
+ *  it is linkable, the same check an authored `himi.open` gets.
+ *
+ *  On the standalone sign-in screen the target is pushed, not a `replace`: on iOS and
+ *  Android `replace` resets the stack to its root, which would drop the screens the
+ *  visitor came through. Back from the target shows the form again, and the form sends a
+ *  member back on appear (settle). With no target the form goes back. */
 function resumeAfterAuth(next: S): S {
   const target = resumeTarget(next);
-  if (!next.isMember || !target) return next;
+  if (!next.isMember) return next;
+  if (!target) return next.standalone ? navigate(next, { presentation: "back" }) : next;
   routeInputConsumed = true;
-  return navigate(derive({ ...next, authIntent: "", authContextName: "", returnScreenId: "", returnId: "", returnChannelId: "" }), target);
+  const cleared = derive({ ...next, authIntent: "", authContextName: "", returnScreenId: "", returnId: "", returnChannelId: "" });
+  return navigate(cleared, target);
+}
+
+/** Account with a standalone sign-in screen (`signInScreen` appear param): a guest who
+ *  arrives with a sign-in intent or a return path — a member gate, an old deep link — is
+ *  sent on to that screen with the same params, once. */
+function forwardToSignIn(next: S): S {
+  if (!next.signInScreen || next.isMember || routeInputConsumed) return next;
+  if (!next.authIntent && !next.returnScreenId) return next;
+  routeInputConsumed = true;
+  const args: Record<string, string> = { mode: "signin" };
+  for (const key of ["authIntent", "authContextName", "returnScreenId", "returnId", "returnChannelId"] as const) {
+    if (next[key]) args[key === "authIntent" ? "intent" : key === "authContextName" ? "contextName" : key] = next[key];
+  }
+  return navigate(derive({ ...next, authIntent: "", authContextName: "", returnScreenId: "", returnId: "", returnChannelId: "" }),
+    { screenId: next.signInScreen, args });
+}
+
+/** After a load: the standalone sign-in screen sends a member back (a stale link, or a
+ *  sign-in finished elsewhere); Account forwards a guest with a sign-in intent.
+ *
+ *  The member goes back WITHOUT the return path: only a sign-in made on this form resumes
+ *  it (authenticate → resumeAfterAuth). The screen is public, so honouring a route's
+ *  return path here would let a bare link open a member-only screen with no tap. */
+function stashScreenCopy(arg: unknown): void {
+  stashCopy(arg);
+  if (strField(arg, "copy")) headingReady = true;
+}
+
+function settle(next: S, arg: unknown, latest = true): S {
+  // A member on the form goes back. Coming back to the form after the pushed
+  // target, iOS re-runs only `load()` with no params and DISCARDS its result, so the move is
+  // a dispatch, not `_nav`. Never from the boot load: the appear refresh of the same visit
+  // sends it.
+  if (next.standalone && next.isMember) {
+    routeInputConsumed = true;
+    const cleared = derive({ ...next, ...NO_VISIT });
+    // Only the newest probe moves: web re-shows a form with an arg-less load AND the appear
+    // refresh, and both may land, any time apart. The boot load never moves.
+    if (!latest || strField(arg, "boot") === "1") return cleared;
+    // The appear refresh returns `_nav`, which every host applies — binaries from before
+    // worker nav dispatch included. Only an arg-less load, whose result iOS
+    // discards, dispatches.
+    if (strField(arg, "standalone") === "1") return navigate(cleared, { presentation: "back" });
+    void dispatch("himi.open", { presentation: "back" });
+    return cleared;
+  }
+  // Account forwards only on an appear refresh: the boot `load()` has no params and its
+  // navigation is dropped, so a forward there was lost and used up the one forward.
+  return strField(arg, "signInScreen") ? forwardToSignIn(next) : next;
 }
 
+// A tick reads only the session. The profile is read again only when the signed-in email
+// changes, so an idle tick costs no profile read and no re-render. Account opts in
+// (`pollIdentity`): a sign-in on the standalone screen changes the session while Account
+// stays mounted, and not every host re-runs `load` when it comes back.
+const IDENTITY_POLL = { id: "himi-account-identity", intervalMs: 1500, action: "himiStoreAccount.sync" };
+
+/** "Hey, <name>" wants a first name. A profile with no display name carries the email. */
+function greetingName(memberName: string): string {
+  const name = memberName.trim();
+  const bare = name.includes("@") ? name.slice(0, name.indexOf("@")) : name;
+  return bare.split(/\s+/)[0] ?? "";
+}
+
+// Applied once per worker: the standalone screen opens on the mode its route asked for.
+let routeModeApplied = false;
+
+/** One visit's form mode and mid-flow return path. Never restored from a snapshot: the
+ *  snapshot is keyed by screen, not by the route that opened it. */
+const NO_VISIT = {
+  isRegistering: false, isRecovering: false,
+  authIntent: "", authContextName: "", returnScreenId: "", returnId: "", returnChannelId: "",
+};
+const VISIT_KEYS = Object.keys(NO_VISIT) as (keyof typeof NO_VISIT)[];
+/** What derive() computes from the visit keys. Hydration copies keys without re-deriving,
+ *  so these stay out of the snapshot with them, or the first paint mixes two visits. */
+const VISIT_DERIVED_KEYS = ["notRegistering", "notRecovering", "hideSignInChoices", "authTitle", "authBody",
+  "hasReturnPath", "noReturnPath", "returnCta"] as const;
+
 // Actions are not serialized: two quick Sign in taps both run against the pre-tap
 // state, so without this both would submit credentials and both would resume.
 let authInFlight = false;
 // Never projected or persisted. The renderer retains its own masked draft for retry.
 let passwordDraft = "";
 let editRevision = 0;
+// load, refresh and sync each run a whole probe and replace the whole state. Only the newest
+// one to start may land: a boot `load()` that resolves after the appear refresh would put
+// back a state without the appear params, and a sync that resolves after a Sign out would
+// put the member back.
+let probeSeq = 0;
+let appliedSeq = 0;
+// The appear params belong to the worker session too, like the two flags above: a probe
+// dropped because the visitor typed must not take them with it.
+let signInScreenRequested = "";
+let standaloneRequested = false;
+let pollIdentityRequested = false;
+// Bumped by every mode switch, so a dropped probe never puts back a mode the visitor left.
+let modeSwitches = 0;
+
+interface AppearConfig { mode: Partial<S>; visit: Partial<S> }
+
+/** The appear params the worker session has seen so far — read when a state is built, so a
+ *  probe that started before an appear refresh still carries what that refresh asked for. */
+function appearBase(): Partial<S> {
+  return {
+    signInScreen: signInScreenRequested,
+    standalone: standaloneRequested,
+    pollIdentity: pollIdentityRequested,
+    ...(pollIdentityRequested ? { _poll: { ...IDENTITY_POLL } } : {}),
+  };
+}
+
+/** What the appear params ask for. Read before the probe awaits anything. */
+function appearConfig(s: S, arg: unknown): AppearConfig {
+  const appearing = strField(arg, "standalone") === "1";
+  // Each visit to the form reads its own route again. A pooled worker comes back for a
+  // later visit with the same params, after an earlier visit consumed the route.
+  if (appearing) {
+    routeInputConsumed = false;
+    // A pooled worker serves the next visitor too: the fields mount empty, so the last
+    // visit's draft must not be what Sign in submits.
+    passwordDraft = "";
+  }
+  signInScreenRequested ||= strField(arg, "signInScreen") || s.signInScreen;
+  // Only the sign-in screen's route carries `mode`, so it marks the form from the boot load on.
+  standaloneRequested ||= s.standalone || appearing || (!routeInputConsumed && !!routeInput().mode);
+  pollIdentityRequested ||= s.pollIdentity || strField(arg, "pollIdentity") === "1";
+  // The form opens on the mode its route asked for each time it appears, sign-in by
+  // default: a pooled worker reopened with the same params must not open on the mode the
+  // last visit toggled to.
+  let mode: Partial<S> = {};
+  if (standaloneRequested && (!routeModeApplied || appearing)) {
+    routeModeApplied = true;
+    const asked = strField(arg, "mode") || (routeInputConsumed ? "" : routeInput().mode ?? "");
+    const isRegistering = asked === "register";
+    if (isRegistering !== !!s.isRegistering || s.isRecovering) {
+      mode = { isRegistering, isRecovering: false, ...NO_FOCUS_MODE_SWITCH };
+    }
+  }
+  const visit: Partial<S> = appearing
+    // The route's own intent and return path too: a dropped probe must not keep the last
+    // visit's (an abandoned gate) for the next Sign in to resume.
+    ? { email: "", firstName: "", lastName: "", password: "", emailError: "", passwordError: "", message: "", lastNameFocus: "", emailFocus: "", passwordFocus: "", ...authIntentFromArg(arg, NO_VISIT) }
+    : {};
+  return { mode, visit };
+}
+
+/** The probe's state, or — when it must not land — the appear params alone, on the
+ *  current state. */
+// Bumped when an appear refresh's visit reset lands. A probe that started before it read the
+// last visit's state, so it must not land over the reset (iOS can start the arg-less load
+// after the appear refresh, from the same pre-reset state).
+let visitsApplied = 0;
+
+async function freshProbe(s: S, arg?: unknown): Promise<{ next: S; latest: boolean } | { kept: S; latest: boolean }> {
+  const seq = ++probeSeq;
+  const revision = editRevision;
+  const switches = modeSwitches;
+  const visits = visitsApplied;
+  const config = appearConfig(s, arg);
+  const next = await probe(s, arg, config);
+  if (authInFlight || revision !== editRevision || seq < appliedSeq || visits !== visitsApplied) {
+    const current = svc.getState();
+    const mode = authInFlight || switches !== modeSwitches ? {} : config.mode;
+    // The new visit's clean form, except for what the visitor typed since it appeared.
+    const visit = Object.fromEntries(Object.entries(config.visit)
+      .filter(([key]) => current[key as keyof S] === s[key as keyof S]));
+    // Dropped only because a visit reset landed meanwhile: this is still the newest probe, so
+    // it may still move a member off the form (the reset's own probe was not the newest).
+    const latest = !authInFlight && revision === editRevision && seq >= appliedSeq && seq === probeSeq;
+    const kept = derive({ ...current, ...appearBase(), ...mode, ...visit });
+    // The reset still landed even though its probe was dropped. Invalidate arg-less loads
+    // that started from the previous visit's state before they can restore its return path.
+    if (strField(arg, "standalone") === "1") visitsApplied++;
+    return { kept, latest };
+  }
+  appliedSeq = seq;
+  if (strField(arg, "standalone") === "1") visitsApplied++;
+  // A newer probe is still on its way: this one may land, but must not navigate.
+  return { next, latest: seq === probeSeq };
+}
 // Descriptor configuration belongs to the worker session. Keep it even when a
 // delayed profile probe is discarded because the user edited the form.
 let memberAccountLinksRequested = false;
+let cartCountRequested = false;
 const translated = (key: string) => copyParam(key, authMessage(key));
 
 function validateAuth(s: S, operation: AuthOperation): S {
@@ -122,11 +311,15 @@ async function authenticate(s: S, operation: "signIn" | "register"): Promise<S |
   } finally { authInFlight = false; }
 }
 
-// Next value of a focus token: monotonic, and never empty once requested. A counter
-// rather than Date.now() — deterministic under test, and immune to two focus
+// Next value of a focus token: never empty once requested, and never a value this worker
+// issued before — one counter for every token, not "previous + 1". A visit reset puts a
+// token back to "" while a pooled form's field may still be mounted; "previous + 1" would
+// then republish a value that field already acted on, and it would ignore the request.
+// A counter rather than Date.now() — deterministic under test, and immune to two focus
 // requests landing inside the same millisecond.
-function bumpToken(t: string): string {
-  return String(Number(t || 0) + 1);
+let focusSeq = 0;
+function bumpToken(_previous: string): string {
+  return String(++focusSeq);
 }
 
 // A token may be cleared ONLY by a transition that unmounts the field it targets, so
@@ -143,6 +336,9 @@ const NO_FOCUS_MODE_SWITCH = { lastNameFocus: "" };
 // here both tokens must go or the re-mounted card auto-focuses Email on logout.
 const NO_FOCUS_ALL = { lastNameFocus: "", emailFocus: "" };
 
+// Every focus token, cleared once the visitor types (see setEmail).
+const TYPED = { ...NO_FOCUS_ALL, passwordFocus: "" };
+
 function authHeadline(s: S, isRegistering: boolean, isRecovering: boolean): { authTitle: string; authBody: string } {
   if (isRecovering) {
     return {
@@ -252,6 +448,25 @@ interface S extends IapRestoreFields {
    *  `restorePurchases: "1"`). Only then does the worker reach the App Store layer, so a
    *  descriptor that renders no such row need not declare `iap`. */
   restorePurchases: boolean;
+  /** Top-bar cart badge, read only once a descriptor asks for it (appear param
+   *  `cartCount: "1"`), so an app with no store never reads a cart. A guest has a
+   *  visitor cart too, so this is read for members and guests alike. */
+  cartCount: number;
+  /** "Hey, guest" / "Hey, <first name>". */
+  greeting: string;
+  /** The member's first name alone. Account puts it after its own translated "Hey,":
+   *  the server translates descriptor copy, never worker copy. */
+  greetingFirstName: string;
+  /** Guest header: hidden for a member and while the first session check runs. */
+  hideGuest: boolean;
+  /** Member header and the Sign out footer: hidden for a guest and while loading. */
+  hideMember: boolean;
+  /** Account only (appear param): the standalone sign-in screen a guest is sent to. */
+  signInScreen: string;
+  /** The standalone sign-in screen itself (appear param `standalone: "1"`). */
+  standalone: boolean;
+  /** Account only (appear param `pollIdentity: "1"`): re-read the session on a timer. */
+  pollIdentity: boolean;
 }
 
 // Restore purchases (App Review 3.1.1) for every vertical the app sells through the App Store. The
@@ -275,10 +490,20 @@ function derive(s: S): S {
   const isRegistering = !!s.isRegistering;
   const isRecovering = !!s.isRecovering;
   const hasActivity = s.activityRows.length > 0;
-  const headline = authHeadline(s, isRegistering, isRecovering);
+  // Empty until the screen's copy pack (or a probe) arrives: the boot state is built before
+  // any copy, and its English default would paint first in a translated app.
+  const headline = headingReady ? authHeadline(s, isRegistering, isRecovering) : { authTitle: "", authBody: "" };
   const hasReturnPath = !!s.isMember && !!s.returnScreenId;
+  const loading = s.status === "loading";
+  const name = s.isMember ? greetingName(s.memberName) : "";
   return {
     ...s,
+    greeting: name
+      ? copyTemplate("storeAccount.greetingMember", "Hey, {name}", { name })
+      : copyParam("storeAccount.greetingGuest", "Hey, guest"),
+    greetingFirstName: name,
+    hideGuest: loading || !!s.isMember,
+    hideMember: loading || !s.isMember,
     password: "",
     busyMessage: s.authBusy ? translated("auth.feedback.busy") : "",
     isLoading: s.status === "loading",
@@ -342,10 +567,30 @@ async function orderRows(memberEmail: string): Promise<AccountActivityRow[]> {
     .map(orderRow);
 }
 
-async function probe(s: S, arg?: unknown): Promise<S> {
+/** A failed read keeps the count the badge last showed (`known`): an unreachable cart
+ *  must not read as an emptied one. Before any read succeeds, that is 0 — no badge. */
+async function cartItemCount(known: number): Promise<number> {
+  try {
+    const cart = await getCurrentCart();
+    return (cart.lineItems ?? []).reduce((n, li) => n + (li.quantity ?? 1), 0);
+  } catch {
+    return known;
+  }
+}
+
+async function probe(s: S, arg?: unknown, config: AppearConfig = appearConfig(s, arg)): Promise<S> {
   memberAccountLinksRequested ||= s.memberAccountLinks || strField(arg, "memberAccountLinks") === "1";
-  const intent = authIntentFromArg(arg, s);
+  // A new visit to the form reads its intent and return path from its own route only: the
+  // last visit's (an abandoned gate) must not be resumed by a plain sign-in.
+  const intent = authIntentFromArg(arg, strField(arg, "standalone") === "1" ? NO_VISIT : s);
+  cartCountRequested ||= strField(arg, "cartCount") === "1";
+  // Beside the profile, not after it: the badge must not add a round trip to the paint.
+  // Not asked for (yet — the boot load runs before the appear params): keep the count the
+  // snapshot restored, not a 0 that would empty the badge until the appear refresh lands.
+  const cartCountRead = cartCountRequested ? cartItemCount(s.cartCount ?? 0) : Promise.resolve(s.cartCount ?? 0);
   const profile = await loadMemberProfile(copyParam("storeAccount.guestDetail", "Sign in to keep your cart and orders connected."));
+  // Not the boot load: it never carries the copy, and the appear refresh that does is coming.
+  if (strField(arg, "boot") !== "1") headingReady = true;
   const memberAccountLinks = memberAccountLinksRequested;
   const restorePurchases = s.restorePurchases || strField(arg, "restorePurchases") === "1";
   if (restorePurchases) enterCommerce();
@@ -358,10 +603,12 @@ async function probe(s: S, arg?: unknown): Promise<S> {
       activityRows = [];
     }
   }
+  const cartCount = await cartCountRead;
   return derive({
     ...s,
     ...intent,
     status: "ready",
+    cartCount,
     isMember: profile.isMember,
     identityLine: profile.identityLine,
     detailLine: profile.detailLine,
@@ -375,6 +622,9 @@ async function probe(s: S, arg?: unknown): Promise<S> {
     message: "",
     memberAccountLinks,
     restorePurchases,
+    ...appearBase(),
+    ...config.mode,
+    ...config.visit,
     noMemberAddresses: !routes.addresses,
     noMemberWallet: !routes.wallet,
     activityRows,
@@ -419,10 +669,12 @@ const svc = defineService<S, {
   signIn: (s: S) => Promise<S | undefined>;
   register: (s: S) => Promise<S | undefined>;
   signOut: (s: S) => Promise<S>;
+  sync: (s: S) => Promise<S | undefined>;
+  openMember: (s: S, arg?: unknown) => Promise<S>;
   restorePublish: (s: S) => S;
   iapRestore: (s: S) => Promise<undefined>;
 }>("himiStoreAccount", {
-  notHydrated: ["password", "authBusy", "emailError", "passwordError", "passwordFocus", ...IAP_RESTORE_KEYS],
+  notHydrated: ["password", "authBusy", "emailError", "passwordError", "passwordFocus", "lastNameFocus", "emailFocus", ...VISIT_KEYS, ...VISIT_DERIVED_KEYS, ...IAP_RESTORE_KEYS],
   state: derive({
     status: "loading",
     isMember: false,
@@ -455,7 +707,8 @@ const svc = defineService<S, {
     message: "",
     isLoading: true,
     notLoading: false,
-    isRegistering: false,
+    // The form's first paint is already on its route's mode: only sign-in's route has `mode`.
+    isRegistering: ROUTE_ASKS_REGISTER,
     notRegistering: true,
     isRecovering: false,
     notRecovering: true,
@@ -470,17 +723,54 @@ const svc = defineService<S, {
     noMemberAddresses: true,
     noMemberWallet: true,
     restorePurchases: false,
+    cartCount: 0,
+    greeting: "Hey, guest",
+    greetingFirstName: "",
+    hideGuest: true,
+    hideMember: true,
+    signInScreen: "",
+    standalone: false,
+    pollIdentity: false,
     ...NO_IAP_RESTORE,
   }),
   actions: {
     submit: (s): Promise<S | undefined> => s.isRecovering ? svc.resetPassword() : authenticate(s, s.isRegistering ? "register" : "signIn"),
     beginAuth: (s) => derive({ ...s, authBusy: true, message: "", emailError: "", passwordError: "" }),
-    load: async (s, arg): Promise<S> => { stashCopy(arg); const revision = editRevision; const next = await probe(s, arg); return authInFlight || revision !== editRevision ? svc.getState() : next; },
-    refresh: async (s, arg): Promise<S> => { stashCopy(arg); const revision = editRevision; const next = await probe(s, arg); return authInFlight || revision !== editRevision ? svc.getState() : next; },
-    setEmail: (s, arg) => { editRevision++; const next = { ...s, email: strOf(arg).trim(), message: "" }; return derive({ ...next, emailError: s.emailError ? (identityErrors({ email: next.email }, "reset").email ? translated(identityErrors({ email: next.email }, "reset").email!) : "") : "" }); },
-    setPassword: (s, arg) => { editRevision++; passwordDraft = strOf(arg); return derive({ ...s, message: "", passwordError: s.passwordError && !passwordDraft ? translated("auth.validation.passwordRequired") : "" }); },
-    setFirstName: (s, arg) => { editRevision++; return derive({ ...s, firstName: strOf(arg), message: "" }); },
-    setLastName: (s, arg) => { editRevision++; return derive({ ...s, lastName: strOf(arg), message: "" }); },
+    load: async (s, arg): Promise<S> => { stashScreenCopy(arg); const r = await freshProbe(s, arg); return "next" in r ? settle(r.next, arg, r.latest) : r.latest ? settle(r.kept, arg, true) : r.kept; },
+    refresh: async (s, arg): Promise<S> => { stashScreenCopy(arg); const r = await freshProbe(s, arg); return "next" in r ? settle(r.next, arg, r.latest) : r.latest ? settle(r.kept, arg, true) : r.kept; },
+    // Idle ticks return undefined, so an unchanged session costs no re-render.
+    sync: async (s): Promise<S | undefined> => {
+      if (authInFlight) return undefined;
+      const email = (await signedInEmail()).toLowerCase();
+      // An empty read during a poll is a failed read as often as a sign-out (a network blip,
+      // a 5xx): it never turns a member into a guest. Account's own Sign out, and the next
+      // appear refresh, handle a real sign-out.
+      if (!email && s.isMember) return undefined;
+      if (email === s.memberEmail.toLowerCase() && !!email === s.isMember) return undefined;
+      const r = await freshProbe(s);
+      return "next" in r ? r.next : undefined;
+    },
+    // A row to a member-only screen shows to a guest too. A member opens it; a guest signs
+    // in first and the sign-in screen replaces itself with it, so Back returns here.
+    openMember: async (s, arg): Promise<S> => {
+      const screenId = strField(arg, "screenId");
+      if (!screenId) return s;
+      const member = s.isMember || !!await signedInEmail();
+      // From the state as it is now: a probe may have landed during the identity read.
+      const now = svc.getState();
+      if (member) return navigate(now, { screenId });
+      return navigate(now, { screenId: now.signInScreen || "himi_sign_in", args: { mode: "signin", returnScreenId: screenId } });
+    },
+    // Typing means any focus request was delivered: clear the tokens (safe while mounted, since
+    // bumpToken never repeats), so a visit rarely ends — and a pooled form rarely reopens —
+    // holding one.
+    // A setter given the value it already has is not an edit: a hidden form's secure field
+    // clears itself on unmount (setPassword("")), and counting that would drop the probe
+    // that is about to move a member off the form.
+    setEmail: (s, arg) => { if (strOf(arg).trim() === s.email) return s; editRevision++; const next = { ...s, ...TYPED, email: strOf(arg).trim(), message: "" }; return derive({ ...next, emailError: s.emailError ? (identityErrors({ email: next.email }, "reset").email ? translated(identityErrors({ email: next.email }, "reset").email!) : "") : "" }); },
+    setPassword: (s, arg) => { if (strOf(arg) === passwordDraft) return s; editRevision++; passwordDraft = strOf(arg); return derive({ ...s, ...TYPED, message: "", passwordError: s.passwordError && !passwordDraft ? translated("auth.validation.passwordRequired") : "" }); },
+    setFirstName: (s, arg) => { if (strOf(arg) === s.firstName) return s; editRevision++; return derive({ ...s, ...TYPED, firstName: strOf(arg), message: "" }); },
+    setLastName: (s, arg) => { if (strOf(arg) === s.lastName) return s; editRevision++; return derive({ ...s, ...TYPED, lastName: strOf(arg), message: "" }); },
     // The register form's Next keys. Only first/last name carry one: they share a
     // single visibility gate (notRegistering) so their target is always on screen.
     // Email deliberately does NOT chain to password — see the comment on the
@@ -493,9 +783,9 @@ const svc = defineService<S, {
     // register and coming back would open focused on Last name, skipping First name.
     // Only the tokens whose fields actually unmount here are cleared: see
     // NO_FOCUS_MODE_SWITCH for why Email's is deliberately NOT among them.
-    showRegister: (s) => { if (authInFlight) return s; editRevision++; return derive({ ...s, isRegistering: true, isRecovering: false, message: "", emailError: "", passwordError: "", ...NO_FOCUS_MODE_SWITCH }) },
-    showSignIn: (s) => { if (authInFlight) return s; editRevision++; return derive({ ...s, isRegistering: false, isRecovering: false, message: "", emailError: "", passwordError: "", ...NO_FOCUS_MODE_SWITCH }) },
-    showRecovery: (s) => { if (authInFlight) return s; editRevision++; return derive({ ...s, isRegistering: false, isRecovering: true, password: "", message: "", emailError: "", passwordError: "", ...NO_FOCUS_MODE_SWITCH }) },
+    showRegister: (s) => { if (authInFlight) return s; editRevision++; modeSwitches++; headingReady = true; return derive({ ...s, isRegistering: true, isRecovering: false, message: "", emailError: "", passwordError: "", ...NO_FOCUS_MODE_SWITCH }) },
+    showSignIn: (s) => { if (authInFlight) return s; editRevision++; modeSwitches++; headingReady = true; return derive({ ...s, isRegistering: false, isRecovering: false, message: "", emailError: "", passwordError: "", ...NO_FOCUS_MODE_SWITCH }) },
+    showRecovery: (s) => { if (authInFlight) return s; editRevision++; modeSwitches++; headingReady = true; return derive({ ...s, isRegistering: false, isRecovering: true, password: "", message: "", emailError: "", passwordError: "", ...NO_FOCUS_MODE_SWITCH }) },
     resetPassword: async (s): Promise<S> => {
       if (authInFlight) return s;
       const checked = validateAuth(s, "reset");
@@ -546,6 +836,9 @@ const svc = defineService<S, {
         returnScreenId: "",
         returnId: "",
         returnChannelId: "",
+        // The member's cart stays with the member; the new visitor session has its own.
+        cartCount: cartCountRequested ? await cartItemCount(0) : 0,
+        ...(s.pollIdentity ? { _poll: { ...IDENTITY_POLL } } : {}),
       };
       return derive(cleared);
     },
@@ -554,6 +847,8 @@ const svc = defineService<S, {
   },
 });
 
-resetUnhydratedKeysOnOlderRuntime(svc, { ...svc.getState(), ...NO_IAP_RESTORE }, IAP_RESTORE_KEYS);
-svc.load();
+resetUnhydratedKeysOnOlderRuntime(svc, derive({ ...svc.getState(), ...NO_IAP_RESTORE, ...NO_VISIT, ...NO_FOCUS_ALL, passwordFocus: "", isRegistering: ROUTE_ASKS_REGISTER }), [...IAP_RESTORE_KEYS, ...VISIT_KEYS, ...VISIT_DERIVED_KEYS, "lastNameFocus", "emailFocus", "passwordFocus"]);
+// `boot` tells settle this is not a visit: the host drops this call's navigation, and the
+// appear refresh does the visit's moves.
+svc.load({ boot: "1" });
 export { svc };

package/templates/podcast-creator/config.ts

@@ -236,6 +236,20 @@ export default defineApp({
         ],
         "parentScreenId": "",
         "tabId": "profile"
+      },
+      {
+        "screenId": "himi_sign_in",
+        "isPublic": true,
+        "paramKeys": [
+          "mode",
+          "intent",
+          "contextName",
+          "returnScreenId",
+          "returnId",
+          "returnChannelId"
+        ],
+        "parentScreenId": "himi_account",
+        "tabId": "profile"
       }
     ],
     "tabBar": {