@wix/himalaya-cli 0.1543.0 → 0.1544.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/auth-providers/wix/src/index.d.ts

@@ -42,8 +42,9 @@ export interface MemberCaptchaKey {
     siteKeyId: string;
 }
 export interface WixConsumerAuthConfig {
-    /** Per-site Wix Headless OAuth client id. Required unless `visitorSource` is `"one-app"`;
-     *  there it is optional and only enables member sign-in. */
+    /** Per-site Wix Headless OAuth client id. Required unless `visitorSource` is `"one-app"`.
+     *  There it is optional: without it, native email + password sign-in uses the One App member
+     *  path (no OAuth client on the site); with it, member sign-in uses this OAuth client instead. */
     clientId?: string;
     /** Where the anonymous visitor credential comes from. `"oauth"` (default) mints
      *  `POST /oauth2/token {clientId, grantType:"anonymous"}` and needs a Headless OAuth client on

package/guides/one-app-to-himi-app.md

@@ -414,10 +414,12 @@ auth: WixConsumerAuthProvider({
 ```
 
 Every surface reads the site with it: the native apps, the hosted draft preview, and
-`himi run`, `himi render --live` and `himi test --record`. It is a visitor: member
-sign-in still needs a Headless OAuth client.
+`himi run`, `himi render --live` and `himi test --record`. On iOS and Android the same
+binding also signs a site member in with email and password (the Branded app's own
+member flow), still without a client. Google sign-in, registration, password reset and change, and member
+sign-in on the web still need a Headless OAuth client.
 
-**Only when the site owner wants member sign-in now**, and with their agreement,
+**Only when the site owner wants those (Google, registration, web member sign-in)**, and with their agreement,
 resolve the site's mobile OAuth client with the existing idempotent command (it is
 an owner-scoped write to the customer's site):
 

package/guides/wix-api-usage.md

@@ -104,8 +104,15 @@ The instance comes from `GET apps.wix.com/_api/one-app-session-web/v3/businesses
 mints it directly; the browser cannot (no CORS), so the app's own origin mints it at `/v1/visitor/instance`;
 `himi run`, `render --live` and `test --record` mint it in Node. Each mint is a new visitor, so it is
 kept until its `validUntil` (~4h) and re-minted only once expired — a 401 on an unexpired instance is
-the endpoint's answer (members-only reads refuse every visitor). Scope is visitor: member sign-in still
-needs a `clientId` (+ `redirectUri`), which you may add beside it.
+the endpoint's answer (members-only reads refuse every visitor).
+
+**Members, the same way (iOS + Android).** `signInDirect(email, password)` signs a SITE member in the
+way the Branded app does: `POST <site>/_api/iam/authentication/v2/login` with the visitor instance,
+`createSessionCookie` → the site's `smSession`, then the Member signed instance from
+`<siteUrl>/_api/one-app-session-web/v3/businesses/<metaSiteId>/signed-instance?signed_instance_type=Member`
+(sent bare; re-minted from `smSession` when it expires). No `clientId` needed. Still OAuth-only: Google /
+social sign-in, the hosted login page, registration, password reset and change, and member sign-in on the web
+(the app's own origin never handles a password) — add a `clientId` (+ `redirectUri`) beside it for those.
 
 Monorepo / native Branded Lite (env overrides, auth bake, shareable binary with icon/splash):
 [branded-lite-site-binding.md](branded-lite-site-binding.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1543.0",
+  "version": "0.1544.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "09228c43934e4e9f2b68984330c9830359aca30af7bd2c96c0073572"
+  "falconPackageHash": "dd6b1446735f5206d1c3c73510948819f59f090968b25177db037538"
 }