@wix/himalaya-cli 0.1569.0 → 0.1571.0

package/templates/gym-fitness/tier5-src/himi-events-my-events/index.ts

@@ -5,6 +5,8 @@ import { queryEvents, type WixEvent } from "@himalaya/wix-events";
 import { getAll, upsert, type DbEntity } from "@himalaya/local-db";
 import { confirmedRsvpIds, eventStartMillis, normalizeEvent, type EventRow } from "../_shared/himi-events";
 import { stashCopy, copyParam, copyTemplate } from "../_shared/himi-copy.js";
+import { memberAccess } from "../_shared/member-access.js";
+import { readAccess, assertReadAccess, readAccessDenied, readSignInFlags, NO_READ_SIGN_IN } from "../_shared/member-read.js";
 
 // Offline-first (data-offline): My Events is a read-through over the same `events`
 // catalog the list caches — paint the last-synced rows (filtered to this device's
@@ -27,6 +29,7 @@ async function writeCached(rows: CachedEventRow[]): Promise<void> {
 }
 
 interface S {
+  signInRequired: boolean; noSignIn: boolean; signInScreenId: string;
   status: "loading" | "ready";
   events: EventRow[];
   emptyText: string;
@@ -98,11 +101,10 @@ function unverifiedEvent(event: CachedEventRow): CachedEventRow {
   };
 }
 
-/** Keep only the candidate rows the member ACTUALLY still holds an RSVP for, asking
- *  Wix per event. Fail-open per row: a network/permission blip must not blank a row the
- *  member really has (that would look like their RSVP vanished), so an errored probe
- *  keeps the row and only an explicit "no active RSVP" drops it. */
-async function confirmRsvps(candidates: CachedEventRow[]): Promise<{ events: CachedEventRow[]; verificationUnavailable: boolean }> {
+/** Verify device-local candidates against the current member. Member-only mode
+ *  requires successful verification; standalone mode retains failed probes as
+ *  explicitly unverified device-local history. */
+async function confirmRsvps(candidates: CachedEventRow[], memberOnly = false): Promise<{ events: CachedEventRow[]; verificationUnavailable: boolean }> {
   // Raw wixApi chokepoint rather than a generated client: the member RSVP read lives in
   // events **v2**, and `@himalaya/wix-events` is the v1 domain module. Adding a
   // `wix-events-v2` specifier is not an option — the umbrella package deliberately
@@ -122,7 +124,9 @@ async function confirmRsvps(candidates: CachedEventRow[]): Promise<{ events: Cac
         event: held ? { ...event, status: [event.status, copyParam("myEvents.rsvpConfirmed", "RSVP confirmed")].filter(Boolean).join(" · ") } : null,
         verificationUnavailable: false,
       };
-    } catch {
+    } catch (error) {
+      // Device candidates carry no member ownership proof until this read succeeds.
+      if (memberOnly) throw error;
       // Fail-open, but never claim backend confirmation while its member-readable
       // probe is unavailable. The device id remains a candidate, explicitly labeled.
       return { event: unverifiedEvent(event), verificationUnavailable: true };
@@ -134,8 +138,8 @@ async function confirmRsvps(candidates: CachedEventRow[]): Promise<{ events: Cac
   };
 }
 
-const svc = defineService<S, { load: (s: S, arg?: unknown) => Promise<S> }>("himiMyEvents", {
-  state: derive({
+const INITIAL: S = derive({
+    ...NO_READ_SIGN_IN, signInScreenId: "himi_account",
     status: "loading",
     events: [],
     emptyText: "",
@@ -147,45 +151,75 @@ const svc = defineService<S, { load: (s: S, arg?: unknown) => Promise<S> }>("him
     isLoading: true,
     notLoading: false,
     noEmpty: true,
-  }),
+  });
+let memberOnlyRequested = false;
+let loadVersion = 0;
+const svc = defineService<S, { prepare: (s: S) => S; load: (s: S, arg?: unknown) => Promise<S | undefined> }>("himiMyEvents", {
+  state: INITIAL,
   actions: {
-    load: async (s, arg) => {
+    prepare: (s) => ({ ...s, ...INITIAL }),
+    load: async (s, arg): Promise<S | undefined> => {
       stashCopy(arg);
-      const confirmed = new Set(confirmedRsvpIds());
-      const identity = await identityLine();
-      // 1) Instant paint from the on-device cache (offline-safe; empty on first-ever run).
-      const cached = await readCached();
-      const cachedEvents = cached.filter((event) => confirmed.has(event.id)).map(displayEventRow);
-      const base = cached.length
-        ? derive({ ...s, status: "ready", errored: false, events: cachedEvents, identityLine: identity, verificationUnavailable: cachedEvents.length > 0 })
-        : s;
-      // 2) Revalidate from Wix and refresh the cache.
+      const version = ++loadVersion;
+      const options = arg as { memberOnly?: unknown; signInScreenId?: unknown } | undefined;
+      if (options?.memberOnly !== undefined) memberOnlyRequested = options.memberOnly === "1";
+      const memberOnly = memberOnlyRequested;
+      const clean = { ...INITIAL, signInScreenId: options?.signInScreenId === "himi_sign_in" ? "himi_sign_in" : s.signInScreenId };
+      await svc.prepare();
       try {
-        const res = await queryEvents({ limit: 50 });
-        const all = ((res as unknown as { events?: WixEvent[] }).events ?? []).map(cachedEventRow);
-        await writeCached(all);
-        // Phase 3c — make each row AUTHORITATIVE. The device list is only a candidate
-        // set: it never forgets, so an RSVP cancelled elsewhere (web, or by the
-        // business) would otherwise show here forever. Confirm each candidate against
-        // Wix and drop the ones the member no longer holds.
-        //
-        // Per-event by necessity, not by choice: a member CANNOT enumerate their own
-        // RSVPs. Verified live against a real member token — `queryRsvps` (cross-event)
-        // 403s "WIX_EVENTS.READ_RSVP permission required", `listOrders` 403s
-        // READ_ORDERS, and `/rsvps/current` 400s without an eventId. Only the
-        // single-event read is member-readable, so the fan-out below IS the ceiling
-        // until those member scopes exist server-side.
-        const candidates = all.filter((event) => confirmed.has(event.id)).map(displayEventRow);
-        const confirmation = await confirmRsvps(candidates);
-        return derive({ ...base, status: "ready", errored: false, events: confirmation.events, identityLine: identity, verificationUnavailable: confirmation.verificationUnavailable });
-      } catch {
-        // Offline / fetch failure: keep the cached rows instead of a blank error state.
-        return cached.length
-          ? base
-          : derive({ ...s, status: "ready", errored: true, events: [], identityLine: identity });
+        const member = memberOnly ? await readAccess() : null;
+        if (memberOnly && !member?.member.email) throw new Error("Unauthenticated: sign in to see your events");
+        const confirmed = new Set(confirmedRsvpIds());
+        const identity = await identityLine();
+        // 1) Instant paint from the on-device cache (offline-safe; empty on first-ever run).
+        // Device-local candidates have no member ownership proof. Branded must
+        // verify them online rather than show a previous member's cached RSVP list.
+        const cached = memberOnly ? [] : await readCached();
+        const cachedEvents = cached.filter((event) => confirmed.has(event.id)).map(displayEventRow);
+        const base = cached.length
+          ? derive({ ...clean, status: "ready", errored: false, events: cachedEvents, identityLine: identity, verificationUnavailable: cachedEvents.length > 0 })
+          : clean;
+        // 2) Revalidate from Wix and refresh the cache.
+        try {
+          const res = await queryEvents({ limit: 50 });
+          const all = ((res as unknown as { events?: WixEvent[] }).events ?? []).map(cachedEventRow);
+          if (member) await assertReadAccess(member);
+          if (version !== loadVersion) return undefined;
+          await writeCached(all);
+          // Phase 3c — make each row AUTHORITATIVE. The device list is only a candidate
+          // set: it never forgets, so an RSVP cancelled elsewhere (web, or by the
+          // business) would otherwise show here forever. Confirm each candidate against
+          // Wix and drop the ones the member no longer holds.
+          //
+          // Per-event by necessity, not by choice: a member CANNOT enumerate their own
+          // RSVPs. Verified live against a real member token — `queryRsvps` (cross-event)
+          // 403s "WIX_EVENTS.READ_RSVP permission required", `listOrders` 403s
+          // READ_ORDERS, and `/rsvps/current` 400s without an eventId. Only the
+          // single-event read is member-readable, so the fan-out below IS the ceiling
+          // until those member scopes exist server-side.
+          const candidates = all.filter((event) => confirmed.has(event.id)).map(displayEventRow);
+          const confirmation = await confirmRsvps(candidates, memberOnly);
+          if (member) await assertReadAccess(member);
+          if (version !== loadVersion) return undefined;
+          return derive({ ...base, status: "ready", errored: false, events: confirmation.events, identityLine: identity, verificationUnavailable: confirmation.verificationUnavailable });
+        } catch (error) {
+          if (memberOnly && readAccessDenied(error)) throw error;
+          if (member) await assertReadAccess(member);
+          if (version !== loadVersion) return undefined;
+          // Offline / fetch failure: keep the cached rows instead of a blank error state.
+          return cached.length
+            ? base
+            : derive({ ...clean, status: "ready", errored: true, events: [], identityLine: identity });
+        }
+      } catch (error) {
+        const failure = memberOnly && !(await memberAccess()).email ? new Error("Unauthenticated: sign in to see your events") : error;
+        const flags = await readSignInFlags(failure);
+        return version === loadVersion ? derive({ ...clean, ...flags, status: "ready", errored: true, events: [] }) : undefined;
       }
     },
   },
 });
-svc.load();
+// Wait for the descriptor's load action to select member-only or device-local scope.
+// An eager unconfigured read could briefly expose guest KV before Branded opts in.
+svc.prepare();
 export { svc };

package/templates/gym-fitness/tier5-src/himi-store-product/index.ts

@@ -15,7 +15,7 @@ import { stashCopy, copyParam, copyTemplate } from "../_shared/himi-copy.js";
 import { isBridgeUnavailable } from "../_shared/owner-load-error.js";
 import { isProductSaved, toggleSavedProduct } from "../_shared/himi-store-saved.js";
 import { openRichLink } from "../_shared/rich-content-link.js";
-import { richBody } from "../_shared/rich-body.js";
+import { descriptionBody } from "../_shared/rich-body.js";
 
 // Offline-first (data-offline): the detail is a public READ-THROUGH — when the live
 // product fetch fails (offline) fall back to the last-synced row the catalog cached
@@ -85,9 +85,7 @@ function productPolicyBody(product: StoreProduct, kind: "returns" | "shipping"):
   });
   if (!section) return "";
   const html = "plainDescription" in section ? section.plainDescription : undefined;
-  if (html) return plainText(html.replace(/ /gi, " "));
-  if (typeof section.description === "string") return plainText(section.description.replace(/ /gi, " "));
-  return richBody(section.description).bodyText;
+  return descriptionBody(html || section.description).bodyText;
 }
 
 /** The product id `lastProduct` was read for. A pooled screen re-appearing calls
@@ -170,13 +168,12 @@ function optionsHint(groups: StoreOption[], selection: StoreOptionSelection): st
   return copyTemplate("product.optionsChoose", "Choose {options}", { options: missing.join(", ") });
 }
 
-/** The description pair. V3's `description` is a Ricos OBJECT (the HTML `plainText` would throw on it): it
- *  becomes the RichContent document, and `plainDescription` (or the document's own text) the plain copy. A V1
- *  `description` is an HTML string: stripped text, no document. */
+/** Catalog V3 returns Ricos objects or serialized documents; V1 returns HTML.
+ * Keep plainDescription as the independent fallback, never raw document JSON. */
 function productBody(p: StoreProduct): { description: string; descriptionJson: string } {
   const raw = (p as { description?: unknown }).description;
-  const html = plainText(p.plainDescription || (typeof raw === "string" ? raw : ""));
-  const { bodyJson, bodyText } = richBody(typeof raw === "string" ? null : raw, html);
+  const html = descriptionBody(p.plainDescription).bodyText;
+  const { bodyJson, bodyText } = descriptionBody(raw, html);
   return { description: html || bodyText, descriptionJson: bodyJson };
 }
 

package/templates/gym-fitness-owner/config.ts

@@ -37,7 +37,7 @@ export default defineApp({
     actions: "http://localhost:8190/v1/actions",
     sync: "http://localhost:8190/v1/sync",
   },
-  capabilities: ["live_activity","push","share","secure_storage","open_url","local_database","clipboard","ui","speech","camera","photos","file_picker","files","presigned_upload","app_info","biometrics","wix_platform","animation"],
+  capabilities: ["live_activity","push","share","secure_storage","open_url","local_database","clipboard","ui","speech","camera","photos","file_picker","files","presigned_upload","app_info","biometrics","wix_platform","stream","wix_api"],
   designTokensPath: "./tokens.json",
   // Native fallback; the T5 splash descriptor owns the editable launch appearance.
   splash: {

package/templates/nonprofit-cause/config.ts

@@ -37,7 +37,7 @@ export default defineApp({
     actions: "http://localhost:8190/v1/actions",
     sync: "http://localhost:8190/v1/sync",
   },
-  capabilities: ["live_activity","push","share","secure_storage","open_url","calendar","local_database","wix_api","wix_platform","app_info","iap","release_control","clipboard","theme"],
+  capabilities: ["push","share","secure_storage","open_url","calendar","local_database","wix_api","wix_platform","app_info","iap","release_control","clipboard","theme","wix_cashier"],
   cache: {
     "rules": [
       {
@@ -81,6 +81,13 @@ export default defineApp({
         "parentScreenId": "himi_account",
         "tabId": "profile"
       },
+      {
+        "screenId": "himi_business_contact",
+        "isPublic": true,
+        "paramKeys": [],
+        "parentScreenId": "himi_account",
+        "tabId": "profile"
+      },
       {
         "screenId": "himi_appearance",
         "isPublic": true,

package/templates/nonprofit-cause/dev/index.ts

@@ -6231,6 +6231,219 @@ const SCREENS = runtimeSetting({
       "bundleVersion": "0.0.1"
     }
   },
+  "himi_business_contact": {
+    "screenId": "himi_business_contact",
+    "title": "Business contact",
+    "renderer": "sdui_intent",
+    "schemaVersion": 1,
+    "cacheControl": {
+      "maxAge": 0,
+      "staleWhileRevalidate": 0
+    },
+    "payload": {
+      "id": "himi_business_contact.root",
+      "body": {
+        "package": "himalaya",
+        "type": "VStack",
+        "props": {
+          "spacing": 16,
+          "alignment": "leading",
+          "children": [
+            {
+              "id": "himi_business_contact.section",
+              "body": {
+                "package": "himalaya",
+                "type": "VStack",
+                "props": {
+                  "spacing": 12,
+                  "alignment": "leading",
+                  "children": [
+                    {
+                      "id": "himi_business_contact.section.directions_copy",
+                      "body": {
+                        "package": "himalaya",
+                        "type": "Text",
+                        "props": {
+                          "text": "Directions",
+                          "style": "body",
+                          "collapseWhenEmpty": true
+                        }
+                      },
+                      "modifiers": {
+                        "hidden": true
+                      }
+                    },
+                    {
+                      "id": "himi_business_contact.section.unavailable",
+                      "body": {
+                        "package": "himalaya",
+                        "type": "Text",
+                        "props": {
+                          "text": "Contact details unavailable",
+                          "style": "body",
+                          "collapseWhenEmpty": true
+                        }
+                      }
+                    },
+                    {
+                      "id": "himi_business_contact.section.member_count",
+                      "body": {
+                        "package": "himalaya",
+                        "type": "FragmentSlot",
+                        "props": {
+                          "casePath": "$service:businessContact.memberCountCase",
+                          "defaultCase": "unavailable",
+                          "cases": [
+                            {
+                              "id": "one",
+                              "content": {
+                                "id": "himi_business_contact.section.members_one",
+                                "body": {
+                                  "package": "himalaya",
+                                  "type": "HStack",
+                                  "props": {
+                                    "spacing": 4,
+                                    "alignment": "center",
+                                    "children": [
+                                      {
+                                        "id": "himi_business_contact.section.count_one",
+                                        "body": {
+                                          "package": "himalaya",
+                                          "type": "Text",
+                                          "props": {
+                                            "text": "$service:businessContact.memberCount",
+                                            "style": "footnote",
+                                            "collapseWhenEmpty": true
+                                          }
+                                        }
+                                      },
+                                      {
+                                        "id": "himi_business_contact.section.unit_one",
+                                        "body": {
+                                          "package": "himalaya",
+                                          "type": "Text",
+                                          "props": {
+                                            "text": "member",
+                                            "style": "footnote",
+                                            "collapseWhenEmpty": true
+                                          }
+                                        }
+                                      }
+                                    ]
+                                  }
+                                }
+                              }
+                            },
+                            {
+                              "id": "other",
+                              "content": {
+                                "id": "himi_business_contact.section.members_other",
+                                "body": {
+                                  "package": "himalaya",
+                                  "type": "HStack",
+                                  "props": {
+                                    "spacing": 4,
+                                    "alignment": "center",
+                                    "children": [
+                                      {
+                                        "id": "himi_business_contact.section.count_other",
+                                        "body": {
+                                          "package": "himalaya",
+                                          "type": "Text",
+                                          "props": {
+                                            "text": "$service:businessContact.memberCount",
+                                            "style": "footnote",
+                                            "collapseWhenEmpty": true
+                                          }
+                                        }
+                                      },
+                                      {
+                                        "id": "himi_business_contact.section.unit_other",
+                                        "body": {
+                                          "package": "himalaya",
+                                          "type": "Text",
+                                          "props": {
+                                            "text": "members",
+                                            "style": "footnote",
+                                            "collapseWhenEmpty": true
+                                          }
+                                        }
+                                      }
+                                    ]
+                                  }
+                                }
+                              }
+                            },
+                            {
+                              "id": "unavailable",
+                              "content": {
+                                "id": "himi_business_contact.section.members_unavailable",
+                                "body": {
+                                  "package": "himalaya",
+                                  "type": "Text",
+                                  "props": {
+                                    "text": "Member count unavailable",
+                                    "style": "footnote",
+                                    "collapseWhenEmpty": true
+                                  }
+                                }
+                              }
+                            }
+                          ]
+                        }
+                      },
+                      "modifiers": {
+                        "hidden": true
+                      }
+                    },
+                    {
+                      "id": "himi_business_contact.section.feedback",
+                      "body": {
+                        "package": "himalaya",
+                        "type": "Text",
+                        "props": {
+                          "text": "$service:businessContact.message",
+                          "style": "footnote",
+                          "collapseWhenEmpty": true
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          ]
+        }
+      },
+      "modifiers": {
+        "background": {
+          "token": "surfacePrimary"
+        },
+        "padding": {
+          "leading": 20,
+          "trailing": 20,
+          "top": 18,
+          "bottom": 28
+        },
+        "onAppear": {
+          "actionId": "tier5.businessContact.load",
+          "args": {
+            "showMemberCount": false
+          }
+        }
+      }
+    },
+    "logicBundle": {
+      "url": "http://localhost:8190/v1/bundles/business-contact?integrity=",
+      "integrity": "",
+      "contentType": "application/javascript+ts-bundle",
+      "declaredCapabilities": [
+        "open_url"
+      ],
+      "minBinaryVersion": "0.1.0",
+      "bundleVersion": "0.0.1"
+    }
+  },
   "himi_appearance": {
     "screenId": "himi_appearance",
     "renderer": "sdui_intent",
@@ -15628,6 +15841,9 @@ const SCREENS = runtimeSetting({
                           "style": "body",
                           "color": "textSecondary"
                         }
+                      },
+                      "modifiers": {
+                        "hiddenPath": "$service:himiMyEvents.signInRequired"
                       }
                     },
                     {
@@ -15642,6 +15858,32 @@ const SCREENS = runtimeSetting({
                             "actionId": "tier5.himiMyEvents.load"
                           }
                         }
+                      },
+                      "modifiers": {
+                        "hiddenPath": "$service:himiMyEvents.signInRequired"
+                      }
+                    },
+                    {
+                      "id": "himi_my_events.retry.sign_in",
+                      "body": {
+                        "package": "himalaya",
+                        "type": "Button",
+                        "props": {
+                          "title": "Sign in",
+                          "style": "primary",
+                          "action": {
+                            "actionId": "himi.open",
+                            "params": {
+                              "screenId": "himi_sign_in",
+                              "mode": "signin",
+                              "modal": "1"
+                            },
+                            "presentation": "sheet"
+                          }
+                        }
+                      },
+                      "modifiers": {
+                        "hiddenPath": "$service:himiMyEvents.noSignIn"
                       }
                     }
                   ]
@@ -16072,7 +16314,11 @@ const SCREENS = runtimeSetting({
           "bottom": 24
         },
         "onAppear": {
-          "actionId": "tier5.himiMyEvents.load"
+          "actionId": "tier5.himiMyEvents.load",
+          "params": {
+            "signInScreenId": "himi_sign_in",
+            "memberOnly": "1"
+          }
         }
       }
     },
@@ -25279,6 +25525,9 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
                           "style": "body",
                           "color": "textSecondary"
                         }
+                      },
+                      "modifiers": {
+                        "hiddenPath": "$service:himiBlogPost.signInRequired"
                       }
                     },
                     {
@@ -25293,6 +25542,32 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
                             "actionId": "tier5.himiBlogPost.retry"
                           }
                         }
+                      },
+                      "modifiers": {
+                        "hiddenPath": "$service:himiBlogPost.signInRequired"
+                      }
+                    },
+                    {
+                      "id": "himi_blog_post.retry.sign_in",
+                      "body": {
+                        "package": "himalaya",
+                        "type": "Button",
+                        "props": {
+                          "title": "Sign in",
+                          "style": "primary",
+                          "action": {
+                            "actionId": "himi.open",
+                            "params": {
+                              "screenId": "himi_sign_in",
+                              "mode": "signin",
+                              "modal": "1"
+                            },
+                            "presentation": "sheet"
+                          }
+                        }
+                      },
+                      "modifiers": {
+                        "hiddenPath": "$service:himiBlogPost.noSignIn"
                       }
                     }
                   ]
@@ -25997,7 +26272,8 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
         "onAppear": {
           "actionId": "tier5.himiBlogPost.load",
           "params": {
-            "id": "__HIMI_ID__"
+            "id": "__HIMI_ID__",
+            "signInScreenId": "himi_sign_in"
           }
         }
       }

package/templates/nonprofit-cause/himalaya.content.json

@@ -28,6 +28,9 @@
     "himi_branded_splash": {
       "displayName": "Splash"
     },
+    "himi_business_contact": {
+      "displayName": "Business contact"
+    },
     "himi_create_post": {
       "displayName": "Create Post"
     },