@wix/himalaya-cli 0.1570.0 → 0.1571.0

package/templates/branded-lite/tier5-src/himi-events-my-events/index.ts

@@ -5,6 +5,8 @@ import { queryEvents, type WixEvent } from "@himalaya/wix-events";
 import { getAll, upsert, type DbEntity } from "@himalaya/local-db";
 import { confirmedRsvpIds, eventStartMillis, normalizeEvent, type EventRow } from "../_shared/himi-events";
 import { stashCopy, copyParam, copyTemplate } from "../_shared/himi-copy.js";
+import { memberAccess } from "../_shared/member-access.js";
+import { readAccess, assertReadAccess, readAccessDenied, readSignInFlags, NO_READ_SIGN_IN } from "../_shared/member-read.js";
 
 // Offline-first (data-offline): My Events is a read-through over the same `events`
 // catalog the list caches — paint the last-synced rows (filtered to this device's
@@ -27,6 +29,7 @@ async function writeCached(rows: CachedEventRow[]): Promise<void> {
 }
 
 interface S {
+  signInRequired: boolean; noSignIn: boolean; signInScreenId: string;
   status: "loading" | "ready";
   events: EventRow[];
   emptyText: string;
@@ -98,11 +101,10 @@ function unverifiedEvent(event: CachedEventRow): CachedEventRow {
   };
 }
 
-/** Keep only the candidate rows the member ACTUALLY still holds an RSVP for, asking
- *  Wix per event. Fail-open per row: a network/permission blip must not blank a row the
- *  member really has (that would look like their RSVP vanished), so an errored probe
- *  keeps the row and only an explicit "no active RSVP" drops it. */
-async function confirmRsvps(candidates: CachedEventRow[]): Promise<{ events: CachedEventRow[]; verificationUnavailable: boolean }> {
+/** Verify device-local candidates against the current member. Member-only mode
+ *  requires successful verification; standalone mode retains failed probes as
+ *  explicitly unverified device-local history. */
+async function confirmRsvps(candidates: CachedEventRow[], memberOnly = false): Promise<{ events: CachedEventRow[]; verificationUnavailable: boolean }> {
   // Raw wixApi chokepoint rather than a generated client: the member RSVP read lives in
   // events **v2**, and `@himalaya/wix-events` is the v1 domain module. Adding a
   // `wix-events-v2` specifier is not an option — the umbrella package deliberately
@@ -122,7 +124,9 @@ async function confirmRsvps(candidates: CachedEventRow[]): Promise<{ events: Cac
         event: held ? { ...event, status: [event.status, copyParam("myEvents.rsvpConfirmed", "RSVP confirmed")].filter(Boolean).join(" · ") } : null,
         verificationUnavailable: false,
       };
-    } catch {
+    } catch (error) {
+      // Device candidates carry no member ownership proof until this read succeeds.
+      if (memberOnly) throw error;
       // Fail-open, but never claim backend confirmation while its member-readable
       // probe is unavailable. The device id remains a candidate, explicitly labeled.
       return { event: unverifiedEvent(event), verificationUnavailable: true };
@@ -134,8 +138,8 @@ async function confirmRsvps(candidates: CachedEventRow[]): Promise<{ events: Cac
   };
 }
 
-const svc = defineService<S, { load: (s: S, arg?: unknown) => Promise<S> }>("himiMyEvents", {
-  state: derive({
+const INITIAL: S = derive({
+    ...NO_READ_SIGN_IN, signInScreenId: "himi_account",
     status: "loading",
     events: [],
     emptyText: "",
@@ -147,45 +151,75 @@ const svc = defineService<S, { load: (s: S, arg?: unknown) => Promise<S> }>("him
     isLoading: true,
     notLoading: false,
     noEmpty: true,
-  }),
+  });
+let memberOnlyRequested = false;
+let loadVersion = 0;
+const svc = defineService<S, { prepare: (s: S) => S; load: (s: S, arg?: unknown) => Promise<S | undefined> }>("himiMyEvents", {
+  state: INITIAL,
   actions: {
-    load: async (s, arg) => {
+    prepare: (s) => ({ ...s, ...INITIAL }),
+    load: async (s, arg): Promise<S | undefined> => {
       stashCopy(arg);
-      const confirmed = new Set(confirmedRsvpIds());
-      const identity = await identityLine();
-      // 1) Instant paint from the on-device cache (offline-safe; empty on first-ever run).
-      const cached = await readCached();
-      const cachedEvents = cached.filter((event) => confirmed.has(event.id)).map(displayEventRow);
-      const base = cached.length
-        ? derive({ ...s, status: "ready", errored: false, events: cachedEvents, identityLine: identity, verificationUnavailable: cachedEvents.length > 0 })
-        : s;
-      // 2) Revalidate from Wix and refresh the cache.
+      const version = ++loadVersion;
+      const options = arg as { memberOnly?: unknown; signInScreenId?: unknown } | undefined;
+      if (options?.memberOnly !== undefined) memberOnlyRequested = options.memberOnly === "1";
+      const memberOnly = memberOnlyRequested;
+      const clean = { ...INITIAL, signInScreenId: options?.signInScreenId === "himi_sign_in" ? "himi_sign_in" : s.signInScreenId };
+      await svc.prepare();
       try {
-        const res = await queryEvents({ limit: 50 });
-        const all = ((res as unknown as { events?: WixEvent[] }).events ?? []).map(cachedEventRow);
-        await writeCached(all);
-        // Phase 3c — make each row AUTHORITATIVE. The device list is only a candidate
-        // set: it never forgets, so an RSVP cancelled elsewhere (web, or by the
-        // business) would otherwise show here forever. Confirm each candidate against
-        // Wix and drop the ones the member no longer holds.
-        //
-        // Per-event by necessity, not by choice: a member CANNOT enumerate their own
-        // RSVPs. Verified live against a real member token — `queryRsvps` (cross-event)
-        // 403s "WIX_EVENTS.READ_RSVP permission required", `listOrders` 403s
-        // READ_ORDERS, and `/rsvps/current` 400s without an eventId. Only the
-        // single-event read is member-readable, so the fan-out below IS the ceiling
-        // until those member scopes exist server-side.
-        const candidates = all.filter((event) => confirmed.has(event.id)).map(displayEventRow);
-        const confirmation = await confirmRsvps(candidates);
-        return derive({ ...base, status: "ready", errored: false, events: confirmation.events, identityLine: identity, verificationUnavailable: confirmation.verificationUnavailable });
-      } catch {
-        // Offline / fetch failure: keep the cached rows instead of a blank error state.
-        return cached.length
-          ? base
-          : derive({ ...s, status: "ready", errored: true, events: [], identityLine: identity });
+        const member = memberOnly ? await readAccess() : null;
+        if (memberOnly && !member?.member.email) throw new Error("Unauthenticated: sign in to see your events");
+        const confirmed = new Set(confirmedRsvpIds());
+        const identity = await identityLine();
+        // 1) Instant paint from the on-device cache (offline-safe; empty on first-ever run).
+        // Device-local candidates have no member ownership proof. Branded must
+        // verify them online rather than show a previous member's cached RSVP list.
+        const cached = memberOnly ? [] : await readCached();
+        const cachedEvents = cached.filter((event) => confirmed.has(event.id)).map(displayEventRow);
+        const base = cached.length
+          ? derive({ ...clean, status: "ready", errored: false, events: cachedEvents, identityLine: identity, verificationUnavailable: cachedEvents.length > 0 })
+          : clean;
+        // 2) Revalidate from Wix and refresh the cache.
+        try {
+          const res = await queryEvents({ limit: 50 });
+          const all = ((res as unknown as { events?: WixEvent[] }).events ?? []).map(cachedEventRow);
+          if (member) await assertReadAccess(member);
+          if (version !== loadVersion) return undefined;
+          await writeCached(all);
+          // Phase 3c — make each row AUTHORITATIVE. The device list is only a candidate
+          // set: it never forgets, so an RSVP cancelled elsewhere (web, or by the
+          // business) would otherwise show here forever. Confirm each candidate against
+          // Wix and drop the ones the member no longer holds.
+          //
+          // Per-event by necessity, not by choice: a member CANNOT enumerate their own
+          // RSVPs. Verified live against a real member token — `queryRsvps` (cross-event)
+          // 403s "WIX_EVENTS.READ_RSVP permission required", `listOrders` 403s
+          // READ_ORDERS, and `/rsvps/current` 400s without an eventId. Only the
+          // single-event read is member-readable, so the fan-out below IS the ceiling
+          // until those member scopes exist server-side.
+          const candidates = all.filter((event) => confirmed.has(event.id)).map(displayEventRow);
+          const confirmation = await confirmRsvps(candidates, memberOnly);
+          if (member) await assertReadAccess(member);
+          if (version !== loadVersion) return undefined;
+          return derive({ ...base, status: "ready", errored: false, events: confirmation.events, identityLine: identity, verificationUnavailable: confirmation.verificationUnavailable });
+        } catch (error) {
+          if (memberOnly && readAccessDenied(error)) throw error;
+          if (member) await assertReadAccess(member);
+          if (version !== loadVersion) return undefined;
+          // Offline / fetch failure: keep the cached rows instead of a blank error state.
+          return cached.length
+            ? base
+            : derive({ ...clean, status: "ready", errored: true, events: [], identityLine: identity });
+        }
+      } catch (error) {
+        const failure = memberOnly && !(await memberAccess()).email ? new Error("Unauthenticated: sign in to see your events") : error;
+        const flags = await readSignInFlags(failure);
+        return version === loadVersion ? derive({ ...clean, ...flags, status: "ready", errored: true, events: [] }) : undefined;
       }
     },
   },
 });
-svc.load();
+// Wait for the descriptor's load action to select member-only or device-local scope.
+// An eager unconfigured read could briefly expose guest KV before Branded opts in.
+svc.prepare();
 export { svc };

package/templates/branded-lite/tier5-src/himi-store-product/index.ts

@@ -19,7 +19,7 @@ import { stashCopy, copyParam, copyTemplate } from "../_shared/himi-copy.js";
 import { isBridgeUnavailable } from "../_shared/owner-load-error.js";
 import { isProductSaved, toggleSavedProduct } from "../_shared/himi-store-saved.js";
 import { openRichLink } from "../_shared/rich-content-link.js";
-import { richBody } from "../_shared/rich-body.js";
+import { descriptionBody } from "../_shared/rich-body.js";
 
 /** Live cart size (sum of line-item quantities) for the top-bar cart badge.
  *  Best-effort: a cart error just yields 0 (badge hidden), never fails the screen. */
@@ -74,9 +74,7 @@ function productPolicyBody(product: StoreProduct, kind: "returns" | "shipping"):
   });
   if (!section) return "";
   const html = "plainDescription" in section ? section.plainDescription : undefined;
-  if (html) return plainText(html.replace(/ /gi, " "));
-  if (typeof section.description === "string") return plainText(section.description.replace(/ /gi, " "));
-  return richBody(section.description).bodyText;
+  return descriptionBody(html || section.description).bodyText;
 }
 
 /** The product id `lastProduct` was read for. A pooled screen re-appearing calls
@@ -140,13 +138,12 @@ function optionsHint(groups: StoreOption[], selection: StoreOptionSelection): st
   return copyTemplate("product.optionsChoose", "Choose {options}", { options: missing.join(", ") });
 }
 
-/** The description pair. V3's `description` is a Ricos OBJECT (the HTML `plainText` would throw on it): it
- *  becomes the RichContent document, and `plainDescription` (or the document's own text) the plain copy. A V1
- *  `description` is an HTML string: stripped text, no document. */
+/** Catalog V3 returns Ricos objects or serialized documents; V1 returns HTML.
+ * Keep plainDescription as the independent fallback, never raw document JSON. */
 function productBody(p: StoreProduct): { description: string; descriptionJson: string } {
   const raw = (p as { description?: unknown }).description;
-  const html = plainText(p.plainDescription || (typeof raw === "string" ? raw : ""));
-  const { bodyJson, bodyText } = richBody(typeof raw === "string" ? null : raw, html);
+  const html = descriptionBody(p.plainDescription).bodyText;
+  const { bodyJson, bodyText } = descriptionBody(raw, html);
   return { description: html || bodyText, descriptionJson: bodyJson };
 }
 

package/templates/branded-lite/tier5-src/wix-spaces-chat-thread/index.ts

@@ -9,7 +9,7 @@
 // `chatRealtime` channel, else a 4 s foreground `_poll` of `refresh`. A message from the
 // business then appears without the member leaving the screen. `load`, `setDraft` and
 // `send` keep their contract; the directives are stripped by the runtime, never state.
-import { defineService, type PollDirective, type StreamDirective } from "@himalaya/state";
+import { defineService, type PollDirective, type PollStopDirective, type StreamDirective } from "@himalaya/state";
 import { getMessages, sendChatMessage, getOrCreateDirectChatroom, getChatToken, type ChatMessage } from "@himalaya/wix-chat-web";
 import { getMyData } from "@himalaya/wix-users";
 import { formatMonthDay, formatMonthDayTime } from "../_shared/engine-intl.js";
@@ -17,7 +17,10 @@ import { initials } from "../_shared/himi-text.js";
 import { copyParam, stashCopy } from "../_shared/himi-copy.js";
 import { presence, presenceAfterError, detailInputId, type PresenceFlags } from "../_shared/detail-presence.js";
 import { writeMayHaveLanded } from "../_shared/owner-load-error.js";
-import { chatRealtimeConfig, createReloadGate, createSendIntents, createVisitToken, liveDirectives, postWithVisitToken, liveFallback, type ChatLiveMode, type ChatRealtimeConfig } from "../_shared/chat-live.js";
+import { CHAT_LIVE_POLL_ID, chatRealtimeConfig, createReloadGate, createSendIntents, createVisitToken, liveDirectives, postWithVisitToken, isTokenRejected, liveFallback, type ChatLiveMode, type ChatRealtimeConfig } from "../_shared/chat-live.js";
+
+import { memberAccess, memberAccessChanged } from "../_shared/member-access.js";
+import { readAccess, assertReadAccess, readAccessDenied, NO_READ_SIGN_IN, type ReadAccess } from "../_shared/member-read.js";
 
 const SERVICE = "spacesChatThread";
 const EMPTY_TEXT = "No messages yet. Say hello!";
@@ -31,13 +34,14 @@ interface Row {
   imageUrl: string; imageDescription: string; imageHidden: boolean; dayLabel: string; dayHidden: boolean;
 }
 interface S extends PresenceFlags {
+  threadMember: ReadAccess | null; signInRequired: boolean; noSignIn: boolean;
   status: "loading" | "ready"; messages: Row[]; emptyText: string; emptyHidden: boolean; draft: string; sendHint: string; resolvedChatroomId: string; myUserId: string;
   /** Send token for the host's transcript scroll: a new value follows the tail. */
   scrollSend: string;
   /** Which path keeps the open thread live (diagnostic). */
   live?: ChatLiveMode;
   _stream?: StreamDirective;
-  _poll?: PollDirective;
+  _poll?: PollDirective | PollStopDirective;
 }
 
 function inputId(): string {
@@ -125,15 +129,21 @@ function nextScrollToken(prev: string): string {
 // mint a token every 4 s on top of its GET. Reset on every `load`.
 const memberToken = createVisitToken(() => getChatToken({ role: "member" }).then((t) => t.chatToken));
 
-async function reload(id: string, myUserId: string): Promise<Row[]> {
+async function reload(id: string, myUserId: string, member: ReadAccess): Promise<Row[]> {
   if (!id) return [];
-  const token = memberToken.get();
-  try {
-    const msgs = await getMessages(id, 30, { role: "member", chatToken: await token });
-    return rowsOf(msgs ?? [], myUserId);
-  } catch (e) {
-    memberToken.drop(token);
-    throw e;
+  for (let attempt = 0; ; attempt++) {
+    const token = memberToken.get();
+    try {
+      const chatToken = await token;
+      await assertReadAccess(member);
+      const msgs = await getMessages(id, 30, { role: "member", chatToken });
+      return rowsOf(msgs ?? [], myUserId);
+    } catch (error) {
+      memberToken.drop(token);
+      // An expired visit token gets one fresh attempt. A repeated refusal still
+      // clears private history; checking identity before each read prevents stale retries.
+      if (attempt > 0 || !isTokenRejected(error)) throw error;
+    }
   }
 }
 
@@ -142,9 +152,13 @@ const intents = createSendIntents();
 
 /** Post once per intent: a retried tap of the same text reuses its message id, so a send
  *  that failed ambiguously and is tapped again stays one message. */
-async function postOnce(chatroomId: string, text: string): Promise<void> {
+async function postOnce(chatroomId: string, text: string, member: ReadAccess): Promise<void> {
   const messageId = intents.idFor(chatroomId, text);
-  await postWithVisitToken(memberToken, (chatToken) => sendChatMessage(chatroomId, text, { role: "member", chatToken, messageId }));
+  await postWithVisitToken(memberToken, async (chatToken) => {
+    await assertReadAccess(member);
+    if (liveState().threadMember !== member) throw memberAccessChanged();
+    return sendChatMessage(chatroomId, text, { role: "member", chatToken, messageId });
+  });
   intents.settle(chatroomId, text);
 }
 
@@ -155,7 +169,7 @@ let sendingNow = false;
 // The conversation a live re-read reads, and the channel the screen passed (if any).
 let current = { chatroomId: "", myUserId: "" };
 let realtime: ChatRealtimeConfig | null = null;
-const gate = createReloadGate(() => reload(current.chatroomId, current.myUserId));
+const gate = createReloadGate(() => reload(current.chatroomId, current.myUserId, liveState().threadMember!));
 
 /** A tick or a stream event: re-read the open conversation. A failed tick keeps the
  *  thread as it is — the next one tries again.
@@ -167,12 +181,16 @@ const gate = createReloadGate(() => reload(current.chatroomId, current.myUserId)
 async function reread(s: S): Promise<S> {
   if (!s.found || !s.resolvedChatroomId || s.resolvedChatroomId !== current.chatroomId) return s;
   try {
+    await assertThreadMember(s);
     const messages = await gate.request();
+    await assertThreadMember(s);
     const now = svc.getState();
-    if (now.resolvedChatroomId !== s.resolvedChatroomId) return now;
+    if (now.threadMember !== s.threadMember || now.resolvedChatroomId !== s.resolvedChatroomId) return now;
     return { ...now, messages, emptyText: messages.length ? "" : now.emptyText || EMPTY_TEXT, emptyHidden: messages.length > 0 };
-  } catch {
-    return svc.getState();
+  } catch (error) {
+    const now = svc.getState();
+    if (now.threadMember !== s.threadMember) return now;
+    return readAccessDenied(error) ? threadFailure(error) : now;
   }
 }
 
@@ -187,40 +205,71 @@ async function resolveMyUserId(): Promise<string> {
   try { return (await getMyData()).userId || ""; } catch { return ""; }
 }
 
+const INITIAL: S = { status: "loading", messages: [], emptyText: "", emptyHidden: true, scrollSend: "", draft: "", sendHint: "", resolvedChatroomId: "", myUserId: "", ...presence("loading"), ...NO_READ_SIGN_IN, threadMember: null };
+let loadVersion = 0;
+
+async function threadFailure(error: unknown): Promise<S> {
+  const version = loadVersion;
+  const member = await memberAccess();
+  const flags = member.email ? NO_READ_SIGN_IN : { signInRequired: true, noSignIn: false };
+  if (version !== loadVersion) return liveState();
+  current = { chatroomId: "", myUserId: "" };
+  memberToken.reset();
+  return { ...INITIAL, status: "ready", ...presenceAfterError(error), ...flags, live: "off", _poll: { id: CHAT_LIVE_POLL_ID, stop: true } };
+}
+async function assertThreadMember(s: S): Promise<void> {
+  if (!s.threadMember?.member?.email) throw new Error("Unauthenticated: sign in to read messages");
+  await assertReadAccess(s.threadMember);
+}
+
 const svc = defineService<S, {
-  load: (s: S, a?: unknown) => Promise<S>;
+  prepare: (s: S) => S;
+  load: (s: S, a?: unknown) => Promise<S | undefined>;
   setDraft: (s: S, a?: unknown) => S;
   send: (s: S) => Promise<S>;
   refresh: (s: S) => Promise<S>;
   onStreamEvent: (s: S) => Promise<S>;
   onStreamError: (s: S) => S;
 }>(SERVICE, {
-  state: { status: "loading", messages: [], emptyText: "", emptyHidden: true, scrollSend: "", draft: "", sendHint: "", resolvedChatroomId: "", myUserId: "", ...presence("loading") },
+  state: INITIAL,
   actions: {
-    load: async (s, a) => {
+    prepare: (s) => ({ ...s, ...INITIAL, _poll: { id: CHAT_LIVE_POLL_ID, stop: true } }),
+    load: async (s, a): Promise<S | undefined> => {
+      const version = ++loadVersion;
+      await svc.prepare();
+      current = { chatroomId: "", myUserId: "" };
       stashCopy(a);
       const param = (a as { chatRealtime?: unknown } | null | undefined)?.chatRealtime;
       if (param !== undefined) realtime = chatRealtimeConfig(param);
       const raw = inputId();
       // No thread / recipient id (a stale link, a route opened directly) -> the shared
       // not-found state, and no composer: there is nobody to send to.
-      if (!detailInputId()) return { ...s, status: "ready", messages: [], emptyText: "", emptyHidden: true, ...presence("missing") };
+      if (!detailInputId()) return { ...INITIAL, status: "ready", messages: [], emptyText: "", emptyHidden: true, ...presence("missing") };
       memberToken.reset();
-      // Resolve chatroom + my user id concurrently (myUserId tags own messages).
-      const [chatroomId, myUserId] = await Promise.all([resolveChatroomId(raw, inputKind()), resolveMyUserId()]);
-      // A recipient whose 1:1 chatroom could not be resolved is not a conversation yet:
-      // reload("") would return [] without throwing and publish a live, empty thread
-      // whose Send can only fail. Show the load-error line instead.
-      if (!chatroomId) return { ...s, status: "ready", resolvedChatroomId: "", myUserId, messages: [], emptyText: "", emptyHidden: true, ...presence("failed") };
       try {
-        const messages = await reload(chatroomId, myUserId);
+        const member = await readAccess();
+        if (!member.member.email) throw new Error("Unauthenticated: sign in to read messages");
+        // Resolve chatroom + my user id concurrently (myUserId tags own messages).
+        const [chatroomId, myUserId] = await Promise.all([resolveChatroomId(raw, inputKind()), resolveMyUserId()]);
+        // A recipient whose 1:1 chatroom could not be resolved is not a conversation yet:
+        // reload("") would return [] without throwing and publish a live, empty thread
+        // whose Send can only fail. Show the load-error line instead.
+        if (!chatroomId) return version === loadVersion ? { ...INITIAL, status: "ready", ...presence("failed") } : undefined;
+        const messages = await reload(chatroomId, myUserId, member);
+        await assertReadAccess(member);
+        if (version !== loadVersion) return undefined;
         current = { chatroomId, myUserId };
-        return { ...s, status: "ready", resolvedChatroomId: chatroomId, myUserId, messages, emptyText: messages.length ? "" : EMPTY_TEXT, emptyHidden: messages.length > 0, scrollSend: messages.length ? nextScrollToken(s.scrollSend) : "", ...presence("found"), ...liveDirectives(realtime, chatroomId, SERVICE) };
+        const previous = s.threadMember;
+        const sameReader = previous?.member.email === member.member.email && previous?.member.scope === member.member.scope && previous?.tenant === member.tenant;
+        const draft = sameReader && s.resolvedChatroomId === chatroomId ? s.draft : "";
+        return { ...INITIAL, draft, threadMember: member, status: "ready", resolvedChatroomId: chatroomId, myUserId, messages, emptyText: messages.length ? "" : EMPTY_TEXT, emptyHidden: messages.length > 0, scrollSend: messages.length ? nextScrollToken(s.scrollSend) : "", ...presence("found"), ...liveDirectives(realtime, chatroomId, SERVICE) };
       } catch (e) {
         // A thread whose messages cannot be read is not a live, empty conversation: a 404
         // is the shared not-found state, anything else the load-error line — never a
         // "Say hello!" composer that can only fail.
-        return { ...s, status: "ready", resolvedChatroomId: chatroomId, myUserId, messages: [], emptyText: "", emptyHidden: true, ...presenceAfterError(e) };
+        if (version !== loadVersion) return undefined;
+        const failed = await threadFailure(e);
+        return version === loadVersion ? failed : undefined;
       }
     },
     setDraft: (s, a) => ({ ...s, draft: val(a) }),
@@ -234,9 +283,14 @@ const svc = defineService<S, {
     // Every return builds on the LIVE state: the runtime replaces state wholesale, and ticks
     // or typing may have changed it while this awaited.
     send: async (s) => {
+      if (!s.found) return s;
       const text = s.draft.trim();
-      if (!text) return { ...s, sendHint: "Type a message first." };
-      if (sendingNow) return s;
+      try { await assertThreadMember(s); }
+      catch (error) { return liveState().threadMember !== s.threadMember ? liveState() : threadFailure(error); }
+      if (liveState().threadMember !== s.threadMember) return liveState();
+      const checked = liveState();
+      if (!text) return checked.draft.trim() ? checked : { ...checked, sendHint: "Type a message first." };
+      if (sendingNow) return checked;
       sendingNow = true;
       try {
         // Resolve lazily in case send() runs before load() settled.
@@ -244,8 +298,11 @@ const svc = defineService<S, {
         if (!chatroomId) chatroomId = await resolveChatroomId(inputId(), inputKind());
         if (!chatroomId) return { ...liveState(), sendHint: "Couldn't start conversation." };
         try {
-          await postOnce(chatroomId, text);
+          await postOnce(chatroomId, text, s.threadMember!);
         } catch (e) {
+          if (liveState().threadMember !== s.threadMember) return liveState();
+          try { await assertThreadMember(s); }
+          catch (error) { return threadFailure(error); }
           // Surface a short reason (the SDK rejects with "HTTP <code>: <body>") so a
           // real failure is diagnosable on-device instead of an opaque "Couldn't send".
           // A failure that may have posted anyway (a gateway timeout after the backend stored
@@ -255,6 +312,8 @@ const svc = defineService<S, {
           if (writeMayHaveLanded(e)) return { ...liveState(), resolvedChatroomId: chatroomId, sendHint: "Couldn't confirm it was sent — check before sending again." };
           return { ...liveState(), resolvedChatroomId: chatroomId, sendHint: msg ? `Couldn't send — ${msg.slice(0, 80)}` : "Couldn't send — try again." };
         }
+        await assertThreadMember(s);
+        if (liveState().threadMember !== s.threadMember) return liveState();
         // SENT. From here on nothing may say otherwise: a failed re-read must not offer a
         // second Send of a message that already posted.
         const myUserId = s.myUserId || (await resolveMyUserId());
@@ -264,18 +323,26 @@ const svc = defineService<S, {
         const cleared = (now: S): string => (now.draft.trim() === text ? "" : now.draft);
         try {
           const messages = await gate.request();
+          await assertThreadMember(s);
+          if (liveState().threadMember !== s.threadMember) return liveState();
           const now = liveState();
           return { ...now, resolvedChatroomId: chatroomId, myUserId, messages, draft: cleared(now), emptyText: "", emptyHidden: true, scrollSend: nextScrollToken(now.scrollSend), sendHint: "Sent ✓" };
-        } catch {
+        } catch (error) {
+          if (liveState().threadMember !== s.threadMember) return liveState();
+          if (readAccessDenied(error)) return threadFailure(error);
           const now = liveState();
           const local: Row = { id: `local-${now.messages.length}`, text, when: "", leadFill: " ", mine: true, notMine: false, senderBadge: "", avatarUrl: "", avatarInitials: "", imageUrl: "", imageDescription: "", imageHidden: true, dayLabel: "", dayHidden: true };
           return { ...now, resolvedChatroomId: chatroomId, myUserId, messages: [...now.messages, local], draft: cleared(now), emptyText: "", emptyHidden: true, scrollSend: nextScrollToken(now.scrollSend), sendHint: "Sent ✓" };
         }
+      } catch (error) {
+        if (liveState().threadMember !== s.threadMember) return liveState();
+        return threadFailure(error);
       } finally {
         sendingNow = false;
       }
     },
   },
 });
+svc.prepare();
 svc.load();
 export { svc };

package/templates/branded-lite/tier5-src/wix-spaces-forum-post/index.ts

@@ -7,7 +7,10 @@ import { presence, presenceAfterError, detailInputId, type PresenceFlags } from
 import { openRichLink } from "../_shared/rich-content-link.js";
 import { richBody } from "../_shared/rich-body.js";
 
+import { readAccess, assertReadAccess, readSignInFlags, NO_READ_SIGN_IN } from "../_shared/member-read.js";
+
 interface S extends PresenceFlags {
+  signInRequired: boolean; noSignIn: boolean;
   status: "loading" | "ready"; id: string; title: string; author: string; subtitle: string;
   /** The plain-text body (`contentText`): RichContent's fallback, and what shows when there is no document. */
   body: string;
@@ -26,8 +29,12 @@ function val(arg?: unknown): string {
   return typeof arg === "string" ? arg : ((arg as { value?: string; text?: string })?.value ?? (arg as { text?: string })?.text ?? "");
 }
 
+const INITIAL: S = { status: "loading", id: "", title: "", author: "", subtitle: "", body: "", bodyJson: "", hasBodyJson: false, initial: "", likeHint: "", commentText: "", commentHint: "", ...presence("loading"), ...NO_READ_SIGN_IN };
+let loadVersion = 0;
+
 const svc = defineService<S, {
-  load: (s: S) => Promise<S>;
+  prepare: (s: S) => S;
+  load: (s: S) => Promise<S | undefined>;
   like: (s: S) => Promise<S>;
   unlike: (s: S) => Promise<S>;
   setComment: (s: S, a?: unknown) => S;
@@ -35,12 +42,16 @@ const svc = defineService<S, {
   /** [rico] #3372 — RichContent's on_link: `{ url }` of the tapped link. */
   openLink: (s: S, a?: unknown) => Promise<S>;
 }>("spacesForumPost", {
-  state: { status: "loading", id: "", title: "", author: "", subtitle: "", body: "", bodyJson: "", hasBodyJson: false, initial: "", likeHint: "", commentText: "", commentHint: "", ...presence("loading") },
+  state: INITIAL,
   actions: {
-    load: async (s) => {
+    prepare: (s) => ({ ...s, ...INITIAL }),
+    load: async (s): Promise<S | undefined> => {
+      const version = ++loadVersion;
+      await svc.prepare();
       const id = detailInputId();
-      if (!id) return { ...s, status: "ready", ...presence("missing") };
+      if (!id) return { ...INITIAL, status: "ready", ...presence("missing") };
       try {
+        const access = await readAccess();
         const res = await getPost(id);
         const p = ((res as unknown as { post?: WixPost }).post) ?? (res as unknown as WixPost);
         const pp = p as unknown as { title?: string; contentText?: string; content?: unknown; writer?: { name?: string }; commentCount?: number; viewCount?: number };
@@ -56,10 +67,15 @@ const svc = defineService<S, {
         // which is the document's own text when there is no contentText.
         const { bodyJson, bodyText } = richBody(doc, legacy);
         const body = legacy || bodyText || "No content.";
-        return { status: "ready", id, title: pp.title || "Post", author, subtitle: bits.join(" · "),
+        await assertReadAccess(access);
+        if (version !== loadVersion) return undefined;
+        return { ...INITIAL, status: "ready", id, title: pp.title || "Post", author, subtitle: bits.join(" · "),
           body, bodyJson, hasBodyJson: bodyJson !== "", initial: (author[0] || "#").toUpperCase(),
           likeHint: "", commentText: "", commentHint: "", ...presence("found") };
-      } catch (e) { return { ...s, status: "ready", id, ...presenceAfterError(e) }; }
+      } catch (e) {
+        const flags = await readSignInFlags(e);
+        return version === loadVersion ? { ...INITIAL, status: "ready", id, ...presenceAfterError(e), ...flags } : undefined;
+      }
     },
     // REAL WRITE: react to / un-react to the post.
     like: async (s) => {
@@ -85,5 +101,6 @@ const svc = defineService<S, {
     openLink: async (s, a) => ((await openRichLink(a)) ? s : { ...s, commentHint: "This link could not be opened." }),
   },
 });
+svc.prepare();
 svc.load();
 export { svc };

package/templates/branded-lite/tier5-src/wix-spaces-member-detail/index.ts

@@ -14,7 +14,10 @@ import {
 } from "@himalaya/wix-members";
 import { presence, presenceAfterError, detailInputId, type PresenceFlags } from "../_shared/detail-presence.js";
 
+import { readAccess, assertReadAccess, readSignInFlags, NO_READ_SIGN_IN } from "../_shared/member-read.js";
+
 interface S extends PresenceFlags {
+  signInRequired: boolean; noSignIn: boolean;
   status: "loading" | "ready";
   id: string;
   name: string;
@@ -43,11 +46,7 @@ function followCountFor(followers: number, following: number): string {
   return followers + " Followers · " + following + " Following";
 }
 
-const svc = defineService<S, {
-  load: (s: S) => Promise<S>;
-  toggleFollow: (s: S) => Promise<S>;
-}>("spacesMemberDetail", {
-  state: {
+const INITIAL: S = {
     status: "loading",
     id: "",
     name: "",
@@ -61,13 +60,25 @@ const svc = defineService<S, {
     following: 0,
     followLabel: "Follow",
     followCount: "0 Followers · 0 Following",
-    ...presence("loading"),
-  },
+    ...presence("loading"), ...NO_READ_SIGN_IN,
+  };
+let loadVersion = 0;
+
+const svc = defineService<S, {
+  prepare: (s: S) => S;
+  load: (s: S) => Promise<S | undefined>;
+  toggleFollow: (s: S) => Promise<S>;
+}>("spacesMemberDetail", {
+  state: INITIAL,
   actions: {
-    load: async (s) => {
+    prepare: (s) => ({ ...s, ...INITIAL }),
+    load: async (s): Promise<S | undefined> => {
+      const version = ++loadVersion;
+      await svc.prepare();
       const id = detailInputId();
-      if (!id) return { ...s, status: "ready", ...presence("missing") };
+      if (!id) return { ...INITIAL, status: "ready", ...presence("missing") };
       try {
+        const access = await readAccess();
         const res = await getMember(id);
         const m = ((res as unknown as { member?: WixMember }).member) ?? (res as unknown as WixMember);
         const n = name(m);
@@ -87,8 +98,10 @@ const svc = defineService<S, {
           isFollowing = await isFollowingMember(id);
         } catch { /* default false */ }
 
+        await assertReadAccess(access);
+        if (version !== loadVersion) return undefined;
         return {
-          status: "ready",
+          ...INITIAL, status: "ready",
           id,
           name: n,
           email: m.loginEmail || "",
@@ -104,7 +117,8 @@ const svc = defineService<S, {
           ...presence("found"),
         };
       } catch (e) {
-        return { ...s, status: "ready", id, ...presenceAfterError(e) };
+        const flags = await readSignInFlags(e);
+        return version === loadVersion ? { ...INITIAL, status: "ready", id, ...presenceAfterError(e), ...flags } : undefined;
       }
     },
     // REAL WRITE: two-state toggle. Flips the relationship and optimistically
@@ -144,5 +158,6 @@ const svc = defineService<S, {
     },
   },
 });
+svc.prepare();
 svc.load();
 export { svc };

package/templates/community-club/config.ts

@@ -37,7 +37,7 @@ export default defineApp({
     actions: "http://localhost:8190/v1/actions",
     sync: "http://localhost:8190/v1/sync",
   },
-  capabilities: ["live_activity","push","share","secure_storage","open_url","calendar","local_database","wix_api","wix_platform","app_info","iap","release_control","clipboard","theme"],
+  capabilities: ["push","share","secure_storage","open_url","calendar","local_database","wix_api","wix_platform","app_info","iap","release_control","clipboard","theme","wix_cashier"],
   cache: {
     "rules": [
       {