@wix/himalaya-cli 0.1573.0 → 0.1575.0

package/templates/gym-fitness-owner/tier5-src/himi-owner-lite-event-form/index.ts

@@ -6,7 +6,9 @@
 // form can't safely collect — so this form only edits an existing event's text
 // (title + description). Bound by buildForm ($service:himiOwnerLiteEventForm.*).
 
-import { defineService } from "@himalaya/state";
+import { defineService as registerService } from "@himalaya/state";
+import { withExclusiveWrites } from "../_shared/exclusive-writes.js";
+const defineService = withExclusiveWrites(registerService, ["submit"]);
 import { getEvent, updateEvent, type WixEvent } from "@himalaya/wix-events";
 import { normalizeEvent } from "../_shared/himi-events.js";
 import { postBodyText, plainPostBody } from "../_shared/owner-post-content.js";
@@ -66,6 +68,7 @@ interface EventFormState {
   when: string;
   location: string;
   status: "idle" | "loading" | "saving" | "saved" | "error";
+  writeBusy: boolean;
   error: string;
   savedMessage: string;
   /** WS-C — canonical detail target (`himi_owner_lite_event`); `savedId` rides
@@ -140,6 +143,7 @@ function shape(s: Partial<EventFormState>): EventFormState {
     when: s.when ?? "—",
     location: s.location ?? "—",
     status: s.status ?? "idle",
+    writeBusy: s.writeBusy ?? false,
     error: s.error ?? "",
     savedMessage: s.savedMessage ?? "",
     // WS-C — canonical detail target + the saved entity's id as a separate nav

package/templates/gym-fitness-owner/tier5-src/himi-owner-lite-post-form/index.ts

@@ -8,7 +8,9 @@ import { editorSubmitValue, queuedDocument, editorChanged, editorRunKeys, resetH
 import { ricosUploadService } from "@himalaya/wix-rich-content-editor";
 import { wixCall } from "@himalaya/wix-site-media";
 import { wixMediaUrl, WIX_DETAIL_IMAGE } from "../_shared/himi-store.js";
-import { defineService } from "@himalaya/state";
+import { defineService as registerService } from "@himalaya/state";
+import { withExclusiveWrites } from "../_shared/exclusive-writes.js";
+const defineService = withExclusiveWrites(registerService, ["submit"]);
 import { getDraftPost, createDraftPost, updateDraftPost, type WixDraftPostWrite, type WixRichContent } from "@himalaya/wix-blog";
 import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback, ownerWriteError } from "../_shared/owner-load-error.js";
 import { DEMO_POSTS, DEMO_NOTE, DEMO_SAVE_NOTE, demoRefusalPatch } from "../_shared/owner-preview-demo.js";
@@ -53,6 +55,7 @@ interface PostFormState {
   noCover: boolean;
   isFeatured: string;
   status: "idle" | "loading" | "saving" | "saved" | "error";
+  writeBusy: boolean;
   error: string;
   savedMessage: string;
   /** WS-C — canonical detail target (`himi_owner_lite_post`); `savedId` rides
@@ -128,6 +131,7 @@ function shape(s: Partial<PostFormState>): PostFormState {
     noCover: !s.coverUrl,
     isFeatured: s.isFeatured ?? "false",
     status: s.status ?? "idle",
+    writeBusy: s.writeBusy ?? false,
     error: s.error ?? "",
     savedMessage: s.savedMessage ?? "",
     // WS-C — canonical detail target + the saved entity's id as a separate nav

package/templates/gym-fitness-owner/tier5-src/himi-owner-lite-product-form/index.ts

@@ -6,7 +6,9 @@
 // the WRITE shape needs `priceData: { price: <number>, currency }`. Bound by the
 // generic buildForm descriptor ($service:himiOwnerLiteProductForm.*).
 
-import { defineService } from "@himalaya/state";
+import { defineService as registerService } from "@himalaya/state";
+import { withExclusiveWrites } from "../_shared/exclusive-writes.js";
+const defineService = withExclusiveWrites(registerService, ["submit"]);
 import {
   getProduct,
   createProduct,
@@ -76,6 +78,7 @@ interface ProductFormState {
   descriptionNote: string;
   visible: string;
   status: "idle" | "loading" | "saving" | "saved" | "error";
+  writeBusy: boolean;
   error: string;
   savedMessage: string;
   /** WS-C — canonical detail target (`himi_owner_lite_product`); `savedId` rides
@@ -161,6 +164,7 @@ function shape(s: Partial<ProductFormState>): ProductFormState {
     descriptionNote: dMode === "locked" ? copyParam("ownerProductForm.richDescriptionNote", "This description has formatting or media. Edit it in your site dashboard to keep that content intact; name, price and SKU can be changed here.") : "",
     visible: s.visible ?? "true",
     status: s.status ?? "idle",
+    writeBusy: s.writeBusy ?? false,
     error: s.error ?? "",
     savedMessage: s.savedMessage ?? "",
     // WS-C — canonical detail target + the saved entity's id as a separate nav

package/templates/gym-fitness-owner/tier5-src/himi-owner-lite-service-form/index.ts

@@ -5,7 +5,9 @@
 // updateService. Bound by buildForm ($service:himiOwnerLiteServiceForm.*).
 
 import { landsOnLive } from "../_shared/owner-editor-value.js";
-import { defineService } from "@himalaya/state";
+import { defineService as registerService } from "@himalaya/state";
+import { withExclusiveWrites } from "../_shared/exclusive-writes.js";
+const defineService = withExclusiveWrites(registerService, ["submit"]);
 import { getService, updateService, type WixService } from "@himalaya/wix-bookings";
 import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback, ownerWriteError } from "../_shared/owner-load-error.js";
 import { DEMO_SERVICES, DEMO_NOTE, DEMO_SAVE_NOTE, demoRefusalPatch } from "../_shared/owner-preview-demo.js";
@@ -31,6 +33,7 @@ interface ServiceFormState {
   description: string;
   category: string;
   status: "idle" | "loading" | "saving" | "saved" | "error";
+  writeBusy: boolean;
   error: string;
   savedMessage: string;
   /** WS-C — canonical detail target (`himi_owner_lite_service`); `savedId` rides
@@ -88,6 +91,7 @@ function shape(s: Partial<ServiceFormState>): ServiceFormState {
     description: s.description ?? "",
     category: s.category ?? "",
     status: s.status ?? "idle",
+    writeBusy: s.writeBusy ?? false,
     error: s.error ?? "",
     savedMessage: s.savedMessage ?? "",
     // WS-C — canonical detail target + the saved entity's id as a separate nav

package/templates/himi-chat/dev/index.ts

@@ -1799,15 +1799,31 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
 
 // Live seed-id enumeration: a published release serves only EXACT screens, so
 // `himi push` bakes each templated detail route's CURRENT catalog ids as exact
-// screens via `seedIds`. Anonymous visitor rung against this app's own clientId;
-// best-effort (offline build → no baked details, preview still live-resolves).
+// screens via `seedIds`. Anonymous visitor rung against this app's own clientId — or,
+// for an app bound through the One App visitor identity (`visitorSource: "one-app"`,
+// no client), that site's One App visitor instance. Best-effort (offline build → no
+// baked details, preview still live-resolves).
+async function liveSeedToken(WIX: string): Promise<string | undefined> {
+  const auth = (config as { auth?: { config?: { clientId?: string; visitorSource?: string; metaSiteId?: string } } }).auth?.config;
+  // A One App binding boots as the site's One App visitor, so the seed reads as that visitor too —
+  // even beside a member-login clientId, and never repointed by a stray local WIX_CLIENT_ID.
+  const oneApp = auth?.visitorSource === "one-app";
+  const clientId = oneApp ? "" : process.env.WIX_CLIENT_ID ?? auth?.clientId ?? "";
+  if (clientId && !clientId.startsWith("YOUR_")) {
+    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
+    return ((await mint.json()) as { access_token?: string }).access_token;
+  }
+  const msid = oneApp ? auth?.metaSiteId ?? "" : "";
+  if (!/^[0-9a-fA-F-]{10,64}$/.test(msid)) return undefined;
+  const mint = await fetch(`https://apps.wix.com/_api/one-app-session-web/v3/businesses/${msid}/signed-instance?signed_instance_type=Visitor`, { headers: { Accept: "application/json" }, redirect: "error" });
+  const visitor = (await mint.json()) as { signedInstance?: string; signedInstanceType?: string };
+  return visitor.signedInstanceType === "Visitor" ? visitor.signedInstance : undefined;
+}
+
 async function liveSeedIds(spec: LiveSeed): Promise<string[]> {
   try {
     const WIX = "https://www.wixapis.com";
-    const clientId = process.env.WIX_CLIENT_ID ?? (config as { auth?: { config?: { clientId?: string } } }).auth?.config?.clientId ?? "";
-    if (!clientId || clientId.startsWith("YOUR_")) return [];
-    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
-    const token = ((await mint.json()) as { access_token?: string }).access_token;
+    const token = await liveSeedToken(WIX);
     if (!token) return [];
     const res = await fetch(WIX + spec.path, { method: "POST", headers: { Authorization: token, "Content-Type": "application/json" }, body: JSON.stringify(spec.body) });
     const json = (await res.json()) as Record<string, unknown>;

package/templates/nonprofit-cause/dev/index.ts

@@ -26721,15 +26721,31 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
 
 // Live seed-id enumeration: a published release serves only EXACT screens, so
 // `himi push` bakes each templated detail route's CURRENT catalog ids as exact
-// screens via `seedIds`. Anonymous visitor rung against this app's own clientId;
-// best-effort (offline build → no baked details, preview still live-resolves).
+// screens via `seedIds`. Anonymous visitor rung against this app's own clientId — or,
+// for an app bound through the One App visitor identity (`visitorSource: "one-app"`,
+// no client), that site's One App visitor instance. Best-effort (offline build → no
+// baked details, preview still live-resolves).
+async function liveSeedToken(WIX: string): Promise<string | undefined> {
+  const auth = (config as { auth?: { config?: { clientId?: string; visitorSource?: string; metaSiteId?: string } } }).auth?.config;
+  // A One App binding boots as the site's One App visitor, so the seed reads as that visitor too —
+  // even beside a member-login clientId, and never repointed by a stray local WIX_CLIENT_ID.
+  const oneApp = auth?.visitorSource === "one-app";
+  const clientId = oneApp ? "" : process.env.WIX_CLIENT_ID ?? auth?.clientId ?? "";
+  if (clientId && !clientId.startsWith("YOUR_")) {
+    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
+    return ((await mint.json()) as { access_token?: string }).access_token;
+  }
+  const msid = oneApp ? auth?.metaSiteId ?? "" : "";
+  if (!/^[0-9a-fA-F-]{10,64}$/.test(msid)) return undefined;
+  const mint = await fetch(`https://apps.wix.com/_api/one-app-session-web/v3/businesses/${msid}/signed-instance?signed_instance_type=Visitor`, { headers: { Accept: "application/json" }, redirect: "error" });
+  const visitor = (await mint.json()) as { signedInstance?: string; signedInstanceType?: string };
+  return visitor.signedInstanceType === "Visitor" ? visitor.signedInstance : undefined;
+}
+
 async function liveSeedIds(spec: LiveSeed): Promise<string[]> {
   try {
     const WIX = "https://www.wixapis.com";
-    const clientId = process.env.WIX_CLIENT_ID ?? (config as { auth?: { config?: { clientId?: string } } }).auth?.config?.clientId ?? "";
-    if (!clientId || clientId.startsWith("YOUR_")) return [];
-    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
-    const token = ((await mint.json()) as { access_token?: string }).access_token;
+    const token = await liveSeedToken(WIX);
     if (!token) return [];
     const res = await fetch(WIX + spec.path, { method: "POST", headers: { Authorization: token, "Content-Type": "application/json" }, body: JSON.stringify(spec.body) });
     const json = (await res.json()) as Record<string, unknown>;

package/templates/nonprofit-cause-owner/dev/index.ts

@@ -76564,6 +76564,7 @@ const SCREENS = runtimeSetting({
                         "title": "Create post",
                         "style": "primary",
                         "fullWidth": true,
+                        "disabledPath": "$service:himiOwnerLitePostForm.writeBusy",
                         "action": {
                           "actionId": "tier5.himiOwnerLitePostForm.submit"
                         }
@@ -76923,6 +76924,7 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
                         "title": "Save changes",
                         "style": "primary",
                         "fullWidth": true,
+                        "disabledPath": "$service:himiOwnerLiteServiceForm.writeBusy",
                         "action": {
                           "actionId": "tier5.himiOwnerLiteServiceForm.submit"
                         }
@@ -77285,6 +77287,7 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
                         "title": "Save changes",
                         "style": "primary",
                         "fullWidth": true,
+                        "disabledPath": "$service:himiOwnerLiteEventForm.writeBusy",
                         "action": {
                           "actionId": "tier5.himiOwnerLiteEventForm.submit"
                         }
@@ -77608,6 +77611,7 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
                         "title": "Save changes",
                         "style": "primary",
                         "fullWidth": true,
+                        "disabledPath": "$service:himiOwnerLitePostForm.writeBusy",
                         "action": {
                           "actionId": "tier5.himiOwnerLitePostForm.submit"
                         }
@@ -82115,15 +82119,31 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
 
 // Live seed-id enumeration: a published release serves only EXACT screens, so
 // `himi push` bakes each templated detail route's CURRENT catalog ids as exact
-// screens via `seedIds`. Anonymous visitor rung against this app's own clientId;
-// best-effort (offline build → no baked details, preview still live-resolves).
+// screens via `seedIds`. Anonymous visitor rung against this app's own clientId — or,
+// for an app bound through the One App visitor identity (`visitorSource: "one-app"`,
+// no client), that site's One App visitor instance. Best-effort (offline build → no
+// baked details, preview still live-resolves).
+async function liveSeedToken(WIX: string): Promise<string | undefined> {
+  const auth = (config as { auth?: { config?: { clientId?: string; visitorSource?: string; metaSiteId?: string } } }).auth?.config;
+  // A One App binding boots as the site's One App visitor, so the seed reads as that visitor too —
+  // even beside a member-login clientId, and never repointed by a stray local WIX_CLIENT_ID.
+  const oneApp = auth?.visitorSource === "one-app";
+  const clientId = oneApp ? "" : process.env.WIX_CLIENT_ID ?? auth?.clientId ?? "";
+  if (clientId && !clientId.startsWith("YOUR_")) {
+    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
+    return ((await mint.json()) as { access_token?: string }).access_token;
+  }
+  const msid = oneApp ? auth?.metaSiteId ?? "" : "";
+  if (!/^[0-9a-fA-F-]{10,64}$/.test(msid)) return undefined;
+  const mint = await fetch(`https://apps.wix.com/_api/one-app-session-web/v3/businesses/${msid}/signed-instance?signed_instance_type=Visitor`, { headers: { Accept: "application/json" }, redirect: "error" });
+  const visitor = (await mint.json()) as { signedInstance?: string; signedInstanceType?: string };
+  return visitor.signedInstanceType === "Visitor" ? visitor.signedInstance : undefined;
+}
+
 async function liveSeedIds(spec: LiveSeed): Promise<string[]> {
   try {
     const WIX = "https://www.wixapis.com";
-    const clientId = process.env.WIX_CLIENT_ID ?? (config as { auth?: { config?: { clientId?: string } } }).auth?.config?.clientId ?? "";
-    if (!clientId || clientId.startsWith("YOUR_")) return [];
-    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
-    const token = ((await mint.json()) as { access_token?: string }).access_token;
+    const token = await liveSeedToken(WIX);
     if (!token) return [];
     const res = await fetch(WIX + spec.path, { method: "POST", headers: { Authorization: token, "Content-Type": "application/json" }, body: JSON.stringify(spec.body) });
     const json = (await res.json()) as Record<string, unknown>;

package/templates/nonprofit-cause-owner/tier5-src/_shared/exclusive-writes.ts

@@ -0,0 +1,66 @@
+import { defineService as register, type ServiceDefinition } from '@himalaya/state';
+
+/** Reject repeated taps until the accepted write's result is committed. A promise
+ * queue alone releases before the host applies the reducer result, so the next
+ * write can still read an old revision/id. The private synchronous reducer below
+ * publishes busy and commits completion through the ordinary service handle;
+ * awaiting that handle guarantees the host has stored the result before unlock.
+ * Skipped actions return undefined, so they cannot roll back the accepted write.
+ */
+export function withExclusiveWrites<S extends object = Record<string, unknown>>(
+  registerService: typeof register, names: readonly string[],
+  options: { prepare?: (action: string, args: readonly unknown[]) => void; coalesce?: readonly string[]; settle?: (before: S, next: S, live: S) => S } = {},
+): typeof register {
+  return ((name: string, definition: ServiceDefinition<Record<string, unknown>>) => {
+    let busy = false;
+    let activeAction = "";
+    let completion = Promise.resolve();
+    let complete = () => {};
+    let handle: { getState(): Record<string, unknown>; exclusiveWriteState(next: Record<string, unknown>): Promise<unknown> };
+    const wrapped: ServiceDefinition<Record<string, unknown>> = {
+      ...definition,
+      state: { ...definition.state, writeBusy: false },
+      notHydrated: [...(definition.notHydrated ?? []), 'writeBusy'],
+      actions: {
+        ...Object.fromEntries(Object.entries(definition.actions ?? {}).map(([action, reduce]) => [action,
+          names.includes(action) ? async (state: Record<string, unknown>, ...args: never[]) => {
+            // Intake request metadata even when its state replacement is skipped.
+            options.prepare?.(action, args);
+            if (busy) {
+              // Repeated initial loads must await the accepted load, so callers
+              // observe its committed rows rather than the initial skeleton.
+              if (activeAction === action && options.coalesce?.includes(action)) await completion;
+              return;
+            }
+            busy = true;
+            activeAction = action;
+            completion = new Promise<void>(resolve => { complete = resolve; });
+            try {
+              await handle.exclusiveWriteState({ ...handle.getState(), writeBusy: true });
+              const next = await reduce(state, ...args);
+              const live = handle.getState();
+              // Non-write actions (for example editing a draft field) can still run
+              // during I/O. Let the owning service preserve those newer edits.
+              const settled = options.settle ? options.settle(state as S, (next ?? live) as S, live as S) : next ?? live;
+              await handle.exclusiveWriteState({ ...settled, writeBusy: false });
+            } catch (error) {
+              await handle.exclusiveWriteState({ ...handle.getState(), writeBusy: false });
+              throw error;
+            } finally {
+              busy = false;
+              complete();
+            }
+          } : reduce,
+        ])),
+        exclusiveWriteState: (_state, next: Record<string, unknown>) => next,
+      },
+    };
+    const registered = registerService(name, wrapped);
+    // Registration preserves this private action, but the dynamic action map
+    // cannot express its payload to the generic service handle.
+    handle = registered as unknown as typeof handle;
+    // Older hosts ignore notHydrated. A fresh worker has no pending write.
+    handle.getState().writeBusy = false;
+    return registered;
+  }) as typeof register;
+}

package/templates/nonprofit-cause-owner/tier5-src/himi-owner-lite-event-form/index.ts

@@ -6,7 +6,9 @@
 // form can't safely collect — so this form only edits an existing event's text
 // (title + description). Bound by buildForm ($service:himiOwnerLiteEventForm.*).
 
-import { defineService } from "@himalaya/state";
+import { defineService as registerService } from "@himalaya/state";
+import { withExclusiveWrites } from "../_shared/exclusive-writes.js";
+const defineService = withExclusiveWrites(registerService, ["submit"]);
 import { getEvent, updateEvent, type WixEvent } from "@himalaya/wix-events";
 import { normalizeEvent } from "../_shared/himi-events.js";
 import { postBodyText, plainPostBody } from "../_shared/owner-post-content.js";
@@ -66,6 +68,7 @@ interface EventFormState {
   when: string;
   location: string;
   status: "idle" | "loading" | "saving" | "saved" | "error";
+  writeBusy: boolean;
   error: string;
   savedMessage: string;
   /** WS-C — canonical detail target (`himi_owner_lite_event`); `savedId` rides
@@ -140,6 +143,7 @@ function shape(s: Partial<EventFormState>): EventFormState {
     when: s.when ?? "—",
     location: s.location ?? "—",
     status: s.status ?? "idle",
+    writeBusy: s.writeBusy ?? false,
     error: s.error ?? "",
     savedMessage: s.savedMessage ?? "",
     // WS-C — canonical detail target + the saved entity's id as a separate nav

package/templates/nonprofit-cause-owner/tier5-src/himi-owner-lite-post-form/index.ts

@@ -8,7 +8,9 @@ import { editorSubmitValue, queuedDocument, editorChanged, editorRunKeys, resetH
 import { ricosUploadService } from "@himalaya/wix-rich-content-editor";
 import { wixCall } from "@himalaya/wix-site-media";
 import { wixMediaUrl, WIX_DETAIL_IMAGE } from "../_shared/himi-store.js";
-import { defineService } from "@himalaya/state";
+import { defineService as registerService } from "@himalaya/state";
+import { withExclusiveWrites } from "../_shared/exclusive-writes.js";
+const defineService = withExclusiveWrites(registerService, ["submit"]);
 import { getDraftPost, createDraftPost, updateDraftPost, type WixDraftPostWrite, type WixRichContent } from "@himalaya/wix-blog";
 import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback, ownerWriteError } from "../_shared/owner-load-error.js";
 import { DEMO_POSTS, DEMO_NOTE, DEMO_SAVE_NOTE, demoRefusalPatch } from "../_shared/owner-preview-demo.js";
@@ -53,6 +55,7 @@ interface PostFormState {
   noCover: boolean;
   isFeatured: string;
   status: "idle" | "loading" | "saving" | "saved" | "error";
+  writeBusy: boolean;
   error: string;
   savedMessage: string;
   /** WS-C — canonical detail target (`himi_owner_lite_post`); `savedId` rides
@@ -128,6 +131,7 @@ function shape(s: Partial<PostFormState>): PostFormState {
     noCover: !s.coverUrl,
     isFeatured: s.isFeatured ?? "false",
     status: s.status ?? "idle",
+    writeBusy: s.writeBusy ?? false,
     error: s.error ?? "",
     savedMessage: s.savedMessage ?? "",
     // WS-C — canonical detail target + the saved entity's id as a separate nav

package/templates/nonprofit-cause-owner/tier5-src/himi-owner-lite-service-form/index.ts

@@ -5,7 +5,9 @@
 // updateService. Bound by buildForm ($service:himiOwnerLiteServiceForm.*).
 
 import { landsOnLive } from "../_shared/owner-editor-value.js";
-import { defineService } from "@himalaya/state";
+import { defineService as registerService } from "@himalaya/state";
+import { withExclusiveWrites } from "../_shared/exclusive-writes.js";
+const defineService = withExclusiveWrites(registerService, ["submit"]);
 import { getService, updateService, type WixService } from "@himalaya/wix-bookings";
 import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback, ownerWriteError } from "../_shared/owner-load-error.js";
 import { DEMO_SERVICES, DEMO_NOTE, DEMO_SAVE_NOTE, demoRefusalPatch } from "../_shared/owner-preview-demo.js";
@@ -31,6 +33,7 @@ interface ServiceFormState {
   description: string;
   category: string;
   status: "idle" | "loading" | "saving" | "saved" | "error";
+  writeBusy: boolean;
   error: string;
   savedMessage: string;
   /** WS-C — canonical detail target (`himi_owner_lite_service`); `savedId` rides
@@ -88,6 +91,7 @@ function shape(s: Partial<ServiceFormState>): ServiceFormState {
     description: s.description ?? "",
     category: s.category ?? "",
     status: s.status ?? "idle",
+    writeBusy: s.writeBusy ?? false,
     error: s.error ?? "",
     savedMessage: s.savedMessage ?? "",
     // WS-C — canonical detail target + the saved entity's id as a separate nav

package/templates/owner-lite/dev/index.ts

@@ -84172,6 +84172,7 @@ const SCREENS = runtimeSetting({
                         "title": "Create product",
                         "style": "primary",
                         "fullWidth": true,
+                        "disabledPath": "$service:himiOwnerLiteProductForm.writeBusy",
                         "action": {
                           "actionId": "tier5.himiOwnerLiteProductForm.submit"
                         }
@@ -84491,6 +84492,7 @@ const SCREENS = runtimeSetting({
                         "title": "Create post",
                         "style": "primary",
                         "fullWidth": true,
+                        "disabledPath": "$service:himiOwnerLitePostForm.writeBusy",
                         "action": {
                           "actionId": "tier5.himiOwnerLitePostForm.submit"
                         }
@@ -85006,6 +85008,7 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
                         "title": "Save changes",
                         "style": "primary",
                         "fullWidth": true,
+                        "disabledPath": "$service:himiOwnerLiteProductForm.writeBusy",
                         "action": {
                           "actionId": "tier5.himiOwnerLiteProductForm.submit"
                         }
@@ -85253,6 +85256,7 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
                         "title": "Save changes",
                         "style": "primary",
                         "fullWidth": true,
+                        "disabledPath": "$service:himiOwnerLiteServiceForm.writeBusy",
                         "action": {
                           "actionId": "tier5.himiOwnerLiteServiceForm.submit"
                         }
@@ -85615,6 +85619,7 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
                         "title": "Save changes",
                         "style": "primary",
                         "fullWidth": true,
+                        "disabledPath": "$service:himiOwnerLiteEventForm.writeBusy",
                         "action": {
                           "actionId": "tier5.himiOwnerLiteEventForm.submit"
                         }
@@ -85938,6 +85943,7 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
                         "title": "Save changes",
                         "style": "primary",
                         "fullWidth": true,
+                        "disabledPath": "$service:himiOwnerLitePostForm.writeBusy",
                         "action": {
                           "actionId": "tier5.himiOwnerLitePostForm.submit"
                         }
@@ -93008,15 +93014,31 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
 
 // Live seed-id enumeration: a published release serves only EXACT screens, so
 // `himi push` bakes each templated detail route's CURRENT catalog ids as exact
-// screens via `seedIds`. Anonymous visitor rung against this app's own clientId;
-// best-effort (offline build → no baked details, preview still live-resolves).
+// screens via `seedIds`. Anonymous visitor rung against this app's own clientId — or,
+// for an app bound through the One App visitor identity (`visitorSource: "one-app"`,
+// no client), that site's One App visitor instance. Best-effort (offline build → no
+// baked details, preview still live-resolves).
+async function liveSeedToken(WIX: string): Promise<string | undefined> {
+  const auth = (config as { auth?: { config?: { clientId?: string; visitorSource?: string; metaSiteId?: string } } }).auth?.config;
+  // A One App binding boots as the site's One App visitor, so the seed reads as that visitor too —
+  // even beside a member-login clientId, and never repointed by a stray local WIX_CLIENT_ID.
+  const oneApp = auth?.visitorSource === "one-app";
+  const clientId = oneApp ? "" : process.env.WIX_CLIENT_ID ?? auth?.clientId ?? "";
+  if (clientId && !clientId.startsWith("YOUR_")) {
+    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
+    return ((await mint.json()) as { access_token?: string }).access_token;
+  }
+  const msid = oneApp ? auth?.metaSiteId ?? "" : "";
+  if (!/^[0-9a-fA-F-]{10,64}$/.test(msid)) return undefined;
+  const mint = await fetch(`https://apps.wix.com/_api/one-app-session-web/v3/businesses/${msid}/signed-instance?signed_instance_type=Visitor`, { headers: { Accept: "application/json" }, redirect: "error" });
+  const visitor = (await mint.json()) as { signedInstance?: string; signedInstanceType?: string };
+  return visitor.signedInstanceType === "Visitor" ? visitor.signedInstance : undefined;
+}
+
 async function liveSeedIds(spec: LiveSeed): Promise<string[]> {
   try {
     const WIX = "https://www.wixapis.com";
-    const clientId = process.env.WIX_CLIENT_ID ?? (config as { auth?: { config?: { clientId?: string } } }).auth?.config?.clientId ?? "";
-    if (!clientId || clientId.startsWith("YOUR_")) return [];
-    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
-    const token = ((await mint.json()) as { access_token?: string }).access_token;
+    const token = await liveSeedToken(WIX);
     if (!token) return [];
     const res = await fetch(WIX + spec.path, { method: "POST", headers: { Authorization: token, "Content-Type": "application/json" }, body: JSON.stringify(spec.body) });
     const json = (await res.json()) as Record<string, unknown>;

package/templates/owner-lite/tier5-src/_shared/exclusive-writes.ts

@@ -0,0 +1,66 @@
+import { defineService as register, type ServiceDefinition } from '@himalaya/state';
+
+/** Reject repeated taps until the accepted write's result is committed. A promise
+ * queue alone releases before the host applies the reducer result, so the next
+ * write can still read an old revision/id. The private synchronous reducer below
+ * publishes busy and commits completion through the ordinary service handle;
+ * awaiting that handle guarantees the host has stored the result before unlock.
+ * Skipped actions return undefined, so they cannot roll back the accepted write.
+ */
+export function withExclusiveWrites<S extends object = Record<string, unknown>>(
+  registerService: typeof register, names: readonly string[],
+  options: { prepare?: (action: string, args: readonly unknown[]) => void; coalesce?: readonly string[]; settle?: (before: S, next: S, live: S) => S } = {},
+): typeof register {
+  return ((name: string, definition: ServiceDefinition<Record<string, unknown>>) => {
+    let busy = false;
+    let activeAction = "";
+    let completion = Promise.resolve();
+    let complete = () => {};
+    let handle: { getState(): Record<string, unknown>; exclusiveWriteState(next: Record<string, unknown>): Promise<unknown> };
+    const wrapped: ServiceDefinition<Record<string, unknown>> = {
+      ...definition,
+      state: { ...definition.state, writeBusy: false },
+      notHydrated: [...(definition.notHydrated ?? []), 'writeBusy'],
+      actions: {
+        ...Object.fromEntries(Object.entries(definition.actions ?? {}).map(([action, reduce]) => [action,
+          names.includes(action) ? async (state: Record<string, unknown>, ...args: never[]) => {
+            // Intake request metadata even when its state replacement is skipped.
+            options.prepare?.(action, args);
+            if (busy) {
+              // Repeated initial loads must await the accepted load, so callers
+              // observe its committed rows rather than the initial skeleton.
+              if (activeAction === action && options.coalesce?.includes(action)) await completion;
+              return;
+            }
+            busy = true;
+            activeAction = action;
+            completion = new Promise<void>(resolve => { complete = resolve; });
+            try {
+              await handle.exclusiveWriteState({ ...handle.getState(), writeBusy: true });
+              const next = await reduce(state, ...args);
+              const live = handle.getState();
+              // Non-write actions (for example editing a draft field) can still run
+              // during I/O. Let the owning service preserve those newer edits.
+              const settled = options.settle ? options.settle(state as S, (next ?? live) as S, live as S) : next ?? live;
+              await handle.exclusiveWriteState({ ...settled, writeBusy: false });
+            } catch (error) {
+              await handle.exclusiveWriteState({ ...handle.getState(), writeBusy: false });
+              throw error;
+            } finally {
+              busy = false;
+              complete();
+            }
+          } : reduce,
+        ])),
+        exclusiveWriteState: (_state, next: Record<string, unknown>) => next,
+      },
+    };
+    const registered = registerService(name, wrapped);
+    // Registration preserves this private action, but the dynamic action map
+    // cannot express its payload to the generic service handle.
+    handle = registered as unknown as typeof handle;
+    // Older hosts ignore notHydrated. A fresh worker has no pending write.
+    handle.getState().writeBusy = false;
+    return registered;
+  }) as typeof register;
+}

package/templates/owner-lite/tier5-src/himi-owner-lite-event-form/index.ts

@@ -6,7 +6,9 @@
 // form can't safely collect — so this form only edits an existing event's text
 // (title + description). Bound by buildForm ($service:himiOwnerLiteEventForm.*).
 
-import { defineService } from "@himalaya/state";
+import { defineService as registerService } from "@himalaya/state";
+import { withExclusiveWrites } from "../_shared/exclusive-writes.js";
+const defineService = withExclusiveWrites(registerService, ["submit"]);
 import { getEvent, updateEvent, type WixEvent } from "@himalaya/wix-events";
 import { normalizeEvent } from "../_shared/himi-events.js";
 import { postBodyText, plainPostBody } from "../_shared/owner-post-content.js";
@@ -66,6 +68,7 @@ interface EventFormState {
   when: string;
   location: string;
   status: "idle" | "loading" | "saving" | "saved" | "error";
+  writeBusy: boolean;
   error: string;
   savedMessage: string;
   /** WS-C — canonical detail target (`himi_owner_lite_event`); `savedId` rides
@@ -140,6 +143,7 @@ function shape(s: Partial<EventFormState>): EventFormState {
     when: s.when ?? "—",
     location: s.location ?? "—",
     status: s.status ?? "idle",
+    writeBusy: s.writeBusy ?? false,
     error: s.error ?? "",
     savedMessage: s.savedMessage ?? "",
     // WS-C — canonical detail target + the saved entity's id as a separate nav

package/templates/owner-lite/tier5-src/himi-owner-lite-post-form/index.ts

@@ -8,7 +8,9 @@ import { editorSubmitValue, queuedDocument, editorChanged, editorRunKeys, resetH
 import { ricosUploadService } from "@himalaya/wix-rich-content-editor";
 import { wixCall } from "@himalaya/wix-site-media";
 import { wixMediaUrl, WIX_DETAIL_IMAGE } from "../_shared/himi-store.js";
-import { defineService } from "@himalaya/state";
+import { defineService as registerService } from "@himalaya/state";
+import { withExclusiveWrites } from "../_shared/exclusive-writes.js";
+const defineService = withExclusiveWrites(registerService, ["submit"]);
 import { getDraftPost, createDraftPost, updateDraftPost, type WixDraftPostWrite, type WixRichContent } from "@himalaya/wix-blog";
 import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback, ownerWriteError } from "../_shared/owner-load-error.js";
 import { DEMO_POSTS, DEMO_NOTE, DEMO_SAVE_NOTE, demoRefusalPatch } from "../_shared/owner-preview-demo.js";
@@ -53,6 +55,7 @@ interface PostFormState {
   noCover: boolean;
   isFeatured: string;
   status: "idle" | "loading" | "saving" | "saved" | "error";
+  writeBusy: boolean;
   error: string;
   savedMessage: string;
   /** WS-C — canonical detail target (`himi_owner_lite_post`); `savedId` rides
@@ -128,6 +131,7 @@ function shape(s: Partial<PostFormState>): PostFormState {
     noCover: !s.coverUrl,
     isFeatured: s.isFeatured ?? "false",
     status: s.status ?? "idle",
+    writeBusy: s.writeBusy ?? false,
     error: s.error ?? "",
     savedMessage: s.savedMessage ?? "",
     // WS-C — canonical detail target + the saved entity's id as a separate nav