@wix/himalaya-cli 0.1611.0 → 0.1613.0

package/fixtures/wix-canned.json

@@ -1047,6 +1047,47 @@
       }
     ]
   },
+  "GET /loyalty-tiers/v1/tiers/program": {
+    "programSettings": {
+      "status": "ACTIVE",
+      "baseTierDefinition": {
+        "name": "Bronze"
+      },
+      "rollingWindow": {
+        "durationInMonths": 12
+      }
+    },
+    "tiers": [
+      {
+        "id": "tier-0001",
+        "tierDefinition": {
+          "name": "Silver"
+        },
+        "requiredPoints": 500
+      },
+      {
+        "id": "tier-0002",
+        "tierDefinition": {
+          "name": "Gold"
+        },
+        "requiredPoints": 1000
+      }
+    ]
+  },
+  "GET /loyalty-coupons/v1/coupons/my-coupons": {
+    "loyaltyCoupons": [
+      {
+        "id": "lc-0001",
+        "rewardName": "Free filter coffee",
+        "status": "ACTIVE",
+        "couponReference": {
+          "couponId": "cp-0001",
+          "code": "BEANS-0001",
+          "deleted": false
+        }
+      }
+    ]
+  },
   "POST /reviews/v1/reviews/query": {
     "reviews": [
       {

package/guides/component-reference.json

@@ -1,7 +1,7 @@
 {
   "_comment": "GENERATED by core/web-embed/authoring/gen-reference.mjs from core/ts/src/schema.ts — do not hand-edit. The schema is the source of truth; regenerate on schema changes.",
   "schemaSource": "core/ts/src/schema.ts",
-  "bindingGrammar": "$service:<service>.<path> (worker state) · $item.<field> (list row) · $flag:<key> (feature flag) · $env:<key> (client environment — #1056). Bindings resolve in the text/value props marked 'binding-aware' below — INCLUDING Modifiers token refs — but only `background` and `border.color`, which are the two whose token a binding actually fills: a worker can drive per-item theming (e.g. a game board's per-square color), not just text. `shadow` is NOT binding-aware on any renderer, and a gradient is driven by its own `backgroundGradientPath` prop resolving to a gradient token NAME, not by a binding inside a token ref — so `shadow: { token: \"$item.x\" }` and `backgroundGradient: { token: \"$item.x\" }` keep the sentinel and silently lose the per-item styling. Colour slots split by LEVEL, not by component: inside modifiers a colour is a TokenRef OBJECT ({ token: \"…\" }), inside props it is a bare TokenName STRING — there is no modifiers.color or modifiers.tint (see the 'Token slots' section in component-reference.md). A few input props render the LITERAL and are NOT binding-aware — notably SearchField.placeholder and Chip.label; SearchField.value is live and binding-aware like other content props. Bindings also CANNOT target strict-enum fields (style, size, alignment, severity, presentation, contentMode, …) — those fail at render, not validation. $env: is client-resolved (no worker) and valid in modifiers.hiddenPath and FragmentSlot.casePath ONLY — keys reduceMotion/colorScheme/sizeClass/isRTL, e.g. hiddenPath:\"$env:reduceMotion\" or hiddenPath:\"$env:colorScheme==light\", casePath:\"$env:colorScheme\"; unknown key fails open (shown / defaultCase).",
+  "bindingGrammar": "$service:<service>.<path> (worker state) · $item.<field> (list row) · $flag:<key> (feature flag) · $env:<key> (client environment — #1056). Bindings resolve in the text/value props marked 'binding-aware' below — INCLUDING Modifiers token refs — but only `background` and `border.color`, which are the two whose token a binding actually fills: a worker can drive per-item theming (e.g. a game board's per-square color), not just text. `shadow` is NOT binding-aware on any renderer, and a gradient is driven by its own `backgroundGradientPath` prop resolving to a gradient token NAME, not by a binding inside a token ref — so `shadow: { token: \"$item.x\" }` and `backgroundGradient: { token: \"$item.x\" }` keep the sentinel and silently lose the per-item styling. Colour slots split by LEVEL, not by component: inside modifiers a colour is a TokenRef OBJECT ({ token: \"…\" }), inside props it is a bare TokenName STRING — there is no modifiers.color or modifiers.tint (see the 'Token slots' section in component-reference.md). A few input props render the LITERAL and are NOT binding-aware — notably SearchField.placeholder and Chip.label; SearchField.value is live and binding-aware like other content props. Bindings also CANNOT target strict-enum fields (style, size, alignment, severity, presentation, contentMode, …) — those fail at render, not validation. $env: is client-resolved (no worker) and valid in modifiers.hiddenPath and FragmentSlot.casePath ONLY — keys reduceMotion/colorScheme/sizeClass/isRTL/keyboardVisible, e.g. hiddenPath:\"$env:reduceMotion\" or hiddenPath:\"$env:colorScheme==light\", casePath:\"$env:colorScheme\"; unknown key fails open (shown / defaultCase).",
   "componentCount": 88,
   "notImplementedComponents": [
     "Text",
@@ -515,14 +515,17 @@
         "currentIndexPath",
         "itemsPath"
       ],
-      "propsSource": "export interface CarouselProps {\n  /** Opt-in paging for itemsPath; absent preserves the horizontal card rail. */\n  paged?: boolean;\n  /** Worker-driven page index; clamped to the current page count. */\n  currentIndexPath?: string;\n  items: Component[];\n  currentIndex?: number;\n  onChange?: Action;\n  autoplayIntervalMs?: number;\n  /** `$service:` binding → a live array to render as slides (overrides `items`). */\n  itemsPath?: string;\n  /** 0 (default) = all slides mounted; N ⇒ mount current ± N, unmount the rest. */\n  liveWindow?: number;\n}"
+      "propsSource": "export interface CarouselProps {\n  /** Opt-in paging for itemsPath; absent preserves the horizontal card rail. */\n  paged?: boolean;\n  /** #4673 — `$service:` path to the page index, two-way with `onChange`: a CHANGE of the resolved\n   *  value animates the carousel there (instantly under reduced motion); a swipe still fires\n   *  `onChange` with `args.index`, which the worker writes back. Out of range ⇒ clamped; not an\n   *  integer ⇒ ignored; equal to the current page ⇒ nothing; a move the binding made fires no\n   *  `onChange`. Drives literal `items` and `paged` bound ones; inside a bound row a substituted\n   *  literal places the page like `currentIndex`. A rail (`itemsPath` without `paged`) ignores it. */\n  currentIndexPath?: string;\n  items: Component[];\n  currentIndex?: number;\n  onChange?: Action;\n  autoplayIntervalMs?: number;\n  /** `$service:` binding → a live array to render as slides (overrides `items`). */\n  itemsPath?: string;\n  /** 0 (default) = all slides mounted; N ⇒ mount current ± N, unmount the rest. */\n  liveWindow?: number;\n}"
     },
     {
       "name": "Pager",
       "category": "Navigation primitives",
       "propsType": "PagerProps",
-      "bindings": [],
-      "propsSource": "export interface PagerProps {\n  pages: Component[];\n  currentIndex?: number;\n  onChange?: Action;\n  showIndicator?: boolean;\n  /** As {@link CarouselProps.liveWindow}. */\n  liveWindow?: number;\n}"
+      "bindings": [
+        "currentIndexPath",
+        "pagesPath"
+      ],
+      "propsSource": "export interface PagerProps {\n  pages: Component[];\n  currentIndex?: number;\n  onChange?: Action;\n  showIndicator?: boolean;\n  /** As {@link CarouselProps.liveWindow}. */\n  liveWindow?: number;\n  /** #4673 — as {@link CarouselProps.currentIndexPath}: a worker-driven page, two-way with `onChange`. */\n  currentIndexPath?: string;\n  /** #4673 — `$service:` path to an array: `pages[0]` is the page TEMPLATE, instantiated once per\n   *  element with `$item.` substitution (as `Carousel.itemsPath`). Pages are keyed by `$item.id`, so\n   *  the page on screen stays on screen when items are inserted before it. */\n  pagesPath?: string;\n}"
     },
     {
       "name": "StepIndicator",

package/guides/component-reference.md

@@ -6,7 +6,7 @@
 **88 core component types.** Every component body is `{ "package": "himalaya", "type": "<Type>", "props": { … } }`.
 Binding grammar: `$service:<service>.<path>` (worker state) · `$item.<field>` (list row template) · `$flag:<key>` (feature flag) · `$env:<key>` (client environment — #1056).
 Bindings resolve in the text/value props marked **binding-aware** below — **including two `Modifiers` token refs**, `background` and `border.color`, which are the only two whose token a binding actually fills: a worker can drive per-item **theming** (e.g. a game board's per-square color, `background: { token: "$item.bg" }`), not just text content. `shadow` and `backgroundGradient` are `TokenRef`s but are **not** binding-aware on any renderer — `shadow: { token: "$item.x" }` keeps the sentinel as a literal token name and silently loses the per-item styling, and a gradient is driven by its own `backgroundGradientPath` prop resolving to a gradient token NAME, not by a binding inside a token ref.
-`$env:` is **client-resolved** (no worker) and valid in `modifiers.hiddenPath` and `FragmentSlot.casePath` **only** — keys `reduceMotion` / `colorScheme` / `sizeClass` / `isRTL`, with an optional `==`/`!=` comparison (e.g. `hiddenPath: "$env:reduceMotion"`, `hiddenPath: "$env:colorScheme==light"`, `casePath: "$env:colorScheme"`). An unknown key fails open (shown / `defaultCase`).
+`$env:` is **client-resolved** (no worker) and valid in `modifiers.hiddenPath` and `FragmentSlot.casePath` **only** — keys `reduceMotion` / `colorScheme` / `sizeClass` / `isRTL` / `keyboardVisible` (an on-screen keyboard is up — `hiddenPath: "$env:keyboardVisible"` hides a header while typing), with an optional `==`/`!=` comparison (e.g. `hiddenPath: "$env:reduceMotion"`, `hiddenPath: "$env:colorScheme==light"`, `casePath: "$env:colorScheme"`). An unknown key fails open (shown / `defaultCase`).
 A few input props render the **literal** and are **not** binding-aware — notably `SearchField.placeholder` and `Chip.label`. `SearchField.value` is live/binding-aware like other content props.
 They **cannot target strict-enum fields** (`style`, `size`, `alignment`, `severity`, `presentation`, `contentMode`, …) — those fail at render time, not validation.
 
@@ -63,7 +63,7 @@ See also **[Modifiers](#modifiers)** (the `modifiers` block) and **[Actions](#ac
 | `Tabs` | Navigation primitives | `optionsPath`, `activeColorPath`, `selectedId` |
 | `SegmentedControl` | Navigation primitives | `optionsPath`, `selectedId` |
 | `Carousel` | Navigation primitives | `currentIndexPath`, `itemsPath` |
-| `Pager` | Navigation primitives | — |
+| `Pager` | Navigation primitives | `currentIndexPath`, `pagesPath` |
 | `StepIndicator` | Navigation primitives | — |
 | `CollapsingHeader` | Navigation primitives | — |
 | `AvatarStrip` | Navigation primitives | `avatarsPath` |
@@ -1075,7 +1075,12 @@ export interface SegmentedControlProps {
 export interface CarouselProps {
   /** Opt-in paging for itemsPath; absent preserves the horizontal card rail. */
   paged?: boolean;
-  /** Worker-driven page index; clamped to the current page count. */
+  /** #4673 — `$service:` path to the page index, two-way with `onChange`: a CHANGE of the resolved
+   *  value animates the carousel there (instantly under reduced motion); a swipe still fires
+   *  `onChange` with `args.index`, which the worker writes back. Out of range ⇒ clamped; not an
+   *  integer ⇒ ignored; equal to the current page ⇒ nothing; a move the binding made fires no
+   *  `onChange`. Drives literal `items` and `paged` bound ones; inside a bound row a substituted
+   *  literal places the page like `currentIndex`. A rail (`itemsPath` without `paged`) ignores it. */
   currentIndexPath?: string;
   items: Component[];
   currentIndex?: number;
@@ -1098,6 +1103,12 @@ export interface PagerProps {
   showIndicator?: boolean;
   /** As {@link CarouselProps.liveWindow}. */
   liveWindow?: number;
+  /** #4673 — as {@link CarouselProps.currentIndexPath}: a worker-driven page, two-way with `onChange`. */
+  currentIndexPath?: string;
+  /** #4673 — `$service:` path to an array: `pages[0]` is the page TEMPLATE, instantiated once per
+   *  element with `$item.` substitution (as `Carousel.itemsPath`). Pages are keyed by `$item.id`, so
+   *  the page on screen stays on screen when items are inserted before it. */
+  pagesPath?: string;
 }
 ```
 

package/guides/getting-started.md

@@ -256,8 +256,9 @@ product. Right after `init`:
    typed input → submit → the persisted result with a typed journey in `himi-test.json`
    (`.himi/himi-test.stub.json` has a skeleton per form: fill the values and expected text)
    (`--deep` replays action chains but never types a field value), then prove the destination
-   and cancel/back recovery separately — a typed journey is screen-local and does not follow
-   navigation, so use a render of the destination or a device drive. A fresh-screen crawl alone
+   and cancel/back recovery separately. For device-local records, add explicit `coldVisits`
+   assertions from `himi docs himi-test` so another cold worker must read the same saved record.
+   Cold visits do not drive navigation or prove warm repaint/relaunch: drive those in the UI. A fresh-screen crawl alone
    does not prove a flow.
 
 Before authoring a multi-screen mobile app, ensure the customer-approved `SPEC.md` and

package/guides/himi-json-output.md

@@ -44,7 +44,10 @@ keeps its existing fields and adds the code:
 
 | Code | Meaning |
 | --- | --- |
+| `test_journey_budget_exceeded` | The authored config exceeds a shared journey/visit/worker-segment/step/assertion work bound. Exit 2 with `ok: false` and the existing `error` on stderr before compilation or worker boot. Tokenless `POST /v1/test` uses the same code with HTTP422 before upload compilation/evaluation. Split the evaluation into separately identified bounded runs; no truncated pass is emitted. |
 | `test_journey_failed` | At least one unsuppressed authored journey failed: its destination is absent, initialization/action failed, or the expected rendered values were missing. The existing `failures`, `journeys`, counts and exit 1 remain. This includes cold-entry journeys with `steps: []`. |
+| `test_browser_cold_visits_unsupported` | `--browser` was requested with an authored `coldVisits` contract. Exit 2 before compilation or opening a browser; run without `--browser` to exercise those visits. The browser loop cannot certify saved-record return behavior. |
+| `test_browser_journeys_unsupported` | `--browser` was requested with authored journeys that have no `coldVisits`. Exit 2 before compilation or opening a browser. The single-screen browser loop does not execute authored steps or root `expectText`/`absentText` assertions; run without `--browser` to execute that contract. The existing cold-visit code remains in use when any journey has `coldVisits`. |
 | `test_input_evidence_requires_json` | `--input-evidence` was requested without explicit `--json`. Exit 2 before build or worker execution. |
 | `test_input_evidence_unsupported_mode` | `--input-evidence` was combined with `--browser`, or the content is a functions package rather than an app worker crawl. Exit 2 before execution. |
 | `test_input_evidence_unavailable` | The isolated input crawl cannot establish all contained realms, cannot read a stable source archive before/after the crawl, or fails to return one complete JSON report (including interruption, process timeout or output limit). Exit 1; no host-realm fallback or positive input acceptance. |

package/guides/himi-skill.md

@@ -279,8 +279,9 @@ product. Right after `init`:
    typed input → submit → the persisted result with a typed journey in `himi-test.json`
    (`.himi/himi-test.stub.json` has a skeleton per form: fill the values and expected text)
    (`--deep` replays action chains but never types a field value), then prove the destination
-   and cancel/back recovery separately — a typed journey is screen-local and does not follow
-   navigation, so use a render of the destination or a device drive. A fresh-screen crawl alone
+   and cancel/back recovery separately. For device-local records, add explicit `coldVisits`
+   assertions from `himi docs himi-test` so another cold worker must read the same saved record.
+   Cold visits do not drive navigation or prove warm repaint/relaunch: drive those in the UI. A fresh-screen crawl alone
    does not prove a flow.
 
 Before authoring a multi-screen mobile app, ensure the customer-approved `SPEC.md` and

package/guides/himi-test.md

@@ -110,7 +110,7 @@ The receipt has these fields:
 | `execution` | CLI-established `devModule`, `appConfig`, `workerBoot` and `workerAction` modes, each `quickjs-wasm`. A v1 report missing these fields predates the contained CLI path; do not accept it as contained execution. This marker is meaningful only when captured from the trusted pinned producer. |
 | `probes` | Each synthesized typed dispatch's screen/component/action/hook, contract control and injected field/value, actual argument list, precondition input/current value/state hash, post-state hash, and observed state/navigation/request/host-call/throw results. Zero probes is not proof that required controls ran. |
 | `journeys` | Actual screen/input, each attempted step's scope, raw `declaredPayload`, effective row-resolved `descriptorPayload`, exact `testOverrides`, final merged `payload`, pre/post state hashes, executed/threw/not-dispatched status, final visible observations and evaluator-computed assertions. Unavailable actions remain not-dispatched, never successful steps. |
-| `unavailableScreens`, `unavailableJourneys` | Requested coverage for which the evaluator did not supply v1 evidence, including older engines, invalid/collapsed screens and unavailable journeys. With positional screen IDs, these lists contain only requested roots; requested unknown IDs remain unavailable. Unrelated configured journeys do not run or fail a scoped run. These gaps are not accepted behavior. |
+| `unavailableScreens`, `unavailableJourneys` | Requested coverage for which the evaluator did not supply evaluated v1 evidence, including older engines, invalid/collapsed screens and explicitly unavailable source journeys. An unavailable source can still retain evaluated nested cold-visit receipts. With positional screen IDs, these lists contain only requested roots; requested unknown IDs remain unavailable. Unrelated configured journeys do not run or fail a scoped run. These gaps are not accepted behavior. |
 
 State hashes fingerprint the exact serialized worker snapshot captured at the dispatch
 boundary. `currentValuePresent` distinguishes an absent current value from null.
@@ -189,6 +189,69 @@ edge would hand it — so the journey boots the way a real tap into it would. Ke
 navigation in the ordinary edge pass, which boots the destination with real source
 parameters. Pair dynamic journeys with app-specific `dev/net-mocks.json` fixtures.
 
+### Prove a local mutation survives a cold visit
+
+A success message proves only the current screen's outcome. It does not prove that another
+screen can read the saved record. Add `coldVisits` to a typed journey when the approved flow
+requires another screen worker to read a created, edited or removed authoritative local record:
+
+```json
+{
+  "journeys": [{
+    "name": "create then read the same record",
+    "screen": "record_form",
+    "steps": [{
+      "action": "tier5.records.save",
+      "params": { "id": "probe-record", "title": "Field notebook", "notes": "Keep this note" }
+    }],
+    "expectText": ["Saved"],
+    "coldVisits": [
+      { "screen": "record_list", "expectText": ["Field notebook"] },
+      { "screen": "record_detail", "input": { "id": "probe-record" },
+        "expectText": ["Field notebook", "Keep this note"] },
+      { "screen": "record_list", "expectText": ["Field notebook"] }
+    ]
+  }]
+}
+```
+
+Use the app's actual screen/action names, field payloads and independently chosen expected
+values. Every visit boots a **new worker realm** with only that destination's descriptor and
+`input`; module variables and service state do not cross. Visits within one journey share a
+private hermetic `local_database`, `secure_storage` and app-scoped `himalaya.storage` store. Each journey starts with empty
+stores. Destination capability declarations and the app's local-entity schema still apply.
+The ordinary crawl's other axes keep their fresh stores.
+
+A visit can also have `steps`, using the same declared worker-action contract as the initial
+journey. For a destructive flow, request removal then cancel, cold-visit the list and require
+the selected row plus an unrelated row. In a separate sequence, confirm, then require the
+unrelated row and use `"absentText": ["unique removed title"]`. `absentText` works on the
+initial journey too. Both text checks use substrings of the resolved visible render tree;
+choose distinct values that cannot be satisfied by another row or a static heading. Assert
+all required fields and displayed totals, not just a generic success line. A missing screen,
+failed expectation or unexecuted visit fails the journey; JSON reports include a receipt for
+each cold visit.
+
+Authored work is admitted as a whole before any worker executes: at most 32 journeys,
+32 cold visits per journey,128 total worker segments (sources plus visits),512 total
+steps and2048 total positive/absent assertions. These shared limits apply to the CLI,
+`POST /v1/test` and direct crawl callers. Over-budget work is rejected with
+`test_journey_budget_exceeded`; visits or receipts are never silently truncated. Split a
+larger evaluation into separately identified runs. A bundleless source retains an
+explicit `worker-unavailable` receipt and every later visit's positional outcome.
+Validation-blocked destination workers do not execute, but their baked descriptor
+input and explicit visit overrides are retained in their unavailable receipt.
+
+A same-screen favorite may legitimately use a retained worker snapshot; this no-snapshot check does not test that contract.
+
+This is **headless local-store proof**, not a router drive or a real browser database
+relaunch. It does not hydrate worker snapshots, run app services, synchronize with a backend,
+or prove warm-screen refresh, native behavior, account switching or deployed-service
+acceptance. Keep the normal navigation edge checks and drive the actual UI through return
+and reload/relaunch on each required platform. Inspect storage separately when the row
+exists but the screen is stale. The state ownership choices remain in
+[tier-5-add-a-screen.md](tier-5-add-a-screen.md#state-does-not-cross-screens-automatically).
+
 Journeys run only the initialization the bundle and descriptor actually declare: module-scope
 calls and the root `onAppear`. Unlike the discovery crawl's convenience `load()` sweep, they do
 not call an otherwise uncalled loader. A declaration of `actions.load` alone does not initialize
@@ -575,7 +638,7 @@ behavior. This instruction does not add an automatic suppression or retry gate t
 | `--budget <ms>` | Per-action settle budget (default 2000). |
 | `--native` | Also decode every baked descriptor, and the release's `tokens.json`, with the real native decoders; bare `--native` runs whichever toolchains are present and names each one it could NOT check in a top-level `skippedPlatforms: [{ platform, reason }]` (never a pass), while `--native ios` or `--native android` selects one and exits 2 when it is unavailable. The Android SDK is found from `ANDROID_HOME`, then `ANDROID_SDK_ROOT`, then `sdk.dir` in the source checkout's Android test harness `local.properties`, then the default install path (`~/Library/Android/sdk` on macOS, `~/Android/Sdk` on Linux). **Source-checkout only** — the decoder oracles are that tree's own HimalayaCore Swift package and Gradle harness, which a published install does not ship, so it cannot run this at all (and its coverage ledger stays silent about native decoding rather than suggesting it). |
 | `--all-screens` | Crawl every templated instance instead of one representative per structure. |
-| `--browser` / `--no-open` / `--timeout <ms>` | Run the loop in your own browser tab (one screen per run; refuses record/net/offline/hostile/deep/budget/shots/native). |
+| `--browser` / `--no-open` / `--timeout <ms>` | Run the loop in your own browser tab (one screen per run; refuses all authored journeys, including root assertions and `coldVisits`, and record/net/offline/hostile/deep/budget/shots/native). |
 | `himi test <screenId>…` | Focus one or more screens — the record and shots passes scope with them. |
 
 **Screenshots** are on by default when a headless browser is installed: one PNG per screen

package/guides/one-app-section-mappings.md

@@ -25,8 +25,8 @@ Source snapshots: Catalyst `617c06d43d2a5608b6876d724553269b1e5346f0`; Himalaya
 | Module | 13 |
 | Primitive | 7 |
 | Composition | 9 |
-| Partial | 24 |
-| Empty | 24 |
+| Partial | 25 |
+| Empty | 23 |
 | Total | 77 |
 
 ## Mappings by server group
@@ -127,7 +127,7 @@ carousel placement remain separate gaps; the mappings above stay Partial.
 
 | Source sectionDefinitionId | Source viewer component | Himalaya implementation | Placement / reuse | Class | Settings, actions and gaps |
 | --- | --- | --- | --- | --- | --- |
-| `loyalty_status_section` | `loyalty.components.StatusSection` |  |  | Empty | The existing Loyalty worker lists the program and rewards but does not load this member's points balance/tier/status. A rewards catalog is not a loyalty-status widget. |
+| `loyalty_status_section` | `loyalty.components.StatusSection` | [himi_loyalty member card](https://github.com/wix-private/himalaya/blob/adf4c8b47fd237307b278a5dbb8198a94b7feb69/apps/himi-branded-lite/dev/index.ts) (`buildLoyalty` points card) + [loyalty worker](https://github.com/wix-private/himalaya/blob/adf4c8b47fd237307b278a5dbb8198a94b7feb69/core/dev-server/tier5-bundles-src/himi-branded-lite-loyalty/index.ts "audience-lint-ok: optional pinned upstream evidence, not a local authoring dependency") | Existing base; adaptation needed | Partial | The member card on `himi_loyalty` reads the signed-in member's balance (`getCurrentMemberLoyaltyAccount`) and, beside it, the tiers program and the claimed coupons; it shows the balance, the tier name, the points-expiry line and `Rewards available (N)` (rewards the balance covers on the member's tier + ACTIVE claimed coupons), each blank when its read fails. Visitors get the sign-in gate. Not carried over: the referral-coupon share of the count (no referral spec in codegen) and the one-app `View` link (the catalog it opens is on the same screen). |
 | `loyalty_offering_section` | `loyalty.components.OfferingSection` | [himi_loyalty](https://github.com/wix-private/himalaya/blob/97f1542f2f7d6e8cb7a902b912c87dcaa37e5a67/apps/himi-branded-lite/dev/index.ts) + [rewards worker](https://github.com/wix-private/himalaya/blob/97f1542f2f7d6e8cb7a902b912c87dcaa37e5a67/core/dev-server/tier5-bundles-src/himi-branded-lite-loyalty/index.ts "audience-lint-ok: optional pinned upstream evidence, not a local authoring dependency") | Existing base; adaptation needed | Partial | Reuse program/reward reads and required-points presentation. Preserve offering selection. Member earning/redemption operations are not established by this read-only rewards list. |
 
 ### 8. referrals-section-definitions.json
@@ -355,7 +355,6 @@ These are the exact definitions whose target cells above remain empty. “Not fo
 | `events-section-definitions.json` | `events_discussion_section` | No event-scoped discussion implementation was found. Groups/social feed and Blog comments must not be selected automatically. |
 | `events-section-definitions.json` | `events_guests_section` | The Events detail has only a best-effort attendee summary/avatar strip using an owner-scoped guest query. It is not a full consumer guest-list section; leave the mapping unassigned. |
 | `groups-section-definitions.json` | `single_group_feed_section` | A feed exists, but it selects a relevant/home group internally and does not accept the configured fixed-group selector. No verified single-group feed adapter exists; keep this target empty until a policy/implementation is chosen. |
-| `loyalty-section-definitions.json` | `loyalty_status_section` | The existing Loyalty worker lists the program and rewards but does not load this member's points balance/tier/status. A rewards catalog is not a loyalty-status widget. |
 | `referrals-section-definitions.json` | `referrals_refer_section` | No consumer referral-code/link sharing and referral-status feature was found. Do not map to Loyalty or generic sharing without a user decision. A visitor-readable program read exists; see the row above. |
 | `referrals-section-definitions.json` | `referrals_description_section` | No referral-program description/data implementation was found. Text primitives alone do not resolve the business-bound referral content. A visitor-readable program read exists; see the row above. |
 | `photoalbum-section-definitions.json` | `photoAlbums_list_section` | Existing Photo Albums code is an empty-state placeholder with no album API wired. Pro Gallery uses a different data source and is not a substitute; choose an implementation explicitly. |

package/guides/one-app-to-himi-app.md

@@ -345,7 +345,7 @@ Apply these interpretation rules:
   typography tokens use the body family. Numeric metrics stay unchanged. Read each
   source heading/body family and check `himi fonts list`; use `himi fonts add <Family>`
   when it is available. A known source family that Himi does not ship (for example
-  `spaceGrotesk` → Space Grotesk) is still compared with the actual target family.
+  `sora` → Sora) is still compared with the actual target family.
   Choose an available replacement, such as `$system`, only with the owner's explicit
   instruction; this is an adaptation, never a font match. Sync the coverage ledger
   against the current source evidence, then mark the corresponding `design` requirement

package/guides/recipe-form-submit.md

@@ -233,3 +233,12 @@ shape (heading swap, `savedScreenId`, back-navigation).
 - `himi docs recipe-dynamic-list` — the list the created entity lands in.
 - `himi components Form` / `FormField` / `TextField` / `Toggle` / `Picker`.
 - `.agents/skills/himalaya/examples/form-submit.*` (written into the app by `himi init` / `himi agent-init`) — this recipe, runnable.
+
+## Verify the saved record outside this worker
+
+For a local create/edit flow, a saved banner alone is insufficient. Add a typed journey
+with [cold visits](../himi-test.md#prove-a-local-mutation-survives-a-cold-visit) that reads
+the same record from its list and detail, checks all entered fields and relevant totals,
+and preserves an unrelated record. Then drive return and reload in the actual UI. Choose
+the storage owner using [the cross-screen state contract](../tier-5-add-a-screen.md#state-does-not-cross-screens-automatically);
+a worker snapshot is not a shared record store.

package/guides/sdk-reference.json

@@ -23425,19 +23425,43 @@
         "name": "WixLoyaltyRewardConfig",
         "kind": "interface",
         "jsdoc": "",
-        "decl": "export interface WixLoyaltyRewardConfig {\n  tierId?: string;\n  costInPoints?: number;\n  amount?: number;\n  percentage?: number;\n}"
+        "decl": "export interface WixLoyaltyRewardConfig {\n  tierId?: string;\n  costInPoints?: number;\n  amount?: string | number;\n  percentage?: number;\n}"
+      },
+      {
+        "name": "WixLoyaltyTierConfig",
+        "kind": "type",
+        "jsdoc": "/** One reward price row: what the reward costs a member on tier `tierId` (absent = the base tier). */",
+        "decl": "export type WixLoyaltyTierConfig = WixLoyaltyRewardConfig;"
       },
       {
         "name": "WixLoyaltyProgram",
         "kind": "interface",
         "jsdoc": "",
-        "decl": "export interface WixLoyaltyProgram {\n  id?: string;\n  name?: string;\n  /** ACTIVE | DRAFT | PAUSED */\n  status?: string;\n  pointDefinition?: { customName?: string; icon?: WixLoyaltyImage };\n}"
+        "decl": "export interface WixLoyaltyProgram {\n  id?: string;\n  name?: string;\n  /** ACTIVE | DRAFT | PAUSED */\n  status?: string;\n  pointDefinition?: { customName?: string; icon?: WixLoyaltyImage };\n  /** Which premium loyalty features the site's plan unlocks. Absent on older responses. */\n  premiumFeatures?: { loyaltyProgram?: boolean; tiers?: boolean; pointsExpiration?: boolean };\n  /** The program-level expiry POLICY (not a member's date — that is `WixLoyaltyAccount.pointsExpiration`). */\n  pointsExpiration?: { status?: string; monthsOfInactivity?: number; expiringPointsPercentage?: number };\n}"
       },
       {
         "name": "WixLoyaltyReward",
         "kind": "interface",
         "jsdoc": "",
-        "decl": "export interface WixLoyaltyReward {\n  id: string;\n  name?: string;\n  type?: string;\n  /** Legacy adapter field. REST costs live in the reward's tier configurations. */\n  requiredPoints?: number;\n  discountAmount?: { configsByTier?: { tierId?: string; costInPoints?: number; amount?: string }[] };\n  couponReward?: {\n    fixedAmount?: { configsByTier?: WixLoyaltyRewardConfig[] };\n    percentage?: { configsByTier?: WixLoyaltyRewardConfig[] };\n    freeShipping?: { configsByTier?: WixLoyaltyRewardConfig[] };\n  };\n  active?: boolean;\n}"
+        "decl": "export interface WixLoyaltyReward {\n  id: string;\n  name?: string;\n  /** DISCOUNT_AMOUNT | COUPON_REWARD | COUPON | SPI_DISCOUNT_AMOUNT | … */\n  type?: string;\n  /** Legacy adapter field. REST costs live in the reward's tier configurations. */\n  requiredPoints?: number;\n  discountAmount?: { configsByTier?: WixLoyaltyRewardConfig[] };\n  couponReward?: {\n    fixedAmount?: { configsByTier?: WixLoyaltyRewardConfig[] };\n    percentage?: { configsByTier?: WixLoyaltyRewardConfig[] };\n    freeShipping?: { configsByTier?: WixLoyaltyRewardConfig[] };\n  };\n  active?: boolean;\n}"
+      },
+      {
+        "name": "WixLoyaltyAccount",
+        "kind": "interface",
+        "jsdoc": "/** The signed-in member's loyalty account (wix.loyalty.v1.account, `/my-account`). */",
+        "decl": "export interface WixLoyaltyAccount {\n  id?: string;\n  points?: { balance?: number; earned?: number; adjusted?: number; redeemed?: number; expired?: number };\n  /** The member's current tier; absent or without `id` while on the base tier. */\n  tier?: { id?: string; points?: number };\n  /** The member's own expiry — when and how many points lapse next. */\n  pointsExpiration?: { expirationDate?: string; expiringPointsAmount?: number };\n  rewardAvailable?: boolean;\n}"
+      },
+      {
+        "name": "WixLoyaltyTiersProgram",
+        "kind": "interface",
+        "jsdoc": "/** The tiers program: settings (ACTIVE | PAUSED, the base tier's definition) plus the custom tiers. */",
+        "decl": "export interface WixLoyaltyTiersProgram {\n  tiers?: WixLoyaltyTier[];\n  programSettings?: {\n    status?: string;\n    baseTierDefinition?: { name?: string; description?: string; icon?: unknown };\n    rollingWindow?: { durationInMonths?: number };\n  };\n}"
+      },
+      {
+        "name": "WixLoyaltyCoupon",
+        "kind": "interface",
+        "jsdoc": "/** A reward the member already claimed as a coupon (wix.loyalty.v1.coupon). */",
+        "decl": "export interface WixLoyaltyCoupon {\n  id?: string;\n  rewardName?: string;\n  /** ACTIVE | APPLIED | DELETED */\n  status?: string;\n  couponReference?: { couponId?: string; code?: string; deleted?: boolean };\n}"
       },
       {
         "name": "WixLoyaltyTier",
@@ -23480,6 +23504,22 @@
         "http": "GET /_api/loyalty-earning-rules/v1/earning-rules/rules",
         "scope": "visitor"
       },
+      {
+        "name": "getLoyaltyTiersProgram",
+        "kind": "function",
+        "jsdoc": "/** GET /loyalty-tiers/v1/tiers/program → { tiers, programSettings }. The custom tiers plus the\n *  settings that carry the BASE tier's name — the one a member with no `tier.id` is on.\n *\n * @scope visitor — readable without signing in. */",
+        "decl": "export function getLoyaltyTiersProgram(readOptions?: WixCallOptions): Promise<WixLoyaltyTiersProgram>;",
+        "http": "GET /loyalty-tiers/v1/tiers/program",
+        "scope": "visitor"
+      },
+      {
+        "name": "listMyLoyaltyCoupons",
+        "kind": "function",
+        "jsdoc": "/** GET /loyalty-coupons/v1/coupons/my-coupons → { loyaltyCoupons }. The member's claimed\n *  rewards; an ACTIVE, undeleted one still counts as a reward available to use.\n *\n * @scope member — requires a signed-in site member. */",
+        "decl": "export function listMyLoyaltyCoupons(readOptions?: WixCallOptions): Promise<{ loyaltyCoupons?: WixLoyaltyCoupon[] }>;",
+        "http": "GET /loyalty-coupons/v1/coupons/my-coupons",
+        "scope": "member"
+      },
       {
         "name": "LoyaltyOverview",
         "kind": "interface",
@@ -23514,7 +23554,7 @@
         "name": "getCurrentMemberLoyaltyAccount",
         "kind": "function",
         "jsdoc": "/** Read the authenticated member's own Loyalty account; no customer ID is accepted.\n * Source contract: loyalty-v1.getCurrentMemberAccount. Anonymous visitors are refused.\n * A signed-in customer recording is still required for migration acceptance.\n * @scope member\n */",
-        "decl": "export function getCurrentMemberLoyaltyAccount(readOptions?: WixCallOptions): Promise<{ account?: { points?: { balance?: number } } }>;",
+        "decl": "export function getCurrentMemberLoyaltyAccount(readOptions?: WixCallOptions): Promise<{ account?: WixLoyaltyAccount }>;",
         "http": "GET /loyalty-accounts/v1/accounts/my-account",
         "scope": "member"
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1611.0",
+  "version": "0.1613.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -72,5 +72,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "5919de535cfa33dabfeb372e350f3934dc2b5ccd610a7c9acdea0c51"
+  "falconPackageHash": "8d1e7814c00d18146088e2680fe43650535ec12113548c216d4fdbe0"
 }

package/stdlib/fonts/catalog.json

@@ -210,6 +210,32 @@
         }
       ]
     },
+    "DM Serif Display": {
+      "category": "serif",
+      "dir": "ofl/dmserifdisplay",
+      "webFallback": "serif",
+      "aliases": [
+        "dmserifdisplay",
+        "dm serif display",
+        "dm serif"
+      ],
+      "license": {
+        "id": "OFL-1.1",
+        "url": "https://raw.githubusercontent.com/google/fonts/8e44913e4ff26fc997e6856c1ec40ff4791c98c5/ofl/dmserifdisplay/OFL.txt",
+        "copyright": "Copyright 2014-2018 Adobe (http://www.adobe.com/), with Reserved Font Name 'Source'. All Rights Reserved. Source is a trademark of Adobe in the United States and/or other countries. Copyright 2019 Google LLC."
+      },
+      "faces": [
+        {
+          "weight": 400,
+          "style": "normal",
+          "postScriptName": "DMSerifDisplay-Regular",
+          "file": "DMSerifDisplay-Regular.ttf",
+          "sha256": "8cc3643535edf039aa5d95440a8542735e9197e4f4b8d9303e980fefbf5ab616",
+          "sri": "sha256-jMNkNTXt8DmqXZVECoVCc16Rl+T0uNkwPpgP779athY=",
+          "bytes": 76580
+        }
+      ]
+    },
     "Dancing Script": {
       "category": "handwriting",
       "dir": "ofl/dancingscript",
@@ -279,6 +305,54 @@
         }
       ]
     },
+    "Fraunces": {
+      "category": "serif",
+      "dir": "ofl/fraunces",
+      "webFallback": "serif",
+      "aliases": [
+        "fraunces"
+      ],
+      "license": {
+        "id": "OFL-1.1",
+        "url": "https://raw.githubusercontent.com/google/fonts/8e44913e4ff26fc997e6856c1ec40ff4791c98c5/ofl/fraunces/OFL.txt",
+        "copyright": "Copyright 2018 The Fraunces Project Authors (https://github.com/undercasetype/Fraunces)"
+      },
+      "variable": {
+        "axes": {
+          "opsz": {
+            "min": 9,
+            "default": 9,
+            "max": 144
+          },
+          "wght": {
+            "min": 100,
+            "default": 900,
+            "max": 900
+          },
+          "SOFT": {
+            "min": 0,
+            "default": 0,
+            "max": 100
+          },
+          "WONK": {
+            "min": 0,
+            "default": 1,
+            "max": 1
+          }
+        }
+      },
+      "faces": [
+        {
+          "weight": 900,
+          "style": "normal",
+          "postScriptName": "Fraunces-9ptBlack",
+          "file": "Fraunces[SOFT,WONK,opsz,wght].ttf",
+          "sha256": "177ff6c0f14e5550a3c624247cd1189611d4eb65d000b14944c63d967958abbb",
+          "sri": "sha256-F3/2wPFOVVCjxiQkfNEYlhHU62XQALFJRMY9lnlYq7s=",
+          "bytes": 360440
+        }
+      ]
+    },
     "IBM Plex Mono": {
       "category": "mono",
       "dir": "ofl/ibmplexmono",
@@ -863,6 +937,40 @@
         }
       ]
     },
+    "Space Grotesk": {
+      "category": "sans",
+      "dir": "ofl/spacegrotesk",
+      "webFallback": "sans-serif",
+      "aliases": [
+        "spacegrotesk",
+        "space grotesk"
+      ],
+      "license": {
+        "id": "OFL-1.1",
+        "url": "https://raw.githubusercontent.com/google/fonts/8e44913e4ff26fc997e6856c1ec40ff4791c98c5/ofl/spacegrotesk/OFL.txt",
+        "copyright": "Copyright 2020 The Space Grotesk Project Authors (https://github.com/floriankarsten/space-grotesk)"
+      },
+      "variable": {
+        "axes": {
+          "wght": {
+            "min": 300,
+            "default": 300,
+            "max": 700
+          }
+        }
+      },
+      "faces": [
+        {
+          "weight": 300,
+          "style": "normal",
+          "postScriptName": "SpaceGrotesk-Light",
+          "file": "SpaceGrotesk[wght].ttf",
+          "sha256": "acad6de1fc93436f5c0f1f4137751ef04f1aea3063e7036535970ffcfbd79f72",
+          "sri": "sha256-rK1t4fyTQ29cDx9BN3Ue8E8a6jBj5wNlNZcP/PvXn3I=",
+          "bytes": 136676
+        }
+      ]
+    },
     "Space Mono": {
       "category": "mono",
       "dir": "ofl/spacemono",
@@ -897,6 +1005,39 @@
         }
       ]
     },
+    "Vollkorn": {
+      "category": "serif",
+      "dir": "ofl/vollkorn",
+      "webFallback": "serif",
+      "aliases": [
+        "vollkorn"
+      ],
+      "license": {
+        "id": "OFL-1.1",
+        "url": "https://raw.githubusercontent.com/google/fonts/8e44913e4ff26fc997e6856c1ec40ff4791c98c5/ofl/vollkorn/OFL.txt",
+        "copyright": "Copyright 2017 The Vollkorn Project Authors (https://github.com/FAlthausen/Vollkorn-Typeface)"
+      },
+      "variable": {
+        "axes": {
+          "wght": {
+            "min": 400,
+            "default": 400,
+            "max": 900
+          }
+        }
+      },
+      "faces": [
+        {
+          "weight": 400,
+          "style": "normal",
+          "postScriptName": "Vollkorn-Regular",
+          "file": "Vollkorn[wght].ttf",
+          "sha256": "4ebef434f76f80286204840354a84db79a0dc3c87deeeb791e015b70b2ade49d",
+          "sri": "sha256-Tr70NPdvgChiBIQDVKhNt5oNw8h97ut5HgFbcLKt5J0=",
+          "bytes": 577864
+        }
+      ]
+    },
     "Work Sans": {
       "category": "sans",
       "dir": "ofl/worksans",