@wix/himalaya-cli 0.1613.0 → 0.1614.0

package/fixtures/wix-canned.json

@@ -625,6 +625,10 @@
       "total": 2
     }
   },
+  "POST /online-programs/participants/v3/join-applications/query": {
+    "joinApplications": [],
+    "pagingMetadata": { "count": 0, "total": 0 }
+  },
   "GET /pricing-plans/v2/plans/public": {
     "plans": [
       {

package/guides/component-reference.json

@@ -565,7 +565,7 @@
       "category": "Feedback",
       "propsType": "SnackbarProps",
       "bindings": [],
-      "propsSource": "export interface SnackbarProps {\n  message: string;\n  action?: Action;\n  durationMs?: number;\n  severity?: Severity;\n  /** #1059 — action label; overridable for localized hosts. Default \"Take action\". */\n  actionLabel?: string;\n}"
+      "propsSource": "export interface SnackbarProps {\n  message: string;\n  action?: Action;\n  durationMs?: number;\n  severity?: Severity;\n  /** #1059 — action label; overridable for localized hosts. Default \"Take action\". */\n  actionLabel?: string;\n  /** #4661 — a 40 pt/dp thumbnail at the leading edge (`https:` or a local file/asset URL; any\n   *  other is ignored), drawn by the same presenter as a worker's `ui.snackbar({ imageUrl })`. */\n  imageUrl?: string;\n}"
     },
     {
       "name": "AlertDialog",

package/guides/component-reference.md

@@ -1200,6 +1200,9 @@ export interface SnackbarProps {
   severity?: Severity;
   /** #1059 — action label; overridable for localized hosts. Default "Take action". */
   actionLabel?: string;
+  /** #4661 — a 40 pt/dp thumbnail at the leading edge (`https:` or a local file/asset URL; any
+   *  other is ignored), drawn by the same presenter as a worker's `ui.snackbar({ imageUrl })`. */
+  imageUrl?: string;
 }
 ```
 

package/guides/designing-himi-screens.md

@@ -307,7 +307,10 @@ contextual actions/detail; `Tooltip`/`Popover` for a small anchored hint. *Reach
 inline where you place it; for a transient toast that floats at the bottom of the screen — an app
 error after a failed action, say — use the `snackbar` presentation verb or `ui.snackbar({ message,
 tone: "danger" })` from a worker: it floats above the tab bar, animates in and out, queues, honours
-`durationMs`, and is announced to screen readers on every platform.
+`durationMs`, and is announced to screen readers on every platform. It stays a toast: two lines of
+message, one optional 40 pt thumbnail (`imageUrl`), one action of up to 24 characters, 2–10 s on screen.
+For "Item deleted — Undo", a screen worker can `await` it and read `actionTapped` instead of wiring an
+action id; anything richer is a descriptor overlay, not a snackbar.
 
 **Status & data-viz** — `Badge`/`Tag`/`Chip` for compact labels; `Rating` for stars (`size: "sm"` in a
 dense row); `ProgressBar` for determinate progress, `ActivityIndicator` for indeterminate; `Gauge` for

package/guides/hhp.md

@@ -210,13 +210,13 @@ Declare the mockup each screen was designed from in `hhp.json`:
 A screen may also carry `params` (the navigation input a device opens it with, used by native capture, #4935) and `fidelity: { "warn": 80, "fail": 60 }`. Thresholds can also be set app-wide at the top level.
 
 ```bash
-himi fidelity --content <dir> [--screen a,b] [--variant light,dark,rtl,tablet] [--ios <udid>] [--android <serial>] [--ios-tablet <udid>] [--android-tablet <serial>] [--app-id <id>] [--release <id>] [--no-native] [--json] [--post-pr <n>]
+himi fidelity --content <dir> [--screen a,b] [--variant light,dark,rtl,tablet] [--ios <udid>] [--android <serial>] [--ios-tablet <udid>] [--android-tablet <serial>] [--app-id <id>] [--release <id>] [--serve <port>] [--no-native] [--json] [--post-pr <n>]
 ```
 
 For each screen and variant (`light`, `dark`, `rtl`, `tablet`), the command does four things:
 
 1. **Captures the mockup.** It draws the page in Chromium at the variant's width. Dark mode is drawn by emulating `prefers-color-scheme`. RTL is drawn by setting `dir=rtl` on the page.
-2. **Captures the web render** from the app's recorded data, as `himi render` does by default. Native frames come from Himi Player on the devices you pass: `--ios <udid>` and `--android <serial>`, plus `--ios-tablet` and `--android-tablet` for the tablet variant. Only those devices are touched. For each variant the command sets dark or light appearance and, for `rtl`, the Hebrew language (iOS `AppleLanguages`, Android per-app locale, API 33+). It opens `himi://app/<app>/screen/<screen>` and captures once two frames match. Every setting it changed is restored afterwards, also on Ctrl-C. A variant with no device is reported `skipped`, never passed. Without `--release <id>` the Player shows the app's **live** release, not your working copy. A screen that declares `params` is skipped natively for now, because the Player's deep link does not carry them yet. On a fresh iOS simulator, open one `himi://` link by hand first and accept iOS's "Open in Himi Player?" prompt: the command cannot answer it, and until it is accepted every iOS capture shows the prompt.
+2. **Captures the web render** from the app's recorded data, as `himi render` does by default. Native frames come from Himi Player on the devices you pass: `--ios <udid>` and `--android <serial>`, plus `--ios-tablet` and `--android-tablet` for the tablet variant. Only those devices are touched. For each variant the command sets dark or light appearance and, for `rtl`, the Hebrew language (iOS `AppleLanguages`, Android per-app locale, API 33+). It opens `himi://app/<app>/screen/<screen>` and captures once two frames match. Every setting it changed is restored afterwards, also on Ctrl-C. A variant with no device is reported `skipped`, never passed. Without `--release <id>` or `--serve <port>` the Player shows the app's **live** release, not your working copy. `--serve <port>` serves the working copy on `127.0.0.1:<port>` as `himi run` does, so native and web render the same release. The Player reads a local origin only from a Debug build that compiled it in (see [View your package on a device](himi-player-implementation.md#view-your-package-on-a-device)): build it with `HIMALAYA_API_BASE_URL_INFO=http://127.0.0.1:<port>` on iOS and `-PhimalayaDevServeBaseUrl=http://10.0.2.2:<port>` on Android. An iOS device whose Player reads another origin is skipped with the rebuild to run. Android's origin cannot be read back from the installed app, so check that build yourself. A screen that declares `params` is skipped natively for now, because the Player's deep link does not carry them yet. On a fresh iOS simulator, open one `himi://` link by hand first and accept iOS's "Open in Himi Player?" prompt: the command cannot answer it, and until it is accepted every iOS capture shows the prompt.
 3. **Scores mockup↔web** with ImageMagick SSIM, globally and per tile. The worst tile says where the screens differ most.
 4. **Asks a fresh model** two questions, using the repo's fidelity judge prompt. The model never ran in the session that wrote the app.
    - **Design:** does WEB look like the MOCKUP? This judges the port.

package/guides/sdk-reference.json

@@ -5332,19 +5332,43 @@
         "name": "SnackbarOptions",
         "kind": "interface",
         "jsdoc": "",
-        "decl": "export interface SnackbarOptions {\n  message: string;\n  /** Default \"info\". */\n  tone?: SnackbarTone;\n  /** Auto-dismiss delay in ms, on every host. Default 3000; 0 or less also means 3000. */\n  durationMs?: number;\n  /** One action button (\"Undo\", \"View\"). Tapping it runs `actionId` with `args`, then dismisses the\n   *  snackbar. The id must be a worker action:\n   *  - one of this bundle's own `tier5.<svc>.<action>` ids — run on THIS worker, never another\n   *    screen's or the app-level worker's;\n   *  - an app service's `app.<svc>.<action>` — needs `app_services` and an exported action (an app\n   *    service's own id needs neither). The web host refuses it until it hosts app services.\n   *  Any other id (`capability.*`, `himi.*`, a registered handler) is refused when the snackbar is\n   *  requested: the call rejects and nothing is shown. A host that cannot tell which worker asked\n   *  (React Native, an embedded web region) refuses every `action` the same way. */\n  action?: SnackbarAction;\n}"
+        "decl": "export interface SnackbarOptions {\n  /** At most two lines on screen; a longer message is ellipsised. */\n  message: string;\n  /** Default \"info\". */\n  tone?: SnackbarTone;\n  /** Auto-dismiss delay in ms, clamped on every host to {@link SNACKBAR_LIMITS} (2–10 s, at least\n   *  4 s with an `action` so it can be reached by VoiceOver / TalkBack before it goes). Absent, 0 or\n   *  less: the default, 3000 (4000 with an `action`). */\n  durationMs?: number;\n  /** A thumbnail of the thing the toast is about: a 40 pt square at the leading edge. `https:` on\n   *  every host; a local `file:` URL on iOS and macOS only, whose image pipeline already reads local\n   *  files. Any other URL is ignored (the toast shows without it), and an image that fails to load\n   *  just hides. */\n  imageUrl?: string;\n  /** One action button (\"Undo\", \"View\"). Tapping it dismisses the snackbar and resolves the call\n   *  `{ actionTapped: true }`. With an `actionId` the tap also runs that action with `args`. The id\n   *  must be a worker action:\n   *  - one of this bundle's own `tier5.<svc>.<action>` ids — run on THIS worker, never another\n   *    screen's or the app-level worker's;\n   *  - an app service's `app.<svc>.<action>` — needs `app_services` and an exported action (an app\n   *    service's own id needs neither). The web host refuses it until it hosts app services.\n   *  Any other id (`capability.*`, `himi.*`, a registered handler) is refused when the snackbar is\n   *  requested: the call rejects and nothing is shown. A host that cannot tell which worker asked\n   *  (React Native, an embedded web reg\n/* … */"
       },
       {
         "name": "SnackbarAction",
         "kind": "interface",
         "jsdoc": "",
-        "decl": "export interface SnackbarAction {\n  /** The button's text — also its VoiceOver / TalkBack / screen-reader label. */\n  label: string;\n  /** What the tap runs: one of this bundle's own `tier5.<svc>.<action>` ids, or `app.<svc>.<action>`. */\n  actionId: string;\n  /** The action's arguments, which the reducer receives as typed JSON. */\n  args?: Record<string, unknown>;\n}"
+        "decl": "export interface SnackbarAction {\n  /** The button's text — also its VoiceOver / TalkBack / screen-reader label. At most 24\n   *  characters; a longer label is ellipsised. */\n  label: string;\n  /** What the tap runs, if anything: one of this bundle's own `tier5.<svc>.<action>` ids, or\n   *  `app.<svc>.<action>`. A screen worker may leave it out and branch on `actionTapped` instead\n   *  (\"Undo\"); an app service may not. */\n  actionId?: string;\n  /** The action's arguments, which the reducer receives as typed JSON. */\n  args?: Record<string, unknown>;\n}"
+      },
+      {
+        "name": "SnackbarResult",
+        "kind": "interface",
+        "jsdoc": "/** What a snackbar call resolves with. */",
+        "decl": "export interface SnackbarResult {\n  /** The user tapped the action. Always false for a snackbar without one (resolved on\n   *  presentation); with one, false when it was dismissed any other way — timed out, swiped, closed,\n   *  or replaced by a newer snackbar. */\n  actionTapped: boolean;\n}"
+      },
+      {
+        "name": "SNACKBAR_LIMITS",
+        "kind": "const",
+        "jsdoc": "/** #4661 — the constraints that keep a snackbar a toast, enforced here and again by every host. */",
+        "decl": "export const SNACKBAR_LIMITS = {\n  messageLines: 2,\n  labelChars: 24,\n  minDurationMs: 2000,\n  /** The floor with an action: long enough to reach it with a screen reader. */\n  minActionDurationMs: 4000,\n  maxDurationMs: 10_000,\n  /** The thumbnail's side, in pt / dp / CSS px. */\n  imageSize: 40,\n} as const;"
+      },
+      {
+        "name": "snackbarDurationMs",
+        "kind": "function",
+        "jsdoc": "/** The duration a host shows a snackbar for: absent / non-finite / 0 or less → undefined (the host\n *  default applies), else clamped to {@link SNACKBAR_LIMITS}. */",
+        "decl": "export function snackbarDurationMs(durationMs: number | undefined, hasAction: boolean): number | undefined;"
+      },
+      {
+        "name": "snackbarLabel",
+        "kind": "function",
+        "jsdoc": "/** An action label as every host draws it: at most {@link SNACKBAR_LIMITS}.labelChars characters\n *  (by code point, so an emoji is never cut in half), the last one an ellipsis when it was cut. */",
+        "decl": "export function snackbarLabel(label: string): string;"
       },
       {
         "name": "snackbar",
         "kind": "function",
-        "jsdoc": "/** Show a transient snackbar toast: it floats above the tab bar, slides and fades in and out\n *  (fades only under reduced motion), queues behind one that is already showing, and is read\n *  by VoiceOver / TalkBack. Resolves once it is PRESENTED (not after it auto-dismisses).\n *  Rejects with `no_ui_host` if no presenter is attached; with an `action`, also with\n *  `invalid_action` (empty label or id), `action_not_allowed` (not one of this bundle's\n *  actions), or, for an `app.*` id, `undeclared` (no `app_services`), `not_exported`, `no_service`,\n *  `no_action`, `not_booted` or `unavailable`. */",
-        "decl": "export async function snackbar(options: SnackbarOptions): Promise<void>;"
+        "jsdoc": "/** Show a transient snackbar toast: it floats above the tab bar, slides and fades in and out\n *  (fades only under reduced motion), queues behind one that is already showing, and is announced\n *  by VoiceOver / TalkBack / the screen reader. Without an `action` it resolves\n *  `{ actionTapped: false }` once it is queued, as before; with one it resolves when the snackbar\n *  goes, `{ actionTapped: true }` only if the action was tapped (see {@link SnackbarResult}).\n *  Rejects with `no_ui_host` if no presenter is attached; with an `action`, also with\n *  `invalid_action` (empty label), `action_id_required` (an app service with no `actionId`),\n *  `action_not_allowed` (not one of this bundle's actions), or, for an `app.*` id, `undeclared` (no\n *  `app_services`), `not_exported`, `no_service`, `no_action`, `not_booted` or `unavailable`. */",
+        "decl": "export async function snackbar(options: SnackbarOptions): Promise<SnackbarResult>;"
       },
       {
         "name": "version",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1613.0",
+  "version": "0.1614.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -72,5 +72,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "8d1e7814c00d18146088e2680fe43650535ec12113548c216d4fdbe0"
+  "falconPackageHash": "5d96af6574de509f64d0dfcd8cb4660e4a7d81a0deb73b852e474acd"
 }

package/templates/beauty-salon/tier5-src/himi-branded-lite-home/index.ts

@@ -9,7 +9,14 @@ import { withIapPresentation } from "../_shared/iap-presentation.js";
 import { queryServices, type WixService } from "@himalaya/wix-bookings";
 import { getPost, queryPosts, type WixPost } from "@himalaya/wix-blog";
 import { queryGroups, type WixGroup } from "@himalaya/wix-groups";
-import { queryPrograms, type WixProgram } from "@himalaya/wix-online-programs";
+import {
+  listMyParticipations,
+  participationsByProgram,
+  queryJoinApplications,
+  queryPrograms,
+  type WixProgram,
+} from "@himalaya/wix-online-programs";
+import { getMyMember } from "@himalaya/wix-members";
 import { listFeedItems, type WixFeedItem, type WixFeedProfile } from "@himalaya/wix-social-feed";
 import { queryItems as queryMenuItems, querySections as queryMenuSections } from "@himalaya/wix-restaurants";
 import { normalizeEvent, queryEvents } from "../_shared/himi-events.js";
@@ -166,6 +173,13 @@ interface ProgramCard {
   noImage: boolean;
 }
 
+/** A member's own program state, kept separate from the visitor catalog cards. */
+interface MemberProgramCard extends ProgramCard {
+  stateLabel: string;
+  progressFraction: number;
+  hideProgress: boolean;
+}
+
 /** A communityPulse latest-activity Carousel card (design §4.5). */
 interface FeedHighlight {
   id: string;
@@ -308,6 +322,8 @@ interface State {
   noNextEvent: boolean;
   homePrograms: ProgramCard[];
   noHomePrograms: boolean;
+  memberPrograms: MemberProgramCard[];
+  noMemberPrograms: boolean;
   /** The videos module's carousel — the newest ready Wix Video videos, the channels
    *  taking turns. Guarded on `videos`; same silent-fail contract. */
   homeVideos: (WixVideoCard & CaptionFlags)[];
@@ -549,6 +565,7 @@ interface ExtrasSignal {
   upcomingEvents: EventEntry[];
   nextEventCards: NextEventCard[];
   homePrograms: ProgramCard[];
+  memberPrograms: MemberProgramCard[];
   homeVideos: (WixVideoCard & CaptionFlags)[];
   feedHighlights: FeedHighlight[];
   memberAvatars: CoachAvatar[];
@@ -559,8 +576,17 @@ interface ExtrasSignal {
   menuCategories: MenuCategory[];
 }
 
+let homeProgramCandidates: { generation: number; programs: WixProgram[] } = { generation: 0, programs: [] };
+/** A finite number from a progress field, or `fallback` when the read left it out or sent junk. */
+function finiteOr(value: unknown, fallback: number): number {
+  return typeof value === "number" && Number.isFinite(value) ? value : fallback;
+}
+
+/** How many microtask turns `memberProgramsLoaded` waits for refresh's own result to land (see the action). */
+const MEMBER_PROGRAMS_APPLY_RETRIES = 50;
+
 function emptyExtrasSignal(): ExtrasSignal {
-  return { upcomingEvents: [], nextEventCards: [], homePrograms: [], homeVideos: [], feedHighlights: [], memberAvatars: [], groupCards: [], announcementTitle: "", postCards: [], popularDishes: [], menuCategories: [] };
+  return { upcomingEvents: [], nextEventCards: [], homePrograms: [], memberPrograms: [], homeVideos: [], feedHighlights: [], memberAvatars: [], groupCards: [], announcementTitle: "", postCards: [], popularDishes: [], menuCategories: [] };
 }
 
 /** Cover URL probe for a blog post — the himi-blog-feed imageUrl fallbacks
@@ -670,13 +696,13 @@ async function fetchUpcomingEvents(): Promise<{ entries: EventEntry[]; nextEvent
   }
 }
 
-async function fetchHomePrograms(): Promise<ProgramCard[]> {
+async function fetchHomePrograms(): Promise<{ cards: ProgramCard[]; programs: WixProgram[] }> {
   try {
     const response = await queryPrograms({ cursorPaging: { limit: 12 } });
-    return (response.programs ?? [])
+    const programs = (response.programs ?? [])
       .filter((p: WixProgram) => ((p.state ?? p.status ?? "").toUpperCase()) !== "DRAFT")
-      .slice(0, 6)
-      .map((p: WixProgram) => {
+      .slice(0, 12);
+    const cards = programs.slice(0, 6).map((p: WixProgram) => {
         const desc = (p as { description?: unknown }).description;
         const nestedTitle = desc && typeof desc === "object" ? (desc as { title?: string }).title : undefined;
         const name = cleanTitle(p.settings?.title ?? nestedTitle ?? p.title) || copyParam("home.programFallbackName", "Program");
@@ -692,7 +718,112 @@ async function fetchHomePrograms(): Promise<ProgramCard[]> {
           noImage: !image,
         };
       });
+    return { cards, programs };
   } catch {
+    return { cards: [], programs: [] };
+  }
+}
+
+/** Member state is best-effort Home enrichment: visitors and unsupported member sessions
+ * collapse the rail, while the public Programs section remains available. */
+async function fetchMemberProgramCards(programs: WixProgram[]): Promise<MemberProgramCard[]> {
+  try {
+    const member = await memberAccess();
+    if (!member.email) return [];
+    const memberId = (await getMyMember()).member?.id;
+    if (!memberId) return [];
+
+    const [participantResult, applicationResult] = await Promise.allSettled([
+      listMyParticipations(memberId, { maxPages: 2 }),
+      queryJoinApplications({ memberId, limit: 100 }),
+    ]);
+    // These are independent member reads. An unverified participant-query permission
+    // must not also hide applications that the member-scoped endpoint can return.
+    const participants = participantResult.status === "fulfilled" ? participantResult.value : [];
+    const applications = applicationResult.status === "fulfilled" ? applicationResult.value : { joinApplications: [] };
+    const participation = participationsByProgram(participants);
+    // An application that already became a participant keeps its status and carries `participantId`
+    // (the SDK's PENDING_JOIN_APPLICATION_STATUSES note): the participation is the standing, and a member
+    // who later left must not read as "Approved" from the application that once admitted them. Newest
+    // first, one per program, and only programs with no participation of their own — so the admitted
+    // rows a joined member accumulates never take the lookup slots of a real pending request.
+    const applicationByProgram = new Map<string, { status?: string }>();
+    for (const application of applications.joinApplications ?? []) {
+      if (!application.programId || application.participantId || participation.has(application.programId)) continue;
+      if (!applicationByProgram.has(application.programId)) applicationByProgram.set(application.programId, application);
+    }
+    // The public catalog preview is intentionally capped at 12. Resolve the
+    // member's six most recent enrolled programs and six open applications
+    // outside that window in one filtered query so both remain visible.
+    const knownIds = new Set(programs.map((program) => program.id).filter((id): id is string => !!id));
+    const participantProgramIds = [...participation.keys()].slice(0, 6);
+    const applicationProgramIds = [...applicationByProgram.keys()].filter((id) => !participantProgramIds.includes(id)).slice(0, 6);
+    const candidateIds = [...participantProgramIds, ...applicationProgramIds].slice(0, 12);
+    const missingIds = candidateIds.filter((id) => !knownIds.has(id));
+    const extraPrograms = missingIds.length
+      ? await queryPrograms({ filter: { id: { $in: missingIds } }, cursorPaging: { limit: missingIds.length } })
+          .then((response) => response.programs ?? []).catch(() => [])
+      : [];
+    const memberPrograms = [...programs, ...extraPrograms.filter((program) => !!program.id && !knownIds.has(program.id))];
+    await assertMemberAccess(member);
+
+    return memberPrograms.flatMap((program) => {
+      if (!program.id) return [];
+      const participant = participation.get(program.id);
+      const application = applicationByProgram.get(program.id);
+      if (!participant && !application) return [];
+      const desc = (program as { description?: unknown }).description;
+      const nestedTitle = desc && typeof desc === "object" ? (desc as { title?: string }).title : undefined;
+      const name = cleanTitle(program.settings?.title ?? nestedTitle ?? program.title) || copyParam("home.programFallbackName", "Program");
+      const image = programImage(program);
+      // Progress may be absent (a `fields` the read did not ask for, or a program with no steps): the
+      // bar then sits at 0 and the label comes from `progressStatus`, never from NaN arithmetic.
+      const available = finiteOr(participant?.progress?.totalStepsAvailable, 0);
+      const completed = finiteOr(participant?.progress?.totalStepsCompleted, 0);
+      const percentage = finiteOr(participant?.progress?.completionPercentage, Number.NaN);
+      const hasProgress = available > 0 || Number.isFinite(percentage);
+      const rawFraction = available > 0 ? completed / available : Number.isFinite(percentage) ? percentage / 100 : 0;
+      const progressFraction = Math.max(0, Math.min(1, rawFraction));
+      let stateLabel: string;
+      if (participant) {
+        const enrollmentStatus = (participant.enrollmentStatus ?? "").toUpperCase();
+        const progressStatus = (participant.progressStatus ?? "").toUpperCase();
+        stateLabel = enrollmentStatus === "SUSPENDED"
+          ? copyParam("home.memberProgramSuspended", "Access paused")
+          : progressStatus === "COMPLETED" || enrollmentStatus === "COMPLETED"
+          ? copyParam("home.memberProgramCompleted", "Completed")
+          : progressStatus === "FAILED"
+            ? copyParam("home.memberProgramFailed", "Failed")
+          : progressStatus === "IN_PROGRESS" || (progressStatus !== "NOT_STARTED" && progressFraction > 0)
+            ? copyParam("home.memberProgramInProgress", "In progress")
+            : copyParam("home.memberProgramNotStarted", "Not started");
+      } else {
+        const status = (application?.status ?? "").toUpperCase();
+        stateLabel = status === "INVITED"
+          ? copyParam("home.memberProgramInvited", "Invitation")
+          : status === "APPROVED"
+            ? copyParam("home.memberProgramApproved", "Approved")
+            : status === "SUSPENDED"
+              ? copyParam("home.memberProgramSuspended", "Access paused")
+            : copyParam("home.memberProgramPending", "Request pending");
+      }
+      return [{
+        id: program.id,
+        name,
+        description: "",
+        image,
+        initial: initials(name),
+        hasImage: !!image,
+        noImage: !image,
+        stateLabel,
+        progressFraction,
+        hideProgress: !hasProgress || !participant || (participant.enrollmentStatus ?? "").toUpperCase() === "SUSPENDED",
+      }];
+    });
+  } catch (error) {
+    // The member rail is optional; never let a member-state refusal blank public Home.
+    const status = (error as { status?: unknown } | null)?.status ?? /\bHTTP (\d{3})\b/.exec(String(error))?.[1];
+    console.warn("[home.member-programs] member state unavailable", status !== undefined ? `HTTP ${String(status)}` : (error as { name?: string } | null)?.name ?? "unknown");
     return [];
   }
 }
@@ -747,7 +878,7 @@ function groupCard(group: WixGroup): GroupCard {
   };
 }
 
-async function fetchExtrasSignal(arg: unknown): Promise<ExtrasSignal> {
+async function fetchExtrasSignal(arg: unknown, generation: number): Promise<ExtrasSignal> {
   const verticals = parseVerticals(arg);
   const extras = emptyExtrasSignal();
   const jobs: Promise<void>[] = [];
@@ -758,7 +889,12 @@ async function fetchExtrasSignal(arg: unknown): Promise<ExtrasSignal> {
     }));
   }
   if (verticals.includes("programs")) {
-    jobs.push(fetchHomePrograms().then((cards) => { extras.homePrograms = cards; }));
+    jobs.push(fetchHomePrograms().then(({ cards, programs }) => {
+      extras.homePrograms = cards;
+      // An older refresh can finish this query after a newer one. Keep its
+      // candidates from replacing the current generation's member-read input.
+      if (generation === refreshGen) homeProgramCandidates = { generation, programs };
+    }));
   }
   if (verticals.includes("videos") && !videoSurfaceRefused) {
     const caption = videoCaptionOf(paramValue(arg, "videoCaption"));
@@ -883,6 +1019,7 @@ function derive(state: State): State {
     noUpcomingEvents: state.upcomingEvents.length === 0,
     noNextEvent: state.nextEventCards.length === 0,
     noHomePrograms: state.homePrograms.length === 0,
+    noMemberPrograms: state.memberPrograms.length === 0,
     noHomeVideos: state.homeVideos.length === 0,
     noFeedHighlights: state.feedHighlights.length === 0,
     noMemberAvatars: state.memberAvatars.length === 0,
@@ -977,6 +1114,8 @@ function baseState(): State {
     noNextEvent: true,
     homePrograms: [],
     noHomePrograms: true,
+    memberPrograms: [],
+    noMemberPrograms: true,
     homeVideos: [],
     noHomeVideos: true,
     feedHighlights: [],
@@ -1026,7 +1165,7 @@ async function refreshPublic(state: State, arg?: unknown): Promise<State | undef
   // failure just collapses their blocks), so a store outage cannot blank them
   // and vice versa. paramValue() stashes the appear params on first read, so the
   // arg-less fallback below still resolves the stashed verticals.
-  const [bookings, extras, saved] = await Promise.all([fetchBookingsSignal(arg), fetchExtrasSignal(arg), fetchSavedSignal(arg)]);
+  const [bookings, extras, saved] = await Promise.all([fetchBookingsSignal(arg), fetchExtrasSignal(arg, gen), fetchSavedSignal(arg)]);
   if (gen !== refreshGen) return undefined;
   // A screen that declares no "store" vertical renders no products rail, so there is
   // nothing to fetch and nothing that could be "not loaded" — skip the call outright
@@ -1186,8 +1325,17 @@ async function refresh(state: State, arg?: unknown): Promise<State | undefined>
   void refreshPersonal(generation, arg);
   const publicState = await refreshPublic(state, arg);
   if (!publicState || generation !== personalGeneration) return undefined;
+  // The member-only read runs after public Home has landed. It is deliberately not awaited:
+  // a slow member endpoint must not hold the public catalog or hero behind authentication.
+  const programCandidates = homeProgramCandidates;
+  if (programCandidates.generation === refreshGen && parseVerticals(arg).includes("programs")) {
+    void fetchMemberProgramCards(programCandidates.programs).then((rows) => {
+      void svc.memberProgramsLoaded({ generation: programCandidates.generation, rows });
+    });
+  }
   const current = svc.getState();
-  return derive({ ...publicState, nextBooking: current.nextBooking, hideNextBooking: current.hideNextBooking,
+  return derive({ ...publicState, memberPrograms: current.memberPrograms, noMemberPrograms: current.noMemberPrograms,
+    nextBooking: current.nextBooking, hideNextBooking: current.hideNextBooking,
     memberProgressLabel: current.memberProgressLabel, memberProgressFraction: current.memberProgressFraction,
     hideMemberProgress: current.hideMemberProgress, personalError: current.personalError, hidePersonalError: current.hidePersonalError,
     // The weekly goal is PERSONAL (member bookings); the public refresh resets it, so keep it.
@@ -1214,6 +1362,7 @@ const svc = defineService<State, {
   refresh: (state: State, arg?: unknown) => Promise<State | undefined>;
   dismissOnboarding: (state: State) => State;
   clearPersonal: (state: State) => State;
+  memberProgramsLoaded: (state: State, arg: { generation: number; rows: MemberProgramCard[]; attempt?: number }) => State | undefined;
   openShopCategory: (state: State, arg?: unknown) => State;
   personalLoaded: (state: State, arg: { generation: number; rows: MemberBookingRow[]; progress: { label: string; fraction: number }; error: boolean; weekly: { count: number; fraction: number; label: string } | null }) => State;
   categoriesLoaded: (state: State, arg: { generation: number; categories: StoreCategoryCard[] }) => State | undefined;
@@ -1221,10 +1370,27 @@ const svc = defineService<State, {
   state: baseState(),
   // The host's site is read fresh at every boot: a snapshot of the last session's site must not
   // decide this one's verticals or name (an owner installs or removes one; another site opens).
-  notHydrated: ["hosted", "hostedName", "hostedCards", "homeCategories", "noHomeCategories"],
+  notHydrated: ["hosted", "hostedName", "hostedCards", "homeCategories", "noHomeCategories", "memberPrograms", "noMemberPrograms"],
+  // A member's standing never reaches the on-device snapshot either: the next boot may be another member's.
+  notPersisted: ["memberPrograms", "noMemberPrograms"],
   actions: {
-    clearPersonal: state => derive({ ...state, nextBooking: [], hideNextBooking: true, memberProgressLabel: "", memberProgressFraction: 0, hideMemberProgress: true, personalError: false, hidePersonalError: true,
+    clearPersonal: state => derive({ ...state, nextBooking: [], hideNextBooking: true, memberProgressLabel: "", memberProgressFraction: 0, hideMemberProgress: true, memberPrograms: [], noMemberPrograms: true, personalError: false, hidePersonalError: true,
       weeklyClassCount: 0, weeklyClassGoalFraction: 0, weeklyGoalLabel: "" }),
+    // The member read starts inside `refresh` and, for a visitor (identity answers synchronously),
+    // resolves within the same microtask turn — BEFORE the runtime has applied refresh's own result.
+    // The `state` handed here is then refresh's PRE-state (status "loading", every rail empty), and
+    // spreading it wrote a loading home over the ready one; the description-projection test caught
+    // exactly that. So an early arrival re-queues itself (a microtask at a time, bounded) until the
+    // state it would spread is the applied one. A stale generation keeps the current state
+    // (`undefined`), never its own stale snapshot.
+    memberProgramsLoaded: (state, arg) => {
+      if (arg.generation !== refreshGen) return undefined;
+      if (state.status === "loading" && (arg.attempt ?? 0) < MEMBER_PROGRAMS_APPLY_RETRIES) {
+        void Promise.resolve().then(() => svc.memberProgramsLoaded({ ...arg, attempt: (arg.attempt ?? 0) + 1 }));
+        return undefined;
+      }
+      return derive({ ...state, memberPrograms: arg.rows, noMemberPrograms: arg.rows.length === 0 });
+    },
     openShopCategory: (state, arg) => {
       const category = String((arg as { category?: unknown } | undefined)?.category ?? "");
       if (!category) return state;