@wix/himalaya-cli 0.1614.0 → 0.1616.0

package/templates/salon-spa/tier5-src/himi-store-account/index.ts

@@ -0,0 +1,925 @@
+import { authFailure, authMessage, identityErrors, type AuthOperation } from "@himalaya/auth";
+// Tier-5 bundle: himi-store — visitor/member account state.
+//
+// SINGLE-SITE BY DESIGN. A Branded Lite build talks to exactly one Wix site, and the
+// binding is the baked Headless `clientId` itself:
+// there is no metaSiteId to move and Wix will not route a consumer token minted for one
+// client at another site. This worker therefore has no site picker — Profile used to carry
+// a "Your sites" list that dispatched `branded_lite.select_site`, which changed the
+// `wix-site-id` header and nothing else, so every read stayed on the baked site while the
+// UI claimed otherwise. Managing several businesses is Owner Lite's job (account auth, a
+// real Sites List, and per-call site scope via `site.forSite`).
+import { defineService, navigate } from "@himalaya/state";
+import { dispatch } from "@himalaya/dispatch";
+import { getCurrentCart, searchOrders, type WixOrder } from "@himalaya/wix-ecom";
+import { guestProfile, loadMemberProfile, signedInEmail, strOf, fmtDate, titleCase, type AccountActivityRow } from "../_shared/himi-account";
+import { stashCopy, copyParam, copyTemplate } from "../_shared/himi-copy.js";
+import { memberAccountRoutes } from "../_shared/member-account-routes.js";
+import { createIapCommerce, onlineProgramOrders, pricingPlanOrders, storesAppleSalesEnabled, storesProductOrders } from "@himalaya/iap-checkout";
+import { IAP_RESTORE_KEYS, NO_IAP_RESTORE, createIapRestore, resetUnhydratedKeysOnOlderRuntime, type IapRestoreFields } from "../_shared/iap-worker.js";
+
+interface AuthRouteInput {
+  authContinuation?: string;
+  /** Standalone sign-in only: `register` opens the form on Create account. */
+  mode?: string;
+  intent?: string;
+  contextName?: string;
+  returnScreenId?: string;
+  returnId?: string;
+  returnChannelId?: string;
+  /** Standalone sign-in only: "1" when it was opened as a modal (sheet / cover). */
+  modal?: string;
+  /** Modal only: the tab whose stack the return screen opens on once the modal closes. */
+  returnTab?: string;
+}
+
+// The screen's boot input survives refresh; consuming it must survive too.
+let routeInputConsumed = false;
+// The form's heading has its copy: a copy pack was stashed, a probe (not the boot load)
+// finished without one, or the visitor switched mode — the form is in use by then.
+let headingReady = false;
+
+/** Mid-flow open params land on `himalaya.input` (paramKeys on himi_account). */
+function routeInput(): AuthRouteInput {
+  const input = (globalThis as { himalaya?: { input?: AuthRouteInput } }).himalaya?.input;
+  return input && typeof input === "object" ? input : {};
+}
+
+/** The route opened the standalone form on Create account. Read once, before any probe. */
+const ROUTE_ASKS_REGISTER = routeInput().mode === "register";
+
+function strField(arg: unknown, key: string): string {
+  if (!arg || typeof arg !== "object") return "";
+  const raw = (arg as Record<string, unknown>)[key];
+  return typeof raw === "string" ? raw.trim() : "";
+}
+
+/** Mid-flow auth (UX F3): intent + return path from himi.open / himalaya.input. */
+function authIntentFromArg(arg: unknown, prev: Pick<S, "authIntent" | "authContextName" | "returnScreenId" | "returnId" | "returnChannelId">): Pick<S, "authIntent" | "authContextName" | "returnScreenId" | "returnId" | "returnChannelId"> {
+  const route = routeInputConsumed ? {} : routeInput();
+  return {
+    authIntent: strField(arg, "intent") || route.intent || prev.authIntent || "",
+    authContextName: strField(arg, "contextName") || route.contextName || prev.authContextName || "",
+    returnScreenId: strField(arg, "returnScreenId") || route.returnScreenId || prev.returnScreenId || "",
+    returnId: strField(arg, "returnId") || route.returnId || prev.returnId || "",
+    returnChannelId: strField(arg, "returnChannelId") || route.returnChannelId || prev.returnChannelId || "",
+  };
+}
+
+/** How the standalone form leaves. A modal is closed: on web `back` pops the tab's stack,
+ *  not the modal. A pushed form goes back. */
+function leaveNav(): "dismiss" | "back" {
+  return routeInput().modal === "1" ? "dismiss" : "back";
+}
+
+/** Where a successful sign-in returns to, or null. Never Account itself — that would
+ *  only push a second copy of the screen the member is already on. */
+function resumeTarget(s: Pick<S, "returnScreenId" | "returnId" | "returnChannelId">): { screenId: string; args?: Record<string, string> } | null {
+  if (!s.returnScreenId || s.returnScreenId === "himi_account") return null;
+  return s.returnId || s.returnChannelId ? {
+    screenId: s.returnScreenId,
+    args: { ...(s.returnId ? { id: s.returnId } : {}), ...(s.returnChannelId ? { channelId: s.returnChannelId } : {}) },
+  } : { screenId: s.returnScreenId };
+}
+
+/** Resume the member-only screen that sent the visitor here, once. The return path is
+ *  consumed so a later refresh cannot fire it again; the host opens the target only if
+ *  it is linkable, the same check an authored `himi.open` gets.
+ *
+ *  On the standalone sign-in screen the target is pushed, not a `replace`: on iOS and
+ *  Android `replace` resets the stack to its root, which would drop the screens the
+ *  visitor came through. Back from the target shows the form again, and the form sends a
+ *  member back on appear (settle). With no target the form goes back.
+ *
+ *  A modal form closes. A target pushed from here would open inside the modal (iOS, Android)
+ *  or under it (web), so a modal that names a `returnTab` hands the target to that tab: the
+ *  host closes the modal, then pushes it on that tab's stack (Account's member rows). A host
+ *  showing no such tab (a drawer, a narrow Mac window) drops that request whole, modal and
+ *  all, so the modal is also dismissed directly: it always closes, and the row opens where
+ *  the tab exists. With no `returnTab` it only closes, and the screen under it loads again —
+ *  the screen that opened the modal is the return target. */
+function resumeAfterAuth(next: S): S {
+  const target = resumeTarget(next);
+  if (!next.isMember) return next;
+  const tab = routeInput().modal === "1" ? routeInput().returnTab ?? "" : "";
+  if (target && tab && next.standalone) {
+    routeInputConsumed = true;
+    void dispatch("himi.open", { presentation: "dismiss" });
+    const cleared = derive({ ...next, authIntent: "", authContextName: "", returnScreenId: "", returnId: "", returnChannelId: "" });
+    return navigate(cleared, target.args ? { tab, screenId: target.screenId, args: target.args } : { tab, screenId: target.screenId });
+  }
+  if (!target || routeInput().modal === "1") return next.standalone ? navigate(next, { presentation: leaveNav() }) : next;
+  routeInputConsumed = true;
+  const cleared = derive({ ...next, authIntent: "", authContextName: "", returnScreenId: "", returnId: "", returnChannelId: "" });
+  return navigate(cleared, target);
+}
+
+/** Account with a standalone sign-in screen (`signInScreen` appear param): a guest who
+ *  arrives with a sign-in intent or a return path — a member gate, an old deep link — is
+ *  sent on to that screen with the same params, once. */
+function forwardToSignIn(next: S): S {
+  if (!next.signInScreen || next.isMember || routeInputConsumed) return next;
+  if (!next.authIntent && !next.returnScreenId) return next;
+  routeInputConsumed = true;
+  const args: Record<string, string> = { mode: "signin" };
+  for (const key of ["authIntent", "authContextName"] as const) {
+    if (next[key]) args[key === "authIntent" ? "intent" : "contextName"] = next[key];
+  }
+  return openSignIn(derive({ ...next, authIntent: "", authContextName: "", returnScreenId: "", returnId: "", returnChannelId: "" }),
+    args, resumeTarget(next));
+}
+
+/** Account sends a guest to the standalone sign-in screen, with `after`, the member screen to
+ *  open once signed in. With a `signInPresentation` appear param it opens as that modal, and
+ *  `after` goes on Account's own tab (`signInReturnTab`) when the modal closes; pushed, the form
+ *  pushes `after` itself (resumeAfterAuth). */
+function openSignIn(next: S, args: Record<string, string>, after: { screenId: string; args?: Record<string, string> } | null): S {
+  const screenId = next.signInScreen || "himi_sign_in";
+  const presentation = signInPresentationRequested;
+  const back: Record<string, string> = {};
+  if (after) {
+    back.returnScreenId = after.screenId;
+    if (after.args?.id) back.returnId = after.args.id;
+    if (after.args?.channelId) back.returnChannelId = after.args.channelId;
+  }
+  if (!presentation) return navigate(next, { screenId, args: { ...args, ...back } });
+  const modalArgs: Record<string, string> = { ...args, modal: "1" };
+  // With no tab to open it on, a modal has no way to the member screen: it only closes.
+  if (after && signInReturnTabRequested) Object.assign(modalArgs, back, { returnTab: signInReturnTabRequested });
+  return navigate(next, { screenId, presentation, args: modalArgs });
+}
+
+/** After a load: the standalone sign-in screen sends a member back (a stale link, or a
+ *  sign-in finished elsewhere); Account forwards a guest with a sign-in intent.
+ *
+ *  The member goes back WITHOUT the return path: only a sign-in made on this form resumes
+ *  it (authenticate → resumeAfterAuth). The screen is public, so honouring a route's
+ *  return path here would let a bare link open a member-only screen with no tap. */
+function stashScreenCopy(arg: unknown): void {
+  stashCopy(arg);
+  if (strField(arg, "copy")) headingReady = true;
+}
+
+function settle(next: S, arg: unknown, latest = true): S {
+  // A member on the form goes back. Coming back to the form after the pushed
+  // target, iOS re-runs only `load()` with no params and DISCARDS its result, so the move is
+  // a dispatch, not `_nav`. Never from the boot load: the appear refresh of the same visit
+  // sends it.
+  if (next.standalone && next.isMember) {
+    routeInputConsumed = true;
+    const cleared = derive({ ...next, ...NO_VISIT });
+    // Only the newest probe moves: web re-shows a form with an arg-less load AND the appear
+    // refresh, and both may land, any time apart. The boot load never moves.
+    if (!latest || strField(arg, "boot") === "1") return cleared;
+    // The appear refresh returns `_nav`, which every host applies — binaries from before
+    // worker nav dispatch included. Only an arg-less load, whose result iOS
+    // discards, dispatches.
+    if (strField(arg, "standalone") === "1") return navigate(cleared, { presentation: leaveNav() });
+    // Not from a modal: nothing pushed over it comes back to it, and on iOS the closing modal's
+    // own screen reloads here once, after it has asked to close — a late dismiss would close
+    // whatever modal is open by then.
+    if (routeInput().modal !== "1") void dispatch("himi.open", { presentation: leaveNav() });
+    return cleared;
+  }
+  // Account forwards only on an appear refresh: the boot `load()` has no params and its
+  // navigation is dropped, so a forward there was lost and used up the one forward.
+  return strField(arg, "signInScreen") ? forwardToSignIn(next) : next;
+}
+
+// A tick reads only the session. The profile is read again only when the signed-in email
+// changes, so an idle tick costs no profile read and no re-render. Account opts in
+// (`pollIdentity`): a sign-in on the standalone screen changes the session while Account
+// stays mounted, and not every host re-runs `load` when it comes back.
+const IDENTITY_POLL = { id: "himi-account-identity", intervalMs: 1500, action: "himiStoreAccount.sync" };
+
+/** "Hey, <name>" wants a first name. A profile with no display name carries the email. */
+function greetingName(memberName: string): string {
+  const name = memberName.trim();
+  const bare = name.includes("@") ? name.slice(0, name.indexOf("@")) : name;
+  return bare.split(/\s+/)[0] ?? "";
+}
+
+// Applied once per worker: the standalone screen opens on the mode its route asked for.
+let routeModeApplied = false;
+
+/** One visit's form mode and mid-flow return path. Never restored from a snapshot: the
+ *  snapshot is keyed by screen, not by the route that opened it. */
+const NO_VISIT = {
+  isRegistering: false, isRecovering: false,
+  authIntent: "", authContextName: "", returnScreenId: "", returnId: "", returnChannelId: "",
+};
+const VISIT_KEYS = Object.keys(NO_VISIT) as (keyof typeof NO_VISIT)[];
+/** What derive() computes from the visit keys. Hydration copies keys without re-deriving,
+ *  so these stay out of the snapshot with them, or the first paint mixes two visits. */
+const VISIT_DERIVED_KEYS = ["notRegistering", "notRecovering", "hideSignInChoices", "authTitle", "authBody",
+  "hasReturnPath", "noReturnPath", "returnCta"] as const;
+
+// Actions are not serialized: two quick Sign in taps both run against the pre-tap
+// state, so without this both would submit credentials and both would resume.
+let authInFlight = false;
+// Never projected or persisted. The renderer retains its own masked draft for retry.
+let passwordDraft = "";
+let editRevision = 0;
+// load, refresh and sync each run a whole probe and replace the whole state. Only the newest
+// one to start may land: a boot `load()` that resolves after the appear refresh would put
+// back a state without the appear params, and a sync that resolves after a Sign out would
+// put the member back.
+let probeSeq = 0;
+let appliedSeq = 0;
+// The appear params belong to the worker session too, like the two flags above: a probe
+// dropped because the visitor typed must not take them with it.
+let signInScreenRequested = "";
+/** Account only: how it opens the standalone sign-in screen ("" = push). */
+let signInPresentationRequested: "" | "sheet" | "full_screen" = "";
+/** Account only: its tab, where a member screen opens after a modal sign-in. */
+let signInReturnTabRequested = "";
+let standaloneRequested = false;
+let pollIdentityRequested = false;
+// iOS can start the arg-less boot load after the appear refresh that asks for the row; the
+// newer boot probe must not land, or be kept, without it.
+let restorePurchasesRequested = false;
+// Bumped by every mode switch, so a dropped probe never puts back a mode the visitor left.
+let modeSwitches = 0;
+
+interface AppearConfig { mode: Partial<S>; visit: Partial<S> }
+
+/** The appear params the worker session has seen so far — read when a state is built, so a
+ *  probe that started before an appear refresh still carries what that refresh asked for. */
+function appearBase(): Partial<S> {
+  return {
+    signInScreen: signInScreenRequested,
+    standalone: standaloneRequested,
+    pollIdentity: pollIdentityRequested,
+    restorePurchases: restorePurchasesRequested,
+    ...(pollIdentityRequested ? { _poll: { ...IDENTITY_POLL } } : {}),
+  };
+}
+
+/** What the appear params ask for. Read before the probe awaits anything. */
+function appearConfig(s: S, arg: unknown): AppearConfig {
+  const appearing = strField(arg, "standalone") === "1";
+  // Each visit to the form reads its own route again. A pooled worker comes back for a
+  // later visit with the same params, after an earlier visit consumed the route.
+  if (appearing) {
+    routeInputConsumed = false;
+    // A pooled worker serves the next visitor too: the fields mount empty, so the last
+    // visit's draft must not be what Sign in submits.
+    passwordDraft = "";
+  }
+  signInScreenRequested ||= strField(arg, "signInScreen") || s.signInScreen;
+  const presentation = strField(arg, "signInPresentation");
+  if (presentation === "sheet" || presentation === "full_screen") signInPresentationRequested = presentation;
+  signInReturnTabRequested ||= strField(arg, "signInReturnTab");
+  // Only the sign-in screen's route carries `mode`, so it marks the form from the boot load on.
+  standaloneRequested ||= s.standalone || appearing || (!routeInputConsumed && !!routeInput().mode);
+  pollIdentityRequested ||= s.pollIdentity || strField(arg, "pollIdentity") === "1";
+  restorePurchasesRequested ||= s.restorePurchases || strField(arg, "restorePurchases") === "1";
+  // The form opens on the mode its route asked for each time it appears, sign-in by
+  // default: a pooled worker reopened with the same params must not open on the mode the
+  // last visit toggled to.
+  let mode: Partial<S> = {};
+  if (standaloneRequested && (!routeModeApplied || appearing)) {
+    routeModeApplied = true;
+    const asked = strField(arg, "mode") || (routeInputConsumed ? "" : routeInput().mode ?? "");
+    const isRegistering = asked === "register";
+    if (isRegistering !== !!s.isRegistering || s.isRecovering) {
+      mode = { isRegistering, isRecovering: false, ...NO_FOCUS_MODE_SWITCH };
+    }
+  }
+  const visit: Partial<S> = appearing
+    // The route's own intent and return path too: a dropped probe must not keep the last
+    // visit's (an abandoned gate) for the next Sign in to resume.
+    ? { email: "", firstName: "", lastName: "", password: "", emailError: "", passwordError: "", message: "", lastNameFocus: "", emailFocus: "", passwordFocus: "", ...authIntentFromArg(arg, NO_VISIT) }
+    : {};
+  return { mode, visit };
+}
+
+/** The probe's state, or — when it must not land — the appear params alone, on the
+ *  current state. */
+// Bumped when an appear refresh's visit reset lands. A probe that started before it read the
+// last visit's state, so it must not land over the reset (iOS can start the arg-less load
+// after the appear refresh, from the same pre-reset state).
+let visitsApplied = 0;
+
+async function freshProbe(s: S, arg?: unknown): Promise<{ next: S; latest: boolean } | { kept: S; latest: boolean }> {
+  const seq = ++probeSeq;
+  const revision = editRevision;
+  const switches = modeSwitches;
+  const visits = visitsApplied;
+  const config = appearConfig(s, arg);
+  const next = await probe(s, arg, config);
+  if (authInFlight || revision !== editRevision || seq < appliedSeq || visits !== visitsApplied) {
+    const current = svc.getState();
+    const mode = authInFlight || switches !== modeSwitches ? {} : config.mode;
+    // The new visit's clean form, except for what the visitor typed since it appeared.
+    const visit = Object.fromEntries(Object.entries(config.visit)
+      .filter(([key]) => current[key as keyof S] === s[key as keyof S]));
+    // Dropped only because a visit reset landed meanwhile: this is still the newest probe, so
+    // it may still move a member off the form (the reset's own probe was not the newest).
+    const latest = !authInFlight && revision === editRevision && seq >= appliedSeq && seq === probeSeq;
+    const kept = derive({ ...current, ...appearBase(), ...mode, ...visit });
+    // The reset still landed even though its probe was dropped. Invalidate arg-less loads
+    // that started from the previous visit's state before they can restore its return path.
+    if (strField(arg, "standalone") === "1") visitsApplied++;
+    return { kept, latest };
+  }
+  appliedSeq = seq;
+  if (strField(arg, "standalone") === "1") visitsApplied++;
+  // A newer probe is still on its way: this one may land, but must not navigate.
+  return { next, latest: seq === probeSeq };
+}
+// Descriptor configuration belongs to the worker session. Keep it even when a
+// delayed profile probe is discarded because the user edited the form.
+let memberAccountLinksRequested = false;
+let cartCountRequested = false;
+const translated = (key: string) => copyParam(key, authMessage(key));
+
+function validateAuth(s: S, operation: AuthOperation): S {
+  const errors = identityErrors({ email: s.email, password: passwordDraft }, operation);
+  return derive({ ...s, emailError: errors.email ? translated(errors.email) : "",
+    passwordError: errors.password ? translated(errors.password) : "",
+    emailFocus: errors.email ? bumpToken(s.emailFocus) : s.emailFocus,
+    passwordFocus: !errors.email && errors.password ? bumpToken(s.passwordFocus) : s.passwordFocus,
+    message: "" });
+}
+function rejectResult(raw: unknown, operation: AuthOperation) {
+  const value = raw as { status?: string; error?: unknown; payload?: { error?: unknown } } | null;
+  if (value?.status === "error" || value?.error || value?.payload?.error) throw authFailure(raw, operation, translated);
+}
+async function authenticate(s: S, operation: "signIn" | "register"): Promise<S | undefined> {
+  if (authInFlight) return undefined;
+  const checked = validateAuth(s, operation);
+  if (checked.emailError || checked.passwordError) return checked;
+  authInFlight = true;
+  const revision = editRevision;
+  const password = passwordDraft;
+  try {
+    await svc.beginAuth(); // publish busy before waiting for the network
+    const raw = await dispatch(operation === "signIn" ? "himi.wix.signInDirect" : "himi.wix.registerDirect", {
+      email: s.email.trim(), password,
+      // An opaque host-issued token, never a return route. Native commits it before the
+      // account change can destroy this worker; the replacement does not need this promise.
+      ...(routeInput().authContinuation ? { authContinuation: routeInput().authContinuation } : {}),
+      ...(operation === "register" ? { firstName: s.firstName, lastName: s.lastName } : {}),
+    });
+    rejectResult(raw, operation);
+    if (revision !== editRevision) return derive({ ...svc.getState(), authBusy: false });
+    const next = await probe(svc.getState());
+    if (revision !== editRevision) return derive({ ...svc.getState(), authBusy: false });
+    if (!next.isMember) throw { code: "unknown" };
+    passwordDraft = "";
+    return resumeAfterAuth(completedAuth(next));
+  } catch (error) {
+    return derive({ ...svc.getState(), authBusy: false,
+      message: revision === editRevision ? authFailure(error, operation, translated).reason : "" });
+  } finally { authInFlight = false; }
+}
+
+// Next value of a focus token: never empty once requested, and never a value this worker
+// issued before — one counter for every token, not "previous + 1". A visit reset puts a
+// token back to "" while a pooled form's field may still be mounted; "previous + 1" would
+// then republish a value that field already acted on, and it would ignore the request.
+// A counter rather than Date.now() — deterministic under test, and immune to two focus
+// requests landing inside the same millisecond.
+let focusSeq = 0;
+function bumpToken(_previous: string): string {
+  return String(++focusSeq);
+}
+
+// A token may be cleared ONLY by a transition that unmounts the field it targets, so
+// the two transitions here clear different sets — the whole rule in two constants.
+//
+// A mode switch re-lays-out the card: the name fields (gated on notRegistering) go
+// away, but Email is rendered in ALL three modes and stays mounted. Clearing
+// `emailFocus` here would be a reset-while-mounted: Email's renderer-side "last token
+// I acted on" survives, so the next bump would republish a value it has already seen
+// and ignores — the Last name → Email chain would silently die after one round-trip.
+const NO_FOCUS_MODE_SWITCH = { lastNameFocus: "" };
+
+// Sign-out hides the entire login card (it is gated on isMember), Email included, so
+// here both tokens must go or the re-mounted card auto-focuses Email on logout.
+const NO_FOCUS_ALL = { lastNameFocus: "", emailFocus: "" };
+
+// Every focus token, cleared once the visitor types (see setEmail).
+const TYPED = { ...NO_FOCUS_ALL, passwordFocus: "" };
+
+function authHeadline(s: S, isRegistering: boolean, isRecovering: boolean): { authTitle: string; authBody: string } {
+  if (isRecovering) {
+    return {
+      authTitle: copyParam("storeAccount.authTitleRecovery", "Reset password"),
+      authBody: copyParam("storeAccount.authBodyRecovery", "Enter your member email and we will send a reset link."),
+    };
+  }
+  if (isRegistering) {
+    return {
+      authTitle: copyParam("storeAccount.authTitleRegister", "Create account"),
+      authBody: copyParam("storeAccount.authBodyRegister", "Create a member account to continue — cart, bookings, RSVPs, and memberships stay with you."),
+    };
+  }
+  switch (s.authIntent) {
+    case "join_group":
+      return {
+        authTitle: copyParam("storeAccount.authTitleJoinGroup", "Sign in to join"),
+        authBody: s.authContextName
+          ? copyTemplate("storeAccount.authBodyJoinGroupNamed", "Sign in to join {name}, then we’ll bring you back.", { name: s.authContextName })
+          : copyParam("storeAccount.authBodyJoinGroup", "Sign in to join this group, then we’ll bring you back."),
+      };
+    case "rsvp":
+      return {
+        authTitle: copyParam("storeAccount.authTitleRsvp", "Sign in to RSVP"),
+        authBody: copyParam("storeAccount.authBodyRsvp", "Sign in to RSVP, then we’ll bring you back."),
+      };
+    case "book":
+      return {
+        authTitle: copyParam("storeAccount.authTitleBook", "Sign in to book"),
+        authBody: copyParam("storeAccount.authBodyBook", "Sign in to book this time, then we’ll bring you back."),
+      };
+    case "post":
+      return {
+        authTitle: copyParam("storeAccount.authTitlePost", "Sign in to post"),
+        authBody: copyParam("storeAccount.authBodyPost", "Sign in to join the conversation, then we’ll bring you back."),
+      };
+    default:
+      return {
+        authTitle: copyParam("storeAccount.authTitle", "Welcome"),
+        authBody: copyParam("storeAccount.authBody", "Sign in to continue — cart, bookings, RSVPs, and memberships stay with you."),
+      };
+  }
+}
+
+interface S extends IapRestoreFields {
+  status: "loading" | "ready";
+  isMember: boolean;
+  notMember: boolean;
+  identityLine: string;
+  detailLine: string;
+  memberName: string;
+  memberEmail: string;
+  memberImage: string;
+  memberInitials: string;
+  hasMemberImage: boolean;
+  noMemberImage: boolean;
+  authTitle: string;
+  authBody: string;
+  /** Mid-flow gate intent (`join_group` | `rsvp` | `book` | `post` | ""). */
+  authIntent: string;
+  authContextName: string;
+  returnScreenId: string;
+  returnId: string;
+  returnChannelId: string;
+  /** Show Continue when an already-signed-in member opens Account with a return path.
+   *  A sign-in made here resumes on its own (resumeAfterAuth). */
+  hasReturnPath: boolean;
+  noReturnPath: boolean;
+  returnCta: string;
+  email: string;
+  /** Legacy snapshot slot, always empty. The active form keeps its password in
+   *  transient memory for retry; hydration never restores a persisted secret. */
+  password: string;
+  authBusy: boolean;
+  busyMessage?: string;
+  emailError: string;
+  passwordError: string;
+  passwordFocus: string;
+  firstName: string;
+  lastName: string;
+  // Focus TOKENS (`TextFieldProps.focus_path`), not flags: the bound field focuses
+  // whenever the token becomes a new non-empty value, so a monotonic counter is the
+  // shape — a latched boolean cannot request focus a second time. Every other
+  // transition here goes through derive({...s}), which carries them, and they are
+  // deliberately never reset: re-publishing a token the renderer has already seen
+  // is ignored, which would make the Next key go dead.
+  lastNameFocus: string;
+  emailFocus: string;
+  message: string;
+  isLoading: boolean;
+  notLoading: boolean;
+  isRegistering: boolean;
+  notRegistering: boolean;
+  isRecovering: boolean;
+  notRecovering: boolean;
+  hideSignInChoices: boolean;
+  activityTitle: string;
+  activitySummary: string;
+  activityRows: AccountActivityRow[];
+  activityEmptyText: string;
+  hasActivity: boolean;
+  noActivity: boolean;
+  /** Set once a descriptor asks for the member-account links (appear param
+   *  `memberAccountLinks: "1"`). Only then does the probe read app_info, so a descriptor
+   *  that renders no such link need not declare that capability. */
+  memberAccountLinks: boolean;
+  /** Hides My Addresses where this runtime cannot reach the address book. */
+  noMemberAddresses: boolean;
+  /** Hides My Wallet where this runtime cannot reach saved cards. */
+  noMemberWallet: boolean;
+  /** Set once a descriptor asks for the Restore purchases row (appear param
+   *  `restorePurchases: "1"`). Only then does the worker reach the App Store layer, so a
+   *  descriptor that renders no such row need not declare `iap`. */
+  restorePurchases: boolean;
+  /** Top-bar cart badge, read only once a descriptor asks for it (appear param
+   *  `cartCount: "1"`), so an app with no store never reads a cart. A guest has a
+   *  visitor cart too, so this is read for members and guests alike. */
+  cartCount: number;
+  /** "Hey, guest" / "Hey, <first name>". */
+  greeting: string;
+  /** The member's first name alone. Account puts it after its own translated "Hey,":
+   *  the server translates descriptor copy, never worker copy. */
+  greetingFirstName: string;
+  /** Guest header: hidden for a member and while the first session check runs. */
+  hideGuest: boolean;
+  /** Member header and the Sign out footer: hidden for a guest and while loading. */
+  hideMember: boolean;
+  /** Account only (appear param): the standalone sign-in screen a guest is sent to. */
+  signInScreen: string;
+  /** The standalone sign-in screen itself (appear param `standalone: "1"`). */
+  standalone: boolean;
+  /** Account only (appear param `pollIdentity: "1"`): re-read the session on a timer. */
+  pollIdentity: boolean;
+}
+
+// Restore purchases (App Review 3.1.1) for every vertical the app sells through the App Store. The
+// row shows once purchasing is ready on this host (a bound iOS binary with managed StoreKit), to a
+// guest too: the restore itself asks them to sign in.
+const commerce = createIapCommerce({
+  adapters: [onlineProgramOrders, pricingPlanOrders, ...(storesAppleSalesEnabled() ? [storesProductOrders] : [])],
+  onChange: () => { void svc.restorePublish(); },
+});
+const restore = createIapRestore(commerce, { prefix: "storeAccount", repaint: () => { void svc.restorePublish(); } });
+let commerceEntered = false;
+
+/** The first entry reads readiness and recovers held purchases; later ones reconcile, as on any
+ *  screen that sells. */
+function enterCommerce(): void {
+  void (commerceEntered ? commerce.reconcile() : commerce.start());
+  commerceEntered = true;
+}
+
+function derive(s: S): S {
+  const isRegistering = !!s.isRegistering;
+  const isRecovering = !!s.isRecovering;
+  const hasActivity = s.activityRows.length > 0;
+  // Empty until the screen's copy pack (or a probe) arrives: the boot state is built before
+  // any copy, and its English default would paint first in a translated app.
+  const headline = headingReady ? authHeadline(s, isRegistering, isRecovering) : { authTitle: "", authBody: "" };
+  const hasReturnPath = !!s.isMember && !!s.returnScreenId;
+  const loading = s.status === "loading";
+  const name = s.isMember ? greetingName(s.memberName) : "";
+  return {
+    ...s,
+    greeting: name
+      ? copyTemplate("storeAccount.greetingMember", "Hey, {name}", { name })
+      : copyParam("storeAccount.greetingGuest", "Hey, guest"),
+    greetingFirstName: name,
+    hideGuest: loading || !!s.isMember,
+    hideMember: loading || !s.isMember,
+    password: "",
+    busyMessage: s.authBusy ? translated("auth.feedback.busy") : "",
+    isLoading: s.status === "loading",
+    notLoading: s.status !== "loading",
+    notMember: !s.isMember,
+    isRegistering,
+    notRegistering: !isRegistering,
+    isRecovering,
+    notRecovering: !isRecovering,
+    hideSignInChoices: isRegistering || isRecovering,
+    hasActivity,
+    noActivity: !hasActivity,
+    ...restore.fields(s.restorePurchases && commerce.readiness().status === "ready"),
+    authTitle: headline.authTitle,
+    authBody: headline.authBody,
+    hasReturnPath,
+    noReturnPath: !hasReturnPath,
+    returnCta: s.authIntent === "join_group"
+      ? copyParam("storeAccount.returnJoinGroupCta", "Back to group")
+      : s.authIntent === "rsvp"
+        ? copyParam("storeAccount.returnRsvpCta", "Back to event")
+        : s.authIntent === "post"
+          ? copyParam("storeAccount.returnPostCta", "Back to feed")
+          : copyParam("storeAccount.returnCta", "Continue"),
+  };
+}
+
+function orderEmail(order: WixOrder): string {
+  return (order.buyerInfo?.email || "").toLowerCase();
+}
+
+function itemCount(order: WixOrder): string {
+  const total = (order.lineItems ?? []).reduce((sum, item) => sum + (item.quantity || 1), 0);
+  if (!total) return "";
+  return `${total} ${total === 1 ? "item" : "items"}`;
+}
+
+function orderRow(order: WixOrder): AccountActivityRow {
+  const total = order.priceSummary?.total?.formattedAmount || "";
+  const meta = [fmtDate(order.createdDate), itemCount(order)].filter(Boolean).join(" · ");
+  return {
+    id: order.id || order.number || "order",
+    title: `Order #${order.number || order.id || ""}`.trim(),
+    subtitle: total || "Order total unavailable",
+    meta,
+    status: titleCase(order.fulfillmentStatus || order.paymentStatus) || "Order",
+  };
+}
+
+async function orderRows(memberEmail: string): Promise<AccountActivityRow[]> {
+  if (!memberEmail) return [];
+  const res = await searchOrders({
+    search: {
+      cursorPaging: { limit: 30 },
+      sort: [{ fieldName: "createdDate", order: "DESC" }],
+    },
+  });
+  return (res.orders ?? [])
+    .filter((order) => orderEmail(order) === memberEmail.toLowerCase())
+    .slice(0, 3)
+    .map(orderRow);
+}
+
+/** A failed read keeps the count the badge last showed (`known`): an unreachable cart
+ *  must not read as an emptied one. Before any read succeeds, that is 0 — no badge. */
+async function cartItemCount(known: number): Promise<number> {
+  try {
+    const cart = await getCurrentCart();
+    return (cart.lineItems ?? []).reduce((n, li) => n + (li.quantity ?? 1), 0);
+  } catch {
+    return known;
+  }
+}
+
+async function probe(s: S, arg?: unknown, config: AppearConfig = appearConfig(s, arg)): Promise<S> {
+  memberAccountLinksRequested ||= s.memberAccountLinks || strField(arg, "memberAccountLinks") === "1";
+  // A new visit to the form reads its intent and return path from its own route only: the
+  // last visit's (an abandoned gate) must not be resumed by a plain sign-in.
+  const intent = authIntentFromArg(arg, strField(arg, "standalone") === "1" ? NO_VISIT : s);
+  cartCountRequested ||= strField(arg, "cartCount") === "1";
+  // Beside the profile, not after it: the badge must not add a round trip to the paint.
+  // Not asked for (yet — the boot load runs before the appear params): keep the count the
+  // snapshot restored, not a 0 that would empty the badge until the appear refresh lands.
+  const cartCountRead = cartCountRequested ? cartItemCount(s.cartCount ?? 0) : Promise.resolve(s.cartCount ?? 0);
+  const profile = await loadMemberProfile(copyParam("storeAccount.guestDetail", "Sign in to keep your cart and orders connected."));
+  // Not the boot load: it never carries the copy, and the appear refresh that does is coming.
+  if (strField(arg, "boot") !== "1") headingReady = true;
+  const memberAccountLinks = memberAccountLinksRequested;
+  if (restorePurchasesRequested) enterCommerce();
+  const routes = memberAccountLinks ? await memberAccountRoutes() : { addresses: false, wallet: false };
+  let activityRows: AccountActivityRow[] = [];
+  if (profile.isMember) {
+    try {
+      activityRows = await orderRows(profile.memberEmail);
+    } catch {
+      activityRows = [];
+    }
+  }
+  const cartCount = await cartCountRead;
+  return derive({
+    ...s,
+    ...intent,
+    status: "ready",
+    cartCount,
+    isMember: profile.isMember,
+    identityLine: profile.identityLine,
+    detailLine: profile.detailLine,
+    memberName: profile.memberName,
+    memberEmail: profile.memberEmail,
+    memberImage: profile.memberImage,
+    memberInitials: profile.memberInitials,
+    hasMemberImage: profile.hasMemberImage,
+    noMemberImage: profile.noMemberImage,
+    email: profile.memberEmail || s.email,
+    message: "",
+    memberAccountLinks,
+    ...appearBase(),
+    ...config.mode,
+    ...config.visit,
+    noMemberAddresses: !routes.addresses,
+    noMemberWallet: !routes.wallet,
+    activityRows,
+    activityTitle: copyParam("storeAccount.activityTitle", "Previous orders"),
+    activitySummary: activityRows.length
+      ? `${activityRows.length} recent ${activityRows.length === 1 ? "order" : "orders"}`
+      : copyParam("storeAccount.activityHint", "Orders are loaded from the store."),
+    activityEmptyText: profile.isMember
+      ? copyParam("storeAccount.activityEmptyMember", "No previous orders for this member yet.")
+      : copyParam("storeAccount.activityEmptyGuest", "Sign in to see orders."),
+  });
+}
+
+function completedAuth(s: S): S {
+  return derive({
+    ...s,
+    password: "",
+    authBusy: false, emailError: "", passwordError: "", passwordFocus: "",
+    firstName: "",
+    lastName: "",
+    isRegistering: false,
+    isRecovering: false,
+    message: "",
+  });
+}
+
+const svc = defineService<S, {
+  beginAuth: (s: S) => S;
+  submit: (s: S) => Promise<S | undefined>;
+  load: (s: S, arg?: unknown) => Promise<S>;
+  refresh: (s: S, arg?: unknown) => Promise<S>;
+  setEmail: (s: S, arg?: unknown) => S;
+  setPassword: (s: S, arg?: unknown) => S;
+  setFirstName: (s: S, arg?: unknown) => S;
+  setLastName: (s: S, arg?: unknown) => S;
+  focusLastName: (s: S) => S;
+  focusEmail: (s: S) => S;
+  showRegister: (s: S) => S;
+  showSignIn: (s: S) => S;
+  showRecovery: (s: S) => S;
+  resetPassword: (s: S) => Promise<S>;
+  signIn: (s: S) => Promise<S | undefined>;
+  register: (s: S) => Promise<S | undefined>;
+  signOut: (s: S) => Promise<S>;
+  sync: (s: S) => Promise<S | undefined>;
+  openMember: (s: S, arg?: unknown) => Promise<S>;
+  leave: (s: S) => S;
+  restorePublish: (s: S) => S;
+  iapRestore: (s: S) => Promise<undefined>;
+}>("himiStoreAccount", {
+  notHydrated: ["password", "authBusy", "emailError", "passwordError", "passwordFocus", "lastNameFocus", "emailFocus", ...VISIT_KEYS, ...VISIT_DERIVED_KEYS, ...IAP_RESTORE_KEYS],
+  state: derive({
+    status: "loading",
+    isMember: false,
+    notMember: true,
+    identityLine: "",
+    detailLine: "",
+    memberName: "",
+    memberEmail: "",
+    memberImage: "",
+    memberInitials: "M",
+    hasMemberImage: false,
+    noMemberImage: true,
+    authTitle: "Welcome",
+    authBody: "Sign in to continue — cart, bookings, RSVPs, and memberships stay with you.",
+    authIntent: "",
+    authContextName: "",
+    returnScreenId: "",
+    returnId: "",
+    returnChannelId: "",
+    hasReturnPath: false,
+    noReturnPath: true,
+    returnCta: "Continue",
+    email: "",
+    password: "",
+    authBusy: false, emailError: "", passwordError: "", passwordFocus: "",
+    firstName: "",
+    lastName: "",
+    lastNameFocus: "",
+    emailFocus: "",
+    message: "",
+    isLoading: true,
+    notLoading: false,
+    // The form's first paint is already on its route's mode: only sign-in's route has `mode`.
+    isRegistering: ROUTE_ASKS_REGISTER,
+    notRegistering: true,
+    isRecovering: false,
+    notRecovering: true,
+    hideSignInChoices: false,
+    activityTitle: "Previous orders",
+    activitySummary: "",
+    activityRows: [],
+    activityEmptyText: "No previous orders for this member yet.",
+    hasActivity: false,
+    noActivity: true,
+    memberAccountLinks: false,
+    noMemberAddresses: true,
+    noMemberWallet: true,
+    restorePurchases: false,
+    cartCount: 0,
+    greeting: "Hey, guest",
+    greetingFirstName: "",
+    hideGuest: true,
+    hideMember: true,
+    signInScreen: "",
+    standalone: false,
+    pollIdentity: false,
+    ...NO_IAP_RESTORE,
+  }),
+  actions: {
+    submit: (s): Promise<S | undefined> => s.isRecovering ? svc.resetPassword() : authenticate(s, s.isRegistering ? "register" : "signIn"),
+    beginAuth: (s) => derive({ ...s, authBusy: true, message: "", emailError: "", passwordError: "" }),
+    load: async (s, arg): Promise<S> => { stashScreenCopy(arg); const r = await freshProbe(s, arg); return "next" in r ? settle(r.next, arg, r.latest) : r.latest ? settle(r.kept, arg, true) : r.kept; },
+    refresh: async (s, arg): Promise<S> => { stashScreenCopy(arg); const r = await freshProbe(s, arg); return "next" in r ? settle(r.next, arg, r.latest) : r.latest ? settle(r.kept, arg, true) : r.kept; },
+    // Idle ticks return undefined, so an unchanged session costs no re-render.
+    sync: async (s): Promise<S | undefined> => {
+      if (authInFlight) return undefined;
+      const email = (await signedInEmail()).toLowerCase();
+      // An empty read during a poll is a failed read as often as a sign-out (a network blip,
+      // a 5xx): it never turns a member into a guest. Account's own Sign out, and the next
+      // appear refresh, handle a real sign-out.
+      if (!email && s.isMember) return undefined;
+      if (email === s.memberEmail.toLowerCase() && !!email === s.isMember) return undefined;
+      const r = await freshProbe(s);
+      return "next" in r ? r.next : undefined;
+    },
+    // A row to a member-only screen shows to a guest too. A member opens it; a guest signs
+    // in first, and the sign-in screen then opens the row's screen — as a modal, by closing
+    // and pushing it on this tab (openSignIn) — so Back returns here either way.
+    openMember: async (s, arg): Promise<S> => {
+      const screenId = strField(arg, "screenId");
+      if (!screenId) return s;
+      const member = s.isMember || !!await signedInEmail();
+      // From the state as it is now: a probe may have landed during the identity read.
+      const now = svc.getState();
+      if (member) return navigate(now, { screenId });
+      return openSignIn(now, { mode: "signin" }, { screenId });
+    },
+    // The standalone form's Continue: leaves the form the way it was opened.
+    leave: (s) => navigate(s, { presentation: leaveNav() }),
+    // Typing means any focus request was delivered: clear the tokens (safe while mounted, since
+    // bumpToken never repeats), so a visit rarely ends — and a pooled form rarely reopens —
+    // holding one.
+    // A setter given the value it already has is not an edit: a hidden form's secure field
+    // clears itself on unmount (setPassword("")), and counting that would drop the probe
+    // that is about to move a member off the form.
+    setEmail: (s, arg) => { if (strOf(arg).trim() === s.email) return s; editRevision++; const next = { ...s, ...TYPED, email: strOf(arg).trim(), message: "" }; return derive({ ...next, emailError: s.emailError ? (identityErrors({ email: next.email }, "reset").email ? translated(identityErrors({ email: next.email }, "reset").email!) : "") : "" }); },
+    setPassword: (s, arg) => { if (strOf(arg) === passwordDraft) return s; editRevision++; passwordDraft = strOf(arg); return derive({ ...s, ...TYPED, message: "", passwordError: s.passwordError && !passwordDraft ? translated("auth.validation.passwordRequired") : "" }); },
+    setFirstName: (s, arg) => { if (strOf(arg) === s.firstName) return s; editRevision++; return derive({ ...s, ...TYPED, firstName: strOf(arg), message: "" }); },
+    setLastName: (s, arg) => { if (strOf(arg) === s.lastName) return s; editRevision++; return derive({ ...s, ...TYPED, lastName: strOf(arg), message: "" }); },
+    // The register form's Next keys. Only first/last name carry one: they share a
+    // single visibility gate (notRegistering) so their target is always on screen.
+    // Email deliberately does NOT chain to password — see the comment on the
+    // descriptor: password is hidden while recovering, and submitLabel is static.
+    focusLastName: (s) => derive({ ...s, lastNameFocus: bumpToken(s.lastNameFocus) }),
+    focusEmail: (s) => derive({ ...s, emailFocus: bumpToken(s.emailFocus) }),
+    // A mode switch RE-LAYS-OUT this card, mounting and unmounting fields behind
+    // `hiddenWhen`. A re-mounted field treats its first seed as "focus me on open", so
+    // a carried-over token would drop the user into the MIDDLE of the form — leaving
+    // register and coming back would open focused on Last name, skipping First name.
+    // Only the tokens whose fields actually unmount here are cleared: see
+    // NO_FOCUS_MODE_SWITCH for why Email's is deliberately NOT among them.
+    showRegister: (s) => { if (authInFlight) return s; editRevision++; modeSwitches++; headingReady = true; return derive({ ...s, isRegistering: true, isRecovering: false, message: "", emailError: "", passwordError: "", ...NO_FOCUS_MODE_SWITCH }) },
+    showSignIn: (s) => { if (authInFlight) return s; editRevision++; modeSwitches++; headingReady = true; return derive({ ...s, isRegistering: false, isRecovering: false, message: "", emailError: "", passwordError: "", ...NO_FOCUS_MODE_SWITCH }) },
+    showRecovery: (s) => { if (authInFlight) return s; editRevision++; modeSwitches++; headingReady = true; return derive({ ...s, isRegistering: false, isRecovering: true, password: "", message: "", emailError: "", passwordError: "", ...NO_FOCUS_MODE_SWITCH }) },
+    resetPassword: async (s): Promise<S> => {
+      if (authInFlight) return s;
+      const checked = validateAuth(s, "reset");
+      if (checked.emailError) return checked;
+      authInFlight = true;
+      const revision = editRevision;
+      try {
+        await svc.beginAuth();
+        const raw = await dispatch("himi.wix.resetPassword", { email: s.email.trim() });
+        rejectResult(raw, "reset");
+        if (revision !== editRevision) return derive({ ...svc.getState(), authBusy: false });
+        return derive({ ...svc.getState(), authBusy: false, isRecovering: false,
+          message: copyParam("storeAccount.resetSent", "If that email is registered, a reset link is on its way.") });
+      } catch (error) {
+        return derive({ ...svc.getState(), authBusy: false,
+          message: revision === editRevision ? authFailure(error, "reset", translated).reason : "" });
+      } finally { authInFlight = false; }
+    },
+    signIn: (s) => authenticate(s, "signIn"),
+    register: (s) => authenticate(s, "register"),
+    signOut: async (s): Promise<S> => {
+      if (authInFlight) return svc.getState();
+      passwordDraft = ""; editRevision++;
+      routeInputConsumed = true;
+      try { await dispatch("himi.wix.signOut"); } catch { /* ignore */ }
+      // Do NOT re-probe via getMyData after logout — visitor-scoped my-data can
+      // still return a site nickname and resurrect isMember (BUG-3). Trust the
+      // cleared session and paint the guest form immediately.
+      const guest = guestProfile(copyParam("storeAccount.guestDetail", "Sign in to keep your cart and orders connected."));
+      const cleared = {
+        ...s,
+        ...guest,
+        status: "ready" as const,
+        isMember: false,
+        isRegistering: false,
+        isRecovering: false,
+        message: "",
+        password: "",
+        // Signing out re-mounts the whole login card (it hides behind isMember), so a
+        // carried token would auto-focus Email and pop the keyboard the instant the
+        // user logs out. This is the one transition that unmounts Email too, so unlike
+        // the mode switches it clears BOTH tokens.
+        ...NO_FOCUS_ALL,
+        activityRows: [] as AccountActivityRow[],
+        activityEmptyText: copyParam("storeAccount.activityEmptyGuest", "Sign in to see orders."),
+        authIntent: "",
+        authContextName: "",
+        returnScreenId: "",
+        returnId: "",
+        returnChannelId: "",
+        // The member's cart stays with the member; the new visitor session has its own.
+        cartCount: cartCountRequested ? await cartItemCount(0) : 0,
+        ...(s.pollIdentity ? { _poll: { ...IDENTITY_POLL } } : {}),
+      };
+      return derive(cleared);
+    },
+    restorePublish: (s) => derive(s),
+    iapRestore: async () => { await restore.run(); return undefined; },
+  },
+});
+
+resetUnhydratedKeysOnOlderRuntime(svc, derive({ ...svc.getState(), ...NO_IAP_RESTORE, ...NO_VISIT, ...NO_FOCUS_ALL, passwordFocus: "", isRegistering: ROUTE_ASKS_REGISTER }), [...IAP_RESTORE_KEYS, ...VISIT_KEYS, ...VISIT_DERIVED_KEYS, "lastNameFocus", "emailFocus", "passwordFocus"]);
+// `boot` tells settle this is not a visit: the host drops this call's navigation, and the
+// appear refresh does the visit's moves.
+svc.load({ boot: "1" });
+export { svc };