@wix/himalaya-cli 0.982.0 → 0.984.0

package/fixtures/wix-canned.json

@@ -504,13 +504,23 @@
   },
   "POST /social-groups-proxy/members/v2/groups/grp-0001/members/query": {
     "members": [
-      { "siteMemberId": "mem-0001", "memberId": "mem-0001", "role": "MEMBER" }
+      {
+        "siteMemberId": "mem-0001",
+        "memberId": "mem-0001",
+        "role": "MEMBER"
+      }
     ],
-    "metadata": { "count": 1, "total": 1 }
+    "metadata": {
+      "count": 1,
+      "total": 1
+    }
   },
   "POST /social-groups-proxy/members/v2/groups/grp-0002/members/query": {
     "members": [],
-    "metadata": { "count": 0, "total": 0 }
+    "metadata": {
+      "count": 0,
+      "total": 0
+    }
   },
   "POST /online-programs/v3/programs/query": {
     "programs": [
@@ -677,7 +687,7 @@
       {
         "id": "menu-0001",
         "name": "All Day",
-        "description": "Served 8am–4pm",
+        "description": "Served 8am\u20134pm",
         "visible": true,
         "sectionIds": [
           "sec-0001",
@@ -888,10 +898,10 @@
       {
         "id": "conv-0002",
         "businessDisplayData": {
-          "name": "The Roastery — Wholesale"
+          "name": "The Roastery \u2014 Wholesale"
         },
         "latestMessage": {
-          "previewText": "Thanks — see you Saturday!",
+          "previewText": "Thanks \u2014 see you Saturday!",
           "createdDate": "2026-06-14T16:40:00.000Z"
         },
         "unreadMessageCount": 0
@@ -959,7 +969,7 @@
       },
       {
         "id": "rw-0002",
-        "name": "£5 off brew gear",
+        "name": "\u00a35 off brew gear",
         "active": true,
         "type": "DISCOUNT_AMOUNT",
         "discountAmount": {
@@ -1193,50 +1203,47 @@
       "total": 2
     }
   },
-  "GET /notifications/v1/preferences/topics": {
-    "topics": [
+  "GET /notification-preferences/v1/preferences/topics": {
+    "preferenceDefinitions": [
       {
-        "id": "topic-0001",
+        "topicId": "topic-0001",
         "displayName": "Order updates"
       },
       {
-        "id": "topic-0002",
+        "topicId": "topic-0002",
         "displayName": "New lots"
       },
       {
-        "id": "topic-0003",
+        "topicId": "topic-0003",
         "displayName": "Events"
       }
     ]
   },
-  "GET /notifications/v1/preferences-by-implicit-recipient": {
-    "preferences": {
+  "GET /notification-preferences/v1/preferences-by-implicit-recipient": {
+    "notificationPreferences": {
       "preferencesInfo": [
         {
           "topicId": "topic-0001",
           "channel": "MOBILE",
           "stateData": {
-            "state": {
-              "muteStatus": "UNMUTED"
-            }
+            "state": "UNMUTED",
+            "granted": true
           }
         },
         {
           "topicId": "topic-0002",
           "channel": "MOBILE",
           "stateData": {
-            "state": {
-              "muteStatus": "MUTED"
-            }
+            "state": "MUTED",
+            "granted": false
           }
         },
         {
           "topicId": "topic-0003",
-          "channel": "MOBILE",
+          "channel": "ALL",
           "stateData": {
-            "state": {
-              "muteStatus": "UNMUTED"
-            }
+            "state": "UNMUTED",
+            "granted": true
           }
         }
       ]
@@ -1282,10 +1289,10 @@
         },
         "reactionsList": [
           {
-            "code": "👍"
+            "code": "\ud83d\udc4d"
           },
           {
-            "code": "☕"
+            "code": "\u2615"
           }
         ]
       },
@@ -1295,7 +1302,7 @@
         "content": {
           "blocks": [
             {
-              "text": "Cupping table set for Saturday — six lots."
+              "text": "Cupping table set for Saturday \u2014 six lots."
             }
           ]
         },
@@ -1305,7 +1312,7 @@
         },
         "reactionsList": [
           {
-            "code": "👍"
+            "code": "\ud83d\udc4d"
           }
         ]
       }
@@ -1488,7 +1495,7 @@
       },
       "commentCount": 12,
       "viewCount": 1280,
-      "contentText": "Looking to upgrade from a blade grinder — what's the sweet spot right now?"
+      "contentText": "Looking to upgrade from a blade grinder \u2014 what's the sweet spot right now?"
     }
   },
   "GET /stores/v3/products/prod-0001": {

package/guides/sdk-reference.json

@@ -19042,109 +19042,146 @@
     "source": "stdlib/wix-sdk/notification-preferences/src/index.ts",
     "description": "Notification preferences",
     "api": [
+      {
+        "name": "NOTIFICATION_PREFERENCES_BASE",
+        "kind": "const",
+        "jsdoc": "/**\n * The service's own mount, from the published swagger `host`\n * (\"www.wixapis.com/notification-preferences\") — the PATH half of it.\n *\n * Relative, not absolute: the `wixApi` bridge supplies the gateway host. Baking one in\n * works on a phone and is rejected in a browser (`400 absolute_urls_not_allowed`), so a\n * client that spells the host works in one place and not the other. What was wrong\n * before was the mount (`/notifications`), not the host.\n */",
+        "decl": "export const NOTIFICATION_PREFERENCES_BASE = \"/notification-preferences/v1\";"
+      },
+      {
+        "name": "PreferenceState",
+        "kind": "type",
+        "jsdoc": "/** `enum State` on `StateData`. A scalar, not an object. */",
+        "decl": "export type PreferenceState = \"MUTED\" | \"UNMUTED\" | string;"
+      },
       {
         "name": "MuteStatus",
         "kind": "type",
-        "jsdoc": "/** \"MUTED\" silences the topic on this channel; \"UNMUTED\" delivers it. */",
-        "decl": "export type MuteStatus = \"MUTED\" | \"UNMUTED\";",
-        "verified": false
+        "jsdoc": "/** Kept as the name the callers already use for the value they write. */",
+        "decl": "export type MuteStatus = \"MUTED\" | \"UNMUTED\";"
       },
       {
         "name": "Channel",
         "kind": "type",
-        "jsdoc": "/** Delivery channel. The mobile push channel value is unconfirmed; \"MOBILE\" is\n *  the working default the bundle passes. */",
-        "decl": "export type Channel = \"MOBILE\" | string;",
-        "verified": false
+        "jsdoc": "/** `enum Channel { UNKNOWN_CHANNEL, ALL, MOBILE, EMAIL, SMS, VOICE, BROWSER, WEB_FEED }`.\n *  `ALL` is real and covers mobile too — filtering it out hides preferences that do\n *  apply on this surface. */",
+        "decl": "export type Channel = \"ALL\" | \"MOBILE\" | \"EMAIL\" | \"SMS\" | \"VOICE\" | \"BROWSER\" | \"WEB_FEED\" | string;"
       },
       {
-        "name": "PreferenceState",
-        "kind": "interface",
+        "name": "RecipientType",
+        "kind": "type",
         "jsdoc": "",
-        "decl": "export interface PreferenceState {\n  /** \"MUTED\" | \"UNMUTED\" — whether the topic is delivered on this channel. */\n  muteStatus?: MuteStatus;\n}",
-        "verified": false
+        "decl": "export type RecipientType = \"WIX_USER\" | \"CONTACT\";"
       },
       {
-        "name": "PreferenceStateData",
+        "name": "StateData",
         "kind": "interface",
-        "jsdoc": "",
-        "decl": "export interface PreferenceStateData {\n  state?: PreferenceState;\n}",
-        "verified": false
+        "jsdoc": "/** `message StateData`. `granted` and `overridden` are read-only server verdicts. */",
+        "decl": "export interface StateData {\n  /** The state the recipient asked for. */\n  state?: PreferenceState;\n  /** Whether the notification is granted to be SENT. An UNMUTED topic under a muted\n   *  channel is `granted: false` — i.e. the row must not render ON. */\n  granted?: boolean;\n  /** Whether a broader rule overrides this row, so it cannot be changed here. */\n  overridden?: boolean;\n  displayName?: string;\n}"
       },
       {
         "name": "PreferenceInfo",
         "kind": "interface",
-        "jsdoc": "/** One topic×channel preference for the implicit recipient. */",
-        "decl": "export interface PreferenceInfo {\n  /** The notification topic id (matches NotificationTopic.id). */\n  topicId: string;\n  /** Delivery channel this preference applies to (e.g. \"MOBILE\"). */\n  channel?: Channel;\n  stateData?: PreferenceStateData;\n}",
-        "verified": false
+        "jsdoc": "/** `message PreferenceInfo` — one topic×channel preference. */",
+        "decl": "export interface PreferenceInfo {\n  topicId: string;\n  channel?: Channel;\n  stateData?: StateData;\n  topicType?: string;\n}"
       },
       {
         "name": "NotificationPreferences",
         "kind": "interface",
-        "jsdoc": "",
-        "decl": "export interface NotificationPreferences {\n  preferencesInfo?: PreferenceInfo[];\n}",
-        "verified": false
+        "jsdoc": "/** `message NotificationPreferences`. */",
+        "decl": "export interface NotificationPreferences {\n  preferencesInfo?: PreferenceInfo[];\n}"
       },
       {
         "name": "GetMyNotificationPreferencesResponse",
         "kind": "interface",
+        "jsdoc": "/** `GetPreferencesBy{Implicit,}RecipientResponse` uses `notification_preferences`;\n *  `UpsertPreferencesBy{Implicit,}RecipientResponse` uses `preferences`. Both are\n *  declared so a caller cannot read the wrong one by accident. */",
+        "decl": "export interface GetMyNotificationPreferencesResponse {\n  notificationPreferences?: NotificationPreferences;\n}"
+      },
+      {
+        "name": "UpsertMyNotificationPreferencesResponse",
+        "kind": "interface",
         "jsdoc": "",
-        "decl": "export interface GetMyNotificationPreferencesResponse {\n  preferences?: NotificationPreferences;\n}",
-        "verified": false
+        "decl": "export interface UpsertMyNotificationPreferencesResponse {\n  preferences?: NotificationPreferences;\n}"
       },
       {
-        "name": "NotificationTopic",
+        "name": "NotificationTopicDefinition",
         "kind": "interface",
-        "jsdoc": "/** A notification topic — its id is the PreferenceInfo.topicId; displayName is\n *  the row label shown in the UI. */",
-        "decl": "export interface NotificationTopic {\n  id: string;\n  displayName?: string;\n}",
-        "verified": false
+        "jsdoc": "/** `message NotificationTopicDefinition`. */",
+        "decl": "export interface NotificationTopicDefinition {\n  topicId: string;\n  displayName?: string;\n  state?: PreferenceState;\n  topicType?: string;\n}"
       },
       {
         "name": "GetNotificationTopicsResponse",
         "kind": "interface",
-        "jsdoc": "",
-        "decl": "export interface GetNotificationTopicsResponse {\n  topics?: NotificationTopic[];\n}",
-        "verified": false
+        "jsdoc": "/** `GetNotificationTopicsDefinitionsResponse.preference_definitions`. */",
+        "decl": "export interface GetNotificationTopicsResponse {\n  preferenceDefinitions?: NotificationTopicDefinition[];\n}"
       },
       {
-        "name": "UpsertMyNotificationPreferencesRequest",
-        "kind": "interface",
-        "jsdoc": "",
-        "decl": "export interface UpsertMyNotificationPreferencesRequest {\n  preferencesInfo: PreferenceInfo[];\n}",
-        "verified": false
+        "name": "readTopics",
+        "kind": "function",
+        "jsdoc": "/** The topic list, or empty when the response carried none. */",
+        "decl": "export function readTopics(res: GetNotificationTopicsResponse | undefined): NotificationTopicDefinition[];"
       },
       {
-        "name": "UpsertMyNotificationPreferencesResponse",
-        "kind": "interface",
-        "jsdoc": "",
-        "decl": "export interface UpsertMyNotificationPreferencesResponse {\n  preferences?: NotificationPreferences;\n}",
-        "verified": false
+        "name": "readPreferences",
+        "kind": "function",
+        "jsdoc": "/** The preference rows out of EITHER response shape (see the asymmetry note above). */",
+        "decl": "export function readPreferences(\n  res: GetMyNotificationPreferencesResponse | UpsertMyNotificationPreferencesResponse | undefined,\n): PreferenceInfo[];"
       },
       {
         "name": "muteStatusFor",
         "kind": "function",
-        "jsdoc": "/** Map a UI \"on\" boolean to a MuteStatus: on ⇒ delivered (\"UNMUTED\"). */",
-        "decl": "export function muteStatusFor(on: boolean): MuteStatus;",
-        "verified": false
+        "jsdoc": "/** Map a UI \"on\" boolean to the state to WRITE: on ⇒ delivered (\"UNMUTED\"). */",
+        "decl": "export function muteStatusFor(on: boolean): MuteStatus;"
       },
       {
-        "name": "getMyNotificationPreferences",
+        "name": "isDeliveredNow",
         "kind": "function",
-        "jsdoc": "/** Get the signed-in member's notification preferences —\n *  GET /notifications/v1/preferences-by-implicit-recipient. */",
-        "decl": "export function getMyNotificationPreferences(): Promise<GetMyNotificationPreferencesResponse>;",
-        "verified": false
+        "jsdoc": "/**\n * Whether this row is actually being delivered right now.\n *\n * `granted` is the server's verdict and beats `state`: a topic the recipient unmuted\n * under a channel they muted is `state: \"UNMUTED\", granted: false`. Rendering `state`\n * alone shows ON for a notification that will never arrive.\n */",
+        "decl": "export function isDeliveredNow(stateData: StateData | undefined): boolean;"
+      },
+      {
+        "name": "isLocked",
+        "kind": "function",
+        "jsdoc": "/** Whether a broader rule overrides this row, so the UI must not offer to change it. */",
+        "decl": "export function isLocked(stateData: StateData | undefined): boolean;"
+      },
+      {
+        "name": "preferenceFor",
+        "kind": "function",
+        "jsdoc": "/**\n * The one preference row that governs `topicId` on `channel`, or undefined when the\n * recipient has no row for it (⇒ the topic's default, which is delivery).\n *\n * A topic can carry SEVERAL rows — one per channel, plus a channel-wide `ALL` — and\n * the response order is not specified. Picking with a bare `find` therefore rendered\n * whichever row the service happened to list first, so a mobile switch could show an\n * EMAIL preference, and a MOBILE + ALL pair flipped meaning between two identical\n * reads. Resolved by SPECIFICITY instead: the exact channel wins, then `ALL`, then a\n * row that names no channel at all.\n */",
+        "decl": "export function preferenceFor(\n  topicId: string,\n  prefs: readonly PreferenceInfo[],\n  channel: Channel = \"MOBILE\",\n): PreferenceInfo | undefined;"
+      },
+      {
+        "name": "deliveredByTopic",
+        "kind": "function",
+        "jsdoc": "/**\n * Per-topic \"is this actually being delivered on `channel`\" verdicts.\n *\n * A topic with no row is absent from the map, not false: absent means \"the topic's\n * own default\", which the caller renders as ON.\n */",
+        "decl": "export function deliveredByTopic(\n  prefs: readonly PreferenceInfo[],\n  channel: Channel = \"MOBILE\",\n): Record<string, boolean>;"
       },
       {
         "name": "getNotificationTopics",
         "kind": "function",
-        "jsdoc": "/** List the available notification topics (id + displayName for labels) —\n *  GET /notifications/v1/preferences/topics. */",
+        "jsdoc": "/** List the site's notification topics — `GET /v1/preferences/topics`\n *  (GetNotificationTopicsDefinitions). Publicly mounted.\n *  verify-live: source contract checked; live caller authorization remains untested. */",
         "decl": "export function getNotificationTopics(): Promise<GetNotificationTopicsResponse>;",
         "verified": false
       },
+      {
+        "name": "getPreferencesForRecipient",
+        "kind": "function",
+        "jsdoc": "/**\n * The PUBLICLY mounted preferences read — `GET /v1/preferences`\n * (GetPreferencesByRecipient). It needs the recipient explicitly: `CONTACT` + a\n * contactId for a member, `WIX_USER` + a wixUserId for an owner.\n *\n * Prefer this from an app going through the public gateway; the implicit-recipient\n * variant below is not among the five paths the swagger exposes.\n * verify-live: source contract checked; live caller authorization remains untested.\n */",
+        "decl": "export function getPreferencesForRecipient(recipient: {\n  recipientType: RecipientType;\n  contactId?: string;\n  wixUserId?: string;\n  language?: string;\n}): Promise<GetMyNotificationPreferencesResponse>;",
+        "verified": false
+      },
+      {
+        "name": "getMyNotificationPreferences",
+        "kind": "function",
+        "jsdoc": "/** The signed-in recipient's preferences — `GET /v1/preferences-by-implicit-recipient`\n *  (GetPreferencesByImplicitRecipient). NOT in the published public swagger; a 404 from\n *  the public gateway is the expected outcome there, not a bug in this call.\n *  verify-live: the implicit-recipient mount has not been verified for member callers. */",
+        "decl": "export function getMyNotificationPreferences(): Promise<GetMyNotificationPreferencesResponse>;",
+        "verified": false
+      },
       {
         "name": "upsertMyNotificationPreferences",
         "kind": "function",
-        "jsdoc": "/** Upsert one or more of the signed-in member's preferences —\n *  POST /notifications/v1/preferences-by-implicit-recipient, body\n *  { preferencesInfo }. Pass only the rows that changed. */",
-        "decl": "export function upsertMyNotificationPreferences(\n  preferencesInfo: PreferenceInfo[]\n): Promise<UpsertMyNotificationPreferencesResponse>;",
+        "jsdoc": "/** Upsert some of the signed-in recipient's preferences —\n *  `POST /v1/preferences-by-implicit-recipient` (UpsertPreferencesByImplicitRecipient),\n *  body `{ preferencesInfo }`. Pass only the rows that changed.\n *  verify-live: the implicit-recipient mount has not been verified for member callers. */",
+        "decl": "export function upsertMyNotificationPreferences(\n  preferencesInfo: PreferenceInfo[],\n): Promise<UpsertMyNotificationPreferencesResponse>;",
         "verified": false
       }
     ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.982.0",
+  "version": "0.984.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -43,6 +43,7 @@
     "quickjs-emscripten": "^0.32.0",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",
+    "tough-cookie": "^6.0.1",
     "typescript": "^5.6.3",
     "wawoff2": "^2.0.1"
   },
@@ -64,5 +65,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "2148a718160adaaf2dd1bf36a397e2015e080ba32885973148deee70"
+  "falconPackageHash": "e36ec2c01ec4bdda409b35153adfc3c768ee3d817a44b697dd584dda"
 }

package/templates/beauty-salon/dev/index.ts

@@ -9201,7 +9201,8 @@ const SCREENS = runtimeSetting({
                           "action": {
                             "actionId": "himi.open",
                             "params": {
-                              "screenId": "himi_account"
+                              "screenId": "himi_account",
+                              "returnScreenId": "himi_orders"
                             }
                           }
                         }
@@ -14352,7 +14353,8 @@ const SCREENS = runtimeSetting({
                                   "action": {
                                     "actionId": "himi.open",
                                     "params": {
-                                      "screenId": "himi_account"
+                                      "screenId": "himi_account",
+                                      "returnScreenId": "himi_bookings"
                                     }
                                   }
                                 }
@@ -23909,6 +23911,29 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
                 },
                 "hiddenPath": "$service:himiBrandedOrder.noEmpty"
               }
+            },
+            {
+              "id": "himi_order.signin",
+              "body": {
+                "package": "himalaya",
+                "type": "Button",
+                "props": {
+                  "title": "Sign in",
+                  "style": "primary",
+                  "fullWidth": true,
+                  "action": {
+                    "actionId": "himi.open",
+                    "params": {
+                      "screenId": "himi_account",
+                      "returnScreenId": "himi_order",
+                      "returnId": "$service:himiBrandedOrder.id"
+                    }
+                  }
+                }
+              },
+              "modifiers": {
+                "hiddenPath": "$service:himiBrandedOrder.noSignIn"
+              }
             }
           ]
         }

package/templates/beauty-salon/tier5-src/himi-branded-lite-order/index.ts

@@ -63,6 +63,10 @@ interface State extends LiveSessionFields {
   cannotReorder: boolean;
   reorderMessage: string;
   emptyText: string;
+  /** No member session is what stands between the visitor and this order — drives the
+   *  sign-in CTA, which returns here with `id` once the member has signed in. */
+  needsSignIn: boolean;
+  noSignIn: boolean;
   isLoading: boolean;
   notLoading: boolean;
   isErrored: boolean;
@@ -180,6 +184,7 @@ function derive(state: State): State {
     isErrored: state.status === "error",
     notErrored: state.status !== "error",
     noEmpty: state.status !== "ready" || hasContent,
+    noSignIn: !state.needsSignIn,
     hideContent: !hasContent,
     hasShipping: !!state.shipping,
     noShipping: !state.shipping,
@@ -249,7 +254,7 @@ function orderState(order: WixOrder): Partial<State> {
 let loadVersion = 0;
 let loadedMember: OrderMember | undefined;
 function clearOrder(state: State): State {
-  return derive({ ...state, title: "", placedAt: "", fulfillmentStatus: "", paymentStatus: "", subtotal: "", shipping: "", tax: "", discount: "", total: "", rows: [], reorderRefs: [], reorderMessage: "", emptyText: "" });
+  return derive({ ...state, title: "", placedAt: "", fulfillmentStatus: "", paymentStatus: "", subtotal: "", shipping: "", tax: "", discount: "", total: "", rows: [], reorderRefs: [], reorderMessage: "", emptyText: "", needsSignIn: false });
 }
 async function load(state: State, arg?: unknown): Promise<State | undefined> {
   const version = ++loadVersion;
@@ -259,9 +264,10 @@ async function load(state: State, arg?: unknown): Promise<State | undefined> {
   const finish = (next: State) => version === loadVersion ? derive(next) : undefined;
   const id = inputId();
   const member = await orderMember();
-  if (!id || !member.email) {
-    return finish({ ...state, status: "ready", emptyText: member.email ? copyParam("order.notFoundEmptyText", "Order not found.") : copyParam("order.signInEmptyText", "Sign in to view this order.") });
-  }
+  const signInText = copyParam("order.signInEmptyText", "Sign in to view this order.");
+  if (!id) return finish({ ...state, status: "ready", emptyText: member.email ? copyParam("order.notFoundEmptyText", "Order not found.") : signInText });
+  const signInRequired = (status: State["status"]) => finish({ ...state, id, status, needsSignIn: true, emptyText: signInText });
+  if (!member.email) return signInRequired("ready");
   try {
     const order = await findOwnedOrder(id, member.email);
     await assertOrderMember(member);
@@ -272,11 +278,11 @@ async function load(state: State, arg?: unknown): Promise<State | undefined> {
   } catch (error) {
     if (version !== loadVersion) return undefined;
     try { await assertOrderMember(member); } catch {
-      return finish({ ...state, status: "error", emptyText: copyParam("order.signInEmptyText", "Sign in to view this order.") });
+      return signInRequired("error");
     }
     const cached = orderAccessDenied(error) ? null : await readCachedOrder(id, member);
     try { await assertOrderMember(member); } catch {
-      return finish({ ...state, status: "error", emptyText: copyParam("order.signInEmptyText", "Sign in to view this order.") });
+      return signInRequired("error");
     }
     if (cached) {
       return finish({ ...state, status: "ready", title: String(cached.title ?? "") || copyTemplate("order.orderTitle", "Order #{number}", { number: id }),
@@ -326,6 +332,8 @@ const svc = defineService<State, {
     cannotReorder: true,
     reorderMessage: "",
     emptyText: "",
+    needsSignIn: false,
+    noSignIn: true,
     isLoading: true,
     notLoading: false,
     isErrored: false,

package/templates/beauty-salon/tier5-src/himi-store-account/index.ts

@@ -8,7 +8,7 @@
 // `wix-site-id` header and nothing else, so every read stayed on the baked site while the
 // UI claimed otherwise. Managing several businesses is Owner Lite's job (account auth, a
 // real Sites List, and per-call site scope via `site.forSite`).
-import { defineService } from "@himalaya/state";
+import { defineService, navigate, type NavDirective } from "@himalaya/state";
 import { dispatch } from "@himalaya/dispatch";
 import { searchOrders, type WixOrder } from "@himalaya/wix-ecom";
 import { guestProfile, loadMemberProfile, strOf, fmtDate, titleCase, type AccountActivityRow } from "../_shared/himi-account";
@@ -21,6 +21,9 @@ interface AuthRouteInput {
   returnId?: string;
 }
 
+// The screen's boot input survives refresh; consuming it must survive too.
+let routeInputConsumed = false;
+
 /** Mid-flow open params land on `himalaya.input` (paramKeys on himi_account). */
 function routeInput(): AuthRouteInput {
   const input = (globalThis as { himalaya?: { input?: AuthRouteInput } }).himalaya?.input;
@@ -35,7 +38,7 @@ function strField(arg: unknown, key: string): string {
 
 /** Mid-flow auth (UX F3): intent + return path from himi.open / himalaya.input. */
 function authIntentFromArg(arg: unknown, prev: Pick<S, "authIntent" | "authContextName" | "returnScreenId" | "returnId">): Pick<S, "authIntent" | "authContextName" | "returnScreenId" | "returnId"> {
-  const route = routeInput();
+  const route = routeInputConsumed ? {} : routeInput();
   return {
     authIntent: strField(arg, "intent") || route.intent || prev.authIntent || "",
     authContextName: strField(arg, "contextName") || route.contextName || prev.authContextName || "",
@@ -44,6 +47,42 @@ function authIntentFromArg(arg: unknown, prev: Pick<S, "authIntent" | "authConte
   };
 }
 
+/** Where a successful sign-in returns to, or null. Never Account itself — that would
+ *  only push a second copy of the screen the member is already on. */
+function resumeTarget(s: Pick<S, "returnScreenId" | "returnId">): NavDirective | null {
+  if (!s.returnScreenId || s.returnScreenId === "himi_account") return null;
+  return s.returnId ? { screenId: s.returnScreenId, args: { id: s.returnId } } : { screenId: s.returnScreenId };
+}
+
+/** Resume the member-only screen that sent the visitor here, once. The return path is
+ *  consumed so a later refresh cannot fire it again; the host opens the target only if
+ *  it is linkable, the same check an authored `himi.open` gets. */
+function resumeAfterAuth(next: S): S {
+  const target = resumeTarget(next);
+  if (!next.isMember || !target) return next;
+  routeInputConsumed = true;
+  return navigate(derive({ ...next, authIntent: "", authContextName: "", returnScreenId: "", returnId: "" }), target);
+}
+
+// Actions are not serialized: two quick Sign in taps both run against the pre-tap
+// state, so without this both would submit credentials and both would resume.
+let authInFlight = false;
+
+async function authenticate(s: S, submit: () => Promise<unknown>, notMemberMessage: string, failedMessage: string): Promise<S | undefined> {
+  if (authInFlight) return undefined;
+  authInFlight = true;
+  try {
+    await submit();
+    const next = await probe(optimisticMember(s, s.email));
+    if (!next.isMember) return derive({ ...next, message: notMemberMessage });
+    return resumeAfterAuth(derive({ ...next, message: "" }));
+  } catch {
+    return derive({ ...s, message: failedMessage });
+  } finally {
+    authInFlight = false;
+  }
+}
+
 // Next value of a focus token: monotonic, and never empty once requested. A counter
 // rather than Date.now() — deterministic under test, and immune to two focus
 // requests landing inside the same millisecond.
@@ -123,7 +162,8 @@ interface S {
   authContextName: string;
   returnScreenId: string;
   returnId: string;
-  /** Show Continue after a successful mid-flow sign-in. */
+  /** Show Continue when an already-signed-in member opens Account with a return path.
+   *  A sign-in made here resumes on its own (resumeAfterAuth). */
   hasReturnPath: boolean;
   noReturnPath: boolean;
   returnCta: string;
@@ -296,8 +336,8 @@ const svc = defineService<S, {
   showSignIn: (s: S) => S;
   showRecovery: (s: S) => S;
   resetPassword: (s: S) => Promise<S>;
-  signIn: (s: S) => Promise<S>;
-  register: (s: S) => Promise<S>;
+  signIn: (s: S) => Promise<S | undefined>;
+  register: (s: S) => Promise<S | undefined>;
   signOut: (s: S) => Promise<S>;
 }>("himiStoreAccount", {
   state: derive({
@@ -381,30 +421,29 @@ const svc = defineService<S, {
     },
     signIn: async (s) => {
       if (!s.email || !s.password) return derive({ ...s, message: copyParam("storeAccount.validationEmailPassword", "Enter your email and password.") });
-      try {
-        await dispatch("himi.wix.signInDirect", { email: s.email, password: s.password });
-        const next = await probe(optimisticMember(s, s.email));
-        return derive({ ...next, message: next.isMember ? "" : copyParam("storeAccount.signInCheckDetails", "Sign in failed. Check your details.") });
-      } catch {
-        return derive({ ...s, message: copyParam("storeAccount.signInFailed", "Sign in failed. Try again.") });
-      }
+      return authenticate(
+        s,
+        () => dispatch("himi.wix.signInDirect", { email: s.email, password: s.password }),
+        copyParam("storeAccount.signInCheckDetails", "Sign in failed. Check your details."),
+        copyParam("storeAccount.signInFailed", "Sign in failed. Try again."),
+      );
     },
     register: async (s) => {
       if (!s.email || !s.password) return derive({ ...s, message: copyParam("storeAccount.validationEmailPassword", "Enter your email and password.") });
-      try {
-        await dispatch("himi.wix.registerDirect", {
+      return authenticate(
+        s,
+        () => dispatch("himi.wix.registerDirect", {
           email: s.email,
           password: s.password,
           firstName: s.firstName,
           lastName: s.lastName,
-        });
-        const next = await probe(optimisticMember(s, s.email));
-        return derive({ ...next, message: next.isMember ? "" : copyParam("storeAccount.registerTrySignIn", "Account creation failed. Try signing in.") });
-      } catch {
-        return derive({ ...s, message: copyParam("storeAccount.registerFailed", "Account creation failed. Try another email.") });
-      }
+        }),
+        copyParam("storeAccount.registerTrySignIn", "Account creation failed. Try signing in."),
+        copyParam("storeAccount.registerFailed", "Account creation failed. Try another email."),
+      );
     },
     signOut: async (s) => {
+      routeInputConsumed = true;
       try { await dispatch("himi.wix.signOut"); } catch { /* ignore */ }
       // Do NOT re-probe via getMyData after logout — visitor-scoped my-data can
       // still return a site nickname and resurrect isMember (BUG-3). Trust the