INSTRUCTIONS

Shipped files

Wire it

1. Keep <MemberMenu client:only="react" /> in the winning site header.
2. Keep the shipped /login route. It is the only login surface; never link to /api/auth/login, build an OAuth callback page, or redirect to Wix login.
3. Keep /account client-gated with <RequireAuth>. A visitor sees a link to /login; a member sees their actual profile.
4. Build your own visual chrome around these shipped components using the site tokens. Do not mock a signed-in member or infer identity from local UI state.

Direct-login contract

• login(email, password) and register(email, password, profile) return all Wix states: SUCCESS, EMAIL_VERIFICATION_REQUIRED, OWNER_APPROVAL_REQUIRED, or FAILURE. The shipped form handles each one.
• A successful state calls getMemberTokensForDirectLogin then setTokens on the same client. It writes Astro’s wixSession cookie, so the next page request and browser islands run later SDK calls as that member.
• No login redirect URI is required for credential login. Password-reset and logout return URLs remain the only optional redirect surfaces.
• The public OAuth client ID is written as WIX_MEMBERS_CLIENT_ID by deploy, even for managed Astro. It is public; never add an OAuth secret to the app.
• Identity needs no Members Area app. Profile data and custom profile fields do; the member seed installs the Members Area app.

Rules

• No Wix-hosted login flow, /api/auth/login, OAuth callback, or callback URI requirement for credential login.
• Keep one explicit custom-members client. Do not instantiate one per component.
• Do not use auth.elevate() for a member reading their own records.
• Surface login failure and the verification/approval states; never silently fall back to anonymous UI.

Verify

• Not done: /login renders an in-app email/password sign-in and sign-up form.
• Not done: A successful sign-in changes the header and unlocks /account without a Wix-hosted login redirect.
• Not done: Email verification and owner approval are rendered as states, not errors.
• Not done: Reload preserves the member session; the next server render also sees it; logout clears it.
• Not done: No mocked member data, redirect-based login, or extra auth client exists.