@wix/himalaya-cli 0.1178.0 → 0.1179.0

package/templates/nonprofit-cause-owner/tier5-src/_shared/owner-editor-value.ts

@@ -8,7 +8,7 @@
 // drops nodes the owner never touched).
 // Inside the platform source this import is a relative path, so node test runs resolve it; an app's
 // copy imports "@himalaya/wix-rich-content".
-import { parseRicosJson, isPlainRicos, RICH_CONTENT_LIMITS, type RicosDocument } from "@himalaya/wix-rich-content";
+import { parseRicosJson, isPlainRicos, richContentOverLimits, type RicosDocument } from "@himalaya/wix-rich-content";
 
 export type EditorValue =
   | { kind: "absent" }                                  // leave the stored body untouched
@@ -17,34 +17,6 @@ export type EditorValue =
   | { kind: "too_large" }                               // past the rich-content limits: save the rest, say why
   | { kind: "invalid" };                                // not a Ricos document: refuse, write nothing
 
-function utf8Bytes(s: string): number {
-  let n = 0;
-  for (let i = 0; i < s.length; i++) {
-    const c = s.charCodeAt(i);
-    if (c < 0x80) n += 1;
-    else if (c < 0x800) n += 2;
-    else if (c >= 0xd800 && c <= 0xdbff && i + 1 < s.length) { n += 4; i++; }
-    else n += 3;
-  }
-  return n;
-}
-
-/** Every viewer renders a body past the rich-content limits as its fallback, so it is never written.
- *  The viewer's order: bytes (before parsing), then depth, then the node count. */
-function overLimits(doc: RicosDocument): boolean {
-  let count = 0;
-  const work: Array<[unknown, number]> = doc.nodes.map((n) => [n, 1] as [unknown, number]);
-  while (work.length) {
-    const [n, depth] = work.pop()!;
-    if (!n || typeof n !== "object" || Array.isArray(n)) continue;
-    if (depth > RICH_CONTENT_LIMITS.maxDepth) return true;
-    if (++count > RICH_CONTENT_LIMITS.maxNodes) return true;
-    const kids = (n as { nodes?: unknown }).nodes;
-    if (Array.isArray(kids)) for (const k of kids) work.push([k, depth + 1]);
-  }
-  return false;
-}
-
 const TEXT_ONLY = new Set(["PARAGRAPH", "TEXT", "HEADING", "BULLETED_LIST", "ORDERED_LIST", "LIST_ITEM", "BLOCKQUOTE", "CODE_BLOCK"]);
 /** No visible text and no non-text node (an image, a divider, an embed…): an empty body. */
 export function isEmptyDocument(doc: RicosDocument): boolean {
@@ -55,10 +27,12 @@ export function isEmptyDocument(doc: RicosDocument): boolean {
 
 /** A Ricos JSON string checked as every viewer would: the limits first, then the shape. */
 function checkedDocument(raw: string): EditorValue {
-  if (utf8Bytes(raw) > RICH_CONTENT_LIMITS.maxBytes) return { kind: "too_large" };
+  // Every viewer renders a body past the limits as its fallback, so it is never written. One parse
+  // feeds both checks; a string past the byte limit is refused before it is parsed at all.
+  if (richContentOverLimits(raw, null) === "too_large") return { kind: "too_large" };
   const doc = parseRicosJson(raw);
   if (!doc) return { kind: "invalid" };
-  return overLimits(doc) ? { kind: "too_large" } : { kind: "doc", doc, json: raw };
+  return richContentOverLimits(raw, doc) ? { kind: "too_large" } : { kind: "doc", doc, json: raw };
 }
 
 /** `raw` is `values[name]`; `seededJson` is the string the form published as the editor's seed. */
@@ -108,15 +82,59 @@ export function cachedRichVerdict(doc: RicosDocument | null, knownPlain: boolean
   return knownPlain ? "false" : "true";
 }
 
-/** Cold boot: the runtime lays this service's last persisted snapshot over its declared state, so the
- *  editor's first seed would be the document as it was when the screen last ran — and a Save after
- *  typing would write it over whatever the record holds now. Blank the hydrated seed and reset the gate
- *  before anything renders, in place (no action has run yet). `extra` resets further UI state. */
-export function resetHydratedEditor(svc: unknown, keys: { json: string; pending: string; dirty: string }, pendingAtBoot: boolean, extra: Record<string, unknown> = {}): void {
+/** The keys of one editor field that describe THIS run, never the last one: the seed (`<key>Json`),
+ *  the load gate (`<key>Pending`), the edit flag (`<key>Dirty`) and its counter (`<key>Edits`). A form
+ *  lists them in `defineService(name, { notHydrated })`, so a cold boot takes their DECLARED values: the
+ *  editor seeds once, and a persisted seed would be painted as its content and saved back over a newer
+ *  record. */
+export function editorRunKeys<K extends string>(key: K): [`${K}Json`, `${K}Pending`, `${K}Dirty`, `${K}Edits`] {
+  return [`${key}Json`, `${key}Pending`, `${key}Dirty`, `${key}Edits`];
+}
+
+/** The same keys on a runtime that ignores `notHydrated` (a binary from before #3644, still served new
+ *  bundles over the air): reset them in place, before any action runs. A no-op where the runtime
+ *  honours the option (`himalaya.hydrationOptOut`). */
+export function resetHydratedEditorOnOlderRuntime(svc: unknown, key: string, pendingAtBoot: boolean, extra: Record<string, unknown> = {}): void {
+  if ((globalThis as { himalaya?: { hydrationOptOut?: unknown } }).himalaya?.hydrationOptOut === true) return;
   const booted = (svc as { getState?: () => Record<string, unknown> | undefined }).getState?.();
   if (!booted || typeof booted !== "object") return;
-  if (booted[keys.json]) booted[keys.json] = "";
-  booted[keys.pending] = pendingAtBoot;
-  booted[keys.dirty] = false;
+  if (booted[`${key}Json`]) booted[`${key}Json`] = "";
+  booted[`${key}Pending`] = pendingAtBoot;
+  booted[`${key}Dirty`] = false;
+  booted[`${key}Edits`] = 0;
   Object.assign(booted, extra);
 }
+
+/** What an awaited save leaves the field as, read from the LIVE state when it lands. An on_change that
+ *  arrived while the save was in flight (`<key>Edits` moved) is an edit the save did not write: the
+ *  field stays dirty and the save's confirmation is stale. Otherwise a save that wrote the field
+ *  re-bases it as saved. `live` is the service's state now (none, or one that never moved: the start state). */
+export function editorAfterSave(key: string, start: Record<string, unknown>, live: Record<string, unknown> | undefined, wrote: boolean):
+  { dirty: boolean; edits: number; editedDuringSave: boolean } {
+  const atStart = Number(start[`${key}Edits`] ?? 0);
+  const now = Number(live?.[`${key}Edits`] ?? atStart);
+  // Only a counter that MOVED ON counts; one behind the start is a host that does not apply results.
+  const editedDuringSave = now > atStart;
+  return editedDuringSave
+    ? { dirty: true, edits: now, editedDuringSave }
+    : { dirty: wrote ? false : Boolean(start[`${key}Dirty`]), edits: atStart, editedDuringSave };
+}
+
+/** The live state of a service handle, when the runtime gives one. */
+export function liveState(svc: unknown): Record<string, unknown> | undefined {
+  const st = (svc as { getState?: () => unknown } | undefined)?.getState?.();
+  return st && typeof st === "object" ? st as Record<string, unknown> : undefined;
+}
+
+/** An awaited action's result, laid over the LIVE state: only the keys the action CHANGED (against the
+ *  state it started from) are written, so anything the owner did while it awaited — an edit, a field in
+ *  the details sheet, closing the sheet — survives a save that lands after it, success or failure. A
+ *  key both changed goes to the action. Where the host gives no live state, the result as it is. */
+export function settleOverLive<S extends object>(svc: unknown, start: S, result: S): S {
+  const now = liveState(svc) as S | undefined;
+  if (!now || now === start || now === result) return result;
+  const out = { ...now } as Record<string, unknown>;
+  const r = result as Record<string, unknown>, s0 = start as Record<string, unknown>;
+  for (const k of Object.keys(r)) if (!Object.is(r[k], s0[k])) out[k] = r[k];
+  return out as S;
+}

package/templates/nonprofit-cause-owner/tier5-src/himi-owner-lite-event-form/index.ts

@@ -10,7 +10,7 @@ import { defineService } from "@himalaya/state";
 import { getEvent, updateEvent, type WixEvent } from "@himalaya/wix-events";
 import { normalizeEvent } from "../_shared/himi-events.js";
 import { postBodyText, plainPostBody } from "../_shared/owner-post-content.js";
-import { editorSubmitValue, queuedDocument, editorChanged, cachedRichVerdict, resetHydratedEditor } from "../_shared/owner-editor-value.js";
+import { editorSubmitValue, queuedDocument, editorChanged, cachedRichVerdict, editorRunKeys, resetHydratedEditorOnOlderRuntime, editorAfterSave, liveState, settleOverLive } from "../_shared/owner-editor-value.js";
 import { parseRicosJson } from "@himalaya/wix-rich-content";
 import { ricosUploadService } from "@himalaya/wix-rich-content-editor";
 import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo, shouldQueueOwnerWrite } from "../_shared/owner-load-error.js";
@@ -59,6 +59,8 @@ interface EventFormState {
    *  hidden until this run's load lands. */
   descriptionDirty: boolean;
   descriptionPending: boolean;
+  /** Counts the editor's on_change events, so a save can tell an edit made while it was in flight. */
+  descriptionEdits: number;
   /** Derived from the mode: "locked" shows the preview + `descriptionNote`, and refuses an edit. */
   descriptionProtected: boolean;
   descriptionEditable: boolean;
@@ -133,6 +135,7 @@ function shape(s: Partial<EventFormState>): EventFormState {
     descriptionEditorHidden: mode !== "editor",
     descriptionDirty: s.descriptionDirty ?? false,
     descriptionPending: s.descriptionPending ?? false,
+    descriptionEdits: s.descriptionEdits ?? 0,
     descriptionProtected: mode === "locked",
     descriptionEditable: mode !== "locked",
     descriptionNote: mode === "locked" ? copyParam("ownerEventForm.richDescriptionNote", "This description has formatting or media. Edit it in your site dashboard to keep that content intact; the title can be changed here.") : "",
@@ -163,8 +166,8 @@ function demoRefusal(s: Parameters<typeof shape>[0]): ReturnType<typeof shape> {
 
 // The RichContentEditor's image tool (the editor's upload contract). The component picks and PUTs
 // the bytes; this service mints the signed Wix Media URL with the worker's own wixApi, so no token
-// reaches the page. Registered BEFORE the form's service on purpose: the worker test harnesses treat a
-// bundle's LAST defineService as its service.
+// reaches the page. Any order: the
+// worker test harnesses find each service by name.
 ricosUploadService("himiOwnerLiteEventFormUploads");
 
 const svc = defineService<EventFormState, {
@@ -173,6 +176,8 @@ const svc = defineService<EventFormState, {
   submit: (s: EventFormState, values?: Record<string, unknown>) => Promise<EventFormState>;
 }>("himiOwnerLiteEventForm", {
   state: shape({ mode: startMode, id: initialInput.id ?? "", descriptionPending: true }),
+  // [rico] #3644 — this run's editor state: a cold boot takes it from `state`, never the snapshot.
+  notHydrated: editorRunKeys("description"),
   actions: {
     load: async (s, arg) => {
       stashCopy(arg); // absorb the descriptor's onAppear copy-pack param
@@ -258,8 +263,9 @@ const svc = defineService<EventFormState, {
       }
     },
     // The editor's on_change carries `args.dirty` only; the document stays in the form bag.
-    descriptionChanged: (s) => shape({ ...s, descriptionDirty: true, ...editorChanged(s) }),
-    submit: async (s, values) => {
+    descriptionChanged: (s) => shape({ ...s, descriptionDirty: true, descriptionEdits: s.descriptionEdits + 1, ...editorChanged(s) }),
+    // Laid over the live state ([rico] #3644): what the owner did while the save awaited survives it.
+    submit: async (s, values): Promise<EventFormState> => settleOverLive(svc, s, await (async (): Promise<EventFormState> => {
       if (isOwnerPreviewDemo() || s.demoNote) return demoRefusal(s);
       const v = values ?? {};
       const title = String(v.title ?? s.title).trim();
@@ -310,14 +316,19 @@ const svc = defineService<EventFormState, {
       // lands nothing is known, so the row stays protected (fail closed).
       const knownPlain = s.descriptionMode === "plain" || (s.descriptionMode === "editor" && !s.descriptionPending && s.descriptionJson === "");
       await cachePut({ id: s.id, name: title, title, description, descriptionProtected: cachedRichVerdict(heldDoc as never, knownPlain), ...(heldJson ? { descriptionJson: heldJson } : {}), when: s.when, location: s.location });
-      const savedState = (savedMessage: string) => shape({
+      const savedState = (savedMessage: string) => {
+        // An edit typed while this save was in flight stays unsaved work ([rico] #3644).
+        const after = editorAfterSave("description", s as never, liveState(svc), !!doc);
+        return shape({
         ...s, mode: "edit", id: s.id, heading: copyParam("ownerEventForm.headingEdit", "Edit event"),
         title, description, originalDescription: doc ? description : s.originalDescription,
         ...(docRaw ? { descriptionJson: docRaw } : {}),
-        descriptionDirty: doc ? false : s.descriptionDirty,
+        descriptionDirty: after.dirty, descriptionEdits: after.edits,
         status: "saved", savedMessage, savedId: s.id,
+        ...(after.editedDuringSave ? { status: "idle" as const, savedMessage: "" } : {}),
         error: tooLarge ? copyParam("ownerEventForm.descriptionTooLarge", "The description is too long to save, so it was left as it was. Your other changes were saved.") : "",
-      });
+        });
+      };
       try {
         await updateEvent(s.id, event);
         return savedState(copyParam("ownerEventForm.savedMessage", "Event saved."));
@@ -337,11 +348,11 @@ const svc = defineService<EventFormState, {
         }
         return shape({ ...s, status: "error", error: ownerLoadError(e), savedMessage: "" });
       }
-    },
+    })()),
   },
 });
 
 // Adopter contract: the editor seeds once, so a cold boot must not seed it with the last run's document.
-resetHydratedEditor(svc, { json: "descriptionJson", pending: "descriptionPending", dirty: "descriptionDirty" }, true);
+resetHydratedEditorOnOlderRuntime(svc, "description", true);
 
 export { svc };

package/templates/nonprofit-cause-owner/tier5-src/himi-owner-lite-post-form/index.ts

@@ -4,7 +4,7 @@
 // screen (himiOwnerLitePost.publish). Bound by buildForm ($service:himiOwnerLitePostForm.*).
 
 import { postBodyText, plainPostBody, postCoverUrl } from "../_shared/owner-post-content.js";
-import { editorSubmitValue, queuedDocument, editorChanged, resetHydratedEditor } from "../_shared/owner-editor-value.js";
+import { editorSubmitValue, queuedDocument, editorChanged, editorRunKeys, resetHydratedEditorOnOlderRuntime, editorAfterSave, liveState, settleOverLive } from "../_shared/owner-editor-value.js";
 import { ricosUploadService } from "@himalaya/wix-rich-content-editor";
 import { wixCall } from "@himalaya/wix-site-media";
 import { wixMediaUrl, WIX_DETAIL_IMAGE } from "../_shared/himi-store.js";
@@ -46,6 +46,8 @@ interface PostFormState {
    *  the body was loaded or saved, and (edit mode) the editor is hidden until this run's load lands. */
   bodyDirty: boolean;
   bodyPending: boolean;
+  /** Counts the editor's on_change events, so a save can tell an edit made while it was in flight. */
+  bodyEdits: number;
   coverUrl: string;
   originalCoverUrl: string;
   coverPreview: string;
@@ -120,6 +122,7 @@ function shape(s: Partial<PostFormState>): PostFormState {
     detailsOpen: s.detailsOpen ?? false,
     bodyDirty: s.bodyDirty ?? false,
     bodyPending: s.bodyPending ?? false,
+    bodyEdits: s.bodyEdits ?? 0,
     coverUrl: s.coverUrl ?? "",
     originalCoverUrl: s.originalCoverUrl ?? "",
     coverPreview: wixMediaUrl(s.coverUrl ?? "", WIX_DETAIL_IMAGE),
@@ -150,9 +153,8 @@ function demoRefusal(s: Parameters<typeof shape>[0]): ReturnType<typeof shape> {
 
 // [rico] #3371 — the RichContentEditor's image tool (the editor's upload contract). The component picks
 // and PUTs the bytes; this service mints the signed Wix Media URL with the worker's own wixApi
-// (@himalaya/wix-site-media rides the `wix_api` grant), so no token reaches the page. Registered
-// BEFORE the form's service on purpose: the worker test harnesses treat a bundle's
-// LAST defineService as its service.
+// (@himalaya/wix-site-media rides the `wix_api` grant), so no token reaches the page. Any order:
+// the worker test harnesses find each service by name.
 ricosUploadService("himiOwnerLitePostFormUploads");
 
 const svc = defineService<PostFormState, {
@@ -165,6 +167,9 @@ const svc = defineService<PostFormState, {
   submit: (s: PostFormState, values?: Record<string, unknown>) => Promise<PostFormState>;
 }>("himiOwnerLitePostForm", {
   state: shape({ mode: startMode, id: initialInput.id ?? "", bodyPending: startMode === "edit" }),
+  // [rico] #3644 — this run's editor state and UI: a cold boot takes these from `state`, never from
+  // the persisted snapshot (the editor seeds once; last run's sheet is not this run's).
+  notHydrated: [...editorRunKeys("body"), "detailsOpen"],
   actions: {
     load: async (s, arg) => {
       stashCopy(arg); // absorb the descriptor's onAppear copy-pack param
@@ -236,8 +241,9 @@ const svc = defineService<PostFormState, {
     detailsOpen: (s) => shape({ ...s, detailsOpen: true }),
     detailsClose: (s) => shape({ ...s, detailsOpen: false }),
     // The editor's `on_change` carries `args.dirty` only; the document stays in the form bag.
-    bodyChanged: (s) => shape({ ...s, bodyDirty: true, ...editorChanged(s) }),
-    submit: async (s, values) => {
+    bodyChanged: (s) => shape({ ...s, bodyDirty: true, bodyEdits: s.bodyEdits + 1, ...editorChanged(s) }),
+    // Laid over the live state ([rico] #3644): what the owner did while the save awaited survives it.
+    submit: async (s, values): Promise<PostFormState> => settleOverLive(svc, s, await (async (): Promise<PostFormState> => {
       if (isOwnerPreviewDemo() || s.demoNote) return demoRefusal(s);
       const v = values ?? {};
       const title = String(v.title ?? s.title).trim();
@@ -292,14 +298,19 @@ const svc = defineService<PostFormState, {
       let kept: WixRichContent | null = bodyEdited ? richContent : (replay ? null : s.richContent);
       const localRow = (id: string): DbEntity => ({ id, name: title, title, excerpt, body: postBodyText(kept), coverUrl, ...(kept ? { richContent: JSON.stringify(kept) } : {}), isFeatured: isFeatured ? "true" : "false", postStatus: "Draft", postStatusRaw: "DRAFT" });
       const localId = editing ? targetId : `local-${Date.now()}`;
-      const savedState = (id: string, savedMessage: string) => shape({
+      const savedState = (id: string, savedMessage: string) => {
+        // An edit typed while this save was in flight stays unsaved work ([rico] #3644).
+        const after = editorAfterSave("body", s as never, liveState(svc), bodyEdited);
+        return shape({
         ...s, mode: "edit", id, heading: copyParam("ownerPostForm.headingEdit", "Edit post"),
         title, excerpt, body: postBodyText(kept), richContent: kept, bodyJson: bodyEdited ? bodyRaw : s.bodyJson,
-        bodyDirty: bodyEdited ? false : s.bodyDirty,
+        bodyDirty: after.dirty, bodyEdits: after.edits,
         coverUrl, originalCoverUrl: coverUrl, isFeatured: isFeatured ? "true" : "false",
         status: "saved", savedMessage, savedId: id,
+        ...(after.editedDuringSave ? { status: "idle" as const, savedMessage: "" } : {}),
         error: bodyTooLarge ? copyParam("ownerPostForm.bodyTooLarge", "The post body is too long to save, so it was left as it was. Your other changes were saved.") : "",
-      });
+        });
+      };
       try {
         // A replay worker starts without the loaded document. Entity upserts replace whole rows, so
         // retain the cached rich body before writing back.
@@ -349,12 +360,11 @@ const svc = defineService<PostFormState, {
         }
         return shape({ ...s, status: "error", error: ownerLoadError(e), savedMessage: "" });
       }
-    },
+    })()),
   },
 });
 
-// [rico] #3371 — adopter contract: the editor seeds once, so a cold boot must not seed it with the last
-// run's document. Nor does it carry this run's UI over: the details sheet is shut.
-resetHydratedEditor(svc, { json: "bodyJson", pending: "bodyPending", dirty: "bodyDirty" }, startMode === "edit", { detailsOpen: false });
+// The same reset on a runtime from before `notHydrated` existed (an older binary on a new bundle).
+resetHydratedEditorOnOlderRuntime(svc, "body", startMode === "edit", { detailsOpen: false });
 
 export { svc };

package/templates/owner-lite/tier5-src/_shared/owner-editor-value.ts

@@ -8,7 +8,7 @@
 // drops nodes the owner never touched).
 // Inside the platform source this import is a relative path, so node test runs resolve it; an app's
 // copy imports "@himalaya/wix-rich-content".
-import { parseRicosJson, isPlainRicos, RICH_CONTENT_LIMITS, type RicosDocument } from "@himalaya/wix-rich-content";
+import { parseRicosJson, isPlainRicos, richContentOverLimits, type RicosDocument } from "@himalaya/wix-rich-content";
 
 export type EditorValue =
   | { kind: "absent" }                                  // leave the stored body untouched
@@ -17,34 +17,6 @@ export type EditorValue =
   | { kind: "too_large" }                               // past the rich-content limits: save the rest, say why
   | { kind: "invalid" };                                // not a Ricos document: refuse, write nothing
 
-function utf8Bytes(s: string): number {
-  let n = 0;
-  for (let i = 0; i < s.length; i++) {
-    const c = s.charCodeAt(i);
-    if (c < 0x80) n += 1;
-    else if (c < 0x800) n += 2;
-    else if (c >= 0xd800 && c <= 0xdbff && i + 1 < s.length) { n += 4; i++; }
-    else n += 3;
-  }
-  return n;
-}
-
-/** Every viewer renders a body past the rich-content limits as its fallback, so it is never written.
- *  The viewer's order: bytes (before parsing), then depth, then the node count. */
-function overLimits(doc: RicosDocument): boolean {
-  let count = 0;
-  const work: Array<[unknown, number]> = doc.nodes.map((n) => [n, 1] as [unknown, number]);
-  while (work.length) {
-    const [n, depth] = work.pop()!;
-    if (!n || typeof n !== "object" || Array.isArray(n)) continue;
-    if (depth > RICH_CONTENT_LIMITS.maxDepth) return true;
-    if (++count > RICH_CONTENT_LIMITS.maxNodes) return true;
-    const kids = (n as { nodes?: unknown }).nodes;
-    if (Array.isArray(kids)) for (const k of kids) work.push([k, depth + 1]);
-  }
-  return false;
-}
-
 const TEXT_ONLY = new Set(["PARAGRAPH", "TEXT", "HEADING", "BULLETED_LIST", "ORDERED_LIST", "LIST_ITEM", "BLOCKQUOTE", "CODE_BLOCK"]);
 /** No visible text and no non-text node (an image, a divider, an embed…): an empty body. */
 export function isEmptyDocument(doc: RicosDocument): boolean {
@@ -55,10 +27,12 @@ export function isEmptyDocument(doc: RicosDocument): boolean {
 
 /** A Ricos JSON string checked as every viewer would: the limits first, then the shape. */
 function checkedDocument(raw: string): EditorValue {
-  if (utf8Bytes(raw) > RICH_CONTENT_LIMITS.maxBytes) return { kind: "too_large" };
+  // Every viewer renders a body past the limits as its fallback, so it is never written. One parse
+  // feeds both checks; a string past the byte limit is refused before it is parsed at all.
+  if (richContentOverLimits(raw, null) === "too_large") return { kind: "too_large" };
   const doc = parseRicosJson(raw);
   if (!doc) return { kind: "invalid" };
-  return overLimits(doc) ? { kind: "too_large" } : { kind: "doc", doc, json: raw };
+  return richContentOverLimits(raw, doc) ? { kind: "too_large" } : { kind: "doc", doc, json: raw };
 }
 
 /** `raw` is `values[name]`; `seededJson` is the string the form published as the editor's seed. */
@@ -108,15 +82,59 @@ export function cachedRichVerdict(doc: RicosDocument | null, knownPlain: boolean
   return knownPlain ? "false" : "true";
 }
 
-/** Cold boot: the runtime lays this service's last persisted snapshot over its declared state, so the
- *  editor's first seed would be the document as it was when the screen last ran — and a Save after
- *  typing would write it over whatever the record holds now. Blank the hydrated seed and reset the gate
- *  before anything renders, in place (no action has run yet). `extra` resets further UI state. */
-export function resetHydratedEditor(svc: unknown, keys: { json: string; pending: string; dirty: string }, pendingAtBoot: boolean, extra: Record<string, unknown> = {}): void {
+/** The keys of one editor field that describe THIS run, never the last one: the seed (`<key>Json`),
+ *  the load gate (`<key>Pending`), the edit flag (`<key>Dirty`) and its counter (`<key>Edits`). A form
+ *  lists them in `defineService(name, { notHydrated })`, so a cold boot takes their DECLARED values: the
+ *  editor seeds once, and a persisted seed would be painted as its content and saved back over a newer
+ *  record. */
+export function editorRunKeys<K extends string>(key: K): [`${K}Json`, `${K}Pending`, `${K}Dirty`, `${K}Edits`] {
+  return [`${key}Json`, `${key}Pending`, `${key}Dirty`, `${key}Edits`];
+}
+
+/** The same keys on a runtime that ignores `notHydrated` (a binary from before #3644, still served new
+ *  bundles over the air): reset them in place, before any action runs. A no-op where the runtime
+ *  honours the option (`himalaya.hydrationOptOut`). */
+export function resetHydratedEditorOnOlderRuntime(svc: unknown, key: string, pendingAtBoot: boolean, extra: Record<string, unknown> = {}): void {
+  if ((globalThis as { himalaya?: { hydrationOptOut?: unknown } }).himalaya?.hydrationOptOut === true) return;
   const booted = (svc as { getState?: () => Record<string, unknown> | undefined }).getState?.();
   if (!booted || typeof booted !== "object") return;
-  if (booted[keys.json]) booted[keys.json] = "";
-  booted[keys.pending] = pendingAtBoot;
-  booted[keys.dirty] = false;
+  if (booted[`${key}Json`]) booted[`${key}Json`] = "";
+  booted[`${key}Pending`] = pendingAtBoot;
+  booted[`${key}Dirty`] = false;
+  booted[`${key}Edits`] = 0;
   Object.assign(booted, extra);
 }
+
+/** What an awaited save leaves the field as, read from the LIVE state when it lands. An on_change that
+ *  arrived while the save was in flight (`<key>Edits` moved) is an edit the save did not write: the
+ *  field stays dirty and the save's confirmation is stale. Otherwise a save that wrote the field
+ *  re-bases it as saved. `live` is the service's state now (none, or one that never moved: the start state). */
+export function editorAfterSave(key: string, start: Record<string, unknown>, live: Record<string, unknown> | undefined, wrote: boolean):
+  { dirty: boolean; edits: number; editedDuringSave: boolean } {
+  const atStart = Number(start[`${key}Edits`] ?? 0);
+  const now = Number(live?.[`${key}Edits`] ?? atStart);
+  // Only a counter that MOVED ON counts; one behind the start is a host that does not apply results.
+  const editedDuringSave = now > atStart;
+  return editedDuringSave
+    ? { dirty: true, edits: now, editedDuringSave }
+    : { dirty: wrote ? false : Boolean(start[`${key}Dirty`]), edits: atStart, editedDuringSave };
+}
+
+/** The live state of a service handle, when the runtime gives one. */
+export function liveState(svc: unknown): Record<string, unknown> | undefined {
+  const st = (svc as { getState?: () => unknown } | undefined)?.getState?.();
+  return st && typeof st === "object" ? st as Record<string, unknown> : undefined;
+}
+
+/** An awaited action's result, laid over the LIVE state: only the keys the action CHANGED (against the
+ *  state it started from) are written, so anything the owner did while it awaited — an edit, a field in
+ *  the details sheet, closing the sheet — survives a save that lands after it, success or failure. A
+ *  key both changed goes to the action. Where the host gives no live state, the result as it is. */
+export function settleOverLive<S extends object>(svc: unknown, start: S, result: S): S {
+  const now = liveState(svc) as S | undefined;
+  if (!now || now === start || now === result) return result;
+  const out = { ...now } as Record<string, unknown>;
+  const r = result as Record<string, unknown>, s0 = start as Record<string, unknown>;
+  for (const k of Object.keys(r)) if (!Object.is(r[k], s0[k])) out[k] = r[k];
+  return out as S;
+}

package/templates/owner-lite/tier5-src/himi-owner-lite-event-form/index.ts

@@ -10,7 +10,7 @@ import { defineService } from "@himalaya/state";
 import { getEvent, updateEvent, type WixEvent } from "@himalaya/wix-events";
 import { normalizeEvent } from "../_shared/himi-events.js";
 import { postBodyText, plainPostBody } from "../_shared/owner-post-content.js";
-import { editorSubmitValue, queuedDocument, editorChanged, cachedRichVerdict, resetHydratedEditor } from "../_shared/owner-editor-value.js";
+import { editorSubmitValue, queuedDocument, editorChanged, cachedRichVerdict, editorRunKeys, resetHydratedEditorOnOlderRuntime, editorAfterSave, liveState, settleOverLive } from "../_shared/owner-editor-value.js";
 import { parseRicosJson } from "@himalaya/wix-rich-content";
 import { ricosUploadService } from "@himalaya/wix-rich-content-editor";
 import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo, shouldQueueOwnerWrite } from "../_shared/owner-load-error.js";
@@ -59,6 +59,8 @@ interface EventFormState {
    *  hidden until this run's load lands. */
   descriptionDirty: boolean;
   descriptionPending: boolean;
+  /** Counts the editor's on_change events, so a save can tell an edit made while it was in flight. */
+  descriptionEdits: number;
   /** Derived from the mode: "locked" shows the preview + `descriptionNote`, and refuses an edit. */
   descriptionProtected: boolean;
   descriptionEditable: boolean;
@@ -133,6 +135,7 @@ function shape(s: Partial<EventFormState>): EventFormState {
     descriptionEditorHidden: mode !== "editor",
     descriptionDirty: s.descriptionDirty ?? false,
     descriptionPending: s.descriptionPending ?? false,
+    descriptionEdits: s.descriptionEdits ?? 0,
     descriptionProtected: mode === "locked",
     descriptionEditable: mode !== "locked",
     descriptionNote: mode === "locked" ? copyParam("ownerEventForm.richDescriptionNote", "This description has formatting or media. Edit it in your site dashboard to keep that content intact; the title can be changed here.") : "",
@@ -163,8 +166,8 @@ function demoRefusal(s: Parameters<typeof shape>[0]): ReturnType<typeof shape> {
 
 // The RichContentEditor's image tool (the editor's upload contract). The component picks and PUTs
 // the bytes; this service mints the signed Wix Media URL with the worker's own wixApi, so no token
-// reaches the page. Registered BEFORE the form's service on purpose: the worker test harnesses treat a
-// bundle's LAST defineService as its service.
+// reaches the page. Any order: the
+// worker test harnesses find each service by name.
 ricosUploadService("himiOwnerLiteEventFormUploads");
 
 const svc = defineService<EventFormState, {
@@ -173,6 +176,8 @@ const svc = defineService<EventFormState, {
   submit: (s: EventFormState, values?: Record<string, unknown>) => Promise<EventFormState>;
 }>("himiOwnerLiteEventForm", {
   state: shape({ mode: startMode, id: initialInput.id ?? "", descriptionPending: true }),
+  // [rico] #3644 — this run's editor state: a cold boot takes it from `state`, never the snapshot.
+  notHydrated: editorRunKeys("description"),
   actions: {
     load: async (s, arg) => {
       stashCopy(arg); // absorb the descriptor's onAppear copy-pack param
@@ -258,8 +263,9 @@ const svc = defineService<EventFormState, {
       }
     },
     // The editor's on_change carries `args.dirty` only; the document stays in the form bag.
-    descriptionChanged: (s) => shape({ ...s, descriptionDirty: true, ...editorChanged(s) }),
-    submit: async (s, values) => {
+    descriptionChanged: (s) => shape({ ...s, descriptionDirty: true, descriptionEdits: s.descriptionEdits + 1, ...editorChanged(s) }),
+    // Laid over the live state ([rico] #3644): what the owner did while the save awaited survives it.
+    submit: async (s, values): Promise<EventFormState> => settleOverLive(svc, s, await (async (): Promise<EventFormState> => {
       if (isOwnerPreviewDemo() || s.demoNote) return demoRefusal(s);
       const v = values ?? {};
       const title = String(v.title ?? s.title).trim();
@@ -310,14 +316,19 @@ const svc = defineService<EventFormState, {
       // lands nothing is known, so the row stays protected (fail closed).
       const knownPlain = s.descriptionMode === "plain" || (s.descriptionMode === "editor" && !s.descriptionPending && s.descriptionJson === "");
       await cachePut({ id: s.id, name: title, title, description, descriptionProtected: cachedRichVerdict(heldDoc as never, knownPlain), ...(heldJson ? { descriptionJson: heldJson } : {}), when: s.when, location: s.location });
-      const savedState = (savedMessage: string) => shape({
+      const savedState = (savedMessage: string) => {
+        // An edit typed while this save was in flight stays unsaved work ([rico] #3644).
+        const after = editorAfterSave("description", s as never, liveState(svc), !!doc);
+        return shape({
         ...s, mode: "edit", id: s.id, heading: copyParam("ownerEventForm.headingEdit", "Edit event"),
         title, description, originalDescription: doc ? description : s.originalDescription,
         ...(docRaw ? { descriptionJson: docRaw } : {}),
-        descriptionDirty: doc ? false : s.descriptionDirty,
+        descriptionDirty: after.dirty, descriptionEdits: after.edits,
         status: "saved", savedMessage, savedId: s.id,
+        ...(after.editedDuringSave ? { status: "idle" as const, savedMessage: "" } : {}),
         error: tooLarge ? copyParam("ownerEventForm.descriptionTooLarge", "The description is too long to save, so it was left as it was. Your other changes were saved.") : "",
-      });
+        });
+      };
       try {
         await updateEvent(s.id, event);
         return savedState(copyParam("ownerEventForm.savedMessage", "Event saved."));
@@ -337,11 +348,11 @@ const svc = defineService<EventFormState, {
         }
         return shape({ ...s, status: "error", error: ownerLoadError(e), savedMessage: "" });
       }
-    },
+    })()),
   },
 });
 
 // Adopter contract: the editor seeds once, so a cold boot must not seed it with the last run's document.
-resetHydratedEditor(svc, { json: "descriptionJson", pending: "descriptionPending", dirty: "descriptionDirty" }, true);
+resetHydratedEditorOnOlderRuntime(svc, "description", true);
 
 export { svc };

package/templates/owner-lite/tier5-src/himi-owner-lite-faq-question-form/index.ts

@@ -4,7 +4,7 @@ import { defineService } from "@himalaya/state";
 import { createQuestionEntry, getQuestionEntry, queryCategories, queryQuestionEntries, updateQuestionEntry, type WixCategory, type WixQuestionEntry } from "@himalaya/wix-faq";
 import { postBodyText, plainPostBody } from "../_shared/owner-post-content.js";
 import { draftjsText } from "../_shared/owner-rich-guard.js";
-import { editorSubmitValue, isEmptyDocument, resetHydratedEditor } from "../_shared/owner-editor-value.js";
+import { editorSubmitValue, isEmptyDocument, editorRunKeys, resetHydratedEditorOnOlderRuntime, editorAfterSave, liveState, settleOverLive } from "../_shared/owner-editor-value.js";
 import { parseRicosJson, type RicosDocument } from "@himalaya/wix-rich-content";
 import { ricosUploadService } from "@himalaya/wix-rich-content-editor";
 
@@ -15,7 +15,9 @@ interface State { id: string; revision: string; mode: "create" | "edit"; heading
  /** The editor's seed: the answer as a Ricos JSON string ("" until this run's load lands; see the boot reset). */
  answerJson: string; answerFieldHidden: boolean; answerEditorHidden: boolean;
  /** The editor gate (`EditorGate` in _shared/owner-editor-value.ts): edited since load/save; hidden until load lands. */
- answerDirty: boolean; answerPending: boolean; }
+ answerDirty: boolean; answerPending: boolean;
+ /** Counts the editor's on_change events, so a save can tell an edit made while it was in flight. */
+ answerEdits: number; }
 const input = ((globalThis as { himalaya?: { input?: { id?: string } } }).himalaya?.input) ?? {};
 const msg = (e: unknown) => String((e as { message?: unknown })?.message ?? e);
 const isConflict = (e: unknown) => /\b409\b|conflict|revision/i.test(msg(e));
@@ -39,20 +41,22 @@ const shape=(s:Partial<State>):State=>({ id:s.id??input.id??"", revision:s.revis
   const editing = (s.mode ?? ((s.id ?? input.id) ? "edit" : "create")) === "edit";
   const mode = s.answerMode ?? (f === "draftjs" ? "locked" : editing ? "editor" : "plain");
   return { answerFormat: f, answerMode: mode, answerJson: s.answerJson ?? "", answerFieldHidden: mode !== "plain", answerEditorHidden: mode !== "editor",
-   answerDirty: s.answerDirty ?? false, answerPending: s.answerPending ?? false,
+   answerDirty: s.answerDirty ?? false, answerPending: s.answerPending ?? false, answerEdits: s.answerEdits ?? 0,
    answerProtected: mode === "locked", answerEditable: mode !== "locked", answerNote: mode === "locked" ? RICH_ANSWER_NOTE : "" }; })() });
 // The RichContentEditor's image tool: this service mints the signed Wix Media URL with the worker's own wixApi.
-// Registered BEFORE the form's service: the worker test harnesses treat a bundle's LAST defineService as its service.
 ricosUploadService("himiOwnerLiteFaqQuestionFormUploads");
-const svc=defineService<State,{load:(s:State,a?:unknown)=>Promise<State>;answerChanged:(s:State,a?:unknown)=>State;submit:(s:State,v?:Record<string,unknown>)=>Promise<State>}>("himiOwnerLiteFaqQuestionForm",{state:shape({answerPending:!!input.id}),actions:{
+const svc=defineService<State,{load:(s:State,a?:unknown)=>Promise<State>;answerChanged:(s:State,a?:unknown)=>State;submit:(s:State,v?:Record<string,unknown>)=>Promise<State>}>("himiOwnerLiteFaqQuestionForm",{state:shape({answerPending:!!input.id}),
+// [rico] #3644 — this run's editor state: a cold boot takes it from `state`, never the snapshot.
+notHydrated:editorRunKeys("answer"),actions:{
  load:async(s,a)=>{const id=input.id||String((a as {id?:unknown})?.id??s.id);try{const cats=await categories();const options=cats.map(c=>({id:c.id??"",label:c.title?.trim()||"Untitled category"}));if(!id)return shape({...s,...ANSWER_LOADED,mode:"create",answerMode:"plain",answerJson:"",categoryOptions:options,statusValue:"HIDDEN"});const q=(await getQuestionEntry(id)).questionEntry;if(!q) return shape({...s,id,error:"Question not found",categoryOptions:options});return shape({...s,id,revision:q.revision??"",mode:"edit",heading:"Edit question",question:q.question??"",...((a)=>({...a,...ANSWER_LOADED,answerMode:a.answerFormat==="draftjs"?"locked" as const:"editor" as const,
   // The seed is the stored document byte for byte (never re-encoded); a plain answer seeds as paragraphs.
   answerJson:a.answerFormat==="draftjs"?"":q.richContent?JSON.stringify(q.richContent):q.plainText?JSON.stringify(plainPostBody(q.plainText)):""}))(answerOf(q)),categoryId:q.categoryId??"",statusValue:q.status==="VISIBLE"?"VISIBLE":"HIDDEN",categoryOptions:options,error:"",conflict:false});}catch(e){return shape({...s,id,error:offline(e)?"Connect to the internet to load this question.":msg(e)});}},
  // The editor's on_change carries `args.dirty` only; the document stays in the form bag.
  // Any on_change after a save is an edit that save did not write (every arm fires the pending on_change
  // before releasing a submit), so the confirmation goes.
- answerChanged:(s)=>shape({...s,answerDirty:true,savedMessage:""}),
- submit:async(s,v)=>{
+ answerChanged:(s)=>shape({...s,answerDirty:true,answerEdits:s.answerEdits+1,savedMessage:""}),
+ // Laid over the live state ([rico] #3644): what the owner did while the save awaited survives it.
+ submit:async(s,v):Promise<State>=>settleOverLive(svc,s,await (async ():Promise<State>=>{
   const question=String(v?.question??s.question).trim(),categoryId=String(v?.categoryId??s.categoryId),statusValue=String(v?.status??s.statusValue)==="VISIBLE"?"VISIBLE":"HIDDEN";
   const editing=s.mode==="edit";
   // The answer, per mode. Editor: `values.answer` is the RichContentEditor's document, or absent (the editor
@@ -83,15 +87,17 @@ const svc=defineService<State,{load:(s:State,a?:unknown)=>Promise<State>;answerC
       const questionEntry={id:s.id,revision:s.revision,question,categoryId,status:statusValue,...(doc?{richContent:doc as never}:plainEdit?{plainText:answer}:{})};
       const fieldMask=["question",...(doc?["richContent"]:plainEdit?["plainText"]:[]),"categoryId","status"];
       const r=await updateQuestionEntry(s.id,{questionEntry,fieldMask});
+      // An edit typed while this save was in flight stays unsaved work ([rico] #3644).
+      const after=editorAfterSave("answer",s as never,liveState(svc),!!doc);
       return shape({...s,revision:r.questionEntry?.revision??s.revision,question,answer,...(doc?{answerFormat:"rich" as const,answerJson:docRaw}:{}),
-        answerDirty:doc?false:s.answerDirty,categoryId,statusValue,conflict:false,savedMessage:"Question saved.",savedId:s.id,
+        answerDirty:after.dirty,answerEdits:after.edits,categoryId,statusValue,conflict:false,savedMessage:after.editedDuringSave?"":"Question saved.",savedId:s.id,
         error:tooLarge?"The answer is too long to save, so it was left as it was. Your other changes were saved.":""});
     }
     const r=await createQuestionEntry({questionEntry:{question,plainText:answer,categoryId,status:statusValue,sortOrder:await appendOrder()}});
     return shape({...s,id:r.questionEntry?.id??"",revision:r.questionEntry?.revision??"",mode:"edit",heading:"Edit question",question,answer,categoryId,statusValue,error:"",savedMessage:"Question created.",savedId:r.questionEntry?.id??""});
   }catch(e){if(isConflict(e))return shape({...s,error:"This question changed elsewhere. Refresh before saving again.",conflict:true,savedMessage:""});return shape({...s,error:offline(e)?"Connect to the internet and try again. This change was not queued.":msg(e),savedMessage:""});}
- }
+ })())
 }});
 // Adopter contract: the editor seeds once, so a cold boot must not seed it with the last run's document.
-resetHydratedEditor(svc,{json:"answerJson",pending:"answerPending",dirty:"answerDirty"},!!input.id);
+resetHydratedEditorOnOlderRuntime(svc,"answer",!!input.id);
 export {svc,appendOrder};