@wix/himalaya-cli 0.1210.0 → 0.1212.0

package/templates/retail-store-owner/tier5-src/_shared/owner-module-data.ts

@@ -13,9 +13,11 @@ import { queryGiftCards, getGiftCard } from '@himalaya/wix-gift-cards';
 import { queryDonationCampaigns, getDonationCampaign } from '@himalaya/wix-donations';
 import { query as queryBadges, get as getBadge } from '@himalaya/wix-badges';
 import { wixMediaUrl } from '@himalaya/wix-media';
+import { getSiteTimeZone } from '@himalaya/wix-analytics';
 import { type OwnerModuleId } from './owner-modules.js';
 import { type CollectionPage } from './collection-query.js';
-import { copyParam } from './himi-copy.js';
+import { copyParam, copyTemplate } from './himi-copy.js';
+import { calendarDay, formatDateMedium, formatMonthDay, formatWeekdayDateTime } from './engine-intl.js';
 import { eligibleOwnerOperations } from './owner-operations.js';
 
 export interface OwnerRecord {
@@ -33,91 +35,144 @@ const join = (...values: string[]) => values.filter(Boolean).join(' · ');
 const name = (value: unknown, first: string, last: string) => [field(value, first), field(value, last)].filter(Boolean).join(' ');
 const yesNo = (value: unknown) => typeof value === 'boolean' ? value ? 'Yes' : 'No' : '';
 const LIMIT = 50;
+
+/** The site's IANA zone, resolved once per worker. Wix hands every date here as a UTC instant;
+ *  formatting it in the viewer's device zone (or leaving it raw) shows an owner outside UTC the
+ *  wrong hour and sometimes the wrong day. A failed or unset lookup degrades to the
+ *  device zone — a zone is garnish on a date, never a reason to fail the collection. The
+ *  answer, failure included, is kept for the worker's life: a role that cannot read site
+ *  properties would otherwise re-send the failing request for every page a search walks. */
+let zoneLookup: Promise<string | undefined> | undefined;
+function siteZone(): Promise<string | undefined> {
+  // `Promise.resolve().then` so a bridge that throws synchronously is caught here too.
+  zoneLookup ??= Promise.resolve().then(getSiteTimeZone).catch(() => undefined);
+  return zoneLookup;
+}
+
+/** A Wix date value as an instant. A calendar date with no time ("2026-11-07") is a DAY, not an
+ *  instant: it is built at local midnight and formatted with no zone, so it never shifts across
+ *  one — including on engines without Intl, where a zone could not be applied anyway. */
+function ownerInstant(value: string): { date: Date; dayOnly: boolean } | undefined {
+  if (!value) return undefined;
+  const day = /^(\d{4})-(\d\d)-(\d\d)$/.exec(value);
+  if (day) return { date: new Date(Number(day[1]), Number(day[2]) - 1, Number(day[3])), dayOnly: true };
+  const ms = /^\d{13}$/.test(value) ? Number(value) : Date.parse(value);
+  return Number.isFinite(ms) ? { date: new Date(ms), dayOnly: false } : undefined;
+}
+/** Has the instant (or, for a calendar date, the whole day) passed? */
+function ownerPast(value: string, now = Date.now()): boolean {
+  const parsed = ownerInstant(value);
+  if (!parsed) return false;
+  const { date, dayOnly } = parsed;
+  return (dayOnly ? new Date(date.getFullYear(), date.getMonth(), date.getDate() + 1).getTime() : date.getTime()) <= now;
+}
+
+type DateStyle = 'date' | 'dateTime' | 'short';
+/** A Wix date as owner copy, through the shared engine-intl shapes: `date` "Jan 5, 2026",
+ *  `dateTime` "Mon, Jan 5, 3:07 PM", `short` "Jan 5" (with the year when it is not this year).
+ *  A value that is not a date at all is kept as Wix sent it. */
+function ownerDate(value: string, zone: string | undefined, style: DateStyle = 'date'): string {
+  if (!value) return '';
+  const parsed = ownerInstant(value);
+  if (!parsed) return value;
+  const { date } = parsed, tz = parsed.dayOnly ? undefined : zone;
+  if (style === 'dateTime') return formatWeekdayDateTime(date, undefined, tz);
+  if (style === 'short' && calendarDay(date, tz).slice(0, 4) === calendarDay(new Date(), tz).slice(0, 4)) return formatMonthDay(date, undefined, tz);
+  return formatDateMedium(date, undefined, tz);
+}
 function offsetOf(cursor: string): number {
   if (cursor && !/^\d{1,9}$/.test(cursor)) throw new Error('Invalid collection cursor. Refresh this view.');
   return Number(cursor || 0);
 }
-function page(module: OwnerModuleId, rows: unknown[], nextCursor: string, total?: number, complete?: boolean): CollectionPage<OwnerRecord> {
-  return { items: rows.map(row => ownerRecord(module, row)), nextCursor, total, ...(complete === undefined ? {} : { complete }) };
+function page(rows: unknown[], nextCursor: string, total?: number, complete?: boolean): CollectionPage<unknown> {
+  return { items: rows, nextCursor, total, ...(complete === undefined ? {} : { complete }) };
 }
-function offsetPage(module: OwnerModuleId, rows: unknown[], offset: number, metadata: unknown) {
+function offsetPage(rows: unknown[], offset: number, metadata: unknown) {
   const total = at(metadata, 'total');
   const more = rows.length > 0 && (typeof total === 'number' ? offset + rows.length < total : rows.length === LIMIT);
-  return page(module, rows, more ? String(offset + rows.length) : '', typeof total === 'number' ? total : undefined);
+  return page(rows, more ? String(offset + rows.length) : '', typeof total === 'number' ? total : undefined);
 }
 
 /** Domain query shapes stay here, shared by list and detail workers. Unsupported
  * server name queries remain explicitly labelled searches of loaded records. */
 export async function queryOwnerModule(module: OwnerModuleId, cursor = ''): Promise<CollectionPage<OwnerRecord>> {
+  // The zone lookup runs beside the query, not after it: the two are independent, and serial
+  // they would double the time to a first paint.
+  const [raw, zone] = await Promise.all([queryRawOwnerModule(module, cursor), siteZone()]);
+  return { ...raw, items: raw.items.map(row => ownerRecord(module, row, zone)) };
+}
+
+async function queryRawOwnerModule(module: OwnerModuleId, cursor: string): Promise<CollectionPage<unknown>> {
   const cursorPaging = { limit: LIMIT, ...(cursor ? { cursor } : {}) };
   switch (module) {
     case 'invoices': {
       const offset = offsetOf(cursor), r = await queryInvoices({ query: { paging: { limit: LIMIT, offset } } });
-      return offsetPage(module, r.invoices ?? [], offset, r.pagingMetadata);
+      return offsetPage(r.invoices ?? [], offset, r.pagingMetadata);
     }
     case 'coupons': {
       const offset = offsetOf(cursor), r = await queryCoupons({ paging: { limit: LIMIT, offset } });
-      return offsetPage(module, r.coupons ?? [], offset, r.metadata);
+      return offsetPage(r.coupons ?? [], offset, r.metadata);
     }
     case 'giftCards': {
       const r = await queryGiftCards({ query: { cursorPaging, sort: [{ fieldName: 'createdDate', order: 'DESC' }] } });
-      return page(module, r.giftCards ?? [], r.pagingMetadata?.cursors?.next ?? '');
+      return page(r.giftCards ?? [], r.pagingMetadata?.cursors?.next ?? '');
     }
     case 'contacts': {
       const offset = offsetOf(cursor), r = await queryContacts({ query: { paging: { limit: LIMIT, offset } } });
-      return offsetPage(module, r.contacts ?? [], offset, r.pagingMetadata);
+      return offsetPage(r.contacts ?? [], offset, r.pagingMetadata);
     }
     case 'members': {
       const offset = offsetOf(cursor), r = await queryMembers({ query: { paging: { limit: LIMIT, offset } } });
-      return offsetPage(module, r.members ?? [], offset, r.metadata);
+      return offsetPage(r.members ?? [], offset, r.metadata);
     }
     case 'groups': {
       const offset = offsetOf(cursor), r = await queryGroups({ paging: { limit: LIMIT, offset } });
-      return offsetPage(module, r.groups ?? [], offset, r.metaData);
+      return offsetPage(r.groups ?? [], offset, r.metaData);
     }
     case 'reviews': {
       const r = await queryReviews({ cursorPaging, sort: [{ fieldName: 'createdDate', order: 'DESC' }] }, true);
-      return page(module, r.reviews ?? r.results ?? [], r.pagingMetadata?.cursors?.next ?? '');
+      return page(r.reviews ?? r.results ?? [], r.pagingMetadata?.cursors?.next ?? '');
     }
     case 'programs': {
       const r = await queryPrograms({ cursorPaging });
-      return page(module, r.programs ?? [], r.pagingMetadata?.cursors?.next ?? '');
+      return page(r.programs ?? [], r.pagingMetadata?.cursors?.next ?? '');
     }
     case 'badges': {
       const r = await queryBadges({ query: { cursorPaging } });
-      return page(module, r.badges ?? [], r.pagingMetadata?.cursors?.next ?? '');
+      return page(r.badges ?? [], r.pagingMetadata?.cursors?.next ?? '');
     }
     case 'reservations': {
       const r = await queryReservations({ cursorPaging, sort: [{ fieldName: 'details.startDate', order: 'ASC' }] });
-      return page(module, r.reservations ?? [], r.pagingMetadata?.cursors?.next ?? '');
+      return page(r.reservations ?? [], r.pagingMetadata?.cursors?.next ?? '');
     }
     case 'portfolio': {
       const r = await listProjects(LIMIT, cursor || undefined);
-      return page(module, r.projects ?? [], r.pagingMetadata?.cursors?.next ?? '');
+      return page(r.projects ?? [], r.pagingMetadata?.cursors?.next ?? '');
     }
     case 'donationCampaigns': {
       const r = await queryDonationCampaigns({ query: { cursorPaging, sort: [{ fieldName: 'updatedDate', order: 'DESC' }] } });
-      return page(module, r.donationCampaigns ?? [], r.pagingMetadata?.cursors?.next ?? '');
+      return page(r.donationCampaigns ?? [], r.pagingMetadata?.cursors?.next ?? '');
     }
     case 'forms': {
       // This collection is Wix Forms. Booking/event registration forms belong
       // to their respective operational records, rather than a mixed union
       // that silently drops namespaces when one permission check fails.
       const offset = offsetOf(cursor), r = await queryForms({ filter: { namespace: 'wix.form_app.form' }, paging: { limit: LIMIT, offset } });
-      return offsetPage(module, r.forms ?? [], offset, r.metaData);
+      return offsetPage(r.forms ?? [], offset, r.metaData);
     }
     case 'plans': {
       const r = await listPlans();
-      return page(module, r.plans ?? [], '', r.pagingMetadata?.total, false);
+      return page(r.plans ?? [], '', r.pagingMetadata?.total, false);
     }
     case 'subscriptions': {
       const r = await listPlanOrders();
-      return page(module, r.orders ?? [], '', r.pagingMetadata?.total, false);
+      return page(r.orders ?? [], '', r.pagingMetadata?.total, false);
     }
   }
 }
 
-export function ownerRecord(module: OwnerModuleId, raw: unknown): OwnerRecord {
+export function ownerRecord(module: OwnerModuleId, raw: unknown, zone?: string): OwnerRecord {
+  const when = (path: string, style?: DateStyle) => ownerDate(field(raw, path), zone, style);
   const id = field(raw, 'id');
   if (!id) throw new Error('Wix returned a record without an identity. Refresh this view.');
   let title = '', subtitle = '', image = '', statusLabel = '';
@@ -127,7 +182,7 @@ export function ownerRecord(module: OwnerModuleId, raw: unknown): OwnerRecord {
       title = field(raw, 'specification.name') || field(raw, 'displayData.name');
       subtitle = field(raw, 'specification.code');
       statusLabel = at(raw, 'expired') === true ? 'Expired' : at(raw, 'specification.active') === true ? 'Active' : 'Inactive';
-      details = [['Code', subtitle], ['Uses', field(raw, 'numberOfUsages')], ['Offer', words(field(raw, 'specification.type'))], ['Expires', field(raw, 'specification.expirationTime')]];
+      details = [['Code', subtitle], ['Uses', field(raw, 'numberOfUsages')], ['Offer', words(field(raw, 'specification.type'))], ['Expires', when('specification.expirationTime')]];
       break;
     case 'giftCards': {
       const suffix = field(raw, 'codeSuffix');
@@ -147,7 +202,7 @@ export function ownerRecord(module: OwnerModuleId, raw: unknown): OwnerRecord {
         ['Initial value', field(raw, 'initialValue.formattedAmount') || join(field(raw, 'initialValue.amount'), field(raw, 'currency'))],
         ['Recipient', recipient],
         ['Order number', field(raw, 'orderInfo.orderNumber')],
-        ['Expires', expires],
+        ['Expires', when('expirationDate')],
         ['Source', words(field(raw, 'source'))],
       ];
       break;
@@ -156,7 +211,7 @@ export function ownerRecord(module: OwnerModuleId, raw: unknown): OwnerRecord {
       title = field(raw, 'number') ? `#${field(raw, 'number')}` : field(raw, 'title');
       subtitle = field(raw, 'customerInfo.contactDetails.fullName') || name(raw, 'customerInfo.contactDetails.firstName', 'customerInfo.contactDetails.lastName') || field(raw, 'customerInfo.contactDetails.email');
       statusLabel = words(field(raw, 'status'));
-      details = [['Customer', subtitle], ['Total', join(field(raw, 'totals.total'), field(raw, 'currency'))], ['Due', field(raw, 'dueDate')]];
+      details = [['Customer', subtitle], ['Total', join(field(raw, 'totals.total'), field(raw, 'currency'))], ['Due', when('dueDate')]];
       break;
     case 'contacts':
       title = name(raw, 'info.name.first', 'info.name.last') || field(raw, 'primaryInfo.email');
@@ -167,12 +222,12 @@ export function ownerRecord(module: OwnerModuleId, raw: unknown): OwnerRecord {
     case 'members':
       title = field(raw, 'profile.nickname') || name(raw, 'contact.firstName', 'contact.lastName') || field(raw, 'loginEmail');
       subtitle = field(raw, 'loginEmail'); image = field(raw, 'profile.photo.url'); statusLabel = words(field(raw, 'status'));
-      details = [['Email', subtitle], ['Last login', field(raw, 'lastLoginDate')]];
+      details = [['Email', subtitle], ['Last login', when('lastLoginDate')]];
       break;
     case 'groups':
       title = field(raw, 'name'); subtitle = field(raw, 'description') || field(raw, 'teaser');
       image = field(raw, 'coverImage.imageInfo.url'); statusLabel = words(field(raw, 'privacyStatus'));
-      details = [['Members', field(raw, 'memberCount') || field(raw, 'membersCount')], ['Last activity', field(raw, 'lastActivityDate')]];
+      details = [['Members', field(raw, 'memberCount') || field(raw, 'membersCount')], ['Last activity', when('lastActivityDate')]];
       break;
     case 'reviews':
       title = field(raw, 'content.title'); subtitle = field(raw, 'content.body'); statusLabel = words(field(raw, 'moderation.moderationStatus'));
@@ -184,8 +239,14 @@ export function ownerRecord(module: OwnerModuleId, raw: unknown): OwnerRecord {
       details = [['Price', join(field(raw, 'pricing.price.value'), field(raw, 'pricing.price.currency'))], ['Free trial days', field(raw, 'pricing.freeTrialDays')]];
       break;
     case 'subscriptions':
-      title = field(raw, 'planName'); subtitle = field(raw, 'buyer.memberId'); statusLabel = words(field(raw, 'status'));
-      details = [['Member ID', subtitle], ['Started', field(raw, 'startDate')], ['Ends', field(raw, 'endDate')], ['Payment', words(field(raw, 'lastPaymentStatus'))]];
+      // The buyer is only a member UUID here — not something an owner can read — so the
+      // row says when the plan started instead of echoing an internal id.
+      title = field(raw, 'planName'); statusLabel = words(field(raw, 'status'));
+      {
+        const started = when('startDate', 'short');
+        subtitle = started ? copyTemplate('ownerModules.startedOn', 'Started {date}', { date: started }) : '';
+      }
+      details = [['Started', when('startDate')], ['Ends', when('endDate')], ['Payment', words(field(raw, 'lastPaymentStatus'))]];
       break;
     case 'programs':
       title = field(raw, 'description.title') || field(raw, 'details.title') || field(raw, 'name');
@@ -203,13 +264,14 @@ export function ownerRecord(module: OwnerModuleId, raw: unknown): OwnerRecord {
       break;
     }
     case 'reservations':
-      title = name(raw, 'reservee.firstName', 'reservee.lastName'); subtitle = field(raw, 'details.startDate'); statusLabel = words(field(raw, 'status'));
+      title = name(raw, 'reservee.firstName', 'reservee.lastName'); subtitle = when('details.startDate', 'dateTime'); statusLabel = words(field(raw, 'status'));
       details = [['Arrival', subtitle], ['Party size', field(raw, 'details.partySize')], ['Email', field(raw, 'reservee.email')], ['Phone', field(raw, 'reservee.phone')]];
       break;
     case 'forms':
-      title = field(raw, 'name'); subtitle = field(raw, 'namespace');
+      // The list is filtered to one namespace (`wix.form_app.form`), so the namespace is an
+      // internal constant, not information — it never reaches copy.
+      title = field(raw, 'name') || copyParam('ownerModules.untitledForm', 'Untitled form');
       statusLabel = typeof at(raw, 'enabled') === 'boolean' ? at(raw, 'enabled') ? 'Enabled' : 'Disabled' : '';
-      details = [['Namespace', subtitle]];
       break;
     case 'portfolio':
       title = field(raw, 'title'); subtitle = field(raw, 'description'); image = portfolioCoverRef(at(raw, 'coverImage') as WixMediaImage | string | undefined);
@@ -217,20 +279,25 @@ export function ownerRecord(module: OwnerModuleId, raw: unknown): OwnerRecord {
       break;
     case 'donationCampaigns':
       title = field(raw, 'name');
-      subtitle = join(field(raw, 'campaignGoal.targetAmount.formattedAmount'), field(raw, 'campaignGoal.endDate'));
+      {
+        const end = when('campaignGoal.endDate', 'short');
+        subtitle = join(field(raw, 'campaignGoal.targetAmount.formattedAmount'), !end ? ''
+          : ownerPast(field(raw, 'campaignGoal.endDate')) ? copyTemplate('ownerModules.endedOn', 'ended {date}', { date: end })
+          : copyTemplate('ownerModules.endsOn', 'ends {date}', { date: end }));
+      }
       image = field(raw, 'coverImage');
       statusLabel = at(raw, 'archived') === true ? 'Archived' : words(field(raw, 'status'));
       details = [
         ['Goal', field(raw, 'campaignGoal.targetAmount.formattedAmount') || field(raw, 'campaignGoal.targetAmount.amount')],
-        ['End date', field(raw, 'campaignGoal.endDate')],
+        ['End date', when('campaignGoal.endDate')],
         ['Frequencies', Array.isArray(at(raw, 'donationFrequencies')) ? (at(raw, 'donationFrequencies') as unknown[]).map(String).join(', ') : ''],
         ['Custom amount', yesNo(at(raw, 'customAmountEnabled'))],
       ];
       break;
   }
   details.push(
-    ['Created', field(raw, 'createdDate') || field(raw, 'dateCreated') || field(raw, 'createDate')],
-    ['Updated', field(raw, 'updatedDate') || field(raw, 'updateDate')],
+    ['Created', when('createdDate') || when('dateCreated') || when('createDate')],
+    ['Updated', when('updatedDate') || when('updateDate')],
   );
   return { id, moduleId: module, title: title || copyParam('ownerModules.untitled', 'Untitled record'), subtitle, image: wixMediaUrl(image), statusLabel,
     detailScreenId: `himi_owner_lite_record_${module}`,
@@ -240,6 +307,7 @@ export function ownerRecord(module: OwnerModuleId, raw: unknown): OwnerRecord {
 
 export async function getOwnerRecord(module: OwnerModuleId, id: string): Promise<OwnerRecord> {
   if (!/^[A-Za-z0-9_.:-]{1,128}$/.test(id)) throw new Error('This record link is invalid. Return to the collection.');
+  const zone = siteZone(); // started now, beside the record fetch; it never rejects
   let raw: unknown;
   switch (module) {
     case 'coupons': raw = (await getCoupon(id)).coupon; break;
@@ -270,13 +338,13 @@ export async function getOwnerRecord(module: OwnerModuleId, id: string): Promise
         seen.add(next); cursor = next;
       }
       if (!raw) throw new Error('This project could not be located. Open the portfolio in Wix to check its availability.');
-      const record = ownerRecord(module, raw);
+      const record = ownerRecord(module, raw, await zone);
       const media = await listProjectItems(id, 100);
       return { ...record, fields: [...record.fields, { id: 'media', label: 'Loaded media items', value: String(media.items?.length ?? 0) }] };
     }
     case 'donationCampaigns': raw = (await getDonationCampaign(id)).donationCampaign; break;
   }
-  const record = ownerRecord(module, raw);
+  const record = ownerRecord(module, raw, await zone);
   if (record.id !== id) throw new Error('The returned record does not match this link. Refresh the collection.');
   return record;
 }

package/templates/retail-store-owner/tier5-src/himi-owner-lite-aria-history/index.ts

@@ -26,6 +26,7 @@ const core = createAriaHistory({
     last7: () => copyParam("ownerAriaHistory.last7", "Last 7 days"),
     last30: () => copyParam("ownerAriaHistory.last30", "Last 30 days"),
     older: () => copyParam("ownerAriaHistory.older", "Older"),
+    today: () => copyParam("ownerAriaHistory.today", "Today"),
   },
 });
 

package/templates/retail-store-owner/tier5-src/himi-owner-lite-home/index.ts

@@ -84,6 +84,10 @@ interface HomeState {
   notLoading: boolean;
   notErrored: boolean;
   hideContent: boolean;
+  /** The retry cards' list is hidden unless the dashboard is ready AND a source failed.
+   *  An empty list still costs its parent stack a gap, which on iOS read as a blank
+   *  band under the header; gating on `hideContent` alone left it mounted. */
+  hideSourceFailures: boolean;
   demoNote: string;
   notDemo: boolean;
 }
@@ -145,6 +149,7 @@ function shape(s: Partial<HomeState>): HomeState {
     notLoading: !isLoading,
     notErrored: status !== "error",
     hideContent: status !== "ready",
+    hideSourceFailures: status !== "ready" || !(s.sourceFailures?.length),
     demoNote: s.demoNote ?? "",
     notDemo: !s.demoNote,
   };

package/templates/retail-store-owner/tier5-src/himi-owner-lite-manage/index.ts

@@ -39,6 +39,8 @@ interface State {
   noEmpty: boolean;
   hasRecents: boolean;
   noRecents: boolean;
+  /** True while `sections` is empty — gates the list so an empty one costs no gap. */
+  noSections: boolean;
   isLoading: boolean;
   notLoading: boolean;
   summaryNote: string;
@@ -200,7 +202,7 @@ function derive(state: State, areas = state.areas): State {
   // areas arrive — or when this app provisions none at all — there is nothing a
   // filter could have excluded, so "Clear filters" would be a lie.
   const noEmpty = next.noEmpty || state.status !== 'ready' || areas.length === 0;
-  return { ...state, ...next, noEmpty, recents, hasRecents: recents.length > 0, noRecents: recents.length === 0, businessName: currentBusinessName };
+  return { ...state, ...next, noEmpty, recents, hasRecents: recents.length > 0, noRecents: recents.length === 0, noSections: next.sections.length === 0, businessName: currentBusinessName };
 }
 
 // Loads are not serialized: on a warm reappearance the host's bare refresh and
@@ -276,7 +278,7 @@ const svc = defineService<State, {
     // 'All' is always a valid filter, so the chip row paints from the first frame
     // instead of appearing (and shifting the layout) when the areas arrive.
     groups: [{ id: 'all', label: allLabel() }], summary: '', noEmpty: true,
-    hasRecents: false, noRecents: true, isLoading: true, notLoading: false, summaryNote: '', handoffError: '',
+    hasRecents: false, noRecents: true, noSections: true, isLoading: true, notLoading: false, summaryNote: '', handoffError: '',
   },
   actions: {
     load: async (state, arg) => {

package/templates/retail-store-owner/tier5-src/himi-owner-lite-post/index.ts

@@ -80,6 +80,9 @@ interface PostState {
   /** Non-empty when showing owner-preview-demo sample data (web preview, no owner bridge). */
   demoNote: string;
   notDemo: boolean;
+  /** #3158 — Delete ARMS a confirmation; only confirmDelete reaches the API. */
+  deletePending: boolean;
+  noDeleteConfirmation: boolean;
 }
 
 /* eslint-disable @typescript-eslint/no-explicit-any */
@@ -159,6 +162,9 @@ function shape(s: Partial<PostState>): PostState {
     hideUnpublish: !published || status !== "ready",
     demoNote: s.demoNote ?? "",
     notDemo: !s.demoNote,
+    // Only a loaded entity can be pending deletion; every other action disarms it (`disarm`).
+    deletePending: !!s.deletePending && hasEntity,
+    noDeleteConfirmation: !(s.deletePending && hasEntity),
   };
 }
 
@@ -276,18 +282,35 @@ async function refresh(prev: PostState, id: string, actionMessage = ""): Promise
   });
 }
 
+/** #3158 — a confirmed delete in flight. Synchronous and module-level on purpose: two
+ *  confirmDelete dispatches (a double tap) both start from a state that says "armed", and only a
+ *  flag set BEFORE the first await stops the second from issuing its own DELETE — whose late 404
+ *  would otherwise land after, and overwrite, the first one's "deleted". */
+let deleteInFlight = false;
+
+/** #3158 — the confirmation describes THIS visit. Never take it from a persisted snapshot, or a
+ *  reopened record comes back with "Delete this …?" already armed. */
+const DELETE_RUN_KEYS = ["deletePending", "noDeleteConfirmation"] as const;
+
+/** #3158 — clear an armed delete confirmation. */
+const disarm = <T extends { deletePending: boolean }>(s: T): T => ({ ...s, deletePending: false });
+
 const svc = defineService<PostState, {
   load: (s: PostState, arg?: unknown) => Promise<PostState>;
   retry: (s: PostState) => Promise<PostState>;
   publish: (s: PostState) => Promise<PostState>;
   unpublish: (s: PostState) => Promise<PostState>;
   delete: (s: PostState) => Promise<PostState>;
+  cancelDelete: (s: PostState) => Promise<PostState>;
+  confirmDelete: (s: PostState) => Promise<PostState | undefined>;
   /** [rico] #3370 — RichContent's on_link: `{ url }` of the tapped link. */
   openLink: (s: PostState, arg?: unknown) => Promise<PostState>;
 }>("himiOwnerLitePost", {
   state: shape({ status: "loading" }),
+  notHydrated: [...DELETE_RUN_KEYS],
   actions: {
-    load: async (s, arg) => {
+    load: async (s0, arg) => {
+      const s = disarm(s0);
       stashCopy(arg); // absorb the descriptor's onAppear copy-pack param
       const id = idFrom(arg, s.id) || inputId();
       if (!id) return shape({ ...s, status: "error", error: copyParam("ownerPost.errorNoId", "no post id") });
@@ -312,7 +335,8 @@ const svc = defineService<PostState, {
         return shape({ ...s, id, status: "error", error: ownerLoadError(e) });
       }
     },
-    retry: async (s) => {
+    retry: async (s0) => {
+      const s = disarm(s0);
       if (!s.id) return shape({ ...s, status: "error", error: copyParam("ownerPost.errorNoId", "no post id") });
       if (isOwnerPreviewDemo()) {
           const demo = demoDetail(s, s.id);
@@ -334,7 +358,8 @@ const svc = defineService<PostState, {
         return shape({ ...s, status: "error", error: ownerLoadError(e) });
       }
     },
-    publish: async (s) => {
+    publish: async (s0) => {
+      const s = disarm(s0);
       if (isOwnerPreviewDemo() || s.demoNote) return shape({ ...s, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
       if (!s.id) return shape({ ...s, actionMessage: copyParam("ownerPost.noIdMessage", "No post id.") });
       if (s.postStatusRaw === "PUBLISHED") return shape({ ...s, actionMessage: copyParam("ownerPost.alreadyPublished", "Post is already published.") });
@@ -352,7 +377,8 @@ const svc = defineService<PostState, {
         return shape({ ...s, actionMessage: ownerLoadError(e) });
       }
     },
-    unpublish: async (s) => {
+    unpublish: async (s0) => {
+      const s = disarm(s0);
       if (isOwnerPreviewDemo() || s.demoNote) return shape({ ...s, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
       if (!s.id) return shape({ ...s, actionMessage: copyParam("ownerPost.noIdMessage", "No post id.") });
       if (s.postStatusRaw !== "PUBLISHED" && s.postStatusRaw !== "SCHEDULED") {
@@ -372,20 +398,35 @@ const svc = defineService<PostState, {
         return shape({ ...s, actionMessage: ownerLoadError(e) });
       }
     },
-    delete: async (s) => {
-      if (isOwnerPreviewDemo() || s.demoNote) return shape({ ...s, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
-      if (!s.id) return shape({ ...s, actionMessage: copyParam("ownerPost.noIdMessage", "No post id.") });
-      // Optimistic local delete — the list drops the row immediately.
-      await cacheDrop(s.id);
+    // #3158 — destructive, so two steps. `delete` (the Manage card's Delete button)
+    // only ARMS the inline confirmation, which names the record and says it cannot
+    // be undone; `cancelDelete` disarms it; only `confirmDelete` deletes. Anything
+    // that dispatches `delete` directly therefore still asks first.
+    delete: async (s) => shape({ ...s, deletePending: true, actionMessage: "" }),
+    cancelDelete: async (s) => shape({ ...s, deletePending: false }),
+    confirmDelete: async (s0) => {
+      // Nothing armed (a stray dispatch, a rehydrated snapshot) or a delete already running
+      // (a second tap): ignore it — `undefined` leaves the state exactly as it is.
+      if (!s0.deletePending || deleteInFlight) return undefined;
+      deleteInFlight = true;
       try {
-        await deleteDraftPost(s.id);
-        return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerPost.deletedEmpty", "Post deleted."), actionMessage: "" });
-      } catch (e) {
-        if (shouldQueueOwnerWrite(e)) {
-          await queueWrite("tier5.himiOwnerLitePost.delete", { id: s.id });
-          return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerPost.deletedEmpty", "Post deleted."), actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
+        const s = disarm(s0);
+        if (isOwnerPreviewDemo() || s.demoNote) return shape({ ...s, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
+        if (!s.id) return shape({ ...s, actionMessage: copyParam("ownerPost.noIdMessage", "No post id.") });
+        // Optimistic local delete — the list drops the row immediately.
+        await cacheDrop(s.id);
+        try {
+          await deleteDraftPost(s.id);
+          return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerPost.deletedEmpty", "Post deleted."), actionMessage: "" });
+        } catch (e) {
+          if (shouldQueueOwnerWrite(e)) {
+            await queueWrite("tier5.himiOwnerLitePost.delete", { id: s.id });
+            return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerPost.deletedEmpty", "Post deleted."), actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
+          }
+          return shape({ ...s, actionMessage: ownerLoadError(e) });
         }
-        return shape({ ...s, actionMessage: ownerLoadError(e) });
+      } finally {
+        deleteInFlight = false;
       }
     },
     // Only http(s), mailto and tel links reach open_url; a refused link, or one nothing opened, says so, and
@@ -397,4 +438,10 @@ const svc = defineService<PostState, {
   },
 });
 
+// The same reset on a runtime from before `notHydrated` (an older binary on a new bundle).
+if ((globalThis as { himalaya?: { hydrationOptOut?: unknown } }).himalaya?.hydrationOptOut !== true) {
+  const booted = svc.getState?.() as unknown as Record<string, unknown> | undefined;
+  if (booted && typeof booted === "object") Object.assign(booted, { deletePending: false, noDeleteConfirmation: true });
+}
+
 export { svc };

package/templates/retail-store-owner/tier5-src/himi-owner-lite-product/index.ts

@@ -59,6 +59,9 @@ interface ProductState {
   /** Non-empty when showing owner-preview-demo sample data (web preview, no owner bridge). */
   demoNote: string;
   notDemo: boolean;
+  /** #3158 — Delete ARMS a confirmation; only confirmDelete reaches the API. */
+  deletePending: boolean;
+  noDeleteConfirmation: boolean;
 }
 
 /* eslint-disable @typescript-eslint/no-explicit-any */
@@ -143,6 +146,9 @@ function shape(s: Partial<ProductState>): ProductState {
     hideHide: !visible || status !== "ready",
     demoNote: s.demoNote ?? "",
     notDemo: !s.demoNote,
+    // Only a loaded entity can be pending deletion; every other action disarms it (`disarm`).
+    deletePending: !!s.deletePending && hasEntity,
+    noDeleteConfirmation: !(s.deletePending && hasEntity),
   };
 }
 
@@ -265,16 +271,33 @@ async function setVisibility(s: ProductState, visible: boolean, msg: string): Pr
   }
 }
 
+/** #3158 — a confirmed delete in flight. Synchronous and module-level on purpose: two
+ *  confirmDelete dispatches (a double tap) both start from a state that says "armed", and only a
+ *  flag set BEFORE the first await stops the second from issuing its own DELETE — whose late 404
+ *  would otherwise land after, and overwrite, the first one's "deleted". */
+let deleteInFlight = false;
+
+/** #3158 — the confirmation describes THIS visit. Never take it from a persisted snapshot, or a
+ *  reopened record comes back with "Delete this …?" already armed. */
+const DELETE_RUN_KEYS = ["deletePending", "noDeleteConfirmation"] as const;
+
+/** #3158 — clear an armed delete confirmation. */
+const disarm = <T extends { deletePending: boolean }>(s: T): T => ({ ...s, deletePending: false });
+
 const svc = defineService<ProductState, {
   load: (s: ProductState, arg?: unknown) => Promise<ProductState>;
   retry: (s: ProductState) => Promise<ProductState>;
   show: (s: ProductState) => Promise<ProductState>;
   hide: (s: ProductState) => Promise<ProductState>;
   delete: (s: ProductState) => Promise<ProductState>;
+  cancelDelete: (s: ProductState) => Promise<ProductState>;
+  confirmDelete: (s: ProductState) => Promise<ProductState | undefined>;
 }>("himiOwnerLiteProduct", {
   state: shape({ status: "loading" }),
+  notHydrated: [...DELETE_RUN_KEYS],
   actions: {
-    load: async (s, arg) => {
+    load: async (s0, arg) => {
+      const s = disarm(s0);
       stashCopy(arg); // absorb the descriptor's onAppear copy-pack param
       const id = idFrom(arg, s.id) || inputId();
       if (!id) return shape({ ...s, status: "error", error: copyParam("ownerProduct.errorNoId", "no product id") });
@@ -297,7 +320,8 @@ const svc = defineService<ProductState, {
         return shape({ ...s, id, status: "error", error: ownerLoadError(e) });
       }
     },
-    retry: async (s) => {
+    retry: async (s0) => {
+      const s = disarm(s0);
       if (!s.id) return shape({ ...s, status: "error", error: copyParam("ownerProduct.errorNoId", "no product id") });
       if (isOwnerPreviewDemo()) {
           const demo = demoDetail(s, s.id);
@@ -317,25 +341,46 @@ const svc = defineService<ProductState, {
         return shape({ ...s, status: "error", error: ownerLoadError(e) });
       }
     },
-    show: async (s) => setVisibility(s, true, copyParam("ownerProduct.shownMessage", "Product is now visible in your store.")),
-    hide: async (s) => setVisibility(s, false, copyParam("ownerProduct.hiddenMessage", "Product hidden from your store.")),
-    delete: async (s) => {
-      if (isOwnerPreviewDemo() || s.demoNote) return shape({ ...s, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
-      if (!s.id) return shape({ ...s, actionMessage: copyParam("ownerProduct.noIdMessage", "No product id.") });
-      // Optimistic local delete — the list drops the row immediately.
-      await cacheDrop(s.id);
+    show: async (s0) => { const s = disarm(s0); return setVisibility(s, true, copyParam("ownerProduct.shownMessage", "Product is now visible in your store.")); },
+    hide: async (s0) => { const s = disarm(s0); return setVisibility(s, false, copyParam("ownerProduct.hiddenMessage", "Product hidden from your store.")); },
+    // #3158 — destructive, so two steps. `delete` (the Manage card's Delete button)
+    // only ARMS the inline confirmation, which names the record and says it cannot
+    // be undone; `cancelDelete` disarms it; only `confirmDelete` deletes. Anything
+    // that dispatches `delete` directly therefore still asks first.
+    delete: async (s) => shape({ ...s, deletePending: true, actionMessage: "" }),
+    cancelDelete: async (s) => shape({ ...s, deletePending: false }),
+    confirmDelete: async (s0) => {
+      // Nothing armed (a stray dispatch, a rehydrated snapshot) or a delete already running
+      // (a second tap): ignore it — `undefined` leaves the state exactly as it is.
+      if (!s0.deletePending || deleteInFlight) return undefined;
+      deleteInFlight = true;
       try {
-        await deleteProduct(s.id);
-        return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerProduct.deletedEmpty", "Product deleted."), actionMessage: "" });
-      } catch (e) {
-        if (shouldQueueOwnerWrite(e)) {
-          await queueWrite("tier5.himiOwnerLiteProduct.delete", { id: s.id });
-          return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerProduct.deletedEmpty", "Product deleted."), actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
+        const s = disarm(s0);
+        if (isOwnerPreviewDemo() || s.demoNote) return shape({ ...s, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
+        if (!s.id) return shape({ ...s, actionMessage: copyParam("ownerProduct.noIdMessage", "No product id.") });
+        // Optimistic local delete — the list drops the row immediately.
+        await cacheDrop(s.id);
+        try {
+          await deleteProduct(s.id);
+          return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerProduct.deletedEmpty", "Product deleted."), actionMessage: "" });
+        } catch (e) {
+          if (shouldQueueOwnerWrite(e)) {
+            await queueWrite("tier5.himiOwnerLiteProduct.delete", { id: s.id });
+            return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerProduct.deletedEmpty", "Product deleted."), actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
+          }
+          return shape({ ...s, actionMessage: ownerLoadError(e) });
         }
-        return shape({ ...s, actionMessage: ownerLoadError(e) });
+      } finally {
+        deleteInFlight = false;
       }
     },
   },
 });
 
+// The same reset on a runtime from before `notHydrated` (an older binary on a new bundle).
+if ((globalThis as { himalaya?: { hydrationOptOut?: unknown } }).himalaya?.hydrationOptOut !== true) {
+  const booted = svc.getState?.() as unknown as Record<string, unknown> | undefined;
+  if (booted && typeof booted === "object") Object.assign(booted, { deletePending: false, noDeleteConfirmation: true });
+}
+
 export { svc };