@wix/himalaya-cli 0.1391.0 → 0.1393.0

package/templates/events-meetups-owner/tier5-src/himi-owner-lite-post/index.ts

@@ -10,25 +10,24 @@ import { getPost, getDraftPost, publishDraftPost, revertDraftPost, deleteDraftPo
 import { parseRicosJson } from "@himalaya/wix-rich-content";
 import { openRichLink } from "../_shared/rich-content-link.js";
 import { richBody } from "../_shared/rich-body.js";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo, shouldQueueOwnerWrite } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isBridgeUnavailable, isTransportFailure, isOwnerPreviewDemo, ownerDemoFallback, ownerWriteError, isNotFound } from "../_shared/owner-load-error.js";
 import { DEMO_POSTS, DEMO_NOTE, DEMO_SAVE_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
-import { get as dbGet, upsert as dbUpsert, remove as dbRemove, enqueue as dbEnqueue, type DbEntity } from "../_shared/owner-local-db.js";
+import { get as dbGet, upsert as dbUpsert, remove as dbRemove, type DbEntity } from "../_shared/owner-local-db.js";
 import { formatDateMedium } from "../_shared/engine-intl.js";
 import { blankFlags } from "../_shared/detail-facts.js";
 
-// Offline-first (data-offline): owner CRUD is WRITE-BEHIND against the encrypted
-// `owner_posts` entity — publish/unpublish/delete update the local store
-// OPTIMISTICALLY so the detail/list repaint from cache immediately, then the wix
-// write is attempted; if it can't reach the bridge/network the mutation is ENQUEUED
-// for replay on reconnect, and detail reads fall back to the last-synced local row.
+// Offline-first (data-offline): detail reads fall back to the last-synced local row
+// of the encrypted `owner_posts` entity. Publish/unpublish/delete are
+// SERVER-CONFIRMED: the local row changes only after Wix accepts the write; a failed
+// one leaves it alone and tells the owner why. No host replays a queued write, so
+// nothing is queued.
 // Every local-db call is wrapped (try/catch) so a build that ships without the
-// `local_database` grant behaves exactly as before (online-only, no cache/queue).
+// `local_database` grant behaves exactly as before (online-only, no cache).
 const ENTITY = "owner_posts";
 async function cachePut(row: DbEntity): Promise<void> { try { await dbUpsert(ENTITY, row); } catch { /* capability not granted */ } }
 async function cacheDrop(id: string): Promise<void> { try { await dbRemove(ENTITY, id); } catch { /* capability not granted */ } }
 async function cacheGet(id: string): Promise<DbEntity | null> { try { return await dbGet(ENTITY, id); } catch { return null; } }
-async function queueWrite(actionId: string, params: Record<string, string>): Promise<void> { try { await dbEnqueue(actionId, params); } catch { /* capability not granted */ } }
 /** [rico] #3370 — keep the body's plain text with the post's cached row, so the offline detail shows it. It is
  *  merged into the row the posts list wrote rather than replacing it; a later list re-sync writes its own rows
  *  and drops it again, until the detail is next opened online. */
@@ -250,16 +249,39 @@ function cachedDetail(s: PostState, row: DbEntity): PostState {
   });
 }
 
-async function refresh(prev: PostState, id: string, actionMessage = ""): Promise<PostState> {
+/** The re-read after a write Wix CONFIRMED: when it fails — thrown or as an error state
+ *  ("post not found" for a 5xx on both reads) — the confirmed change stays on screen. */
+async function reread(prev: PostState, actionMessage: string, confirmed: PostState): Promise<PostState> {
+  try {
+    // A reread right after a CONFIRMED write never drops the row that write just cached: a
+    // both-404 here is a lagging read, not proof the post is gone.
+    const next = await refresh(prev, prev.id, actionMessage, { dropIfGone: false });
+    return next.status === "error" ? confirmed : next;
+  } catch {
+    return confirmed;
+  }
+}
+
+async function refresh(prev: PostState, id: string, actionMessage = "", opts: { dropIfGone?: boolean } = {}): Promise<PostState> {
   let post: any | undefined;
   let draft: any | undefined;
   let lastError: unknown;
-  try { post = (await getPost(id)).post; } catch (e) { lastError = e; /* draft-only */ }
+  let postError: unknown;
+  try { post = (await getPost(id)).post; } catch (e) { lastError = postError = e; /* draft-only */ }
   try { draft = (await getDraftPost(id)).draftPost; } catch (e) { lastError = e; /* published-only or missing */ }
   if (!post && !draft) {
     // Both arms swallowed their errors above; surface the DESIGNED bridge
-    // boundary so the callers' catches can fall back to the demo post.
-    if (isBridgeUnavailable(lastError)) throw lastError;
+    // boundary (and a device with no connection) so the callers' catches can fall
+    // back to the cached row or the demo post — never "post not found" for a post
+    // that was only unreachable.
+    // Either read counts: a published-only post's draft read is always a 404, so the
+    // published read's failure is the one that says whether the post was only unreachable.
+    for (const err of [postError, lastError]) {
+      if (isBridgeUnavailable(err) || isTransportFailure(err)) throw err;
+    }
+    // Wix says it is gone on BOTH reads (a published-only post's draft read is a 404 on its
+    // own): its cached row must not outlive it, or an offline load repaints a deleted post.
+    if (opts.dropIfGone !== false && isNotFound(postError) && isNotFound(lastError)) await cacheDrop(id);
     return shape({ ...prev, id, status: "error", title: "", error: copyParam("ownerPost.errorNotFound", "post not found"), actionMessage });
   }
   const title = (draft?.title || post?.title || "Untitled post").trim();
@@ -336,9 +358,10 @@ const svc = defineService<PostState, {
         return loaded;
       } catch (e) {
         // Offline: fall back to the last-synced local row before the demo/error paths.
-        const cached = await cacheGet(id);
+        // Wix says it is gone (e.g. a delete whose reply was lost): drop the row, never show it.
+        const cached = isNotFound(e) ? (await cacheDrop(id), null) : await cacheGet(id);
         if (cached) return cachedDetail(s, cached);
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const demo = demoDetail(s, id);
           if (demo) return demo;
         }
@@ -359,9 +382,10 @@ const svc = defineService<PostState, {
         await cacheBodyText(loaded);
         return loaded;
       } catch (e) {
-        const cached = await cacheGet(s.id);
+        // Wix says it is gone (e.g. a delete whose reply was lost): drop the row, never show it.
+        const cached = isNotFound(e) ? (await cacheDrop(s.id), null) : await cacheGet(s.id);
         if (cached) return cachedDetail(s, cached);
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const demo = demoDetail(s, s.id);
           if (demo) return demo;
         }
@@ -373,19 +397,18 @@ const svc = defineService<PostState, {
       if (isOwnerPreviewDemo() || s.demoNote) return shape({ ...s, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
       if (!s.id) return shape({ ...s, actionMessage: copyParam("ownerPost.noIdMessage", "No post id.") });
       if (s.postStatusRaw === "PUBLISHED") return shape({ ...s, actionMessage: copyParam("ownerPost.alreadyPublished", "Post is already published.") });
-      // Optimistic local write — the detail/list repaint from cache immediately.
-      const optimistic = shape({ ...s, postStatusRaw: "PUBLISHED", postStatus: "Published", actionMessage: copyParam("ownerPost.publishedMessage", "Post published.") });
-      await cachePut(cacheRow(optimistic));
       try {
         await publishDraftPost(s.id);
-        return refresh(s, s.id, copyParam("ownerPost.publishedMessage", "Post published."));
       } catch (e) {
-        if (shouldQueueOwnerWrite(e)) {
-          await queueWrite("tier5.himiOwnerLitePost.publish", { id: s.id });
-          return shape({ ...optimistic, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
-        }
-        return shape({ ...s, actionMessage: ownerLoadError(e) });
+        // Nothing replays a queued write: the post is as it was, and the owner is told why.
+        return shape({ ...s, actionMessage: ownerWriteError(e) });
       }
+      // Wix confirmed it: the list repaints from cache at once, and a re-read that fails
+      // afterwards still shows the confirmed change rather than undoing it on screen.
+      const published = copyParam("ownerPost.publishedMessage", "Post published.");
+      const confirmed = shape({ ...s, postStatusRaw: "PUBLISHED", postStatus: "Published", actionMessage: published });
+      await cachePut(cacheRow(confirmed));
+      return reread(s, published, confirmed);
     },
     unpublish: async (s0) => {
       const s = disarm(s0);
@@ -394,19 +417,16 @@ const svc = defineService<PostState, {
       if (s.postStatusRaw !== "PUBLISHED" && s.postStatusRaw !== "SCHEDULED") {
         return shape({ ...s, actionMessage: copyParam("ownerPost.alreadyDraft", "Post is already a draft.") });
       }
-      // Optimistic local write — the detail/list repaint from cache immediately.
-      const optimistic = shape({ ...s, postStatusRaw: "UNPUBLISHED", postStatus: "Draft", actionMessage: "Post moved to drafts." });
-      await cachePut(cacheRow(optimistic));
       try {
         await revertDraftPost(s.id);
-        return refresh(s, s.id, copyParam("ownerPost.unpublishedMessage", "Post moved to drafts."));
       } catch (e) {
-        if (shouldQueueOwnerWrite(e)) {
-          await queueWrite("tier5.himiOwnerLitePost.unpublish", { id: s.id });
-          return shape({ ...optimistic, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
-        }
-        return shape({ ...s, actionMessage: ownerLoadError(e) });
+        // Nothing replays a queued write: the post is as it was, and the owner is told why.
+        return shape({ ...s, actionMessage: ownerWriteError(e) });
       }
+      const unpublished = copyParam("ownerPost.unpublishedMessage", "Post moved to drafts.");
+      const confirmed = shape({ ...s, postStatusRaw: "UNPUBLISHED", postStatus: "Draft", actionMessage: unpublished });
+      await cachePut(cacheRow(confirmed));
+      return reread(s, unpublished, confirmed);
     },
     // #3158 — destructive, so two steps. `delete` (the Manage card's Delete button)
     // only ARMS the inline confirmation, which names the record and says it cannot
@@ -423,18 +443,15 @@ const svc = defineService<PostState, {
         const s = disarm(s0);
         if (isOwnerPreviewDemo() || s.demoNote) return shape({ ...s, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
         if (!s.id) return shape({ ...s, actionMessage: copyParam("ownerPost.noIdMessage", "No post id.") });
-        // Optimistic local delete — the list drops the row immediately.
-        await cacheDrop(s.id);
         try {
           await deleteDraftPost(s.id);
-          return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerPost.deletedEmpty", "Post deleted."), actionMessage: "" });
         } catch (e) {
-          if (shouldQueueOwnerWrite(e)) {
-            await queueWrite("tier5.himiOwnerLitePost.delete", { id: s.id });
-            return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerPost.deletedEmpty", "Post deleted."), actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
-          }
-          return shape({ ...s, actionMessage: ownerLoadError(e) });
+          // Nothing replays a queued write: the post stays, and the owner is told why.
+          return shape({ ...s, actionMessage: ownerWriteError(e) });
         }
+        // Only a delete Wix confirmed leaves the local list.
+        await cacheDrop(s.id);
+        return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerPost.deletedEmpty", "Post deleted."), actionMessage: "" });
       } finally {
         deleteInFlight = false;
       }

package/templates/events-meetups-owner/tier5-src/himi-owner-lite-post-form/index.ts

@@ -10,21 +10,20 @@ import { wixCall } from "@himalaya/wix-site-media";
 import { wixMediaUrl, WIX_DETAIL_IMAGE } from "../_shared/himi-store.js";
 import { defineService } from "@himalaya/state";
 import { getDraftPost, createDraftPost, updateDraftPost, type WixDraftPostWrite, type WixRichContent } from "@himalaya/wix-blog";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo, shouldQueueOwnerWrite } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback, ownerWriteError } from "../_shared/owner-load-error.js";
 import { DEMO_POSTS, DEMO_NOTE, DEMO_SAVE_NOTE, demoRefusalPatch } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
-import { get as dbGet, upsert as dbUpsert, remove as dbRemove, enqueue as dbEnqueue, type DbEntity } from "../_shared/owner-local-db.js";
+import { get as dbGet, upsert as dbUpsert, remove as dbRemove, type DbEntity } from "../_shared/owner-local-db.js";
 
 // Offline-first (data-offline): owner CRUD is WRITE-BEHIND against the encrypted
-// `owner_posts` entity — cache confirmed writes, or enqueue offline edits for
-// replay on reconnect. Failed cover imports must not appear as saved drafts.
+// `owner_posts` entity — cache confirmed writes only; a failed save says nothing was
+// saved (no host replays a queue). Failed cover imports must not appear as saved drafts.
 // Every local-db call is wrapped (try/catch) so a build that ships without the
 // `local_database` grant behaves exactly as before (online-only, no cache/queue).
 const ENTITY = "owner_posts";
 async function cachePut(row: DbEntity): Promise<void> { try { await dbUpsert(ENTITY, row); } catch { /* capability not granted */ } }
 async function cacheDrop(id: string): Promise<void> { try { await dbRemove(ENTITY, id); } catch { /* capability not granted */ } }
 async function cacheGet(id: string): Promise<DbEntity | null> { try { return await dbGet(ENTITY, id); } catch { return null; } }
-async function queueWrite(actionId: string, params: Record<string, string>): Promise<void> { try { await dbEnqueue(actionId, params); } catch { /* capability not granted */ } }
 
 type Mode = "create" | "edit";
 
@@ -223,7 +222,7 @@ const svc = defineService<PostFormState, {
             status: "idle", error: "", savedMessage: "",
           });
         }
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const d = DEMO_POSTS.find((x) => x.id === id);
           if (d) {
             return shape({
@@ -342,23 +341,11 @@ const svc = defineService<PostFormState, {
         await cachePut(localRow(id));
         return savedState(id, editing ? copyParam("ownerPostForm.updatedMessage", "Post updated.") : copyParam("ownerPostForm.createdMessage", "Draft created."));
       } catch (e) {
-        if (shouldQueueOwnerWrite(e)) {
-          // Demo / web-preview (no owner bridge; the record came from demo sample
-          // data, marked by demoNote): a queued write could never replay, so answer
-          // with the demo save note instead of the real-offline write-behind.
-          if (s.demoNote) return demoRefusal(s);
-          // Real device offline: cache and queue the edit for reconnect. `preserveBody` stays
-          // "true" even for a body edit, so a bundle rolled back past this change keeps the stored
-          // body rather than flattening it to text. This bundle replays `richContentJson`.
-          await cachePut(localRow(localId));
-          await queueWrite("tier5.himiOwnerLitePostForm.submit", {
-            id: targetId, title, excerpt, coverUrl, coverChanged: String(coverChanged), preserveBody: "true",
-            body: postBodyText(kept), ...(bodyEdited ? { richContentJson: bodyRaw } : {}),
-            isFeatured: String(isFeatured), mode: editing ? "edit" : "create",
-          });
-          return savedState(localId, copyParam("ownerPostForm.savedOffline", "Saved offline — will sync when you reconnect."));
-        }
-        return shape({ ...s, status: "error", error: ownerLoadError(e), savedMessage: "" });
+        // Demo / web-preview: the record came from demo sample data (marked by demoNote).
+        if (s.demoNote) return demoRefusal(s);
+        // Never "saved offline": nothing replays a queued write on any platform. The
+        // typed values stay in the form (the body in its editor), so a retry is one tap.
+        return shape({ ...s, title, excerpt, coverUrl, isFeatured: isFeatured ? "true" : "false", status: "error", error: ownerWriteError(e), savedMessage: "" });
       }
     })()),
   },

package/templates/events-meetups-owner/tier5-src/himi-owner-lite-posts/index.ts

@@ -4,7 +4,7 @@
 
 import { defineService } from "../_shared/collection-service.js";
 import { queryPosts, queryDraftPosts } from "@himalaya/wix-blog";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_shared/owner-load-error.js";
 import { DEMO_POSTS, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { getAll, upsert, type DbEntity } from "../_shared/owner-local-db.js";
@@ -227,7 +227,7 @@ async function loadList(s: PostsState): Promise<PostsState> {
   } catch (e) {
     // Offline / fetch failure: keep the last-synced cache BEFORE the demo/error fallbacks.
     if (cached.length) return base;
-    if (isBridgeUnavailable(e)) return demoList(s);
+    if (ownerDemoFallback(e)) return demoList(s);
     return shape({ ...s, status: "error", allPosts: [], posts: [], error: ownerLoadError(e) });
   }
 }

package/templates/events-meetups-owner/tier5-src/himi-owner-lite-sites/index.ts

@@ -8,7 +8,7 @@
 
 import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_shared/owner-load-error.js";
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { getAll, upsert, type DbEntity } from "../_shared/owner-local-db.js";
@@ -165,7 +165,7 @@ async function loadList(s: SitesState): Promise<SitesState> {
   } catch (e) {
     // Offline / fetch failure: keep the last-synced cache BEFORE the demo/error fallbacks.
     if (repairedCache.length) return base;
-    if (isBridgeUnavailable(e)) return demoList(s);
+    if (ownerDemoFallback(e)) return demoList(s);
     return shape({ ...s, status: "error", allSites: [], sites: [], error: ownerLoadError(e) });
   }
 }

package/templates/events-meetups-owner/tier5-src/himi-owner-lite-today/index.ts

@@ -0,0 +1,315 @@
+// Tier-5 bundle: __HIMI_APP_NAME__ — TODAY. The worker behind the Home Screen widget.
+//
+// A WidgetKit extension (and a Glance receiver) runs no JS and holds no Wix session, and the OTA
+// widget producer has no credential either, so neither can read an owner's business. The PHONE
+// app runs this worker headlessly with its owner Wix bridge, resolves the widget descriptors'
+// `$service:ownerToday.*` leaves to literals (CompanionDescriptorResolver, the same pattern the
+// watch companion uses), and writes the frozen tree to the App Group for the widget to render.
+//
+// One owner glance: "what's next, and what is waiting for me" — the next booking, the booking
+// requests waiting on the owner, and the orders that need attention. Read-only: a widget never
+// writes to the business.
+//
+// Each source degrades on its own. A site without Bookings answers 428/404 on the bookings
+// query, and that must not cost the order count (or the reverse).
+
+import { defineService } from "@himalaya/state";
+import { queryBookings } from "@himalaya/wix-bookings";
+import { searchOrders } from "@himalaya/wix-ecom";
+import { ownerOrderAttentionFilter } from "../_shared/owner-order-attention.js";
+import { readSelectedSite } from "../_shared/owner-selected-site.js";
+
+type Rec = Record<string, unknown>;
+
+/** One booking as the widget shows it. Client FIRST name only: a Home Screen is visible to
+ *  anyone near the phone. */
+export interface TodayBooking {
+  bookingId: string;
+  name: string;
+  service: string;
+  timeLabel: string; // "10:30"
+  dayLabel: string; // "Today" / "Tomorrow" / "Thu 16 Oct"
+  /** "Today 10:30" — the absolute moment, never a countdown: a frozen "in 21 min" is wrong a
+   *  minute later, and nothing re-renders the widget between app foregrounds. */
+  whenLabel: string;
+}
+
+export interface TodayState {
+  status: "loading" | "ready" | "error" | "signedOut";
+  siteName: string;
+  /** Header line: "Today · <site>", or "Today" when the site has no name yet. */
+  header: string;
+  next: TodayBooking;
+  hasNext: boolean;
+  /** Hide the next-booking block: nothing is booked, or Bookings cannot be read. */
+  hideNext: boolean;
+  /** "No upcoming bookings" — shown in place of the block when Bookings has nothing ahead. */
+  nextNote: string;
+  hideNextNote: boolean;
+  requestCount: number;
+  /** "2 requests" / "1 request" / "No requests". At the read cap: "50+ requests". */
+  requestLabel: string;
+  orderCount: number;
+  /** "3 orders to handle" / "1 order to handle" / "No orders waiting". */
+  orderLabel: string;
+  /** Compact counts for the small widget: "2 req · 3 orders". */
+  countsShort: string;
+  bookingsReady: boolean;
+  ordersReady: boolean;
+  hideRequests: boolean;
+  hideOrders: boolean;
+  /** One-line state copy for a degrade (signed out, read failed, nothing installed). */
+  message: string;
+  hideMessage: boolean;
+  /** Epoch SECONDS after which this frame's labels are wrong: the next local midnight ("Today" /
+   *  "Tomorrow" shift) or the next booking's start (it is no longer "next"), whichever is first.
+   *  The phone caps the snapshot's lifetime at it, so a frozen frame never outlives its words. */
+  validUntil: number;
+}
+
+/** Which verticals THIS build provisions — baked into the widget descriptors' `input`. A vertical
+ *  the build does not show is never read: its count must not reach the compact line, and its
+ *  transient failure must not withhold a frame about the sections the build does show. */
+export interface Verticals {
+  bookings: boolean;
+  store: boolean;
+}
+
+export const COPY = {
+  signedOut: "Sign in to Owner to see today",
+  error: "Open Owner to refresh",
+  nothing: "Open Owner to see your business",
+  noneUpcoming: "No upcoming bookings",
+} as const;
+
+const PENDING = ["PENDING", "PENDING_APPROVAL", "WAITING_LIST"];
+/** A glance, not a list: a count at the cap reads as "50+". */
+export const LIMIT = 50;
+
+const WEEKDAYS = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
+const MONTHS = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
+
+function str(r: unknown, ...paths: string[]): string {
+  for (const path of paths) {
+    let v: unknown = r;
+    for (const k of path.split(".")) v = v && typeof v === "object" ? (v as Rec)[k] : undefined;
+    if (typeof v === "string" && v) return v;
+    if (typeof v === "number") return String(v);
+  }
+  return "";
+}
+
+function hhmm(d: Date): string {
+  return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
+}
+
+function sameLocalDay(a: Date, b: Date): boolean {
+  return a.getFullYear() === b.getFullYear() && a.getMonth() === b.getMonth() && a.getDate() === b.getDate();
+}
+
+/** The day a booking falls on, as an owner would say it. */
+export function dayLabel(start: Date, now: Date): string {
+  if (sameLocalDay(start, now)) return "Today";
+  const tomorrow = new Date(now.getFullYear(), now.getMonth(), now.getDate() + 1);
+  if (sameLocalDay(start, tomorrow)) return "Tomorrow";
+  return `${WEEKDAYS[start.getDay()]} ${start.getDate()} ${MONTHS[start.getMonth()]}`;
+}
+
+function startOf(b: Rec): string {
+  return str(b, "startDate", "bookedEntity.slot.startDate");
+}
+
+function booking(b: Rec, now: Date): TodayBooking {
+  const start = new Date(startOf(b));
+  const day = dayLabel(start, now);
+  return {
+    bookingId: str(b, "id"),
+    name: str(b, "contactDetails.firstName") || "Client",
+    service: str(b, "bookedEntity.title", "bookedEntity.slot.serviceName") || "Appointment",
+    timeLabel: hhmm(start),
+    dayLabel: day,
+    whenLabel: `${day} ${hhmm(start)}`,
+  };
+}
+
+const EMPTY_BOOKING: TodayBooking = { bookingId: "", name: "", service: "", timeLabel: "", dayLabel: "", whenLabel: "" };
+
+function counted(n: number, capped: boolean, one: string, many: string): string {
+  return `${capped ? `${LIMIT}+` : n} ${n === 1 && !capped ? one : many}`;
+}
+
+export interface Sources {
+  /** Upcoming CONFIRMED bookings, or null when Bookings could not be read. */
+  bookings: Rec[] | null;
+  /** Upcoming booking REQUESTS (pending statuses), read on their own: one page of every status
+   *  would fill with a busy week's confirmed bookings and hide next week's request. */
+  requests: Rec[] | null;
+  /** Orders needing attention, or null when Store could not be read. */
+  orders: Rec[] | null;
+}
+
+function upcoming(rows: Rec[] | null, statuses: string[], now: Date): Rec[] {
+  return (rows ?? [])
+    .filter((b) => str(b, "id") && statuses.includes(str(b, "status").toUpperCase()))
+    .filter((b) => Date.parse(startOf(b)) >= now.getTime())
+    .sort((a, b) => Date.parse(startOf(a)) - Date.parse(startOf(b)) || str(a, "id").localeCompare(str(b, "id")));
+}
+
+/** Pure: shape what was read into the widget state. `now` is injectable for tests. */
+export function shape(sources: Sources, now: Date, siteName: string): TodayState {
+  const bookingsReady = sources.bookings !== null && sources.requests !== null;
+  const ordersReady = sources.orders !== null;
+  // Re-filtered even though the queries filter: a server (or a fixture) that returns a
+  // cancelled or past row must not become an appointment the owner is told to expect.
+  const confirmed = bookingsReady ? upcoming(sources.bookings, ["CONFIRMED"], now) : [];
+  // Today's next CONFIRMED booking first: a request is not an appointment yet. With none left
+  // today, the first confirmed one after today, so "what's next" still has an answer.
+  const next = confirmed.find((b) => sameLocalDay(new Date(startOf(b)), now)) ?? confirmed[0];
+  const requestCount = bookingsReady ? upcoming(sources.requests, PENDING, now).length : 0;
+  const orderCount = (sources.orders ?? []).length;
+  const requestsCapped = (sources.requests ?? []).length >= LIMIT;
+  const ordersCapped = orderCount >= LIMIT;
+
+  const shortParts = [
+    ...(bookingsReady ? [`${requestsCapped ? `${LIMIT}+` : requestCount} req`] : []),
+    ...(ordersReady ? [counted(orderCount, ordersCapped, "order", "orders")] : []),
+  ];
+  const nothing = !bookingsReady && !ordersReady;
+  const nextNote = bookingsReady && !next ? COPY.noneUpcoming : "";
+  const midnight = new Date(now.getFullYear(), now.getMonth(), now.getDate() + 1).getTime();
+  const nextStart = next ? Date.parse(startOf(next)) : Infinity;
+  return {
+    validUntil: Math.floor(Math.min(midnight, nextStart) / 1000),
+    status: "ready",
+    siteName,
+    header: siteName ? `Today · ${siteName}` : "Today",
+    next: next ? booking(next, now) : EMPTY_BOOKING,
+    hasNext: !!next,
+    hideNext: !next,
+    nextNote,
+    hideNextNote: !nextNote,
+    requestCount,
+    requestLabel: requestCount ? counted(requestCount, requestsCapped, "request", "requests") : "No requests",
+    orderCount,
+    orderLabel: orderCount ? `${counted(orderCount, ordersCapped, "order", "orders")} to handle` : "No orders waiting",
+    countsShort: shortParts.join(" · "),
+    bookingsReady,
+    ordersReady,
+    hideRequests: !bookingsReady,
+    hideOrders: !ordersReady,
+    message: nothing ? COPY.nothing : "",
+    hideMessage: !nothing,
+  };
+}
+
+/** A degrade frame: ONE line, no rows. After a sign-out or a business switch the last rows
+ *  belong to someone else's clients, so none of them survive into it. */
+export function degraded(status: "error" | "signedOut" | "loading", siteName: string): TodayState {
+  // A FIXED instant, not the clock: a degrade frame has no rows, so nothing in it depends on
+  // the time — and the initial state must be deterministic (template contract: no worker's
+  // initial state may read the clock).
+  const base = shape({ bookings: null, requests: null, orders: null }, new Date(0), siteName);
+  const message = status === "signedOut" ? COPY.signedOut : status === "error" ? COPY.error : "";
+  // validUntil pinned too: shape() derives it from LOCAL midnight, so even at a fixed instant it
+  // would vary with the build machine's timezone and change the baked services hash.
+  return { ...base, status, message, hideMessage: !message, validUntil: 0 };
+}
+
+/** No usable owner session behind the bridge (the bridge refusing, or a 401). A transient
+ *  5xx is an ordinary error, not a sign-out — and a 403 is a missing PERMISSION for one
+ *  vertical (a collaborator whose role lacks Bookings), not a sign-out either. */
+export function isSignedOut(e: unknown): boolean {
+  const text = String((e as Error)?.message ?? e);
+  return /^HTTP 401\b/.test(text) || /wixApi not enabled|session unavailable|not signed in|webwix_bridge/i.test(text);
+}
+
+/** This section cannot exist for this owner: the vertical is not installed on the site (its
+ *  API answers 428, or 404 for the route), or the owner's role may not read it (403). Hides
+ *  that one section; every other failure is an error for the whole frame.
+ *
+ *  Read from the LEADING status only — the bridges format a failure as `HTTP <status>: <body>`
+ *  or `HTTP <status> [<code>]: <message>` — never from anywhere in the message: a transient
+ *  `HTTP 503: {"message":"upstream returned 404"}` must stay an error, not hide the section. */
+export function isSectionUnavailable(e: unknown): boolean {
+  const text = String((e as Error)?.message ?? e);
+  return /^HTTP (?:403|404|428)\b/.test(text) || /^HTTP \d{3} \[(?:FAILED_PRECONDITION|PERMISSION_DENIED)\]/.test(text);
+}
+
+function siteName(): string {
+  return readSelectedSite()?.name ?? "";
+}
+
+type Read = { ok: true; value: unknown } | { ok: false; error: unknown };
+
+async function attempt(fn: () => Promise<unknown>): Promise<Read> {
+  try {
+    return { ok: true, value: await fn() };
+  } catch (error) {
+    return { ok: false, error };
+  }
+}
+
+function rows(r: Read, key: string): Rec[] | null {
+  if (!r.ok) return null;
+  const list = (r.value as Rec | undefined)?.[key];
+  return Array.isArray(list) ? (list as Rec[]) : [];
+}
+
+/** The build's verticals from the descriptor's baked `input.verticals` ("bookings,store"). A
+ *  host that passes none (an older descriptor) reads both, as before. */
+export function buildVerticals(): Verticals {
+  const raw = (globalThis as { himalaya?: { input?: Record<string, unknown> } }).himalaya?.input?.verticals;
+  if (typeof raw !== "string") return { bookings: true, store: true };
+  const set = new Set(raw.split(",").map((v) => v.trim()));
+  return { bookings: set.has("bookings"), store: set.has("store") };
+}
+
+/** A section this build does not provision: never read, and indistinguishable from "not
+ *  installed" downstream (hidden, out of the compact line, out of the error rule). */
+const NOT_PROVISIONED: Read = { ok: false, error: new Error("HTTP 404: not provisioned in this build") };
+
+async function read(): Promise<TodayState> {
+  const nowIso = new Date().toISOString();
+  const verticals = buildVerticals();
+  const sort = [{ fieldName: "startDate", order: "ASC" }, { fieldName: "id", order: "ASC" }];
+  const bookingsBy = (statuses: string[]) => verticals.bookings ? attempt(() => queryBookings({ query: {
+    filter: { startDate: { $gte: nowIso }, status: { $in: statuses } },
+    sort,
+    paging: { limit: LIMIT, offset: 0 },
+  } })) : Promise.resolve(NOT_PROVISIONED);
+  const reads = await Promise.all([
+    bookingsBy(["CONFIRMED"]),
+    bookingsBy(PENDING),
+    verticals.store ? attempt(() => searchOrders({ search: {
+      filter: ownerOrderAttentionFilter(),
+      sort: [{ fieldName: "createdDate", order: "DESC" }, { fieldName: "id", order: "ASC" }],
+      cursorPaging: { limit: LIMIT },
+    } })) : Promise.resolve(NOT_PROVISIONED),
+  ]);
+  const failures = reads.flatMap((r) => (r.ok ? [] : [r.error]));
+  if (failures.some(isSignedOut)) return degraded("signedOut", "");
+  // A section that cannot exist (not installed, no permission) is hidden. ANY other failure —
+  // a transient 5xx on one read included — makes this an error frame, which the phone does
+  // not publish: the last good frame stays, rather than a frame that silently drops a
+  // section the owner does have and reads as "nothing waiting".
+  if (failures.some((e) => !isSectionUnavailable(e))) return degraded("error", siteName());
+  const [bookings, requests, orders] = reads;
+  return shape({
+    bookings: rows(bookings, "bookings"),
+    requests: rows(requests, "bookings"),
+    orders: rows(orders, "orders"),
+  }, new Date(), siteName());
+}
+
+const svc = defineService<TodayState, {
+  load: (s: TodayState) => Promise<TodayState>;
+  refresh: (s: TodayState) => Promise<TodayState>;
+}>("ownerToday", {
+  state: degraded("loading", ""),
+  actions: {
+    load: async () => read(),
+    refresh: async () => read(),
+  },
+});
+
+export { svc };