@wix/himalaya-cli 0.1391.0 → 0.1393.0

package/templates/podcast-creator-owner/tier5-src/_shared/owner-booking-respond.ts

@@ -0,0 +1,82 @@
+// Accept / Decline ONE booking request — the write shared by the two __HIMI_APP_NAME__ surfaces that
+// answer a request without opening the booking screen: the paired watch (`himi-owner-lite-wrist`)
+// and the notification's action buttons (`himi-owner-lite-nav`).
+//
+// Both follow the same rules:
+//   • the press names the business it was shown for, and is REFUSED unless that is the business
+//     the phone has active — a site switched between delivery and press must never confirm
+//     another business's booking;
+//   • the write itself is addressed at that business (`wix-site-id`), so even a switch that lands
+//     between the check and the request cannot move it;
+//   • only a request still pending is written, at the revision Wix last reported.
+
+import { getBooking, confirmBooking, declineBooking } from "@himalaya/wix-bookings";
+
+type Rec = Record<string, unknown>;
+
+/** The statuses that are waiting on the owner. */
+export const PENDING_BOOKING_STATUSES: ReadonlySet<string> = new Set(["PENDING", "PENDING_APPROVAL", "WAITING_LIST"]);
+
+export type BookingResponse = "confirm" | "decline";
+
+/** A press may write only for the business the phone has active. Fails CLOSED: a press that
+ *  names no business, or a host that cannot say which one is active, writes nothing. */
+export function isForActiveBusiness(siteId: string, activeSiteId: string): boolean {
+  return !!siteId && !!activeSiteId && siteId === activeSiteId;
+}
+
+/** Wix refused the write because the booking moved on (another revision, already handled). */
+export function isStaleBookingWrite(e: unknown): boolean {
+  return /revision|\b409\b|ABORTED|conflict/i.test(String((e as Error)?.message ?? e));
+}
+
+/** Confirm or decline `bookingId` at `revision`, addressed at `siteId`. Rejects without a
+ *  request when `siteId` is empty: an unaddressed write would land on whatever business the
+ *  ambient bridge is scoped to. */
+export function writeBookingResponse(kind: BookingResponse, bookingId: string, revision: string, siteId: string): Promise<unknown> {
+  const site = siteId.trim();
+  if (!site) return Promise.reject(new Error("writeBookingResponse: a booking write must name its business"));
+  const opts = { site };
+  return kind === "confirm" ? confirmBooking(bookingId, revision, opts) : declineBooking(bookingId, revision, false, opts);
+}
+
+export type BookingResponseOutcome =
+  | "confirmed" | "declined"
+  /** Not written: no booking id, or a press for a business other than the active one. */
+  | "refused"
+  /** Not written: the booking is no longer waiting on the owner (or no longer exists). */
+  | "notPending"
+  /** Not written: Wix reported a newer revision between the read and the write. */
+  | "stale"
+  /** Not written: the read or the write failed. */
+  | "failed";
+
+function str(r: Rec | undefined, key: string): string {
+  const v = r?.[key];
+  return typeof v === "string" ? v : typeof v === "number" ? String(v) : "";
+}
+
+/** Answer a request known only by id — a notification carries no revision, so the booking is
+ *  read first (from the business the press names) and written only while it is still pending. */
+export async function respondToBookingById(
+  kind: BookingResponse,
+  bookingId: string,
+  siteId: string,
+  activeSiteId: string,
+): Promise<BookingResponseOutcome> {
+  if (!bookingId || !isForActiveBusiness(siteId, activeSiteId)) return "refused";
+  let booking: Rec | undefined;
+  try {
+    booking = ((await getBooking(bookingId, { site: siteId })) as unknown as { booking?: Rec } | undefined)?.booking;
+  } catch {
+    return "failed";
+  }
+  const revision = str(booking, "revision");
+  if (!booking || !revision || !PENDING_BOOKING_STATUSES.has(str(booking, "status"))) return "notPending";
+  try {
+    await writeBookingResponse(kind, bookingId, revision, siteId);
+  } catch (e) {
+    return isStaleBookingWrite(e) ? "stale" : "failed";
+  }
+  return kind === "confirm" ? "confirmed" : "declined";
+}

package/templates/podcast-creator-owner/tier5-src/_shared/owner-load-error.ts

@@ -20,10 +20,9 @@ export function isOwnerPreviewLive(): boolean {
  *
  * `isBridgeUnavailable` cannot answer this: it reads "not live" as "preview",
  * and on NATIVE there is no input at all, so `undefined` satisfies it. That is
- * harmless for the callers that use it to pick a demo fallback or to queue a
- * write, and it is deliberately left alone for them — native write-behind
- * depends on it. It is NOT harmless for choosing COPY: native workers format
- * their failures the same way (`"HTTP \(code): \(body)"`, JSWorker.swift;
+ * left alone for the other apps that use it to pick a demo fallback or to queue
+ * a write. Owner-lite reads ask `ownerDemoFallback` instead. It is NOT
+ * harmless for choosing COPY: native workers format their failures the same way (`"HTTP \(code): \(body)"`, JSWorker.swift;
  * `"HTTP ${e.code}: ..."`, WebViewJSWorker.kt), so a transient `HTTP 503` on a
  * phone would otherwise be answered with "open this app on a device" — on the
  * device. Callers that pick a SENTENCE ask this instead.
@@ -43,11 +42,89 @@ export function isBridgeUnavailable(e: unknown): boolean {
   return /HTTP (405|501|502|503)\b/.test(String((e as Error)?.message ?? e));
 }
 
-/** Preserve native write-behind when the bridge is unavailable. This is a
- * queue decision, never permission to replace a failed live read with samples. */
-export function shouldQueueOwnerWrite(e: unknown): boolean {
-  if (ownerPreviewMode() === "live" || isOwnerPreviewDemo()) return false;
-  return /HTTP (405|501|502|503)\b/.test(String((e as Error)?.message ?? e));
+/**
+ * Whether a failed owner-lite READ may answer with the built-in demo records.
+ *
+ * Only where a demo was asked for: a web preview host that is not live. On a phone no
+ * mode is injected, so `isBridgeUnavailable` alone is `true` for a transient Wix
+ * `HTTP 503` — and the owner was shown sample appointments, orders and sites as if
+ * they were their business. Native falls through to the screen's error state.
+ * `isBridgeUnavailable` keeps its semantics: other apps' callers depend on it.
+ */
+export function ownerDemoFallback(e: unknown): boolean {
+  return isOwnerPreviewHost() && !isOwnerPreviewLive() && isBridgeUnavailable(e);
+}
+
+/**
+ * The sentence for an owner WRITE that failed because the device could not reach Wix at
+ * all (a transport failure). Nothing replays a queued write on any platform — every host's
+ * `drain` passes an empty closure — so the honest answer is that nothing was saved.
+ * Copy-as-configuration under `ownerCommon.`, which every owner screen forwards.
+ */
+export function ownerOfflineNotSaved(): string {
+  return copyParam(
+    "ownerCommon.offlineNotSaved",
+    "You’re offline — nothing was saved. Try again when you reconnect.",
+  );
+}
+
+/** The sentence for an owner WRITE that Wix answered with an unavailable status: the
+ *  device is online, so it is not "offline" — but nothing was saved all the same. */
+/**
+ * Whether a failed WRITE may have landed on Wix anyway, so the user must not be told it
+ * was not saved: a transport failure mid-request (timeout, reset, fetch rejection), the web
+ * host's after-send envelope (`HTTP 502 {…"sent":true}`), the serve bridge's mid-request
+ * `webwix_bridge_upstream_failed`, or a gateway status (502/503/504) that can arrive after
+ * the backend already ran. Only connect-time failures (`isOfflineFailure`) and the designed
+ * 405/501 bridge refusals prove nothing happened.
+ */
+export function writeMayHaveLanded(e: unknown): boolean {
+  if (isOfflineFailure(e)) return false;
+  if (isTransportFailure(e)) return true;
+  const msg = String((e as Error)?.message ?? e ?? "");
+  if (/"sent"\s*:\s*true/.test(msg)) return true;
+  // The web host's own envelope WITHOUT `sent: true` failed before the request left it, and
+  // a disabled owner rung / bridge refuses by design without sending anything.
+  if (/\bwebwix_(?:direct_failed|owner_disabled|bridge_disabled)\b/.test(msg)) return false;
+  // `webwix_bridge_upstream_failed` stays ambiguous: the same code covers a lookup that failed
+  // before sending and a serve-bridge failure mid-request, and nothing in it says which.
+  return /\bwebwix_bridge_upstream_failed\b/.test(msg) || /HTTP (502|503|504)\b/.test(msg);
+}
+
+/** Wix answered that the record does not exist (`HTTP 404`). A detail must not fall back to
+ *  its cached row then: that row is what a delete whose reply was lost leaves behind. */
+export function isNotFound(e: unknown): boolean {
+  if (/HTTP 404\b/.test(String((e as Error)?.message ?? e ?? ""))) return true;
+  // An SDK that answers a 404 with its own "not found" error keeps the HTTP one as `cause`
+  // (the blog SDK's getPost, after its query fallback also finds nothing).
+  const cause = (e as { cause?: unknown } | null | undefined)?.cause;
+  return cause !== undefined && cause !== e && /HTTP 404\b/.test(String((cause as Error)?.message ?? cause));
+}
+
+export function ownerUnavailableNotSaved(): string {
+  return copyParam(
+    "ownerCommon.unavailableNotSaved",
+    "Wix isn’t available right now — nothing was saved. Try again in a moment.",
+  );
+}
+
+/** The sentence for an owner WRITE that may have landed (`writeMayHaveLanded`): it can't
+ *  be called saved or not saved. */
+export function ownerWriteUnconfirmed(): string {
+  return copyParam(
+    "ownerCommon.writeUnconfirmed",
+    "Wix didn’t confirm this, so it may or may not have been saved. Check before trying again.",
+  );
+}
+
+/** Display copy for a failed owner write: `ownerOfflineNotSaved` when the request never
+ *  left the device, `ownerWriteUnconfirmed` when it may have landed, `ownerUnavailableNotSaved`
+ *  for the designed 405/501 bridge refusals outside a live preview, else `ownerLoadError`. */
+export function ownerWriteError(e: unknown): string {
+  if (isOfflineFailure(e)) return ownerOfflineNotSaved();
+  if (writeMayHaveLanded(e)) return ownerWriteUnconfirmed();
+  if (!isOwnerPreviewLive() && /HTTP (405|501)\b/.test(String((e as Error)?.message ?? e))) return ownerUnavailableNotSaved();
+  return ownerLoadError(e);
 }
 
 /** `HTTP 403: …` → "403", when the message carries a status at all. */
@@ -99,6 +176,10 @@ const TRANSPORT = [
   /^Failed to connect to \S/,
   /^Unable to resolve host\b/,
   /\b(?:Connection refused|Network is unreachable|Software caused connection abort)\b/,
+  // OkHttp / HttpURLConnection messages a dropped connection produces mid-request, which
+  // Android's bridge forwards without the exception class.
+  /\b(?:Connection reset|ECONNRESET|ETIMEDOUT|EPIPE|Broken pipe|stream was reset)\b/,
+  /^unexpected end of stream\b/i,
   /^(?:timeout|Read timed out|connect timed out)$/i,
   /\bFailed to fetch\b/,
   /\bNetworkError when attempting to fetch\b/,
@@ -113,6 +194,27 @@ export function isTransportFailure(e: unknown): boolean {
   return TRANSPORT.some((re) => re.test(msg));
 }
 
+/** Transport failures that happen while CONNECTING — no connection, no route, no such host,
+ *  connection refused — so the request provably never left the device. Every other
+ *  transport failure (a timeout, a reset, a bad or truncated response, a browser's fetch
+ *  rejection, which says nothing about when it failed) may come after Wix took the write. */
+const NEVER_SENT = [
+  /\bNSURLErrorDomain Code=-10(?:09|04|03|06|20|18)\b/,  // not connected / cannot connect / no host / DNS / data not allowed / roaming off
+  /\b(?:UnknownHost|Connect|NoRouteToHost)Exception\b/,
+  /^Failed to connect to \S/,
+  /^Unable to resolve host\b/,
+  /\b(?:Connection refused|Network is unreachable)\b/,
+  /\bnet::ERR_(?:INTERNET_DISCONNECTED|NAME_NOT_RESOLVED|CONNECTION_REFUSED|ADDRESS_UNREACHABLE|NETWORK_ACCESS_DENIED)\b/,
+];
+
+/** No HTTP answer, and the request provably never left the device: the user is offline, and
+ *  a write certainly did not happen. Anything else may have landed (see `NEVER_SENT`). */
+export function isOfflineFailure(e: unknown): boolean {
+  if (!isTransportFailure(e)) return false;
+  const msg = String((e as Error)?.message ?? e ?? "");
+  return NEVER_SENT.some((re) => re.test(msg));
+}
+
 /** The one sentence for a transport failure. Copy-as-configuration: the key is
  *  under `ownerCommon.`, which every owner screen (Aria included) forwards. */
 export function ownerTransportFailureText(): string {
@@ -194,8 +296,8 @@ export function ownerPreviewUnavailable(): string {
  * error says: this names the web preview when there IS one. `isBridgeUnavailable`
  * reads "not live" as "preview", and native injects no mode at all, so the
  * default would answer a device-side `HTTP 503` with "open this app on a device"
- * — on the device. That predicate is deliberately left alone: native
- * write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
+ * — on the device. That predicate is deliberately left alone: other apps'
+ * demo and write-queue decisions depend on exactly it.
  *
  * The reductions this used to add are now in `humanWireError`, so every owner
  * screen gets them rather than the two that happened to call this.
@@ -232,6 +334,7 @@ export function ownerDisplayError(e: unknown): string {
  */
 export function ownerLoadError(e: unknown): string {
   const msg = String((e as Error)?.message ?? e);
-  if (isBridgeUnavailable(e)) return ownerPreviewUnavailable();
+  // Same host guard as `ownerDisplayError`: on a phone, "open this app on a device" is false.
+  if (isOwnerPreviewHost() && isBridgeUnavailable(e)) return ownerPreviewUnavailable();
   return humanWireError(msg);
 }

package/templates/podcast-creator-owner/tier5-src/himi-owner-lite-account/index.ts

@@ -9,7 +9,8 @@
 //     which goes stale the moment the binary is bumped);
 //   • the help / privacy / terms links, which arrive as onAppear params baked
 //     from provisioning.json `identity` — so a branded template ships ITS links,
-//     and `openLink` can only ever open one of those three URLs.
+//     and `openLink` can only ever open one of those URLs — plus Wix's own
+//     account-deletion page (`deleteAccountUrl`, App Store 5.1.1(v)).
 //
 //   • which business this is — the one the owner picked on Sites (see
 //     `_shared/owner-selected-site.ts`), not the build-time provisioning name,
@@ -27,7 +28,7 @@ import { stashCopy, copyTemplate } from "../_shared/himi-copy.js";
 import { ownerLineOf, shapeAccount, type AccountState } from "../_shared/owner-account.js";
 import { fallbackNameFrom, selectedSiteName } from "../_shared/owner-selected-site.js";
 
-type LinkKind = "support" | "privacy" | "terms";
+type LinkKind = "support" | "privacy" | "terms" | "deleteAccount";
 
 const obj = (v: unknown): Record<string, unknown> => (v && typeof v === "object" ? v as Record<string, unknown> : {});
 
@@ -44,7 +45,8 @@ const svc = defineService<AccountState, {
       fallbackBusinessName = fallbackNameFrom(arg, fallbackBusinessName);
       const businessName = selectedSiteName(fallbackBusinessName);
       const p = obj(arg);
-      const links = { supportUrl: String(p.supportUrl ?? s.supportUrl), privacyUrl: String(p.privacyUrl ?? s.privacyUrl), termsUrl: String(p.termsUrl ?? s.termsUrl) };
+      const links = { supportUrl: String(p.supportUrl ?? s.supportUrl), privacyUrl: String(p.privacyUrl ?? s.privacyUrl), termsUrl: String(p.termsUrl ?? s.termsUrl),
+        deleteAccountUrl: String(p.deleteAccountUrl ?? s.deleteAccountUrl) };
       let ownerLine = "";
       // Why the identity line is missing, when it is. Kept in state (the failure is
       // modelled, not swallowed) but not painted: a settings screen that cannot name
@@ -68,7 +70,8 @@ const svc = defineService<AccountState, {
     },
     openLink: async (s, arg) => {
       const kind = String(obj(arg).kind ?? arg ?? "") as LinkKind;
-      const url = kind === "support" ? s.supportUrl : kind === "privacy" ? s.privacyUrl : kind === "terms" ? s.termsUrl : "";
+      const url = kind === "support" ? s.supportUrl : kind === "privacy" ? s.privacyUrl : kind === "terms" ? s.termsUrl
+        : kind === "deleteAccount" ? s.deleteAccountUrl : "";
       if (url) await open(url);
       return s;
     },

package/templates/podcast-creator-owner/tier5-src/himi-owner-lite-ask/live.ts

@@ -2,7 +2,7 @@
 //
 // `loadEntityRows` calls the SAME owner-scoped Wix clients the sibling
 // list/detail workers use (searchOrders, queryStoreProducts, …), with the
-// identical `isBridgeUnavailable` → owner-preview-demo fallback.
+// identical `ownerDemoFallback` → owner-preview-demo fallback (preview hosts only).
 //
 // That is not a nicety. A generated row carries its record `id` into
 // `tier5.ask.openEntity`, which navigates to `himi_owner_lite_<entity>` — and
@@ -16,7 +16,7 @@
 // alias map to resolve a bare "@himalaya/wix-*" with.
 import { wixMediaUrl } from "@himalaya/wix-media";
 
-import { isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+import { isOwnerPreviewDemo, ownerDemoFallback } from "../_shared/owner-load-error.js";
 import { queryStoreProducts, productPrice, type StoreProduct } from "../_shared/himi-store.js";
 import { updateProduct, deleteProduct } from "@himalaya/wix-stores";
 import { deleteDraftPost } from "@himalaya/wix-blog";
@@ -362,7 +362,7 @@ export async function loadEntityRows(entity: EntityName): Promise<{ rows: Row[];
     // labelled demo row keeps the web preview useful; for a measure it would be
     // fabricated traffic and revenue, which is the one thing this screen family
     // refuses. It takes the error arm below instead, exactly as a timeout does.
-    if (isBridgeUnavailable(e) && entity !== "metrics") return { rows: demoRows(entity), demo: true, error: "" };
+    if (ownerDemoFallback(e) && entity !== "metrics") return { rows: demoRows(entity), demo: true, error: "" };
     return { rows: [], demo: false, error: `${entity} couldn't be read` };
   }
 }

package/templates/podcast-creator-owner/tier5-src/himi-owner-lite-event/index.ts

@@ -8,25 +8,24 @@
 import { defineService } from "@himalaya/state";
 import { getEvent, deleteEvent, type WixEvent } from "@himalaya/wix-events";
 import { normalizeEvent, eventDescription } from "../_shared/himi-events.js";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo, shouldQueueOwnerWrite } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback, ownerWriteError, isNotFound } from "../_shared/owner-load-error.js";
 import { DEMO_EVENTS, DEMO_NOTE, DEMO_SAVE_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { openRichLink } from "../_shared/rich-content-link.js";
 import { richBody } from "../_shared/rich-body.js";
-import { get as dbGet, upsert as dbUpsert, remove as dbRemove, enqueue as dbEnqueue, type DbEntity } from "../_shared/owner-local-db.js";
+import { get as dbGet, upsert as dbUpsert, remove as dbRemove, type DbEntity } from "../_shared/owner-local-db.js";
 import { blankFlags } from "../_shared/detail-facts.js";
 
 // Offline-first (data-offline): the event DETAIL falls back to the last-synced
-// local `owner_events` row (put by the event form's write-behind) on a failed
-// fetch, and its delete is WRITE-BEHIND — the local row is dropped OPTIMISTICALLY,
-// then deleteEvent is attempted; if the bridge/network is unreachable the delete is
-// ENQUEUED for replay on reconnect. Every local-db call is wrapped so a build
-// without the `local_database` grant behaves exactly as before (online-only).
+// local `owner_events` row on a failed fetch. Its delete is SERVER-CONFIRMED: the
+// local row is dropped only after Wix deletes the event; a failed delete leaves it
+// and tells the owner why. No host replays a queued write, so nothing is queued.
+// Every local-db call is wrapped so a build without the `local_database` grant
+// behaves exactly as before (online-only).
 const ENTITY = "owner_events";
 async function cachePut(row: DbEntity): Promise<void> { try { await dbUpsert(ENTITY, row); } catch { /* capability not granted */ } }
 async function cacheDrop(id: string): Promise<void> { try { await dbRemove(ENTITY, id); } catch { /* capability not granted */ } }
 async function cacheGet(id: string): Promise<DbEntity | null> { try { return await dbGet(ENTITY, id); } catch { return null; } }
-async function queueWrite(actionId: string, params: Record<string, string>): Promise<void> { try { await dbEnqueue(actionId, params); } catch { /* capability not granted */ } }
 
 interface EventState {
   id: string;
@@ -281,9 +280,10 @@ const svc = defineService<EventState, {
         return loaded;
       } catch (e) {
         // Offline: fall back to the last-synced local row before the demo/error paths.
-        const cached = await cacheGet(id);
+        // Wix says it is gone (e.g. a delete whose reply was lost): drop the row, never show it.
+        const cached = isNotFound(e) ? (await cacheDrop(id), null) : await cacheGet(id);
         if (cached) return cachedDetail(s, cached);
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const demo = demoDetail(s, id);
           if (demo) return demo;
         }
@@ -304,9 +304,10 @@ const svc = defineService<EventState, {
         await cacheBodyText(loaded);
         return loaded;
       } catch (e) {
-        const cached = await cacheGet(s.id);
+        // Wix says it is gone (e.g. a delete whose reply was lost): drop the row, never show it.
+        const cached = isNotFound(e) ? (await cacheDrop(s.id), null) : await cacheGet(s.id);
         if (cached) return cachedDetail(s, cached);
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const demo = demoDetail(s, s.id);
           if (demo) return demo;
         }
@@ -328,18 +329,15 @@ const svc = defineService<EventState, {
         const s = disarm(s0);
         if (isOwnerPreviewDemo() || s.demoNote) return shape({ ...s, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
         if (!s.id) return shape({ ...s, actionMessage: copyParam("ownerEvent.noIdMessage", "No event id.") });
-        // Optimistic local delete — the list drops the row immediately.
-        await cacheDrop(s.id);
         try {
           await deleteEvent(s.id);
-          return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerEvent.deletedEmpty", "Event deleted."), actionMessage: "" });
         } catch (e) {
-          if (shouldQueueOwnerWrite(e)) {
-            await queueWrite("tier5.himiOwnerLiteEvent.delete", { id: s.id });
-            return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerEvent.deletedEmpty", "Event deleted."), actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
-          }
-          return shape({ ...s, actionMessage: ownerLoadError(e) });
+          // Nothing replays a queued write: the record stays, and the owner is told why.
+          return shape({ ...s, actionMessage: ownerWriteError(e) });
         }
+        // Only a delete Wix confirmed leaves the local list.
+        await cacheDrop(s.id);
+        return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerEvent.deletedEmpty", "Event deleted."), actionMessage: "" });
       } finally {
         deleteInFlight = false;
       }

package/templates/podcast-creator-owner/tier5-src/himi-owner-lite-event-form/index.ts

@@ -13,22 +13,20 @@ import { postBodyText, plainPostBody } from "../_shared/owner-post-content.js";
 import { editorSubmitValue, queuedDocument, editorChanged, cachedRichVerdict, editorRunKeys, resetHydratedEditorOnOlderRuntime, editorAfterSave, liveState, settleOverLive } from "../_shared/owner-editor-value.js";
 import { parseRicosJson } from "@himalaya/wix-rich-content";
 import { ricosUploadService } from "@himalaya/wix-rich-content-editor";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo, shouldQueueOwnerWrite } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback, ownerWriteError } from "../_shared/owner-load-error.js";
 import { DEMO_EVENTS, DEMO_NOTE, DEMO_SAVE_NOTE, demoRefusalPatch } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
-import { get as dbGet, upsert as dbUpsert, enqueue as dbEnqueue, type DbEntity } from "../_shared/owner-local-db.js";
+import { get as dbGet, upsert as dbUpsert, type DbEntity } from "../_shared/owner-local-db.js";
 
-// Offline-first (data-offline): the event edit is WRITE-BEHIND against the encrypted
-// `owner_events` entity — the local store is updated OPTIMISTICALLY so the
-// detail/list repaint from cache immediately, then updateEvent is attempted; if it
-// can't reach the bridge/network the write is ENQUEUED for replay on reconnect, and
-// load prefills from the last-synced local row when offline. Every local-db call is
-// wrapped (try/catch) so a build that ships without the `local_database` grant
-// behaves exactly as before (online-only, no cache/queue).
+// Offline-first (data-offline): load prefills from the last-synced local
+// `owner_events` row when offline, and the edit is SERVER-CONFIRMED — the local row
+// changes only after Wix accepts it; a failed save leaves it alone, keeps the form,
+// and tells the owner why. No host replays a queued write, so nothing is queued.
+// Every local-db call is wrapped (try/catch) so a build that ships without the
+// `local_database` grant behaves exactly as before (online-only, no cache).
 const ENTITY = "owner_events";
 async function cachePut(row: DbEntity): Promise<void> { try { await dbUpsert(ENTITY, row); } catch { /* capability not granted */ } }
 async function cacheGet(id: string): Promise<DbEntity | null> { try { return await dbGet(ENTITY, id); } catch { return null; } }
-async function queueWrite(actionId: string, params: Record<string, string>): Promise<void> { try { await dbEnqueue(actionId, params); } catch { /* capability not granted */ } }
 
 /* eslint-disable @typescript-eslint/no-explicit-any */
 
@@ -248,7 +246,7 @@ const svc = defineService<EventFormState, {
             status: "idle", error: "", savedMessage: "",
           });
         }
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const d = DEMO_EVENTS.find((x) => x.id === id);
           if (d) {
             return shape({
@@ -308,7 +306,7 @@ const svc = defineService<EventFormState, {
       // PUBLISHED SDK until its next release.
       const event: { title: string; description?: { nodes: unknown[] } } = { title, ...(doc ? { description: doc } : {}) };
 
-      // Optimistic local write — the detail/list repaint from cache immediately. The document the record
+      // The row the cache gets once Wix accepts the save. The document the record
       // now holds, when known, rides along so an offline reopen seeds the editor with it.
       const loadedJson = s.descriptionMode === "editor" && !s.descriptionPending ? s.descriptionJson : "";
       const heldJson = docRaw || (doc ? JSON.stringify(doc) : loadedJson);
@@ -319,13 +317,13 @@ const svc = defineService<EventFormState, {
       const cached = replay && !s.id ? await cacheGet(targetId) : null;
       // A queued metadata edit omitted the event body and read-only details. Keep their cached
       // values rather than replacing them with a fresh worker's empty/default state.
-      await cachePut({
+      const localRow: DbEntity = {
         ...(cached ?? {}), id: targetId, name: title, title,
         description: doc ? description : String(cached?.description ?? description),
         descriptionProtected: doc ? cachedRichVerdict(heldDoc as never, knownPlain) : String(cached?.descriptionProtected ?? cachedRichVerdict(heldDoc as never, knownPlain)),
         ...(heldJson ? { descriptionJson: heldJson } : {}),
         when: String(cached?.when ?? s.when), location: String(cached?.location ?? s.location),
-      });
+      };
       const savedState = (savedMessage: string) => {
         // An edit typed while this save was in flight stays unsaved work ([rico] #3644).
         const after = editorAfterSave("description", s as never, liveState(svc), !!doc);
@@ -341,22 +339,16 @@ const svc = defineService<EventFormState, {
       };
       try {
         await updateEvent(targetId, event);
+        // The local row follows only what Wix confirmed.
+        await cachePut(localRow);
         return savedState(copyParam("ownerEventForm.savedMessage", "Event saved."));
       } catch (e) {
-        if (shouldQueueOwnerWrite(e)) {
-          // Demo / web-preview (no owner bridge; the record came from demo sample
-          // data, marked by demoNote): a queued write could never replay, so answer
-          // with the demo save note instead of the real-offline write-behind.
-          if (s.demoNote) return demoRefusal(s);
-          // Real device offline: the optimistic cache row already shows; queue the write to replay
-          // (WriteQueue, idempotent) when connectivity returns. A document rides as `descriptionJson`
-          // with descriptionEdited "false", so a bundle rolled back past this change leaves the
-          // description rather than flattening it to text.
-          await queueWrite("tier5.himiOwnerLiteEventForm.submit", { id: targetId, title, description,
-            ...(docRaw ? { descriptionJson: docRaw, descriptionEdited: "false" } : { descriptionEdited: String(doc !== null) }) });
-          return savedState(copyParam("ownerEventForm.savedOffline", "Saved offline — will sync when you reconnect."));
-        }
-        return shape({ ...s, status: "error", error: ownerLoadError(e), savedMessage: "" });
+        // Never "saved offline": nothing replays a queued write on any platform. The cache was
+        // not touched, and the typed values stay in the form (the body in its editor) so a retry
+        // is one tap.
+        // Demo / web-preview: the record came from demo sample data (marked by demoNote).
+        if (s.demoNote) return demoRefusal(s);
+        return shape({ ...s, title, ...(s.descriptionMode === "editor" ? {} : { description }), status: "error", error: ownerWriteError(e), savedMessage: "" });
       }
     })()),
   },

package/templates/podcast-creator-owner/tier5-src/himi-owner-lite-events/index.ts

@@ -6,7 +6,7 @@ import { offsetPage } from "../_shared/offset-page.js";
 import { defineBackendCollection } from "../_shared/collection-service.js";
 import { queryEvents } from "@himalaya/wix-events";
 import { normalizeEvent, type EventRow } from "../_shared/himi-events.js";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_shared/owner-load-error.js";
 import { DEMO_EVENTS, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { copyParam } from "../_shared/himi-copy.js";
 import { getAll, upsert, type DbEntity } from "../_shared/owner-local-db.js";
@@ -152,7 +152,7 @@ const svc = defineBackendCollection("himiOwnerLiteEvents", {
           const cached = await readCachedRows();
           if (cached.length) return { items: cached, nextCursor: "", complete: false, metadata: { fromCache: true } };
         }
-        if (!cursor && isBridgeUnavailable(error)) return demo();
+        if (!cursor && ownerDemoFallback(error)) return demo();
         throw error;
       }
     },

package/templates/podcast-creator-owner/tier5-src/himi-owner-lite-home/index.ts

@@ -19,7 +19,7 @@ import { getSiteAnalytics, getSiteTimeZone, localDateRange, localDateOf, localMi
 // `text(...)` and never matched on — the RAW reason is kept beside it in
 // `<part>Reason` for anything that needs it — so the display-only reduction is
 // both safe here and the reason a 428 reason code stopped reaching the owner.
-import { ownerDisplayError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+import { ownerDisplayError, isOwnerPreviewDemo, ownerDemoFallback } from "../_shared/owner-load-error.js";
 import { DEMO_DASHBOARD, DEMO_NOTE, DEMO_TODAY } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam, copyTemplate } from "../_shared/himi-copy.js";
 import { fallbackNameFrom, selectedSiteName } from "../_shared/owner-selected-site.js";
@@ -803,7 +803,7 @@ async function loadDashboard(s: HomeState, sources: HomeSourceId[]): Promise<Hom
   const successfulParts = results.flatMap(({ value }) => [value.primary, value.metrics, value.activity]).filter(Boolean);
   const failedReasons = results.flatMap(({ value }) => [value.primaryReason, value.metricsReason, value.activityReason]).filter((reason) => reason !== undefined);
   if (successfulParts.length === 0) {
-    if (failedReasons.length > 0 && failedReasons.every((reason) => isBridgeUnavailable(reason))) {
+    if (failedReasons.length > 0 && failedReasons.every((reason) => ownerDemoFallback(reason))) {
       return demoDashboard(shape({ ...s, sourceStates: [], sourceFailures: [] }));
     }
     return shape({ ...composeState(), status: "error", error: ownerDisplayError(failedReasons[0]) });

package/templates/podcast-creator-owner/tier5-src/himi-owner-lite-order/index.ts

@@ -8,7 +8,7 @@
 
 import { defineService } from "@himalaya/state";
 import { getOrder, type WixOrder, type WixOrderLineItem } from "@himalaya/wix-ecom";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_shared/owner-load-error.js";
 import { DEMO_ORDERS, DEMO_NOTE, demoOrderDate } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { formatDateMedium } from "../_shared/engine-intl.js";
@@ -298,7 +298,7 @@ const svc = defineService<OrderState, {
       try {
         return await refresh(shape({ ...s, id, status: "loading" }), id);
       } catch (e) {
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const demo = demoDetail(s, id);
           if (demo) return demo;
         }
@@ -356,7 +356,7 @@ const svc = defineService<OrderState, {
       try {
         return await refresh(shape({ ...s, status: "loading" }), s.id);
       } catch (e) {
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const demo = demoDetail(s, s.id);
           if (demo) return demo;
         }

package/templates/podcast-creator-owner/tier5-src/himi-owner-lite-orders/index.ts

@@ -8,7 +8,7 @@
 
 import { defineBackendCollection } from "../_shared/collection-service.js";
 import { searchOrders, type WixOrder } from "@himalaya/wix-ecom";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_shared/owner-load-error.js";
 import { DEMO_ORDERS, DEMO_NOTE, demoOrderDate } from "../_shared/owner-preview-demo.js";
 import { copyParam } from "../_shared/himi-copy.js";
 import { compareText, formatMonthDay } from "../_shared/engine-intl.js";
@@ -276,7 +276,7 @@ const svc = defineBackendCollection("himiOwnerLiteOrders", {
         if (metadata?.hasNext && !nextCursor) throw new Error("Orders response is missing its next-page cursor");
         return { items: (response.orders ?? []).filter(order => !!order?.id).map(normalize), nextCursor, metadata: { demoNote: "" } };
       } catch (error) {
-        if (!cursor && isBridgeUnavailable(error)) return demoPage();
+        if (!cursor && ownerDemoFallback(error)) return demoPage();
         throw error;
       }
     },

package/templates/podcast-creator-owner/tier5-src/himi-owner-lite-overview/index.ts

@@ -27,7 +27,7 @@ import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
 import { site } from "@himalaya/wix-platform";
 import { searchOrders } from "@himalaya/wix-ecom";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_shared/owner-load-error.js";
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { pickSite, pickedSite } from "../_shared/owner-site-pick.js";
@@ -203,7 +203,7 @@ async function loadRollup(): Promise<OverviewState> {
     return shape({ status: "ready", rows });
   } catch (e) {
     // Only the ACCOUNT-level list failing gets here; a per-business failure is a row.
-    if (isBridgeUnavailable(e)) return demoRollup();
+    if (ownerDemoFallback(e)) return demoRollup();
     return shape({ status: "error", rows: [], error: ownerLoadError(e) });
   }
 }