@wix/himalaya-cli 0.1391.0 → 0.1393.0

package/templates/beauty-salon-owner/tier5-src/himi-owner-lite-today/index.ts

@@ -0,0 +1,315 @@
+// Tier-5 bundle: __HIMI_APP_NAME__ — TODAY. The worker behind the Home Screen widget.
+//
+// A WidgetKit extension (and a Glance receiver) runs no JS and holds no Wix session, and the OTA
+// widget producer has no credential either, so neither can read an owner's business. The PHONE
+// app runs this worker headlessly with its owner Wix bridge, resolves the widget descriptors'
+// `$service:ownerToday.*` leaves to literals (CompanionDescriptorResolver, the same pattern the
+// watch companion uses), and writes the frozen tree to the App Group for the widget to render.
+//
+// One owner glance: "what's next, and what is waiting for me" — the next booking, the booking
+// requests waiting on the owner, and the orders that need attention. Read-only: a widget never
+// writes to the business.
+//
+// Each source degrades on its own. A site without Bookings answers 428/404 on the bookings
+// query, and that must not cost the order count (or the reverse).
+
+import { defineService } from "@himalaya/state";
+import { queryBookings } from "@himalaya/wix-bookings";
+import { searchOrders } from "@himalaya/wix-ecom";
+import { ownerOrderAttentionFilter } from "../_shared/owner-order-attention.js";
+import { readSelectedSite } from "../_shared/owner-selected-site.js";
+
+type Rec = Record<string, unknown>;
+
+/** One booking as the widget shows it. Client FIRST name only: a Home Screen is visible to
+ *  anyone near the phone. */
+export interface TodayBooking {
+  bookingId: string;
+  name: string;
+  service: string;
+  timeLabel: string; // "10:30"
+  dayLabel: string; // "Today" / "Tomorrow" / "Thu 16 Oct"
+  /** "Today 10:30" — the absolute moment, never a countdown: a frozen "in 21 min" is wrong a
+   *  minute later, and nothing re-renders the widget between app foregrounds. */
+  whenLabel: string;
+}
+
+export interface TodayState {
+  status: "loading" | "ready" | "error" | "signedOut";
+  siteName: string;
+  /** Header line: "Today · <site>", or "Today" when the site has no name yet. */
+  header: string;
+  next: TodayBooking;
+  hasNext: boolean;
+  /** Hide the next-booking block: nothing is booked, or Bookings cannot be read. */
+  hideNext: boolean;
+  /** "No upcoming bookings" — shown in place of the block when Bookings has nothing ahead. */
+  nextNote: string;
+  hideNextNote: boolean;
+  requestCount: number;
+  /** "2 requests" / "1 request" / "No requests". At the read cap: "50+ requests". */
+  requestLabel: string;
+  orderCount: number;
+  /** "3 orders to handle" / "1 order to handle" / "No orders waiting". */
+  orderLabel: string;
+  /** Compact counts for the small widget: "2 req · 3 orders". */
+  countsShort: string;
+  bookingsReady: boolean;
+  ordersReady: boolean;
+  hideRequests: boolean;
+  hideOrders: boolean;
+  /** One-line state copy for a degrade (signed out, read failed, nothing installed). */
+  message: string;
+  hideMessage: boolean;
+  /** Epoch SECONDS after which this frame's labels are wrong: the next local midnight ("Today" /
+   *  "Tomorrow" shift) or the next booking's start (it is no longer "next"), whichever is first.
+   *  The phone caps the snapshot's lifetime at it, so a frozen frame never outlives its words. */
+  validUntil: number;
+}
+
+/** Which verticals THIS build provisions — baked into the widget descriptors' `input`. A vertical
+ *  the build does not show is never read: its count must not reach the compact line, and its
+ *  transient failure must not withhold a frame about the sections the build does show. */
+export interface Verticals {
+  bookings: boolean;
+  store: boolean;
+}
+
+export const COPY = {
+  signedOut: "Sign in to Owner to see today",
+  error: "Open Owner to refresh",
+  nothing: "Open Owner to see your business",
+  noneUpcoming: "No upcoming bookings",
+} as const;
+
+const PENDING = ["PENDING", "PENDING_APPROVAL", "WAITING_LIST"];
+/** A glance, not a list: a count at the cap reads as "50+". */
+export const LIMIT = 50;
+
+const WEEKDAYS = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
+const MONTHS = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
+
+function str(r: unknown, ...paths: string[]): string {
+  for (const path of paths) {
+    let v: unknown = r;
+    for (const k of path.split(".")) v = v && typeof v === "object" ? (v as Rec)[k] : undefined;
+    if (typeof v === "string" && v) return v;
+    if (typeof v === "number") return String(v);
+  }
+  return "";
+}
+
+function hhmm(d: Date): string {
+  return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
+}
+
+function sameLocalDay(a: Date, b: Date): boolean {
+  return a.getFullYear() === b.getFullYear() && a.getMonth() === b.getMonth() && a.getDate() === b.getDate();
+}
+
+/** The day a booking falls on, as an owner would say it. */
+export function dayLabel(start: Date, now: Date): string {
+  if (sameLocalDay(start, now)) return "Today";
+  const tomorrow = new Date(now.getFullYear(), now.getMonth(), now.getDate() + 1);
+  if (sameLocalDay(start, tomorrow)) return "Tomorrow";
+  return `${WEEKDAYS[start.getDay()]} ${start.getDate()} ${MONTHS[start.getMonth()]}`;
+}
+
+function startOf(b: Rec): string {
+  return str(b, "startDate", "bookedEntity.slot.startDate");
+}
+
+function booking(b: Rec, now: Date): TodayBooking {
+  const start = new Date(startOf(b));
+  const day = dayLabel(start, now);
+  return {
+    bookingId: str(b, "id"),
+    name: str(b, "contactDetails.firstName") || "Client",
+    service: str(b, "bookedEntity.title", "bookedEntity.slot.serviceName") || "Appointment",
+    timeLabel: hhmm(start),
+    dayLabel: day,
+    whenLabel: `${day} ${hhmm(start)}`,
+  };
+}
+
+const EMPTY_BOOKING: TodayBooking = { bookingId: "", name: "", service: "", timeLabel: "", dayLabel: "", whenLabel: "" };
+
+function counted(n: number, capped: boolean, one: string, many: string): string {
+  return `${capped ? `${LIMIT}+` : n} ${n === 1 && !capped ? one : many}`;
+}
+
+export interface Sources {
+  /** Upcoming CONFIRMED bookings, or null when Bookings could not be read. */
+  bookings: Rec[] | null;
+  /** Upcoming booking REQUESTS (pending statuses), read on their own: one page of every status
+   *  would fill with a busy week's confirmed bookings and hide next week's request. */
+  requests: Rec[] | null;
+  /** Orders needing attention, or null when Store could not be read. */
+  orders: Rec[] | null;
+}
+
+function upcoming(rows: Rec[] | null, statuses: string[], now: Date): Rec[] {
+  return (rows ?? [])
+    .filter((b) => str(b, "id") && statuses.includes(str(b, "status").toUpperCase()))
+    .filter((b) => Date.parse(startOf(b)) >= now.getTime())
+    .sort((a, b) => Date.parse(startOf(a)) - Date.parse(startOf(b)) || str(a, "id").localeCompare(str(b, "id")));
+}
+
+/** Pure: shape what was read into the widget state. `now` is injectable for tests. */
+export function shape(sources: Sources, now: Date, siteName: string): TodayState {
+  const bookingsReady = sources.bookings !== null && sources.requests !== null;
+  const ordersReady = sources.orders !== null;
+  // Re-filtered even though the queries filter: a server (or a fixture) that returns a
+  // cancelled or past row must not become an appointment the owner is told to expect.
+  const confirmed = bookingsReady ? upcoming(sources.bookings, ["CONFIRMED"], now) : [];
+  // Today's next CONFIRMED booking first: a request is not an appointment yet. With none left
+  // today, the first confirmed one after today, so "what's next" still has an answer.
+  const next = confirmed.find((b) => sameLocalDay(new Date(startOf(b)), now)) ?? confirmed[0];
+  const requestCount = bookingsReady ? upcoming(sources.requests, PENDING, now).length : 0;
+  const orderCount = (sources.orders ?? []).length;
+  const requestsCapped = (sources.requests ?? []).length >= LIMIT;
+  const ordersCapped = orderCount >= LIMIT;
+
+  const shortParts = [
+    ...(bookingsReady ? [`${requestsCapped ? `${LIMIT}+` : requestCount} req`] : []),
+    ...(ordersReady ? [counted(orderCount, ordersCapped, "order", "orders")] : []),
+  ];
+  const nothing = !bookingsReady && !ordersReady;
+  const nextNote = bookingsReady && !next ? COPY.noneUpcoming : "";
+  const midnight = new Date(now.getFullYear(), now.getMonth(), now.getDate() + 1).getTime();
+  const nextStart = next ? Date.parse(startOf(next)) : Infinity;
+  return {
+    validUntil: Math.floor(Math.min(midnight, nextStart) / 1000),
+    status: "ready",
+    siteName,
+    header: siteName ? `Today · ${siteName}` : "Today",
+    next: next ? booking(next, now) : EMPTY_BOOKING,
+    hasNext: !!next,
+    hideNext: !next,
+    nextNote,
+    hideNextNote: !nextNote,
+    requestCount,
+    requestLabel: requestCount ? counted(requestCount, requestsCapped, "request", "requests") : "No requests",
+    orderCount,
+    orderLabel: orderCount ? `${counted(orderCount, ordersCapped, "order", "orders")} to handle` : "No orders waiting",
+    countsShort: shortParts.join(" · "),
+    bookingsReady,
+    ordersReady,
+    hideRequests: !bookingsReady,
+    hideOrders: !ordersReady,
+    message: nothing ? COPY.nothing : "",
+    hideMessage: !nothing,
+  };
+}
+
+/** A degrade frame: ONE line, no rows. After a sign-out or a business switch the last rows
+ *  belong to someone else's clients, so none of them survive into it. */
+export function degraded(status: "error" | "signedOut" | "loading", siteName: string): TodayState {
+  // A FIXED instant, not the clock: a degrade frame has no rows, so nothing in it depends on
+  // the time — and the initial state must be deterministic (template contract: no worker's
+  // initial state may read the clock).
+  const base = shape({ bookings: null, requests: null, orders: null }, new Date(0), siteName);
+  const message = status === "signedOut" ? COPY.signedOut : status === "error" ? COPY.error : "";
+  // validUntil pinned too: shape() derives it from LOCAL midnight, so even at a fixed instant it
+  // would vary with the build machine's timezone and change the baked services hash.
+  return { ...base, status, message, hideMessage: !message, validUntil: 0 };
+}
+
+/** No usable owner session behind the bridge (the bridge refusing, or a 401). A transient
+ *  5xx is an ordinary error, not a sign-out — and a 403 is a missing PERMISSION for one
+ *  vertical (a collaborator whose role lacks Bookings), not a sign-out either. */
+export function isSignedOut(e: unknown): boolean {
+  const text = String((e as Error)?.message ?? e);
+  return /^HTTP 401\b/.test(text) || /wixApi not enabled|session unavailable|not signed in|webwix_bridge/i.test(text);
+}
+
+/** This section cannot exist for this owner: the vertical is not installed on the site (its
+ *  API answers 428, or 404 for the route), or the owner's role may not read it (403). Hides
+ *  that one section; every other failure is an error for the whole frame.
+ *
+ *  Read from the LEADING status only — the bridges format a failure as `HTTP <status>: <body>`
+ *  or `HTTP <status> [<code>]: <message>` — never from anywhere in the message: a transient
+ *  `HTTP 503: {"message":"upstream returned 404"}` must stay an error, not hide the section. */
+export function isSectionUnavailable(e: unknown): boolean {
+  const text = String((e as Error)?.message ?? e);
+  return /^HTTP (?:403|404|428)\b/.test(text) || /^HTTP \d{3} \[(?:FAILED_PRECONDITION|PERMISSION_DENIED)\]/.test(text);
+}
+
+function siteName(): string {
+  return readSelectedSite()?.name ?? "";
+}
+
+type Read = { ok: true; value: unknown } | { ok: false; error: unknown };
+
+async function attempt(fn: () => Promise<unknown>): Promise<Read> {
+  try {
+    return { ok: true, value: await fn() };
+  } catch (error) {
+    return { ok: false, error };
+  }
+}
+
+function rows(r: Read, key: string): Rec[] | null {
+  if (!r.ok) return null;
+  const list = (r.value as Rec | undefined)?.[key];
+  return Array.isArray(list) ? (list as Rec[]) : [];
+}
+
+/** The build's verticals from the descriptor's baked `input.verticals` ("bookings,store"). A
+ *  host that passes none (an older descriptor) reads both, as before. */
+export function buildVerticals(): Verticals {
+  const raw = (globalThis as { himalaya?: { input?: Record<string, unknown> } }).himalaya?.input?.verticals;
+  if (typeof raw !== "string") return { bookings: true, store: true };
+  const set = new Set(raw.split(",").map((v) => v.trim()));
+  return { bookings: set.has("bookings"), store: set.has("store") };
+}
+
+/** A section this build does not provision: never read, and indistinguishable from "not
+ *  installed" downstream (hidden, out of the compact line, out of the error rule). */
+const NOT_PROVISIONED: Read = { ok: false, error: new Error("HTTP 404: not provisioned in this build") };
+
+async function read(): Promise<TodayState> {
+  const nowIso = new Date().toISOString();
+  const verticals = buildVerticals();
+  const sort = [{ fieldName: "startDate", order: "ASC" }, { fieldName: "id", order: "ASC" }];
+  const bookingsBy = (statuses: string[]) => verticals.bookings ? attempt(() => queryBookings({ query: {
+    filter: { startDate: { $gte: nowIso }, status: { $in: statuses } },
+    sort,
+    paging: { limit: LIMIT, offset: 0 },
+  } })) : Promise.resolve(NOT_PROVISIONED);
+  const reads = await Promise.all([
+    bookingsBy(["CONFIRMED"]),
+    bookingsBy(PENDING),
+    verticals.store ? attempt(() => searchOrders({ search: {
+      filter: ownerOrderAttentionFilter(),
+      sort: [{ fieldName: "createdDate", order: "DESC" }, { fieldName: "id", order: "ASC" }],
+      cursorPaging: { limit: LIMIT },
+    } })) : Promise.resolve(NOT_PROVISIONED),
+  ]);
+  const failures = reads.flatMap((r) => (r.ok ? [] : [r.error]));
+  if (failures.some(isSignedOut)) return degraded("signedOut", "");
+  // A section that cannot exist (not installed, no permission) is hidden. ANY other failure —
+  // a transient 5xx on one read included — makes this an error frame, which the phone does
+  // not publish: the last good frame stays, rather than a frame that silently drops a
+  // section the owner does have and reads as "nothing waiting".
+  if (failures.some((e) => !isSectionUnavailable(e))) return degraded("error", siteName());
+  const [bookings, requests, orders] = reads;
+  return shape({
+    bookings: rows(bookings, "bookings"),
+    requests: rows(requests, "bookings"),
+    orders: rows(orders, "orders"),
+  }, new Date(), siteName());
+}
+
+const svc = defineService<TodayState, {
+  load: (s: TodayState) => Promise<TodayState>;
+  refresh: (s: TodayState) => Promise<TodayState>;
+}>("ownerToday", {
+  state: degraded("loading", ""),
+  actions: {
+    load: async () => read(),
+    refresh: async () => read(),
+  },
+});
+
+export { svc };

package/templates/beauty-salon-owner/tier5-src/himi-owner-lite-wrist/index.ts

@@ -13,7 +13,10 @@
 // render and tap must never confirm another business's booking.
 
 import { defineService } from "@himalaya/state";
-import { queryBookings, confirmBooking, declineBooking } from "@himalaya/wix-bookings";
+import { getBooking, queryBookings } from "@himalaya/wix-bookings";
+import {
+  PENDING_BOOKING_STATUSES as PENDING, isForActiveBusiness, isStaleBookingWrite as isStale, writeBookingResponse, type BookingResponse,
+} from "../_shared/owner-booking-respond.js";
 import { isBridgeUnavailable } from "../_shared/owner-load-error.js";
 import { readSelectedSite, selectedSiteName } from "../_shared/owner-selected-site.js";
 
@@ -80,9 +83,9 @@ export const COPY = {
   changed: "This request changed — check it on your iPhone",
   error: "Open Owner on your iPhone",
   writeFailed: "Couldn't update it — check it on your iPhone",
+  busy: "Still updating the last one — try again",
 } as const;
 
-const PENDING = new Set(["PENDING", "PENDING_APPROVAL", "WAITING_LIST"]);
 const LIMIT = 50;
 
 function str(r: Rec | undefined, ...paths: string[]): string {
@@ -257,25 +260,39 @@ async function fetchInto(s: WristState): Promise<WristState> {
   return shape([...byId.values()], new Date(), site(), s.requestIndex);
 }
 
-function isStale(e: unknown): boolean {
-  return /revision|\b409\b|ABORTED|conflict/i.test(String((e as Error)?.message ?? e));
-}
-
-type Write = (bookingId: string, revision: string) => Promise<unknown>;
-
-async function respond(s: WristState, params: unknown, write: Write): Promise<WristState> {
+async function respond(s: WristState, params: unknown, kind: BookingResponse): Promise<WristState> {
   if (s.inFlight) return s;
   const p = (params && typeof params === "object" ? params : {}) as Rec;
   const bookingId = str(p, "bookingId");
   const siteId = str(p, "siteId");
-  // A press rendered for another business, or for a request that is no longer pending.
-  if (siteId !== site().id) return { ...s, actionError: COPY.changed };
-  const target = s.requests.find((r) => r.bookingId === bookingId);
+  // A press rendered for another business — or naming none, or made while no business is
+  // active (two empty ids are not the same business) — or for a request no longer pending.
+  if (!isForActiveBusiness(siteId, site().id)) return { ...s, actionError: COPY.changed };
+  let target = s.requests.find((r) => r.bookingId === bookingId);
+  if (!target && bookingId) {
+    // Not in the queue this state was read with: a press relayed from a NOTIFICATION
+    // can name a request that arrived after the last read, or one past the queue's first page.
+    // The booking itself, read by id from the business the press names, decides — one that is
+    // not pending there is not written. Guarded like the write, so a second press during the
+    // read cannot start a second one.
+    inFlightNow = true;
+    inFlightBooking = bookingId;
+    try {
+      const booking = ((await getBooking(bookingId, { site: siteId })) as unknown as { booking?: Rec } | undefined)?.booking;
+      if (booking && str(booking, "revision") && PENDING.has(str(booking, "status"))
+        && handled.get(bookingId) !== str(booking, "revision")) target = request({ ...booking, id: bookingId });
+    } catch (e) {
+      inFlightNow = false;
+      return isSignedOut(e) ? failure(s, e) : { ...s, actionError: COPY.changed };
+    }
+    inFlightNow = false;
+  }
   if (!target) return { ...s, actionError: COPY.changed };
   inFlightNow = true;
+  inFlightBooking = bookingId;
   writeGeneration += 1;
   try {
-    await write(target.bookingId, target.revision);
+    await writeBookingResponse(kind, target.bookingId, target.revision, siteId);
     handled.set(target.bookingId, target.revision);
   } catch (e) {
     inFlightNow = false;
@@ -319,6 +336,16 @@ async function read(s: WristState): Promise<WristState> {
 // The state a concurrent action sees is the one it was dispatched with, so a double tap
 // would read `inFlight: false` twice; this module flag is the guard that actually holds.
 let inFlightNow = false;
+/** The request that write is for. */
+let inFlightBooking = "";
+
+/** A press that lands while a write is running. The same request again (a double tap) is that
+ *  write; ANOTHER request — a second notification's Accept relayed from the watch — was not
+ *  written, and must say so rather than come back looking handled. */
+function whileBusy(s: WristState, params: unknown): WristState {
+  const bookingId = str((params && typeof params === "object" ? params : {}) as Rec, "bookingId");
+  return bookingId && bookingId !== inFlightBooking ? { ...s, actionError: COPY.busy } : s;
+}
 
 const svc = defineService<WristState, {
   load: (s: WristState) => Promise<WristState>;
@@ -333,8 +360,8 @@ const svc = defineService<WristState, {
   actions: {
     load: async (s) => read(s),
     refresh: async (s) => read(s),
-    confirm: async (s, params) => (inFlightNow ? s : respond(s, params, (id, rev) => confirmBooking(id, rev))),
-    decline: async (s, params) => (inFlightNow ? s : respond(s, params, (id, rev) => declineBooking(id, rev))),
+    confirm: async (s, params) => (inFlightNow ? whileBusy(s, params) : respond(s, params, "confirm")),
+    decline: async (s, params) => (inFlightNow ? whileBusy(s, params) : respond(s, params, "decline")),
     askDecline: async (s) => (s.current.bookingId ? { ...s, confirmingDecline: true, notConfirmingDecline: false, actionError: "" } : s),
     cancelDecline: async (s) => ({ ...s, confirmingDecline: false, notConfirmingDecline: true }),
     nextRequest: async (s) => {

package/templates/branded-lite/tier5-src/_shared/owner-load-error.ts

@@ -20,10 +20,9 @@ export function isOwnerPreviewLive(): boolean {
  *
  * `isBridgeUnavailable` cannot answer this: it reads "not live" as "preview",
  * and on NATIVE there is no input at all, so `undefined` satisfies it. That is
- * harmless for the callers that use it to pick a demo fallback or to queue a
- * write, and it is deliberately left alone for them — native write-behind
- * depends on it. It is NOT harmless for choosing COPY: native workers format
- * their failures the same way (`"HTTP \(code): \(body)"`, JSWorker.swift;
+ * left alone for the other apps that use it to pick a demo fallback or to queue
+ * a write. Owner-lite reads ask `ownerDemoFallback` instead. It is NOT
+ * harmless for choosing COPY: native workers format their failures the same way (`"HTTP \(code): \(body)"`, JSWorker.swift;
  * `"HTTP ${e.code}: ..."`, WebViewJSWorker.kt), so a transient `HTTP 503` on a
  * phone would otherwise be answered with "open this app on a device" — on the
  * device. Callers that pick a SENTENCE ask this instead.
@@ -43,11 +42,89 @@ export function isBridgeUnavailable(e: unknown): boolean {
   return /HTTP (405|501|502|503)\b/.test(String((e as Error)?.message ?? e));
 }
 
-/** Preserve native write-behind when the bridge is unavailable. This is a
- * queue decision, never permission to replace a failed live read with samples. */
-export function shouldQueueOwnerWrite(e: unknown): boolean {
-  if (ownerPreviewMode() === "live" || isOwnerPreviewDemo()) return false;
-  return /HTTP (405|501|502|503)\b/.test(String((e as Error)?.message ?? e));
+/**
+ * Whether a failed owner-lite READ may answer with the built-in demo records.
+ *
+ * Only where a demo was asked for: a web preview host that is not live. On a phone no
+ * mode is injected, so `isBridgeUnavailable` alone is `true` for a transient Wix
+ * `HTTP 503` — and the owner was shown sample appointments, orders and sites as if
+ * they were their business. Native falls through to the screen's error state.
+ * `isBridgeUnavailable` keeps its semantics: other apps' callers depend on it.
+ */
+export function ownerDemoFallback(e: unknown): boolean {
+  return isOwnerPreviewHost() && !isOwnerPreviewLive() && isBridgeUnavailable(e);
+}
+
+/**
+ * The sentence for an owner WRITE that failed because the device could not reach Wix at
+ * all (a transport failure). Nothing replays a queued write on any platform — every host's
+ * `drain` passes an empty closure — so the honest answer is that nothing was saved.
+ * Copy-as-configuration under `ownerCommon.`, which every owner screen forwards.
+ */
+export function ownerOfflineNotSaved(): string {
+  return copyParam(
+    "ownerCommon.offlineNotSaved",
+    "You’re offline — nothing was saved. Try again when you reconnect.",
+  );
+}
+
+/** The sentence for an owner WRITE that Wix answered with an unavailable status: the
+ *  device is online, so it is not "offline" — but nothing was saved all the same. */
+/**
+ * Whether a failed WRITE may have landed on Wix anyway, so the user must not be told it
+ * was not saved: a transport failure mid-request (timeout, reset, fetch rejection), the web
+ * host's after-send envelope (`HTTP 502 {…"sent":true}`), the serve bridge's mid-request
+ * `webwix_bridge_upstream_failed`, or a gateway status (502/503/504) that can arrive after
+ * the backend already ran. Only connect-time failures (`isOfflineFailure`) and the designed
+ * 405/501 bridge refusals prove nothing happened.
+ */
+export function writeMayHaveLanded(e: unknown): boolean {
+  if (isOfflineFailure(e)) return false;
+  if (isTransportFailure(e)) return true;
+  const msg = String((e as Error)?.message ?? e ?? "");
+  if (/"sent"\s*:\s*true/.test(msg)) return true;
+  // The web host's own envelope WITHOUT `sent: true` failed before the request left it, and
+  // a disabled owner rung / bridge refuses by design without sending anything.
+  if (/\bwebwix_(?:direct_failed|owner_disabled|bridge_disabled)\b/.test(msg)) return false;
+  // `webwix_bridge_upstream_failed` stays ambiguous: the same code covers a lookup that failed
+  // before sending and a serve-bridge failure mid-request, and nothing in it says which.
+  return /\bwebwix_bridge_upstream_failed\b/.test(msg) || /HTTP (502|503|504)\b/.test(msg);
+}
+
+/** Wix answered that the record does not exist (`HTTP 404`). A detail must not fall back to
+ *  its cached row then: that row is what a delete whose reply was lost leaves behind. */
+export function isNotFound(e: unknown): boolean {
+  if (/HTTP 404\b/.test(String((e as Error)?.message ?? e ?? ""))) return true;
+  // An SDK that answers a 404 with its own "not found" error keeps the HTTP one as `cause`
+  // (the blog SDK's getPost, after its query fallback also finds nothing).
+  const cause = (e as { cause?: unknown } | null | undefined)?.cause;
+  return cause !== undefined && cause !== e && /HTTP 404\b/.test(String((cause as Error)?.message ?? cause));
+}
+
+export function ownerUnavailableNotSaved(): string {
+  return copyParam(
+    "ownerCommon.unavailableNotSaved",
+    "Wix isn’t available right now — nothing was saved. Try again in a moment.",
+  );
+}
+
+/** The sentence for an owner WRITE that may have landed (`writeMayHaveLanded`): it can't
+ *  be called saved or not saved. */
+export function ownerWriteUnconfirmed(): string {
+  return copyParam(
+    "ownerCommon.writeUnconfirmed",
+    "Wix didn’t confirm this, so it may or may not have been saved. Check before trying again.",
+  );
+}
+
+/** Display copy for a failed owner write: `ownerOfflineNotSaved` when the request never
+ *  left the device, `ownerWriteUnconfirmed` when it may have landed, `ownerUnavailableNotSaved`
+ *  for the designed 405/501 bridge refusals outside a live preview, else `ownerLoadError`. */
+export function ownerWriteError(e: unknown): string {
+  if (isOfflineFailure(e)) return ownerOfflineNotSaved();
+  if (writeMayHaveLanded(e)) return ownerWriteUnconfirmed();
+  if (!isOwnerPreviewLive() && /HTTP (405|501)\b/.test(String((e as Error)?.message ?? e))) return ownerUnavailableNotSaved();
+  return ownerLoadError(e);
 }
 
 /** `HTTP 403: …` → "403", when the message carries a status at all. */
@@ -99,6 +176,10 @@ const TRANSPORT = [
   /^Failed to connect to \S/,
   /^Unable to resolve host\b/,
   /\b(?:Connection refused|Network is unreachable|Software caused connection abort)\b/,
+  // OkHttp / HttpURLConnection messages a dropped connection produces mid-request, which
+  // Android's bridge forwards without the exception class.
+  /\b(?:Connection reset|ECONNRESET|ETIMEDOUT|EPIPE|Broken pipe|stream was reset)\b/,
+  /^unexpected end of stream\b/i,
   /^(?:timeout|Read timed out|connect timed out)$/i,
   /\bFailed to fetch\b/,
   /\bNetworkError when attempting to fetch\b/,
@@ -113,6 +194,27 @@ export function isTransportFailure(e: unknown): boolean {
   return TRANSPORT.some((re) => re.test(msg));
 }
 
+/** Transport failures that happen while CONNECTING — no connection, no route, no such host,
+ *  connection refused — so the request provably never left the device. Every other
+ *  transport failure (a timeout, a reset, a bad or truncated response, a browser's fetch
+ *  rejection, which says nothing about when it failed) may come after Wix took the write. */
+const NEVER_SENT = [
+  /\bNSURLErrorDomain Code=-10(?:09|04|03|06|20|18)\b/,  // not connected / cannot connect / no host / DNS / data not allowed / roaming off
+  /\b(?:UnknownHost|Connect|NoRouteToHost)Exception\b/,
+  /^Failed to connect to \S/,
+  /^Unable to resolve host\b/,
+  /\b(?:Connection refused|Network is unreachable)\b/,
+  /\bnet::ERR_(?:INTERNET_DISCONNECTED|NAME_NOT_RESOLVED|CONNECTION_REFUSED|ADDRESS_UNREACHABLE|NETWORK_ACCESS_DENIED)\b/,
+];
+
+/** No HTTP answer, and the request provably never left the device: the user is offline, and
+ *  a write certainly did not happen. Anything else may have landed (see `NEVER_SENT`). */
+export function isOfflineFailure(e: unknown): boolean {
+  if (!isTransportFailure(e)) return false;
+  const msg = String((e as Error)?.message ?? e ?? "");
+  return NEVER_SENT.some((re) => re.test(msg));
+}
+
 /** The one sentence for a transport failure. Copy-as-configuration: the key is
  *  under `ownerCommon.`, which every owner screen (Aria included) forwards. */
 export function ownerTransportFailureText(): string {
@@ -194,8 +296,8 @@ export function ownerPreviewUnavailable(): string {
  * error says: this names the web preview when there IS one. `isBridgeUnavailable`
  * reads "not live" as "preview", and native injects no mode at all, so the
  * default would answer a device-side `HTTP 503` with "open this app on a device"
- * — on the device. That predicate is deliberately left alone: native
- * write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
+ * — on the device. That predicate is deliberately left alone: other apps'
+ * demo and write-queue decisions depend on exactly it.
  *
  * The reductions this used to add are now in `humanWireError`, so every owner
  * screen gets them rather than the two that happened to call this.
@@ -232,6 +334,7 @@ export function ownerDisplayError(e: unknown): string {
  */
 export function ownerLoadError(e: unknown): string {
   const msg = String((e as Error)?.message ?? e);
-  if (isBridgeUnavailable(e)) return ownerPreviewUnavailable();
+  // Same host guard as `ownerDisplayError`: on a phone, "open this app on a device" is false.
+  if (isOwnerPreviewHost() && isBridgeUnavailable(e)) return ownerPreviewUnavailable();
   return humanWireError(msg);
 }