@wix/himalaya-cli 0.1392.0 → 0.1393.0

package/templates/portfolio-creative-owner/tier5-src/_shared/owner-account.ts

@@ -15,10 +15,13 @@ export interface AccountState {
   supportUrl: string;
   privacyUrl: string;
   termsUrl: string;
+  /** Wix's own account-deletion destination (App Store 5.1.1(v)). */
+  deleteAccountUrl: string;
   /** hiddenPath flags — TRUE hides, so each is phrased negatively. */
   noSupport: boolean;
   noPrivacy: boolean;
   noTerms: boolean;
+  noDeleteAccount: boolean;
 }
 
 /** Only absolute http(s) URLs are openable; anything else is treated as absent. */
@@ -37,13 +40,14 @@ export function ownerLineOf(name: string, email: string): string {
 
 export function shapeAccount(s: Partial<AccountState>): AccountState {
   const supportUrl = safeUrl(s.supportUrl), privacyUrl = safeUrl(s.privacyUrl), termsUrl = safeUrl(s.termsUrl);
+  const deleteAccountUrl = safeUrl(s.deleteAccountUrl);
   return {
     status: s.status ?? "loading",
     businessName: s.businessName ?? "",
     ownerLine: s.ownerLine ?? "",
     versionLine: s.versionLine ?? "",
     error: s.error ?? "",
-    supportUrl, privacyUrl, termsUrl,
-    noSupport: !supportUrl, noPrivacy: !privacyUrl, noTerms: !termsUrl,
+    supportUrl, privacyUrl, termsUrl, deleteAccountUrl,
+    noSupport: !supportUrl, noPrivacy: !privacyUrl, noTerms: !termsUrl, noDeleteAccount: !deleteAccountUrl,
   };
 }

package/templates/portfolio-creative-owner/tier5-src/_shared/owner-booking-respond.ts

@@ -0,0 +1,82 @@
+// Accept / Decline ONE booking request — the write shared by the two __HIMI_APP_NAME__ surfaces that
+// answer a request without opening the booking screen: the paired watch (`himi-owner-lite-wrist`)
+// and the notification's action buttons (`himi-owner-lite-nav`).
+//
+// Both follow the same rules:
+//   • the press names the business it was shown for, and is REFUSED unless that is the business
+//     the phone has active — a site switched between delivery and press must never confirm
+//     another business's booking;
+//   • the write itself is addressed at that business (`wix-site-id`), so even a switch that lands
+//     between the check and the request cannot move it;
+//   • only a request still pending is written, at the revision Wix last reported.
+
+import { getBooking, confirmBooking, declineBooking } from "@himalaya/wix-bookings";
+
+type Rec = Record<string, unknown>;
+
+/** The statuses that are waiting on the owner. */
+export const PENDING_BOOKING_STATUSES: ReadonlySet<string> = new Set(["PENDING", "PENDING_APPROVAL", "WAITING_LIST"]);
+
+export type BookingResponse = "confirm" | "decline";
+
+/** A press may write only for the business the phone has active. Fails CLOSED: a press that
+ *  names no business, or a host that cannot say which one is active, writes nothing. */
+export function isForActiveBusiness(siteId: string, activeSiteId: string): boolean {
+  return !!siteId && !!activeSiteId && siteId === activeSiteId;
+}
+
+/** Wix refused the write because the booking moved on (another revision, already handled). */
+export function isStaleBookingWrite(e: unknown): boolean {
+  return /revision|\b409\b|ABORTED|conflict/i.test(String((e as Error)?.message ?? e));
+}
+
+/** Confirm or decline `bookingId` at `revision`, addressed at `siteId`. Rejects without a
+ *  request when `siteId` is empty: an unaddressed write would land on whatever business the
+ *  ambient bridge is scoped to. */
+export function writeBookingResponse(kind: BookingResponse, bookingId: string, revision: string, siteId: string): Promise<unknown> {
+  const site = siteId.trim();
+  if (!site) return Promise.reject(new Error("writeBookingResponse: a booking write must name its business"));
+  const opts = { site };
+  return kind === "confirm" ? confirmBooking(bookingId, revision, opts) : declineBooking(bookingId, revision, false, opts);
+}
+
+export type BookingResponseOutcome =
+  | "confirmed" | "declined"
+  /** Not written: no booking id, or a press for a business other than the active one. */
+  | "refused"
+  /** Not written: the booking is no longer waiting on the owner (or no longer exists). */
+  | "notPending"
+  /** Not written: Wix reported a newer revision between the read and the write. */
+  | "stale"
+  /** Not written: the read or the write failed. */
+  | "failed";
+
+function str(r: Rec | undefined, key: string): string {
+  const v = r?.[key];
+  return typeof v === "string" ? v : typeof v === "number" ? String(v) : "";
+}
+
+/** Answer a request known only by id — a notification carries no revision, so the booking is
+ *  read first (from the business the press names) and written only while it is still pending. */
+export async function respondToBookingById(
+  kind: BookingResponse,
+  bookingId: string,
+  siteId: string,
+  activeSiteId: string,
+): Promise<BookingResponseOutcome> {
+  if (!bookingId || !isForActiveBusiness(siteId, activeSiteId)) return "refused";
+  let booking: Rec | undefined;
+  try {
+    booking = ((await getBooking(bookingId, { site: siteId })) as unknown as { booking?: Rec } | undefined)?.booking;
+  } catch {
+    return "failed";
+  }
+  const revision = str(booking, "revision");
+  if (!booking || !revision || !PENDING_BOOKING_STATUSES.has(str(booking, "status"))) return "notPending";
+  try {
+    await writeBookingResponse(kind, bookingId, revision, siteId);
+  } catch (e) {
+    return isStaleBookingWrite(e) ? "stale" : "failed";
+  }
+  return kind === "confirm" ? "confirmed" : "declined";
+}

package/templates/portfolio-creative-owner/tier5-src/_shared/owner-load-error.ts

@@ -20,10 +20,9 @@ export function isOwnerPreviewLive(): boolean {
  *
  * `isBridgeUnavailable` cannot answer this: it reads "not live" as "preview",
  * and on NATIVE there is no input at all, so `undefined` satisfies it. That is
- * harmless for the callers that use it to pick a demo fallback or to queue a
- * write, and it is deliberately left alone for them — native write-behind
- * depends on it. It is NOT harmless for choosing COPY: native workers format
- * their failures the same way (`"HTTP \(code): \(body)"`, JSWorker.swift;
+ * left alone for the other apps that use it to pick a demo fallback or to queue
+ * a write. Owner-lite reads ask `ownerDemoFallback` instead. It is NOT
+ * harmless for choosing COPY: native workers format their failures the same way (`"HTTP \(code): \(body)"`, JSWorker.swift;
  * `"HTTP ${e.code}: ..."`, WebViewJSWorker.kt), so a transient `HTTP 503` on a
  * phone would otherwise be answered with "open this app on a device" — on the
  * device. Callers that pick a SENTENCE ask this instead.
@@ -43,11 +42,89 @@ export function isBridgeUnavailable(e: unknown): boolean {
   return /HTTP (405|501|502|503)\b/.test(String((e as Error)?.message ?? e));
 }
 
-/** Preserve native write-behind when the bridge is unavailable. This is a
- * queue decision, never permission to replace a failed live read with samples. */
-export function shouldQueueOwnerWrite(e: unknown): boolean {
-  if (ownerPreviewMode() === "live" || isOwnerPreviewDemo()) return false;
-  return /HTTP (405|501|502|503)\b/.test(String((e as Error)?.message ?? e));
+/**
+ * Whether a failed owner-lite READ may answer with the built-in demo records.
+ *
+ * Only where a demo was asked for: a web preview host that is not live. On a phone no
+ * mode is injected, so `isBridgeUnavailable` alone is `true` for a transient Wix
+ * `HTTP 503` — and the owner was shown sample appointments, orders and sites as if
+ * they were their business. Native falls through to the screen's error state.
+ * `isBridgeUnavailable` keeps its semantics: other apps' callers depend on it.
+ */
+export function ownerDemoFallback(e: unknown): boolean {
+  return isOwnerPreviewHost() && !isOwnerPreviewLive() && isBridgeUnavailable(e);
+}
+
+/**
+ * The sentence for an owner WRITE that failed because the device could not reach Wix at
+ * all (a transport failure). Nothing replays a queued write on any platform — every host's
+ * `drain` passes an empty closure — so the honest answer is that nothing was saved.
+ * Copy-as-configuration under `ownerCommon.`, which every owner screen forwards.
+ */
+export function ownerOfflineNotSaved(): string {
+  return copyParam(
+    "ownerCommon.offlineNotSaved",
+    "You’re offline — nothing was saved. Try again when you reconnect.",
+  );
+}
+
+/** The sentence for an owner WRITE that Wix answered with an unavailable status: the
+ *  device is online, so it is not "offline" — but nothing was saved all the same. */
+/**
+ * Whether a failed WRITE may have landed on Wix anyway, so the user must not be told it
+ * was not saved: a transport failure mid-request (timeout, reset, fetch rejection), the web
+ * host's after-send envelope (`HTTP 502 {…"sent":true}`), the serve bridge's mid-request
+ * `webwix_bridge_upstream_failed`, or a gateway status (502/503/504) that can arrive after
+ * the backend already ran. Only connect-time failures (`isOfflineFailure`) and the designed
+ * 405/501 bridge refusals prove nothing happened.
+ */
+export function writeMayHaveLanded(e: unknown): boolean {
+  if (isOfflineFailure(e)) return false;
+  if (isTransportFailure(e)) return true;
+  const msg = String((e as Error)?.message ?? e ?? "");
+  if (/"sent"\s*:\s*true/.test(msg)) return true;
+  // The web host's own envelope WITHOUT `sent: true` failed before the request left it, and
+  // a disabled owner rung / bridge refuses by design without sending anything.
+  if (/\bwebwix_(?:direct_failed|owner_disabled|bridge_disabled)\b/.test(msg)) return false;
+  // `webwix_bridge_upstream_failed` stays ambiguous: the same code covers a lookup that failed
+  // before sending and a serve-bridge failure mid-request, and nothing in it says which.
+  return /\bwebwix_bridge_upstream_failed\b/.test(msg) || /HTTP (502|503|504)\b/.test(msg);
+}
+
+/** Wix answered that the record does not exist (`HTTP 404`). A detail must not fall back to
+ *  its cached row then: that row is what a delete whose reply was lost leaves behind. */
+export function isNotFound(e: unknown): boolean {
+  if (/HTTP 404\b/.test(String((e as Error)?.message ?? e ?? ""))) return true;
+  // An SDK that answers a 404 with its own "not found" error keeps the HTTP one as `cause`
+  // (the blog SDK's getPost, after its query fallback also finds nothing).
+  const cause = (e as { cause?: unknown } | null | undefined)?.cause;
+  return cause !== undefined && cause !== e && /HTTP 404\b/.test(String((cause as Error)?.message ?? cause));
+}
+
+export function ownerUnavailableNotSaved(): string {
+  return copyParam(
+    "ownerCommon.unavailableNotSaved",
+    "Wix isn’t available right now — nothing was saved. Try again in a moment.",
+  );
+}
+
+/** The sentence for an owner WRITE that may have landed (`writeMayHaveLanded`): it can't
+ *  be called saved or not saved. */
+export function ownerWriteUnconfirmed(): string {
+  return copyParam(
+    "ownerCommon.writeUnconfirmed",
+    "Wix didn’t confirm this, so it may or may not have been saved. Check before trying again.",
+  );
+}
+
+/** Display copy for a failed owner write: `ownerOfflineNotSaved` when the request never
+ *  left the device, `ownerWriteUnconfirmed` when it may have landed, `ownerUnavailableNotSaved`
+ *  for the designed 405/501 bridge refusals outside a live preview, else `ownerLoadError`. */
+export function ownerWriteError(e: unknown): string {
+  if (isOfflineFailure(e)) return ownerOfflineNotSaved();
+  if (writeMayHaveLanded(e)) return ownerWriteUnconfirmed();
+  if (!isOwnerPreviewLive() && /HTTP (405|501)\b/.test(String((e as Error)?.message ?? e))) return ownerUnavailableNotSaved();
+  return ownerLoadError(e);
 }
 
 /** `HTTP 403: …` → "403", when the message carries a status at all. */
@@ -99,6 +176,10 @@ const TRANSPORT = [
   /^Failed to connect to \S/,
   /^Unable to resolve host\b/,
   /\b(?:Connection refused|Network is unreachable|Software caused connection abort)\b/,
+  // OkHttp / HttpURLConnection messages a dropped connection produces mid-request, which
+  // Android's bridge forwards without the exception class.
+  /\b(?:Connection reset|ECONNRESET|ETIMEDOUT|EPIPE|Broken pipe|stream was reset)\b/,
+  /^unexpected end of stream\b/i,
   /^(?:timeout|Read timed out|connect timed out)$/i,
   /\bFailed to fetch\b/,
   /\bNetworkError when attempting to fetch\b/,
@@ -113,6 +194,27 @@ export function isTransportFailure(e: unknown): boolean {
   return TRANSPORT.some((re) => re.test(msg));
 }
 
+/** Transport failures that happen while CONNECTING — no connection, no route, no such host,
+ *  connection refused — so the request provably never left the device. Every other
+ *  transport failure (a timeout, a reset, a bad or truncated response, a browser's fetch
+ *  rejection, which says nothing about when it failed) may come after Wix took the write. */
+const NEVER_SENT = [
+  /\bNSURLErrorDomain Code=-10(?:09|04|03|06|20|18)\b/,  // not connected / cannot connect / no host / DNS / data not allowed / roaming off
+  /\b(?:UnknownHost|Connect|NoRouteToHost)Exception\b/,
+  /^Failed to connect to \S/,
+  /^Unable to resolve host\b/,
+  /\b(?:Connection refused|Network is unreachable)\b/,
+  /\bnet::ERR_(?:INTERNET_DISCONNECTED|NAME_NOT_RESOLVED|CONNECTION_REFUSED|ADDRESS_UNREACHABLE|NETWORK_ACCESS_DENIED)\b/,
+];
+
+/** No HTTP answer, and the request provably never left the device: the user is offline, and
+ *  a write certainly did not happen. Anything else may have landed (see `NEVER_SENT`). */
+export function isOfflineFailure(e: unknown): boolean {
+  if (!isTransportFailure(e)) return false;
+  const msg = String((e as Error)?.message ?? e ?? "");
+  return NEVER_SENT.some((re) => re.test(msg));
+}
+
 /** The one sentence for a transport failure. Copy-as-configuration: the key is
  *  under `ownerCommon.`, which every owner screen (Aria included) forwards. */
 export function ownerTransportFailureText(): string {
@@ -194,8 +296,8 @@ export function ownerPreviewUnavailable(): string {
  * error says: this names the web preview when there IS one. `isBridgeUnavailable`
  * reads "not live" as "preview", and native injects no mode at all, so the
  * default would answer a device-side `HTTP 503` with "open this app on a device"
- * — on the device. That predicate is deliberately left alone: native
- * write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
+ * — on the device. That predicate is deliberately left alone: other apps'
+ * demo and write-queue decisions depend on exactly it.
  *
  * The reductions this used to add are now in `humanWireError`, so every owner
  * screen gets them rather than the two that happened to call this.
@@ -232,6 +334,7 @@ export function ownerDisplayError(e: unknown): string {
  */
 export function ownerLoadError(e: unknown): string {
   const msg = String((e as Error)?.message ?? e);
-  if (isBridgeUnavailable(e)) return ownerPreviewUnavailable();
+  // Same host guard as `ownerDisplayError`: on a phone, "open this app on a device" is false.
+  if (isOwnerPreviewHost() && isBridgeUnavailable(e)) return ownerPreviewUnavailable();
   return humanWireError(msg);
 }

package/templates/portfolio-creative-owner/tier5-src/himi-owner-lite-account/index.ts

@@ -9,7 +9,8 @@
 //     which goes stale the moment the binary is bumped);
 //   • the help / privacy / terms links, which arrive as onAppear params baked
 //     from provisioning.json `identity` — so a branded template ships ITS links,
-//     and `openLink` can only ever open one of those three URLs.
+//     and `openLink` can only ever open one of those URLs — plus Wix's own
+//     account-deletion page (`deleteAccountUrl`, App Store 5.1.1(v)).
 //
 //   • which business this is — the one the owner picked on Sites (see
 //     `_shared/owner-selected-site.ts`), not the build-time provisioning name,
@@ -27,7 +28,7 @@ import { stashCopy, copyTemplate } from "../_shared/himi-copy.js";
 import { ownerLineOf, shapeAccount, type AccountState } from "../_shared/owner-account.js";
 import { fallbackNameFrom, selectedSiteName } from "../_shared/owner-selected-site.js";
 
-type LinkKind = "support" | "privacy" | "terms";
+type LinkKind = "support" | "privacy" | "terms" | "deleteAccount";
 
 const obj = (v: unknown): Record<string, unknown> => (v && typeof v === "object" ? v as Record<string, unknown> : {});
 
@@ -44,7 +45,8 @@ const svc = defineService<AccountState, {
       fallbackBusinessName = fallbackNameFrom(arg, fallbackBusinessName);
       const businessName = selectedSiteName(fallbackBusinessName);
       const p = obj(arg);
-      const links = { supportUrl: String(p.supportUrl ?? s.supportUrl), privacyUrl: String(p.privacyUrl ?? s.privacyUrl), termsUrl: String(p.termsUrl ?? s.termsUrl) };
+      const links = { supportUrl: String(p.supportUrl ?? s.supportUrl), privacyUrl: String(p.privacyUrl ?? s.privacyUrl), termsUrl: String(p.termsUrl ?? s.termsUrl),
+        deleteAccountUrl: String(p.deleteAccountUrl ?? s.deleteAccountUrl) };
       let ownerLine = "";
       // Why the identity line is missing, when it is. Kept in state (the failure is
       // modelled, not swallowed) but not painted: a settings screen that cannot name
@@ -68,7 +70,8 @@ const svc = defineService<AccountState, {
     },
     openLink: async (s, arg) => {
       const kind = String(obj(arg).kind ?? arg ?? "") as LinkKind;
-      const url = kind === "support" ? s.supportUrl : kind === "privacy" ? s.privacyUrl : kind === "terms" ? s.termsUrl : "";
+      const url = kind === "support" ? s.supportUrl : kind === "privacy" ? s.privacyUrl : kind === "terms" ? s.termsUrl
+        : kind === "deleteAccount" ? s.deleteAccountUrl : "";
       if (url) await open(url);
       return s;
     },

package/templates/portfolio-creative-owner/tier5-src/himi-owner-lite-appointments/index.ts

@@ -21,7 +21,7 @@ import { offsetPage } from "../_shared/offset-page.js";
 import { localPreferences } from "../_shared/local-preferences.js";
 import { defineService } from "@himalaya/state";
 import { queryBookings, rescheduleBooking, type WixBooking } from "@himalaya/wix-bookings";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_shared/owner-load-error.js";
 import { DEMO_APPOINTMENTS, DEMO_NOTE, demoAppointmentWindow } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { dayKey, dayLabel, hhmm, type CalendarEvent, type DayDecoration } from "@himalaya/time";
@@ -437,7 +437,7 @@ async function loadList(s: AppointmentsState, append = false): Promise<Appointme
   } catch (e) {
     if (revision !== loadRevision) return undefined;
     s = { ...s, ...presentation() };
-    if (!append && isBridgeUnavailable(e)) return demoList(s);
+    if (!append && ownerDemoFallback(e)) return demoList(s);
     if (append && !/401|403|forbidden/i.test(String(e))) return shape({ ...s, status: "ready", pageError: true });
     return shape({ ...s, status: "error", allAppointments: [], appointments: [], nextCursor: "", pageError: false, error: ownerLoadError(e) });
   } finally { if (revision === loadRevision) paging = false; }

package/templates/portfolio-creative-owner/tier5-src/himi-owner-lite-ask/live.ts

@@ -2,7 +2,7 @@
 //
 // `loadEntityRows` calls the SAME owner-scoped Wix clients the sibling
 // list/detail workers use (searchOrders, queryStoreProducts, …), with the
-// identical `isBridgeUnavailable` → owner-preview-demo fallback.
+// identical `ownerDemoFallback` → owner-preview-demo fallback (preview hosts only).
 //
 // That is not a nicety. A generated row carries its record `id` into
 // `tier5.ask.openEntity`, which navigates to `himi_owner_lite_<entity>` — and
@@ -16,7 +16,7 @@
 // alias map to resolve a bare "@himalaya/wix-*" with.
 import { wixMediaUrl } from "@himalaya/wix-media";
 
-import { isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+import { isOwnerPreviewDemo, ownerDemoFallback } from "../_shared/owner-load-error.js";
 import { queryStoreProducts, productPrice, type StoreProduct } from "../_shared/himi-store.js";
 import { updateProduct, deleteProduct } from "@himalaya/wix-stores";
 import { deleteDraftPost } from "@himalaya/wix-blog";
@@ -362,7 +362,7 @@ export async function loadEntityRows(entity: EntityName): Promise<{ rows: Row[];
     // labelled demo row keeps the web preview useful; for a measure it would be
     // fabricated traffic and revenue, which is the one thing this screen family
     // refuses. It takes the error arm below instead, exactly as a timeout does.
-    if (isBridgeUnavailable(e) && entity !== "metrics") return { rows: demoRows(entity), demo: true, error: "" };
+    if (ownerDemoFallback(e) && entity !== "metrics") return { rows: demoRows(entity), demo: true, error: "" };
     return { rows: [], demo: false, error: `${entity} couldn't be read` };
   }
 }

package/templates/portfolio-creative-owner/tier5-src/himi-owner-lite-home/index.ts

@@ -19,7 +19,7 @@ import { getSiteAnalytics, getSiteTimeZone, localDateRange, localDateOf, localMi
 // `text(...)` and never matched on — the RAW reason is kept beside it in
 // `<part>Reason` for anything that needs it — so the display-only reduction is
 // both safe here and the reason a 428 reason code stopped reaching the owner.
-import { ownerDisplayError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+import { ownerDisplayError, isOwnerPreviewDemo, ownerDemoFallback } from "../_shared/owner-load-error.js";
 import { DEMO_DASHBOARD, DEMO_NOTE, DEMO_TODAY } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam, copyTemplate } from "../_shared/himi-copy.js";
 import { fallbackNameFrom, selectedSiteName } from "../_shared/owner-selected-site.js";
@@ -803,7 +803,7 @@ async function loadDashboard(s: HomeState, sources: HomeSourceId[]): Promise<Hom
   const successfulParts = results.flatMap(({ value }) => [value.primary, value.metrics, value.activity]).filter(Boolean);
   const failedReasons = results.flatMap(({ value }) => [value.primaryReason, value.metricsReason, value.activityReason]).filter((reason) => reason !== undefined);
   if (successfulParts.length === 0) {
-    if (failedReasons.length > 0 && failedReasons.every((reason) => isBridgeUnavailable(reason))) {
+    if (failedReasons.length > 0 && failedReasons.every((reason) => ownerDemoFallback(reason))) {
       return demoDashboard(shape({ ...s, sourceStates: [], sourceFailures: [] }));
     }
     return shape({ ...composeState(), status: "error", error: ownerDisplayError(failedReasons[0]) });

package/templates/portfolio-creative-owner/tier5-src/himi-owner-lite-order/index.ts

@@ -8,7 +8,7 @@
 
 import { defineService } from "@himalaya/state";
 import { getOrder, type WixOrder, type WixOrderLineItem } from "@himalaya/wix-ecom";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_shared/owner-load-error.js";
 import { DEMO_ORDERS, DEMO_NOTE, demoOrderDate } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { formatDateMedium } from "../_shared/engine-intl.js";
@@ -298,7 +298,7 @@ const svc = defineService<OrderState, {
       try {
         return await refresh(shape({ ...s, id, status: "loading" }), id);
       } catch (e) {
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const demo = demoDetail(s, id);
           if (demo) return demo;
         }
@@ -356,7 +356,7 @@ const svc = defineService<OrderState, {
       try {
         return await refresh(shape({ ...s, status: "loading" }), s.id);
       } catch (e) {
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const demo = demoDetail(s, s.id);
           if (demo) return demo;
         }

package/templates/portfolio-creative-owner/tier5-src/himi-owner-lite-orders/index.ts

@@ -8,7 +8,7 @@
 
 import { defineBackendCollection } from "../_shared/collection-service.js";
 import { searchOrders, type WixOrder } from "@himalaya/wix-ecom";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_shared/owner-load-error.js";
 import { DEMO_ORDERS, DEMO_NOTE, demoOrderDate } from "../_shared/owner-preview-demo.js";
 import { copyParam } from "../_shared/himi-copy.js";
 import { compareText, formatMonthDay } from "../_shared/engine-intl.js";
@@ -276,7 +276,7 @@ const svc = defineBackendCollection("himiOwnerLiteOrders", {
         if (metadata?.hasNext && !nextCursor) throw new Error("Orders response is missing its next-page cursor");
         return { items: (response.orders ?? []).filter(order => !!order?.id).map(normalize), nextCursor, metadata: { demoNote: "" } };
       } catch (error) {
-        if (!cursor && isBridgeUnavailable(error)) return demoPage();
+        if (!cursor && ownerDemoFallback(error)) return demoPage();
         throw error;
       }
     },

package/templates/portfolio-creative-owner/tier5-src/himi-owner-lite-overview/index.ts

@@ -27,7 +27,7 @@ import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
 import { site } from "@himalaya/wix-platform";
 import { searchOrders } from "@himalaya/wix-ecom";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_shared/owner-load-error.js";
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { pickSite, pickedSite } from "../_shared/owner-site-pick.js";
@@ -203,7 +203,7 @@ async function loadRollup(): Promise<OverviewState> {
     return shape({ status: "ready", rows });
   } catch (e) {
     // Only the ACCOUNT-level list failing gets here; a per-business failure is a row.
-    if (isBridgeUnavailable(e)) return demoRollup();
+    if (ownerDemoFallback(e)) return demoRollup();
     return shape({ status: "error", rows: [], error: ownerLoadError(e) });
   }
 }

package/templates/portfolio-creative-owner/tier5-src/himi-owner-lite-post/index.ts

@@ -10,25 +10,24 @@ import { getPost, getDraftPost, publishDraftPost, revertDraftPost, deleteDraftPo
 import { parseRicosJson } from "@himalaya/wix-rich-content";
 import { openRichLink } from "../_shared/rich-content-link.js";
 import { richBody } from "../_shared/rich-body.js";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo, shouldQueueOwnerWrite } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isBridgeUnavailable, isTransportFailure, isOwnerPreviewDemo, ownerDemoFallback, ownerWriteError, isNotFound } from "../_shared/owner-load-error.js";
 import { DEMO_POSTS, DEMO_NOTE, DEMO_SAVE_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
-import { get as dbGet, upsert as dbUpsert, remove as dbRemove, enqueue as dbEnqueue, type DbEntity } from "../_shared/owner-local-db.js";
+import { get as dbGet, upsert as dbUpsert, remove as dbRemove, type DbEntity } from "../_shared/owner-local-db.js";
 import { formatDateMedium } from "../_shared/engine-intl.js";
 import { blankFlags } from "../_shared/detail-facts.js";
 
-// Offline-first (data-offline): owner CRUD is WRITE-BEHIND against the encrypted
-// `owner_posts` entity — publish/unpublish/delete update the local store
-// OPTIMISTICALLY so the detail/list repaint from cache immediately, then the wix
-// write is attempted; if it can't reach the bridge/network the mutation is ENQUEUED
-// for replay on reconnect, and detail reads fall back to the last-synced local row.
+// Offline-first (data-offline): detail reads fall back to the last-synced local row
+// of the encrypted `owner_posts` entity. Publish/unpublish/delete are
+// SERVER-CONFIRMED: the local row changes only after Wix accepts the write; a failed
+// one leaves it alone and tells the owner why. No host replays a queued write, so
+// nothing is queued.
 // Every local-db call is wrapped (try/catch) so a build that ships without the
-// `local_database` grant behaves exactly as before (online-only, no cache/queue).
+// `local_database` grant behaves exactly as before (online-only, no cache).
 const ENTITY = "owner_posts";
 async function cachePut(row: DbEntity): Promise<void> { try { await dbUpsert(ENTITY, row); } catch { /* capability not granted */ } }
 async function cacheDrop(id: string): Promise<void> { try { await dbRemove(ENTITY, id); } catch { /* capability not granted */ } }
 async function cacheGet(id: string): Promise<DbEntity | null> { try { return await dbGet(ENTITY, id); } catch { return null; } }
-async function queueWrite(actionId: string, params: Record<string, string>): Promise<void> { try { await dbEnqueue(actionId, params); } catch { /* capability not granted */ } }
 /** [rico] #3370 — keep the body's plain text with the post's cached row, so the offline detail shows it. It is
  *  merged into the row the posts list wrote rather than replacing it; a later list re-sync writes its own rows
  *  and drops it again, until the detail is next opened online. */
@@ -250,16 +249,39 @@ function cachedDetail(s: PostState, row: DbEntity): PostState {
   });
 }
 
-async function refresh(prev: PostState, id: string, actionMessage = ""): Promise<PostState> {
+/** The re-read after a write Wix CONFIRMED: when it fails — thrown or as an error state
+ *  ("post not found" for a 5xx on both reads) — the confirmed change stays on screen. */
+async function reread(prev: PostState, actionMessage: string, confirmed: PostState): Promise<PostState> {
+  try {
+    // A reread right after a CONFIRMED write never drops the row that write just cached: a
+    // both-404 here is a lagging read, not proof the post is gone.
+    const next = await refresh(prev, prev.id, actionMessage, { dropIfGone: false });
+    return next.status === "error" ? confirmed : next;
+  } catch {
+    return confirmed;
+  }
+}
+
+async function refresh(prev: PostState, id: string, actionMessage = "", opts: { dropIfGone?: boolean } = {}): Promise<PostState> {
   let post: any | undefined;
   let draft: any | undefined;
   let lastError: unknown;
-  try { post = (await getPost(id)).post; } catch (e) { lastError = e; /* draft-only */ }
+  let postError: unknown;
+  try { post = (await getPost(id)).post; } catch (e) { lastError = postError = e; /* draft-only */ }
   try { draft = (await getDraftPost(id)).draftPost; } catch (e) { lastError = e; /* published-only or missing */ }
   if (!post && !draft) {
     // Both arms swallowed their errors above; surface the DESIGNED bridge
-    // boundary so the callers' catches can fall back to the demo post.
-    if (isBridgeUnavailable(lastError)) throw lastError;
+    // boundary (and a device with no connection) so the callers' catches can fall
+    // back to the cached row or the demo post — never "post not found" for a post
+    // that was only unreachable.
+    // Either read counts: a published-only post's draft read is always a 404, so the
+    // published read's failure is the one that says whether the post was only unreachable.
+    for (const err of [postError, lastError]) {
+      if (isBridgeUnavailable(err) || isTransportFailure(err)) throw err;
+    }
+    // Wix says it is gone on BOTH reads (a published-only post's draft read is a 404 on its
+    // own): its cached row must not outlive it, or an offline load repaints a deleted post.
+    if (opts.dropIfGone !== false && isNotFound(postError) && isNotFound(lastError)) await cacheDrop(id);
     return shape({ ...prev, id, status: "error", title: "", error: copyParam("ownerPost.errorNotFound", "post not found"), actionMessage });
   }
   const title = (draft?.title || post?.title || "Untitled post").trim();
@@ -336,9 +358,10 @@ const svc = defineService<PostState, {
         return loaded;
       } catch (e) {
         // Offline: fall back to the last-synced local row before the demo/error paths.
-        const cached = await cacheGet(id);
+        // Wix says it is gone (e.g. a delete whose reply was lost): drop the row, never show it.
+        const cached = isNotFound(e) ? (await cacheDrop(id), null) : await cacheGet(id);
         if (cached) return cachedDetail(s, cached);
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const demo = demoDetail(s, id);
           if (demo) return demo;
         }
@@ -359,9 +382,10 @@ const svc = defineService<PostState, {
         await cacheBodyText(loaded);
         return loaded;
       } catch (e) {
-        const cached = await cacheGet(s.id);
+        // Wix says it is gone (e.g. a delete whose reply was lost): drop the row, never show it.
+        const cached = isNotFound(e) ? (await cacheDrop(s.id), null) : await cacheGet(s.id);
         if (cached) return cachedDetail(s, cached);
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const demo = demoDetail(s, s.id);
           if (demo) return demo;
         }
@@ -373,19 +397,18 @@ const svc = defineService<PostState, {
       if (isOwnerPreviewDemo() || s.demoNote) return shape({ ...s, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
       if (!s.id) return shape({ ...s, actionMessage: copyParam("ownerPost.noIdMessage", "No post id.") });
       if (s.postStatusRaw === "PUBLISHED") return shape({ ...s, actionMessage: copyParam("ownerPost.alreadyPublished", "Post is already published.") });
-      // Optimistic local write — the detail/list repaint from cache immediately.
-      const optimistic = shape({ ...s, postStatusRaw: "PUBLISHED", postStatus: "Published", actionMessage: copyParam("ownerPost.publishedMessage", "Post published.") });
-      await cachePut(cacheRow(optimistic));
       try {
         await publishDraftPost(s.id);
-        return refresh(s, s.id, copyParam("ownerPost.publishedMessage", "Post published."));
       } catch (e) {
-        if (shouldQueueOwnerWrite(e)) {
-          await queueWrite("tier5.himiOwnerLitePost.publish", { id: s.id });
-          return shape({ ...optimistic, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
-        }
-        return shape({ ...s, actionMessage: ownerLoadError(e) });
+        // Nothing replays a queued write: the post is as it was, and the owner is told why.
+        return shape({ ...s, actionMessage: ownerWriteError(e) });
       }
+      // Wix confirmed it: the list repaints from cache at once, and a re-read that fails
+      // afterwards still shows the confirmed change rather than undoing it on screen.
+      const published = copyParam("ownerPost.publishedMessage", "Post published.");
+      const confirmed = shape({ ...s, postStatusRaw: "PUBLISHED", postStatus: "Published", actionMessage: published });
+      await cachePut(cacheRow(confirmed));
+      return reread(s, published, confirmed);
     },
     unpublish: async (s0) => {
       const s = disarm(s0);
@@ -394,19 +417,16 @@ const svc = defineService<PostState, {
       if (s.postStatusRaw !== "PUBLISHED" && s.postStatusRaw !== "SCHEDULED") {
         return shape({ ...s, actionMessage: copyParam("ownerPost.alreadyDraft", "Post is already a draft.") });
       }
-      // Optimistic local write — the detail/list repaint from cache immediately.
-      const optimistic = shape({ ...s, postStatusRaw: "UNPUBLISHED", postStatus: "Draft", actionMessage: "Post moved to drafts." });
-      await cachePut(cacheRow(optimistic));
       try {
         await revertDraftPost(s.id);
-        return refresh(s, s.id, copyParam("ownerPost.unpublishedMessage", "Post moved to drafts."));
       } catch (e) {
-        if (shouldQueueOwnerWrite(e)) {
-          await queueWrite("tier5.himiOwnerLitePost.unpublish", { id: s.id });
-          return shape({ ...optimistic, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
-        }
-        return shape({ ...s, actionMessage: ownerLoadError(e) });
+        // Nothing replays a queued write: the post is as it was, and the owner is told why.
+        return shape({ ...s, actionMessage: ownerWriteError(e) });
       }
+      const unpublished = copyParam("ownerPost.unpublishedMessage", "Post moved to drafts.");
+      const confirmed = shape({ ...s, postStatusRaw: "UNPUBLISHED", postStatus: "Draft", actionMessage: unpublished });
+      await cachePut(cacheRow(confirmed));
+      return reread(s, unpublished, confirmed);
     },
     // #3158 — destructive, so two steps. `delete` (the Manage card's Delete button)
     // only ARMS the inline confirmation, which names the record and says it cannot
@@ -423,18 +443,15 @@ const svc = defineService<PostState, {
         const s = disarm(s0);
         if (isOwnerPreviewDemo() || s.demoNote) return shape({ ...s, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
         if (!s.id) return shape({ ...s, actionMessage: copyParam("ownerPost.noIdMessage", "No post id.") });
-        // Optimistic local delete — the list drops the row immediately.
-        await cacheDrop(s.id);
         try {
           await deleteDraftPost(s.id);
-          return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerPost.deletedEmpty", "Post deleted."), actionMessage: "" });
         } catch (e) {
-          if (shouldQueueOwnerWrite(e)) {
-            await queueWrite("tier5.himiOwnerLitePost.delete", { id: s.id });
-            return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerPost.deletedEmpty", "Post deleted."), actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
-          }
-          return shape({ ...s, actionMessage: ownerLoadError(e) });
+          // Nothing replays a queued write: the post stays, and the owner is told why.
+          return shape({ ...s, actionMessage: ownerWriteError(e) });
         }
+        // Only a delete Wix confirmed leaves the local list.
+        await cacheDrop(s.id);
+        return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerPost.deletedEmpty", "Post deleted."), actionMessage: "" });
       } finally {
         deleteInFlight = false;
       }