@wix/himalaya-cli 0.1392.0 → 0.1394.0

package/templates/nonprofit-cause-owner/tier5-src/himi-owner-lite-post/index.ts

@@ -10,25 +10,24 @@ import { getPost, getDraftPost, publishDraftPost, revertDraftPost, deleteDraftPo
 import { parseRicosJson } from "@himalaya/wix-rich-content";
 import { openRichLink } from "../_shared/rich-content-link.js";
 import { richBody } from "../_shared/rich-body.js";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo, shouldQueueOwnerWrite } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isBridgeUnavailable, isTransportFailure, isOwnerPreviewDemo, ownerDemoFallback, ownerWriteError, isNotFound } from "../_shared/owner-load-error.js";
 import { DEMO_POSTS, DEMO_NOTE, DEMO_SAVE_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
-import { get as dbGet, upsert as dbUpsert, remove as dbRemove, enqueue as dbEnqueue, type DbEntity } from "../_shared/owner-local-db.js";
+import { get as dbGet, upsert as dbUpsert, remove as dbRemove, type DbEntity } from "../_shared/owner-local-db.js";
 import { formatDateMedium } from "../_shared/engine-intl.js";
 import { blankFlags } from "../_shared/detail-facts.js";
 
-// Offline-first (data-offline): owner CRUD is WRITE-BEHIND against the encrypted
-// `owner_posts` entity — publish/unpublish/delete update the local store
-// OPTIMISTICALLY so the detail/list repaint from cache immediately, then the wix
-// write is attempted; if it can't reach the bridge/network the mutation is ENQUEUED
-// for replay on reconnect, and detail reads fall back to the last-synced local row.
+// Offline-first (data-offline): detail reads fall back to the last-synced local row
+// of the encrypted `owner_posts` entity. Publish/unpublish/delete are
+// SERVER-CONFIRMED: the local row changes only after Wix accepts the write; a failed
+// one leaves it alone and tells the owner why. No host replays a queued write, so
+// nothing is queued.
 // Every local-db call is wrapped (try/catch) so a build that ships without the
-// `local_database` grant behaves exactly as before (online-only, no cache/queue).
+// `local_database` grant behaves exactly as before (online-only, no cache).
 const ENTITY = "owner_posts";
 async function cachePut(row: DbEntity): Promise<void> { try { await dbUpsert(ENTITY, row); } catch { /* capability not granted */ } }
 async function cacheDrop(id: string): Promise<void> { try { await dbRemove(ENTITY, id); } catch { /* capability not granted */ } }
 async function cacheGet(id: string): Promise<DbEntity | null> { try { return await dbGet(ENTITY, id); } catch { return null; } }
-async function queueWrite(actionId: string, params: Record<string, string>): Promise<void> { try { await dbEnqueue(actionId, params); } catch { /* capability not granted */ } }
 /** [rico] #3370 — keep the body's plain text with the post's cached row, so the offline detail shows it. It is
  *  merged into the row the posts list wrote rather than replacing it; a later list re-sync writes its own rows
  *  and drops it again, until the detail is next opened online. */
@@ -250,16 +249,39 @@ function cachedDetail(s: PostState, row: DbEntity): PostState {
   });
 }
 
-async function refresh(prev: PostState, id: string, actionMessage = ""): Promise<PostState> {
+/** The re-read after a write Wix CONFIRMED: when it fails — thrown or as an error state
+ *  ("post not found" for a 5xx on both reads) — the confirmed change stays on screen. */
+async function reread(prev: PostState, actionMessage: string, confirmed: PostState): Promise<PostState> {
+  try {
+    // A reread right after a CONFIRMED write never drops the row that write just cached: a
+    // both-404 here is a lagging read, not proof the post is gone.
+    const next = await refresh(prev, prev.id, actionMessage, { dropIfGone: false });
+    return next.status === "error" ? confirmed : next;
+  } catch {
+    return confirmed;
+  }
+}
+
+async function refresh(prev: PostState, id: string, actionMessage = "", opts: { dropIfGone?: boolean } = {}): Promise<PostState> {
   let post: any | undefined;
   let draft: any | undefined;
   let lastError: unknown;
-  try { post = (await getPost(id)).post; } catch (e) { lastError = e; /* draft-only */ }
+  let postError: unknown;
+  try { post = (await getPost(id)).post; } catch (e) { lastError = postError = e; /* draft-only */ }
   try { draft = (await getDraftPost(id)).draftPost; } catch (e) { lastError = e; /* published-only or missing */ }
   if (!post && !draft) {
     // Both arms swallowed their errors above; surface the DESIGNED bridge
-    // boundary so the callers' catches can fall back to the demo post.
-    if (isBridgeUnavailable(lastError)) throw lastError;
+    // boundary (and a device with no connection) so the callers' catches can fall
+    // back to the cached row or the demo post — never "post not found" for a post
+    // that was only unreachable.
+    // Either read counts: a published-only post's draft read is always a 404, so the
+    // published read's failure is the one that says whether the post was only unreachable.
+    for (const err of [postError, lastError]) {
+      if (isBridgeUnavailable(err) || isTransportFailure(err)) throw err;
+    }
+    // Wix says it is gone on BOTH reads (a published-only post's draft read is a 404 on its
+    // own): its cached row must not outlive it, or an offline load repaints a deleted post.
+    if (opts.dropIfGone !== false && isNotFound(postError) && isNotFound(lastError)) await cacheDrop(id);
     return shape({ ...prev, id, status: "error", title: "", error: copyParam("ownerPost.errorNotFound", "post not found"), actionMessage });
   }
   const title = (draft?.title || post?.title || "Untitled post").trim();
@@ -336,9 +358,10 @@ const svc = defineService<PostState, {
         return loaded;
       } catch (e) {
         // Offline: fall back to the last-synced local row before the demo/error paths.
-        const cached = await cacheGet(id);
+        // Wix says it is gone (e.g. a delete whose reply was lost): drop the row, never show it.
+        const cached = isNotFound(e) ? (await cacheDrop(id), null) : await cacheGet(id);
         if (cached) return cachedDetail(s, cached);
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const demo = demoDetail(s, id);
           if (demo) return demo;
         }
@@ -359,9 +382,10 @@ const svc = defineService<PostState, {
         await cacheBodyText(loaded);
         return loaded;
       } catch (e) {
-        const cached = await cacheGet(s.id);
+        // Wix says it is gone (e.g. a delete whose reply was lost): drop the row, never show it.
+        const cached = isNotFound(e) ? (await cacheDrop(s.id), null) : await cacheGet(s.id);
         if (cached) return cachedDetail(s, cached);
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const demo = demoDetail(s, s.id);
           if (demo) return demo;
         }
@@ -373,19 +397,18 @@ const svc = defineService<PostState, {
       if (isOwnerPreviewDemo() || s.demoNote) return shape({ ...s, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
       if (!s.id) return shape({ ...s, actionMessage: copyParam("ownerPost.noIdMessage", "No post id.") });
       if (s.postStatusRaw === "PUBLISHED") return shape({ ...s, actionMessage: copyParam("ownerPost.alreadyPublished", "Post is already published.") });
-      // Optimistic local write — the detail/list repaint from cache immediately.
-      const optimistic = shape({ ...s, postStatusRaw: "PUBLISHED", postStatus: "Published", actionMessage: copyParam("ownerPost.publishedMessage", "Post published.") });
-      await cachePut(cacheRow(optimistic));
       try {
         await publishDraftPost(s.id);
-        return refresh(s, s.id, copyParam("ownerPost.publishedMessage", "Post published."));
       } catch (e) {
-        if (shouldQueueOwnerWrite(e)) {
-          await queueWrite("tier5.himiOwnerLitePost.publish", { id: s.id });
-          return shape({ ...optimistic, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
-        }
-        return shape({ ...s, actionMessage: ownerLoadError(e) });
+        // Nothing replays a queued write: the post is as it was, and the owner is told why.
+        return shape({ ...s, actionMessage: ownerWriteError(e) });
       }
+      // Wix confirmed it: the list repaints from cache at once, and a re-read that fails
+      // afterwards still shows the confirmed change rather than undoing it on screen.
+      const published = copyParam("ownerPost.publishedMessage", "Post published.");
+      const confirmed = shape({ ...s, postStatusRaw: "PUBLISHED", postStatus: "Published", actionMessage: published });
+      await cachePut(cacheRow(confirmed));
+      return reread(s, published, confirmed);
     },
     unpublish: async (s0) => {
       const s = disarm(s0);
@@ -394,19 +417,16 @@ const svc = defineService<PostState, {
       if (s.postStatusRaw !== "PUBLISHED" && s.postStatusRaw !== "SCHEDULED") {
         return shape({ ...s, actionMessage: copyParam("ownerPost.alreadyDraft", "Post is already a draft.") });
       }
-      // Optimistic local write — the detail/list repaint from cache immediately.
-      const optimistic = shape({ ...s, postStatusRaw: "UNPUBLISHED", postStatus: "Draft", actionMessage: "Post moved to drafts." });
-      await cachePut(cacheRow(optimistic));
       try {
         await revertDraftPost(s.id);
-        return refresh(s, s.id, copyParam("ownerPost.unpublishedMessage", "Post moved to drafts."));
       } catch (e) {
-        if (shouldQueueOwnerWrite(e)) {
-          await queueWrite("tier5.himiOwnerLitePost.unpublish", { id: s.id });
-          return shape({ ...optimistic, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
-        }
-        return shape({ ...s, actionMessage: ownerLoadError(e) });
+        // Nothing replays a queued write: the post is as it was, and the owner is told why.
+        return shape({ ...s, actionMessage: ownerWriteError(e) });
       }
+      const unpublished = copyParam("ownerPost.unpublishedMessage", "Post moved to drafts.");
+      const confirmed = shape({ ...s, postStatusRaw: "UNPUBLISHED", postStatus: "Draft", actionMessage: unpublished });
+      await cachePut(cacheRow(confirmed));
+      return reread(s, unpublished, confirmed);
     },
     // #3158 — destructive, so two steps. `delete` (the Manage card's Delete button)
     // only ARMS the inline confirmation, which names the record and says it cannot
@@ -423,18 +443,15 @@ const svc = defineService<PostState, {
         const s = disarm(s0);
         if (isOwnerPreviewDemo() || s.demoNote) return shape({ ...s, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
         if (!s.id) return shape({ ...s, actionMessage: copyParam("ownerPost.noIdMessage", "No post id.") });
-        // Optimistic local delete — the list drops the row immediately.
-        await cacheDrop(s.id);
         try {
           await deleteDraftPost(s.id);
-          return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerPost.deletedEmpty", "Post deleted."), actionMessage: "" });
         } catch (e) {
-          if (shouldQueueOwnerWrite(e)) {
-            await queueWrite("tier5.himiOwnerLitePost.delete", { id: s.id });
-            return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerPost.deletedEmpty", "Post deleted."), actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
-          }
-          return shape({ ...s, actionMessage: ownerLoadError(e) });
+          // Nothing replays a queued write: the post stays, and the owner is told why.
+          return shape({ ...s, actionMessage: ownerWriteError(e) });
         }
+        // Only a delete Wix confirmed leaves the local list.
+        await cacheDrop(s.id);
+        return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerPost.deletedEmpty", "Post deleted."), actionMessage: "" });
       } finally {
         deleteInFlight = false;
       }

package/templates/nonprofit-cause-owner/tier5-src/himi-owner-lite-post-form/index.ts

@@ -10,21 +10,20 @@ import { wixCall } from "@himalaya/wix-site-media";
 import { wixMediaUrl, WIX_DETAIL_IMAGE } from "../_shared/himi-store.js";
 import { defineService } from "@himalaya/state";
 import { getDraftPost, createDraftPost, updateDraftPost, type WixDraftPostWrite, type WixRichContent } from "@himalaya/wix-blog";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo, shouldQueueOwnerWrite } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback, ownerWriteError } from "../_shared/owner-load-error.js";
 import { DEMO_POSTS, DEMO_NOTE, DEMO_SAVE_NOTE, demoRefusalPatch } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
-import { get as dbGet, upsert as dbUpsert, remove as dbRemove, enqueue as dbEnqueue, type DbEntity } from "../_shared/owner-local-db.js";
+import { get as dbGet, upsert as dbUpsert, remove as dbRemove, type DbEntity } from "../_shared/owner-local-db.js";
 
 // Offline-first (data-offline): owner CRUD is WRITE-BEHIND against the encrypted
-// `owner_posts` entity — cache confirmed writes, or enqueue offline edits for
-// replay on reconnect. Failed cover imports must not appear as saved drafts.
+// `owner_posts` entity — cache confirmed writes only; a failed save says nothing was
+// saved (no host replays a queue). Failed cover imports must not appear as saved drafts.
 // Every local-db call is wrapped (try/catch) so a build that ships without the
 // `local_database` grant behaves exactly as before (online-only, no cache/queue).
 const ENTITY = "owner_posts";
 async function cachePut(row: DbEntity): Promise<void> { try { await dbUpsert(ENTITY, row); } catch { /* capability not granted */ } }
 async function cacheDrop(id: string): Promise<void> { try { await dbRemove(ENTITY, id); } catch { /* capability not granted */ } }
 async function cacheGet(id: string): Promise<DbEntity | null> { try { return await dbGet(ENTITY, id); } catch { return null; } }
-async function queueWrite(actionId: string, params: Record<string, string>): Promise<void> { try { await dbEnqueue(actionId, params); } catch { /* capability not granted */ } }
 
 type Mode = "create" | "edit";
 
@@ -223,7 +222,7 @@ const svc = defineService<PostFormState, {
             status: "idle", error: "", savedMessage: "",
           });
         }
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const d = DEMO_POSTS.find((x) => x.id === id);
           if (d) {
             return shape({
@@ -342,23 +341,11 @@ const svc = defineService<PostFormState, {
         await cachePut(localRow(id));
         return savedState(id, editing ? copyParam("ownerPostForm.updatedMessage", "Post updated.") : copyParam("ownerPostForm.createdMessage", "Draft created."));
       } catch (e) {
-        if (shouldQueueOwnerWrite(e)) {
-          // Demo / web-preview (no owner bridge; the record came from demo sample
-          // data, marked by demoNote): a queued write could never replay, so answer
-          // with the demo save note instead of the real-offline write-behind.
-          if (s.demoNote) return demoRefusal(s);
-          // Real device offline: cache and queue the edit for reconnect. `preserveBody` stays
-          // "true" even for a body edit, so a bundle rolled back past this change keeps the stored
-          // body rather than flattening it to text. This bundle replays `richContentJson`.
-          await cachePut(localRow(localId));
-          await queueWrite("tier5.himiOwnerLitePostForm.submit", {
-            id: targetId, title, excerpt, coverUrl, coverChanged: String(coverChanged), preserveBody: "true",
-            body: postBodyText(kept), ...(bodyEdited ? { richContentJson: bodyRaw } : {}),
-            isFeatured: String(isFeatured), mode: editing ? "edit" : "create",
-          });
-          return savedState(localId, copyParam("ownerPostForm.savedOffline", "Saved offline — will sync when you reconnect."));
-        }
-        return shape({ ...s, status: "error", error: ownerLoadError(e), savedMessage: "" });
+        // Demo / web-preview: the record came from demo sample data (marked by demoNote).
+        if (s.demoNote) return demoRefusal(s);
+        // Never "saved offline": nothing replays a queued write on any platform. The
+        // typed values stay in the form (the body in its editor), so a retry is one tap.
+        return shape({ ...s, title, excerpt, coverUrl, isFeatured: isFeatured ? "true" : "false", status: "error", error: ownerWriteError(e), savedMessage: "" });
       }
     })()),
   },

package/templates/nonprofit-cause-owner/tier5-src/himi-owner-lite-posts/index.ts

@@ -4,7 +4,7 @@
 
 import { defineService } from "../_shared/collection-service.js";
 import { queryPosts, queryDraftPosts } from "@himalaya/wix-blog";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_shared/owner-load-error.js";
 import { DEMO_POSTS, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { getAll, upsert, type DbEntity } from "../_shared/owner-local-db.js";
@@ -227,7 +227,7 @@ async function loadList(s: PostsState): Promise<PostsState> {
   } catch (e) {
     // Offline / fetch failure: keep the last-synced cache BEFORE the demo/error fallbacks.
     if (cached.length) return base;
-    if (isBridgeUnavailable(e)) return demoList(s);
+    if (ownerDemoFallback(e)) return demoList(s);
     return shape({ ...s, status: "error", allPosts: [], posts: [], error: ownerLoadError(e) });
   }
 }

package/templates/nonprofit-cause-owner/tier5-src/himi-owner-lite-service/index.ts

@@ -7,25 +7,24 @@
 
 import { defineService } from "@himalaya/state";
 import { getService, deleteService, type WixService } from "@himalaya/wix-bookings";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo, shouldQueueOwnerWrite } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback, ownerWriteError, isNotFound } from "../_shared/owner-load-error.js";
 import { DEMO_SERVICES, DEMO_NOTE, DEMO_SAVE_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
-import { get as dbGet, remove as dbRemove, enqueue as dbEnqueue, type DbEntity } from "../_shared/owner-local-db.js";
+import { get as dbGet, remove as dbRemove, type DbEntity } from "../_shared/owner-local-db.js";
 import { wixMediaUrl, WIX_DETAIL_IMAGE } from "@himalaya/wix-media";
 import { blankFlags } from "../_shared/detail-facts.js";
 
 // Offline-first (data-offline): the service DETAIL falls back to the last-synced
-// local `owner_services` row (put by the service form's write-behind) on a failed
-// fetch, and its delete is WRITE-BEHIND — the local row is dropped OPTIMISTICALLY,
-// then deleteService is attempted; if the bridge/network is unreachable the delete
-// is ENQUEUED for replay on reconnect. Every local-db call is wrapped so a build
-// without the `local_database` grant behaves exactly as before (online-only).
+// local `owner_services` row on a failed fetch. Its delete is SERVER-CONFIRMED: the
+// local row is dropped only after Wix deletes the service; a failed delete leaves it
+// and tells the owner why. No host replays a queued write, so nothing is queued.
+// Every local-db call is wrapped so a build without the `local_database` grant
+// behaves exactly as before (online-only).
 const ENTITY = "owner_services";
 
 
 async function cacheDrop(id: string): Promise<void> { try { await dbRemove(ENTITY, id); } catch { /* capability not granted */ } }
 async function cacheGet(id: string): Promise<DbEntity | null> { try { return await dbGet(ENTITY, id); } catch { return null; } }
-async function queueWrite(actionId: string, params: Record<string, string>): Promise<void> { try { await dbEnqueue(actionId, params); } catch { /* capability not granted */ } }
 
 interface ServiceState {
   id: string;
@@ -238,9 +237,10 @@ const svc = defineService<ServiceState, {
         return await refresh(shape({ ...s, id, status: "loading" }), id);
       } catch (e) {
         // Offline: fall back to the last-synced local row before the demo/error paths.
-        const cached = await cacheGet(id);
+        // Wix says it is gone (e.g. a delete whose reply was lost): drop the row, never show it.
+        const cached = isNotFound(e) ? (await cacheDrop(id), null) : await cacheGet(id);
         if (cached) return cachedDetail(s, cached);
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const demo = demoDetail(s, id);
           if (demo) return demo;
         }
@@ -258,9 +258,10 @@ const svc = defineService<ServiceState, {
       try {
         return await refresh(shape({ ...s, status: "loading" }), s.id);
       } catch (e) {
-        const cached = await cacheGet(s.id);
+        // Wix says it is gone (e.g. a delete whose reply was lost): drop the row, never show it.
+        const cached = isNotFound(e) ? (await cacheDrop(s.id), null) : await cacheGet(s.id);
         if (cached) return cachedDetail(s, cached);
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const demo = demoDetail(s, s.id);
           if (demo) return demo;
         }
@@ -270,18 +271,15 @@ const svc = defineService<ServiceState, {
     delete: async (s) => {
       if (isOwnerPreviewDemo() || s.demoNote) return shape({ ...s, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
       if (!s.id) return shape({ ...s, actionMessage: copyParam("ownerService.noIdMessage", "No service id.") });
-      // Optimistic local delete — the list drops the row immediately.
-      await cacheDrop(s.id);
       try {
         await deleteService(s.id);
-        return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerService.deletedEmpty", "Service deleted."), actionMessage: "" });
       } catch (e) {
-        if (shouldQueueOwnerWrite(e)) {
-          await queueWrite("tier5.himiOwnerLiteService.delete", { id: s.id });
-          return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerService.deletedEmpty", "Service deleted."), actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
-        }
-        return shape({ ...s, actionMessage: ownerLoadError(e) });
+        // Nothing replays a queued write: the record stays, and the owner is told why.
+        return shape({ ...s, actionMessage: ownerWriteError(e) });
       }
+      // Only a delete Wix confirmed leaves the local list.
+      await cacheDrop(s.id);
+      return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerService.deletedEmpty", "Service deleted."), actionMessage: "" });
     },
   },
 });

package/templates/nonprofit-cause-owner/tier5-src/himi-owner-lite-service-form/index.ts

@@ -6,22 +6,20 @@
 
 import { defineService } from "@himalaya/state";
 import { getService, updateService, type WixService } from "@himalaya/wix-bookings";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo, shouldQueueOwnerWrite } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback, ownerWriteError } from "../_shared/owner-load-error.js";
 import { DEMO_SERVICES, DEMO_NOTE, DEMO_SAVE_NOTE, demoRefusalPatch } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
-import { get as dbGet, upsert as dbUpsert, enqueue as dbEnqueue, type DbEntity } from "../_shared/owner-local-db.js";
+import { get as dbGet, upsert as dbUpsert, type DbEntity } from "../_shared/owner-local-db.js";
 
-// Offline-first (data-offline): the service edit is WRITE-BEHIND against the
-// encrypted `owner_services` entity — the local store is updated OPTIMISTICALLY so
-// the detail/list repaint from cache immediately, then updateService is attempted;
-// if it can't reach the bridge/network the write is ENQUEUED for replay on
-// reconnect, and load prefills from the last-synced local row when offline. Every
-// local-db call is wrapped (try/catch) so a build that ships without the
-// `local_database` grant behaves exactly as before (online-only, no cache/queue).
+// Offline-first (data-offline): load prefills from the last-synced local
+// `owner_services` row when offline, and the edit is SERVER-CONFIRMED — the local
+// row changes only after Wix accepts it; a failed save leaves it alone, keeps the
+// form, and tells the owner why. No host replays a queued write, so nothing is queued.
+// Every local-db call is wrapped (try/catch) so a build that ships without the
+// `local_database` grant behaves exactly as before (online-only, no cache).
 const ENTITY = "owner_services";
 async function cachePut(row: DbEntity): Promise<void> { try { await dbUpsert(ENTITY, row); } catch { /* capability not granted */ } }
 async function cacheGet(id: string): Promise<DbEntity | null> { try { return await dbGet(ENTITY, id); } catch { return null; } }
-async function queueWrite(actionId: string, params: Record<string, string>): Promise<void> { try { await dbEnqueue(actionId, params); } catch { /* capability not granted */ } }
 
 interface ServiceFormState {
   mode: "edit";
@@ -156,7 +154,7 @@ const svc = defineService<ServiceFormState, {
             status: "idle", error: "", savedMessage: "",
           });
         }
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const d = DEMO_SERVICES.find((x) => x.id === id);
           if (d) {
             return shape({
@@ -178,10 +176,8 @@ const svc = defineService<ServiceFormState, {
       if (!name) return shape({ ...s, status: "error", error: copyParam("ownerServiceForm.nameRequired", "Name is required"), savedMessage: "" });
       if (!targetId) return shape({ ...s, status: "error", error: copyParam("ownerServiceForm.errorNoService", "No service to edit."), savedMessage: "" });
 
-      // Optimistic local write — the detail/list repaint from cache immediately (offline or not).
       const cached = !s.id ? await cacheGet(targetId) : null;
       const localRow: DbEntity = { ...(cached ?? {}), id: targetId, name, title: name, description, category: s.category || String(cached?.category ?? "") };
-      await cachePut(localRow);
       try {
         // v2 PATCH is a masked update requiring the current `revision` (optimistic
         // concurrency), captured from the getService on load. The response wraps
@@ -190,6 +186,8 @@ const svc = defineService<ServiceFormState, {
         // load-time revision and reject.
         const res = await updateService(targetId, { name, ...(description ? { description } : {}), ...(s.revision ? { revision: s.revision } : {}) });
         const bumped = String((res?.service as { revision?: unknown } | undefined)?.revision ?? "");
+        // The local row follows only what Wix confirmed.
+        await cachePut(localRow);
         return shape({
           ...s, id: targetId, name, description,
           revision: bumped || s.revision,
@@ -197,22 +195,11 @@ const svc = defineService<ServiceFormState, {
           savedId: targetId,
         });
       } catch (e) {
-        if (shouldQueueOwnerWrite(e)) {
-          // Demo / web-preview (no owner bridge; the record came from demo sample
-          // data, marked by demoNote): a queued write could never replay, so answer
-          // with the demo save note instead of the real-offline write-behind.
-          if (s.demoNote) return demoRefusal(s);
-          // Real device offline: the optimistic cache row already shows; queue the
-          // write to replay (WriteQueue, idempotent) when connectivity returns.
-          await queueWrite("tier5.himiOwnerLiteServiceForm.submit", { id: targetId, name, description });
-          return shape({
-            ...s, id: targetId, name, description,
-            status: "saved", error: "",
-            savedMessage: copyParam("ownerServiceForm.savedOffline", "Saved offline — will sync when you reconnect."),
-            savedId: targetId,
-          });
-        }
-        return shape({ ...s, status: "error", error: ownerLoadError(e), savedMessage: "" });
+        // Never "saved offline": nothing replays a queued write on any platform. The cache was
+        // not touched, and the typed values stay in the form so a retry is one tap.
+        // Demo / web-preview: the record came from demo sample data (marked by demoNote).
+        if (s.demoNote) return demoRefusal(s);
+        return shape({ ...s, name, description, status: "error", error: ownerWriteError(e), savedMessage: "" });
       }
     },
   },

package/templates/nonprofit-cause-owner/tier5-src/himi-owner-lite-services/index.ts

@@ -5,7 +5,7 @@
 import { defineBackendCollection } from "../_shared/collection-service.js";
 import { offsetPage } from "../_shared/offset-page.js";
 import { queryServices, type WixService } from "@himalaya/wix-bookings";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_shared/owner-load-error.js";
 import { DEMO_SERVICES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { copyParam } from "../_shared/himi-copy.js";
 import { getAll, upsert, type DbEntity } from "../_shared/owner-local-db.js";
@@ -171,7 +171,7 @@ const svc = defineBackendCollection("himiOwnerLiteServices", {
           const cached = await readCachedRows();
           if (cached.length) return { items: cached, nextCursor: "", complete: false, metadata: { fromCache: true } };
         }
-        if (!cursor && isBridgeUnavailable(error)) return demo();
+        if (!cursor && ownerDemoFallback(error)) return demo();
         throw error;
       }
     },

package/templates/nonprofit-cause-owner/tier5-src/himi-owner-lite-sites/index.ts

@@ -8,7 +8,7 @@
 
 import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_shared/owner-load-error.js";
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { getAll, upsert, type DbEntity } from "../_shared/owner-local-db.js";
@@ -165,7 +165,7 @@ async function loadList(s: SitesState): Promise<SitesState> {
   } catch (e) {
     // Offline / fetch failure: keep the last-synced cache BEFORE the demo/error fallbacks.
     if (repairedCache.length) return base;
-    if (isBridgeUnavailable(e)) return demoList(s);
+    if (ownerDemoFallback(e)) return demoList(s);
     return shape({ ...s, status: "error", allSites: [], sites: [], error: ownerLoadError(e) });
   }
 }