@wix/himalaya-cli 0.1392.0 → 0.1394.0

package/templates/retail-store-owner/tier5-src/himi-owner-lite-product/index.ts

@@ -7,24 +7,22 @@
 import { defineService } from "@himalaya/state";
 import { getProduct, updateProduct, deleteProduct, type WixProduct } from "@himalaya/wix-stores";
 import { plainText, productImage, wixMediaUrl, WIX_DETAIL_IMAGE, type StoreProduct } from "../_shared/himi-store.js";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo, shouldQueueOwnerWrite } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback, ownerWriteError, isNotFound } from "../_shared/owner-load-error.js";
 import { DEMO_PRODUCTS, DEMO_NOTE, DEMO_SAVE_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
-import { get as dbGet, upsert as dbUpsert, remove as dbRemove, enqueue as dbEnqueue, type DbEntity } from "../_shared/owner-local-db.js";
+import { get as dbGet, upsert as dbUpsert, remove as dbRemove, type DbEntity } from "../_shared/owner-local-db.js";
 import { blankFlags } from "../_shared/detail-facts.js";
 
-// Offline-first (data-offline): owner CRUD is WRITE-BEHIND against the encrypted
-// `owner_products` entity — the local store is updated OPTIMISTICALLY so the
-// detail/list repaint from cache immediately, then the Wix write is attempted; if
-// it can't reach the bridge/network the mutation is ENQUEUED for replay on
-// reconnect, and detail reads fall back to the last-synced local row. Every
-// local-db call is wrapped (try/catch) so a build that ships without the
-// `local_database` grant behaves exactly as before (online-only, no cache/queue).
+// Offline-first (data-offline): detail reads fall back to the last-synced local row
+// of the encrypted `owner_products` entity. Writes are SERVER-CONFIRMED: the local
+// row changes only after Wix accepts the write; a failed one leaves it alone and
+// tells the owner why. No host replays a queued write, so nothing is queued.
+// Every local-db call is wrapped (try/catch) so a build that ships without the
+// `local_database` grant behaves exactly as before (online-only, no cache).
 const ENTITY = "owner_products";
 async function cachePut(row: DbEntity): Promise<void> { try { await dbUpsert(ENTITY, row); } catch { /* capability not granted */ } }
 async function cacheDrop(id: string): Promise<void> { try { await dbRemove(ENTITY, id); } catch { /* capability not granted */ } }
 async function cacheGet(id: string): Promise<DbEntity | null> { try { return await dbGet(ENTITY, id); } catch { return null; } }
-async function queueWrite(actionId: string, params: Record<string, string>): Promise<void> { try { await dbEnqueue(actionId, params); } catch { /* capability not granted */ } }
 
 interface ProductState {
   id: string;
@@ -265,19 +263,21 @@ async function setVisibility(s: ProductState, visible: boolean, msg: string): Pr
         : copyParam("ownerProduct.alreadyHidden", "Already hidden."),
     });
   }
-  // Optimistic local write — the detail/list repaint from cache immediately.
-  const optimistic = shape({ ...s, visibleRaw: visible, statusLabel: visible ? "Visible in store" : "Hidden", subtitle: visible ? "Visible in store" : "Hidden from store", actionMessage: msg });
-  await cachePut(cacheRow(optimistic));
   try {
     await updateProduct(s.id, { visible });
-    return refresh(s, s.id, msg);
   } catch (e) {
-    if (shouldQueueOwnerWrite(e)) {
-      // Offline / no bridge: queue the visibility write to replay on reconnect.
-      await queueWrite("tier5.himiOwnerLiteProduct." + (visible ? "show" : "hide"), { id: s.id });
-      return shape({ ...optimistic, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
-    }
-    return shape({ ...s, actionMessage: ownerLoadError(e) });
+    // Nothing replays a queued write: the record is as it was, and the owner is told why.
+    return shape({ ...s, actionMessage: ownerWriteError(e) });
+  }
+  // Wix confirmed it: the list repaints from cache at once, and a re-read that fails
+  // afterwards still shows the confirmed change rather than undoing it on screen.
+  const confirmed = shape({ ...s, visibleRaw: visible, statusLabel: visible ? "Visible in store" : "Hidden", subtitle: visible ? "Visible in store" : "Hidden from store", actionMessage: msg });
+  await cachePut(cacheRow(confirmed));
+  try {
+    const next = await refresh(s, s.id, msg);
+    return next.status === "error" ? confirmed : next;
+  } catch {
+    return confirmed;
   }
 }
 
@@ -321,9 +321,10 @@ const svc = defineService<ProductState, {
         return await refresh(shape({ ...s, id, status: "loading" }), id);
       } catch (e) {
         // Offline: fall back to the last-synced local row before the demo/error paths.
-        const cached = await cacheGet(id);
+        // Wix says it is gone (e.g. a delete whose reply was lost): drop the row, never show it.
+        const cached = isNotFound(e) ? (await cacheDrop(id), null) : await cacheGet(id);
         if (cached) return cachedDetail(s, cached);
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const demo = demoDetail(s, id);
           if (demo) return demo;
         }
@@ -342,9 +343,10 @@ const svc = defineService<ProductState, {
       try {
         return await refresh(shape({ ...s, status: "loading" }), s.id);
       } catch (e) {
-        const cached = await cacheGet(s.id);
+        // Wix says it is gone (e.g. a delete whose reply was lost): drop the row, never show it.
+        const cached = isNotFound(e) ? (await cacheDrop(s.id), null) : await cacheGet(s.id);
         if (cached) return cachedDetail(s, cached);
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const demo = demoDetail(s, s.id);
           if (demo) return demo;
         }
@@ -368,18 +370,15 @@ const svc = defineService<ProductState, {
         const s = disarm(s0);
         if (isOwnerPreviewDemo() || s.demoNote) return shape({ ...s, actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
         if (!s.id) return shape({ ...s, actionMessage: copyParam("ownerProduct.noIdMessage", "No product id.") });
-        // Optimistic local delete — the list drops the row immediately.
-        await cacheDrop(s.id);
         try {
           await deleteProduct(s.id);
-          return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerProduct.deletedEmpty", "Product deleted."), actionMessage: "" });
         } catch (e) {
-          if (shouldQueueOwnerWrite(e)) {
-            await queueWrite("tier5.himiOwnerLiteProduct.delete", { id: s.id });
-            return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerProduct.deletedEmpty", "Product deleted."), actionMessage: copyParam("ownerCommon.demoSaveNote", DEMO_SAVE_NOTE) });
-          }
-          return shape({ ...s, actionMessage: ownerLoadError(e) });
+          // Nothing replays a queued write: the record stays, and the owner is told why.
+          return shape({ ...s, actionMessage: ownerWriteError(e) });
         }
+        // Only a delete Wix confirmed leaves the local list.
+        await cacheDrop(s.id);
+        return shape({ ...s, status: "deleted", title: "", emptyText: copyParam("ownerProduct.deletedEmpty", "Product deleted."), actionMessage: "" });
       } finally {
         deleteInFlight = false;
       }

package/templates/retail-store-owner/tier5-src/himi-owner-lite-product-form/index.ts

@@ -15,29 +15,28 @@ import {
   type WixProduct,
   type WixProductWrite,
 } from "@himalaya/wix-stores";
-import { get as dbGet, upsert as dbUpsert, remove as dbRemove, enqueue as dbEnqueue, type DbEntity } from "../_shared/owner-local-db.js";
+import { get as dbGet, upsert as dbUpsert, remove as dbRemove, type DbEntity } from "../_shared/owner-local-db.js";
 import { htmlIsTrivial, htmlPreviewText } from "../_shared/owner-rich-guard.js";
 import { postBodyText, plainPostBody } from "../_shared/owner-post-content.js";
 import { editorSubmitValue, queuedDocument, editorChanged, cachedRichVerdict, editorRunKeys, resetHydratedEditorOnOlderRuntime, editorAfterSave, liveState, settleOverLive } from "../_shared/owner-editor-value.js";
 import { parseRicosJson } from "@himalaya/wix-rich-content";
 import { ricosUploadService } from "@himalaya/wix-rich-content-editor";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo, shouldQueueOwnerWrite } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback, ownerWriteError } from "../_shared/owner-load-error.js";
 import { DEMO_PRODUCTS, DEMO_NOTE, DEMO_SAVE_NOTE, demoRefusalPatch, editablePrice } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 
 type Mode = "create" | "edit";
 
-// Offline-first (data-offline): owner CRUD is WRITE-BEHIND against the encrypted
-// `owner_products` entity — the local store is updated OPTIMISTICALLY so the list
-// repaints from cache immediately, then the Wix write is attempted; if it can't
-// reach the bridge/network the mutation is ENQUEUED for replay on reconnect. Every
-// local-db call is wrapped (try/catch) so a build that ships without the
-// `local_database` grant behaves exactly as before (online-only, no cache/queue).
+// Offline-first (data-offline): writes to the encrypted `owner_products` entity are
+// SERVER-CONFIRMED — the list's local row changes only after Wix accepts the save;
+// a failed one leaves it alone, keeps the form, and tells the owner why. No host
+// replays a queued write, so nothing is queued.
+// Every local-db call is wrapped (try/catch) so a build that ships without the
+// `local_database` grant behaves exactly as before (online-only, no cache).
 const ENTITY = "owner_products";
 async function cachePut(row: DbEntity): Promise<void> { try { await dbUpsert(ENTITY, row); } catch { /* capability not granted */ } }
 async function cacheDrop(id: string): Promise<void> { try { await dbRemove(ENTITY, id); } catch { /* capability not granted */ } }
 async function cacheGet(id: string): Promise<DbEntity | null> { try { return await dbGet(ENTITY, id); } catch { return null; } }
-async function queueWrite(actionId: string, params: Record<string, string>): Promise<void> { try { await dbEnqueue(actionId, params); } catch { /* capability not granted */ } }
 
 // The store's currency — the Apptestersite detail view shows € prices.
 const CURRENCY = "EUR";
@@ -268,7 +267,7 @@ const svc = defineService<ProductFormState, {
             status: "idle", error: "", savedMessage: "",
           });
         }
-        if (isBridgeUnavailable(e)) {
+        if (ownerDemoFallback(e)) {
           const d = DEMO_PRODUCTS.find((p) => p.id === id);
           if (d) {
             return shape({
@@ -356,7 +355,7 @@ const svc = defineService<ProductFormState, {
       const knownPlain = s.descriptionMode === "plain" || (s.descriptionMode === "editor" && !s.descriptionPending && s.descriptionJson === "");
       const descriptionProtected = cachedRichVerdict(heldDoc as never, knownPlain);
 
-      // Optimistic local write — the list repaints from cache immediately (offline or not).
+      // The row the cache gets once Wix accepts the save.
       // Replay starts with default worker state. An untouched description was omitted from the
       // queued PATCH, so retain its cached mirror/document/verdict when replacing the local row.
       const cached = replay && targetId ? await cacheGet(targetId) : null;
@@ -380,7 +379,6 @@ const svc = defineService<ProductFormState, {
         return { descriptionDirty: a.dirty, descriptionEdits: a.edits, ...(a.editedDuringSave ? { status: "idle" as const, savedMessage: "" } : {}) };
       };
       const localId = mode === "edit" && targetId ? targetId : `local-${Date.now()}`;
-      await cachePut(localRow(localId));
       try {
         let id = targetId;
         if (mode === "edit" && targetId) {
@@ -388,9 +386,9 @@ const svc = defineService<ProductFormState, {
         } else {
           const r = await createProduct(write);
           id = r.product?.id || localId;
-          // Reconcile the optimistic local id with the server-assigned id.
-          if (id !== localId) { await cacheDrop(localId); await cachePut(localRow(id)); }
         }
+        // The local row follows only what Wix confirmed, under the id Wix assigned.
+        await cachePut(localRow(id));
         return shape({
           ...s,
           mode: "edit",
@@ -407,44 +405,26 @@ const svc = defineService<ProductFormState, {
           ...afterSaved(),
         });
       } catch (e) {
-        if (shouldQueueOwnerWrite(e)) {
-          // Demo / web-preview (no owner bridge; the record came from DEMO_PRODUCTS,
-          // marked by demoNote): a queued write could never replay, so answer with
-          // the demo save note instead of the real-offline write-behind.
-          if (s.demoNote) return demoRefusal(s);
-          // Real device offline: the optimistic cache row already shows; queue the
-          // write to replay (WriteQueue, idempotent) when connectivity returns.
-          // A document rides as `descriptionJson` with descriptionEdited "false", so a bundle rolled back
-          // past this change leaves the description rather than flattening it to text.
-          await queueWrite("tier5.himiOwnerLiteProductForm.submit", { id: targetId, name, price, sku, description, visible: String(visible), mode,
-            ...(docRaw ? { descriptionJson: docRaw, descriptionEdited: "false" } : { descriptionEdited: String(descriptionEdited) }) });
-          return shape({
-            ...s, mode: "edit", id: localId, name, price, sku, ...savedDescription,
-            visible: visible ? "true" : "false", status: "saved",
-            savedMessage: copyParam("ownerProductForm.savedOffline", "Saved offline — will sync when you reconnect."),
-            savedId: localId,
-            ...afterSaved(),
-          });
-        }
-        return shape({ ...s, status: "error", error: ownerLoadError(e), savedMessage: "" });
+        // Never "saved offline": nothing replays a queued write on any platform. The cache was
+        // not touched, and the typed values stay in the form (the description in its editor) so
+        // a retry is one tap.
+        // Demo / web-preview: the record came from DEMO_PRODUCTS (marked by demoNote).
+        if (s.demoNote) return demoRefusal(s);
+        return shape({ ...s, name, price, sku, ...(s.descriptionMode === "editor" ? {} : { description }), visible: visible ? "true" : "false", status: "error", error: ownerWriteError(e), savedMessage: "" });
       }
     })()),
     remove: async (s) => {
       if (isOwnerPreviewDemo() || s.demoNote) return demoRefusal(s);
       if (!s.id) return shape({ ...s, status: "error", error: copyParam("ownerProductForm.errorNoDelete", "No product to delete."), savedMessage: "" });
-      // Optimistic local delete — the list drops the row immediately.
-      await cacheDrop(s.id);
       try {
         await deleteProduct(s.id);
-        return shape({ ...s, id: "", status: "saved", error: "", savedMessage: copyParam("ownerProductForm.deletedMessage", "Product deleted."), savedId: "" });
       } catch (e) {
-        if (shouldQueueOwnerWrite(e)) {
-          if (s.demoNote) return demoRefusal(s);
-          await queueWrite("tier5.himiOwnerLiteProductForm.remove", { id: s.id });
-          return shape({ ...s, id: "", status: "saved", error: "", savedMessage: copyParam("ownerProductForm.deletedOffline", "Deleted offline — will sync when you reconnect."), savedId: "" });
-        }
-        return shape({ ...s, status: "error", error: ownerLoadError(e), savedMessage: "" });
+        // Nothing replays a queued delete: the row stays, and the owner is told why.
+        return shape({ ...s, status: "error", error: ownerWriteError(e), savedMessage: "" });
       }
+      // Only a delete Wix confirmed leaves the local list.
+      await cacheDrop(s.id);
+      return shape({ ...s, id: "", status: "saved", error: "", savedMessage: copyParam("ownerProductForm.deletedMessage", "Product deleted."), savedId: "" });
     },
   },
 });

package/templates/retail-store-owner/tier5-src/himi-owner-lite-products/index.ts

@@ -7,7 +7,7 @@
 import { compareText } from "../_shared/engine-intl.js";
 import { defineBackendCollection } from "../_shared/collection-service.js";
 import { searchStoreProducts, productImage, productPrice, plainText, type StoreProduct } from "../_shared/himi-store.js";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_shared/owner-load-error.js";
 import { DEMO_PRODUCTS, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { copyParam } from "../_shared/himi-copy.js";
 import { getAll, upsert, type DbEntity } from "../_shared/owner-local-db.js";
@@ -191,7 +191,7 @@ const svc = defineBackendCollection("himiOwnerLiteProducts", {
           const items = (await readCachedRows()).filter(item => !!item.id);
           if (items.length) return { items, nextCursor: "", complete: false, metadata: { fromCache: true, demoNote: "" } };
         }
-        if (!cursor && isBridgeUnavailable(error)) return demoPage();
+        if (!cursor && ownerDemoFallback(error)) return demoPage();
         throw error;
       }
     },

package/templates/retail-store-owner/tier5-src/himi-owner-lite-sites/index.ts

@@ -8,7 +8,7 @@
 
 import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_shared/owner-load-error.js";
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { getAll, upsert, type DbEntity } from "../_shared/owner-local-db.js";
@@ -165,7 +165,7 @@ async function loadList(s: SitesState): Promise<SitesState> {
   } catch (e) {
     // Offline / fetch failure: keep the last-synced cache BEFORE the demo/error fallbacks.
     if (repairedCache.length) return base;
-    if (isBridgeUnavailable(e)) return demoList(s);
+    if (ownerDemoFallback(e)) return demoList(s);
     return shape({ ...s, status: "error", allSites: [], sites: [], error: ownerLoadError(e) });
   }
 }

package/templates/retail-store-owner/tier5-src/himi-owner-lite-today/index.ts

@@ -0,0 +1,315 @@
+// Tier-5 bundle: __HIMI_APP_NAME__ — TODAY. The worker behind the Home Screen widget.
+//
+// A WidgetKit extension (and a Glance receiver) runs no JS and holds no Wix session, and the OTA
+// widget producer has no credential either, so neither can read an owner's business. The PHONE
+// app runs this worker headlessly with its owner Wix bridge, resolves the widget descriptors'
+// `$service:ownerToday.*` leaves to literals (CompanionDescriptorResolver, the same pattern the
+// watch companion uses), and writes the frozen tree to the App Group for the widget to render.
+//
+// One owner glance: "what's next, and what is waiting for me" — the next booking, the booking
+// requests waiting on the owner, and the orders that need attention. Read-only: a widget never
+// writes to the business.
+//
+// Each source degrades on its own. A site without Bookings answers 428/404 on the bookings
+// query, and that must not cost the order count (or the reverse).
+
+import { defineService } from "@himalaya/state";
+import { queryBookings } from "@himalaya/wix-bookings";
+import { searchOrders } from "@himalaya/wix-ecom";
+import { ownerOrderAttentionFilter } from "../_shared/owner-order-attention.js";
+import { readSelectedSite } from "../_shared/owner-selected-site.js";
+
+type Rec = Record<string, unknown>;
+
+/** One booking as the widget shows it. Client FIRST name only: a Home Screen is visible to
+ *  anyone near the phone. */
+export interface TodayBooking {
+  bookingId: string;
+  name: string;
+  service: string;
+  timeLabel: string; // "10:30"
+  dayLabel: string; // "Today" / "Tomorrow" / "Thu 16 Oct"
+  /** "Today 10:30" — the absolute moment, never a countdown: a frozen "in 21 min" is wrong a
+   *  minute later, and nothing re-renders the widget between app foregrounds. */
+  whenLabel: string;
+}
+
+export interface TodayState {
+  status: "loading" | "ready" | "error" | "signedOut";
+  siteName: string;
+  /** Header line: "Today · <site>", or "Today" when the site has no name yet. */
+  header: string;
+  next: TodayBooking;
+  hasNext: boolean;
+  /** Hide the next-booking block: nothing is booked, or Bookings cannot be read. */
+  hideNext: boolean;
+  /** "No upcoming bookings" — shown in place of the block when Bookings has nothing ahead. */
+  nextNote: string;
+  hideNextNote: boolean;
+  requestCount: number;
+  /** "2 requests" / "1 request" / "No requests". At the read cap: "50+ requests". */
+  requestLabel: string;
+  orderCount: number;
+  /** "3 orders to handle" / "1 order to handle" / "No orders waiting". */
+  orderLabel: string;
+  /** Compact counts for the small widget: "2 req · 3 orders". */
+  countsShort: string;
+  bookingsReady: boolean;
+  ordersReady: boolean;
+  hideRequests: boolean;
+  hideOrders: boolean;
+  /** One-line state copy for a degrade (signed out, read failed, nothing installed). */
+  message: string;
+  hideMessage: boolean;
+  /** Epoch SECONDS after which this frame's labels are wrong: the next local midnight ("Today" /
+   *  "Tomorrow" shift) or the next booking's start (it is no longer "next"), whichever is first.
+   *  The phone caps the snapshot's lifetime at it, so a frozen frame never outlives its words. */
+  validUntil: number;
+}
+
+/** Which verticals THIS build provisions — baked into the widget descriptors' `input`. A vertical
+ *  the build does not show is never read: its count must not reach the compact line, and its
+ *  transient failure must not withhold a frame about the sections the build does show. */
+export interface Verticals {
+  bookings: boolean;
+  store: boolean;
+}
+
+export const COPY = {
+  signedOut: "Sign in to Owner to see today",
+  error: "Open Owner to refresh",
+  nothing: "Open Owner to see your business",
+  noneUpcoming: "No upcoming bookings",
+} as const;
+
+const PENDING = ["PENDING", "PENDING_APPROVAL", "WAITING_LIST"];
+/** A glance, not a list: a count at the cap reads as "50+". */
+export const LIMIT = 50;
+
+const WEEKDAYS = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
+const MONTHS = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
+
+function str(r: unknown, ...paths: string[]): string {
+  for (const path of paths) {
+    let v: unknown = r;
+    for (const k of path.split(".")) v = v && typeof v === "object" ? (v as Rec)[k] : undefined;
+    if (typeof v === "string" && v) return v;
+    if (typeof v === "number") return String(v);
+  }
+  return "";
+}
+
+function hhmm(d: Date): string {
+  return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
+}
+
+function sameLocalDay(a: Date, b: Date): boolean {
+  return a.getFullYear() === b.getFullYear() && a.getMonth() === b.getMonth() && a.getDate() === b.getDate();
+}
+
+/** The day a booking falls on, as an owner would say it. */
+export function dayLabel(start: Date, now: Date): string {
+  if (sameLocalDay(start, now)) return "Today";
+  const tomorrow = new Date(now.getFullYear(), now.getMonth(), now.getDate() + 1);
+  if (sameLocalDay(start, tomorrow)) return "Tomorrow";
+  return `${WEEKDAYS[start.getDay()]} ${start.getDate()} ${MONTHS[start.getMonth()]}`;
+}
+
+function startOf(b: Rec): string {
+  return str(b, "startDate", "bookedEntity.slot.startDate");
+}
+
+function booking(b: Rec, now: Date): TodayBooking {
+  const start = new Date(startOf(b));
+  const day = dayLabel(start, now);
+  return {
+    bookingId: str(b, "id"),
+    name: str(b, "contactDetails.firstName") || "Client",
+    service: str(b, "bookedEntity.title", "bookedEntity.slot.serviceName") || "Appointment",
+    timeLabel: hhmm(start),
+    dayLabel: day,
+    whenLabel: `${day} ${hhmm(start)}`,
+  };
+}
+
+const EMPTY_BOOKING: TodayBooking = { bookingId: "", name: "", service: "", timeLabel: "", dayLabel: "", whenLabel: "" };
+
+function counted(n: number, capped: boolean, one: string, many: string): string {
+  return `${capped ? `${LIMIT}+` : n} ${n === 1 && !capped ? one : many}`;
+}
+
+export interface Sources {
+  /** Upcoming CONFIRMED bookings, or null when Bookings could not be read. */
+  bookings: Rec[] | null;
+  /** Upcoming booking REQUESTS (pending statuses), read on their own: one page of every status
+   *  would fill with a busy week's confirmed bookings and hide next week's request. */
+  requests: Rec[] | null;
+  /** Orders needing attention, or null when Store could not be read. */
+  orders: Rec[] | null;
+}
+
+function upcoming(rows: Rec[] | null, statuses: string[], now: Date): Rec[] {
+  return (rows ?? [])
+    .filter((b) => str(b, "id") && statuses.includes(str(b, "status").toUpperCase()))
+    .filter((b) => Date.parse(startOf(b)) >= now.getTime())
+    .sort((a, b) => Date.parse(startOf(a)) - Date.parse(startOf(b)) || str(a, "id").localeCompare(str(b, "id")));
+}
+
+/** Pure: shape what was read into the widget state. `now` is injectable for tests. */
+export function shape(sources: Sources, now: Date, siteName: string): TodayState {
+  const bookingsReady = sources.bookings !== null && sources.requests !== null;
+  const ordersReady = sources.orders !== null;
+  // Re-filtered even though the queries filter: a server (or a fixture) that returns a
+  // cancelled or past row must not become an appointment the owner is told to expect.
+  const confirmed = bookingsReady ? upcoming(sources.bookings, ["CONFIRMED"], now) : [];
+  // Today's next CONFIRMED booking first: a request is not an appointment yet. With none left
+  // today, the first confirmed one after today, so "what's next" still has an answer.
+  const next = confirmed.find((b) => sameLocalDay(new Date(startOf(b)), now)) ?? confirmed[0];
+  const requestCount = bookingsReady ? upcoming(sources.requests, PENDING, now).length : 0;
+  const orderCount = (sources.orders ?? []).length;
+  const requestsCapped = (sources.requests ?? []).length >= LIMIT;
+  const ordersCapped = orderCount >= LIMIT;
+
+  const shortParts = [
+    ...(bookingsReady ? [`${requestsCapped ? `${LIMIT}+` : requestCount} req`] : []),
+    ...(ordersReady ? [counted(orderCount, ordersCapped, "order", "orders")] : []),
+  ];
+  const nothing = !bookingsReady && !ordersReady;
+  const nextNote = bookingsReady && !next ? COPY.noneUpcoming : "";
+  const midnight = new Date(now.getFullYear(), now.getMonth(), now.getDate() + 1).getTime();
+  const nextStart = next ? Date.parse(startOf(next)) : Infinity;
+  return {
+    validUntil: Math.floor(Math.min(midnight, nextStart) / 1000),
+    status: "ready",
+    siteName,
+    header: siteName ? `Today · ${siteName}` : "Today",
+    next: next ? booking(next, now) : EMPTY_BOOKING,
+    hasNext: !!next,
+    hideNext: !next,
+    nextNote,
+    hideNextNote: !nextNote,
+    requestCount,
+    requestLabel: requestCount ? counted(requestCount, requestsCapped, "request", "requests") : "No requests",
+    orderCount,
+    orderLabel: orderCount ? `${counted(orderCount, ordersCapped, "order", "orders")} to handle` : "No orders waiting",
+    countsShort: shortParts.join(" · "),
+    bookingsReady,
+    ordersReady,
+    hideRequests: !bookingsReady,
+    hideOrders: !ordersReady,
+    message: nothing ? COPY.nothing : "",
+    hideMessage: !nothing,
+  };
+}
+
+/** A degrade frame: ONE line, no rows. After a sign-out or a business switch the last rows
+ *  belong to someone else's clients, so none of them survive into it. */
+export function degraded(status: "error" | "signedOut" | "loading", siteName: string): TodayState {
+  // A FIXED instant, not the clock: a degrade frame has no rows, so nothing in it depends on
+  // the time — and the initial state must be deterministic (template contract: no worker's
+  // initial state may read the clock).
+  const base = shape({ bookings: null, requests: null, orders: null }, new Date(0), siteName);
+  const message = status === "signedOut" ? COPY.signedOut : status === "error" ? COPY.error : "";
+  // validUntil pinned too: shape() derives it from LOCAL midnight, so even at a fixed instant it
+  // would vary with the build machine's timezone and change the baked services hash.
+  return { ...base, status, message, hideMessage: !message, validUntil: 0 };
+}
+
+/** No usable owner session behind the bridge (the bridge refusing, or a 401). A transient
+ *  5xx is an ordinary error, not a sign-out — and a 403 is a missing PERMISSION for one
+ *  vertical (a collaborator whose role lacks Bookings), not a sign-out either. */
+export function isSignedOut(e: unknown): boolean {
+  const text = String((e as Error)?.message ?? e);
+  return /^HTTP 401\b/.test(text) || /wixApi not enabled|session unavailable|not signed in|webwix_bridge/i.test(text);
+}
+
+/** This section cannot exist for this owner: the vertical is not installed on the site (its
+ *  API answers 428, or 404 for the route), or the owner's role may not read it (403). Hides
+ *  that one section; every other failure is an error for the whole frame.
+ *
+ *  Read from the LEADING status only — the bridges format a failure as `HTTP <status>: <body>`
+ *  or `HTTP <status> [<code>]: <message>` — never from anywhere in the message: a transient
+ *  `HTTP 503: {"message":"upstream returned 404"}` must stay an error, not hide the section. */
+export function isSectionUnavailable(e: unknown): boolean {
+  const text = String((e as Error)?.message ?? e);
+  return /^HTTP (?:403|404|428)\b/.test(text) || /^HTTP \d{3} \[(?:FAILED_PRECONDITION|PERMISSION_DENIED)\]/.test(text);
+}
+
+function siteName(): string {
+  return readSelectedSite()?.name ?? "";
+}
+
+type Read = { ok: true; value: unknown } | { ok: false; error: unknown };
+
+async function attempt(fn: () => Promise<unknown>): Promise<Read> {
+  try {
+    return { ok: true, value: await fn() };
+  } catch (error) {
+    return { ok: false, error };
+  }
+}
+
+function rows(r: Read, key: string): Rec[] | null {
+  if (!r.ok) return null;
+  const list = (r.value as Rec | undefined)?.[key];
+  return Array.isArray(list) ? (list as Rec[]) : [];
+}
+
+/** The build's verticals from the descriptor's baked `input.verticals` ("bookings,store"). A
+ *  host that passes none (an older descriptor) reads both, as before. */
+export function buildVerticals(): Verticals {
+  const raw = (globalThis as { himalaya?: { input?: Record<string, unknown> } }).himalaya?.input?.verticals;
+  if (typeof raw !== "string") return { bookings: true, store: true };
+  const set = new Set(raw.split(",").map((v) => v.trim()));
+  return { bookings: set.has("bookings"), store: set.has("store") };
+}
+
+/** A section this build does not provision: never read, and indistinguishable from "not
+ *  installed" downstream (hidden, out of the compact line, out of the error rule). */
+const NOT_PROVISIONED: Read = { ok: false, error: new Error("HTTP 404: not provisioned in this build") };
+
+async function read(): Promise<TodayState> {
+  const nowIso = new Date().toISOString();
+  const verticals = buildVerticals();
+  const sort = [{ fieldName: "startDate", order: "ASC" }, { fieldName: "id", order: "ASC" }];
+  const bookingsBy = (statuses: string[]) => verticals.bookings ? attempt(() => queryBookings({ query: {
+    filter: { startDate: { $gte: nowIso }, status: { $in: statuses } },
+    sort,
+    paging: { limit: LIMIT, offset: 0 },
+  } })) : Promise.resolve(NOT_PROVISIONED);
+  const reads = await Promise.all([
+    bookingsBy(["CONFIRMED"]),
+    bookingsBy(PENDING),
+    verticals.store ? attempt(() => searchOrders({ search: {
+      filter: ownerOrderAttentionFilter(),
+      sort: [{ fieldName: "createdDate", order: "DESC" }, { fieldName: "id", order: "ASC" }],
+      cursorPaging: { limit: LIMIT },
+    } })) : Promise.resolve(NOT_PROVISIONED),
+  ]);
+  const failures = reads.flatMap((r) => (r.ok ? [] : [r.error]));
+  if (failures.some(isSignedOut)) return degraded("signedOut", "");
+  // A section that cannot exist (not installed, no permission) is hidden. ANY other failure —
+  // a transient 5xx on one read included — makes this an error frame, which the phone does
+  // not publish: the last good frame stays, rather than a frame that silently drops a
+  // section the owner does have and reads as "nothing waiting".
+  if (failures.some((e) => !isSectionUnavailable(e))) return degraded("error", siteName());
+  const [bookings, requests, orders] = reads;
+  return shape({
+    bookings: rows(bookings, "bookings"),
+    requests: rows(requests, "bookings"),
+    orders: rows(orders, "orders"),
+  }, new Date(), siteName());
+}
+
+const svc = defineService<TodayState, {
+  load: (s: TodayState) => Promise<TodayState>;
+  refresh: (s: TodayState) => Promise<TodayState>;
+}>("ownerToday", {
+  state: degraded("loading", ""),
+  actions: {
+    load: async () => read(),
+    refresh: async () => read(),
+  },
+});
+
+export { svc };