@wix/himalaya-cli 0.1484.0 → 0.1485.0

package/guides/dynamic-list-t5.descriptor.json

@@ -83,6 +83,20 @@
               "hiddenPath": "$service:products.hideServerError"
             }
           },
+          {
+            "id": "error.membership",
+            "body": {
+              "package": "himalaya",
+              "type": "EmptyState",
+              "props": {
+                "title": "Join this site to view products",
+                "subtitle": "Ask the owner of this store to add you as a member."
+              }
+            },
+            "modifiers": {
+              "hiddenPath": "$service:products.hideMembershipError"
+            }
+          },
           {
             "id": "error.permission",
             "body": {

package/guides/dynamic-list.service.ts

@@ -24,19 +24,21 @@ interface ProductRow {
   initial: string; // derived presentation field (avatar letter)
 }
 
-// A public catalog has no sign-in flow, so a 401 reads as "permission" here — every
-// class this worker can return has a node in the descriptor.
-type ErrorKind = "" | "offline" | "server" | "permission";
+// Every class the recipe's classifier returns …
+type ErrorKind = "" | "offline" | "server" | "signIn" | "membership" | "permission";
+// … and the ones this screen shows: it has no sign-in flow (see shownKind()).
+type ShownKind = Exclude<ErrorKind, "" | "signIn">;
 
 interface ProductsState {
   status: "loading" | "ready" | "error";
   items: ProductRow[]; // ← itemsPath binds here; MUST initialize as an array
-  errorKind: ErrorKind; // why the last load failed; "" unless status is "error"
+  errorKind: "" | ShownKind; // why the last load failed; "" unless status is "error"
   // hiddenPath hides a node when its flag is TRUE.
   hideLoading: boolean;         // skeleton: first load, nothing on screen
   notEmpty: boolean;            // EmptyState: ready with zero rows
   hideOfflineError: boolean;    // one EmptyState per error class …
   hideServerError: boolean;
+  hideMembershipError: boolean;
   hidePermissionError: boolean;
   hideRefreshError: boolean;    // … and a Banner when a refresh fails over kept rows
   selectedId: string;  // row identity from onTap params — drive a detail view from it
@@ -62,7 +64,7 @@ function normalize(raw: StoreProduct): ProductRow {
 function shape(s: Partial<ProductsState>): ProductsState {
   const status = s.status ?? "ready";
   const items = s.items ?? [];
-  const errorKind: ErrorKind = status === "error" ? (s.errorKind || "server") : "";
+  const errorKind: "" | ShownKind = status === "error" ? (s.errorKind || "server") : "";
   const blank = items.length === 0; // nothing on screen to keep
   return {
     status,
@@ -72,14 +74,17 @@ function shape(s: Partial<ProductsState>): ProductsState {
     notEmpty: !(status === "ready" && blank),
     hideOfflineError: !(blank && errorKind === "offline"),
     hideServerError: !(blank && errorKind === "server"),
+    hideMembershipError: !(blank && errorKind === "membership"),
     hidePermissionError: !(blank && errorKind === "permission"),
     hideRefreshError: !(!blank && (errorKind === "offline" || errorKind === "server")),
     selectedId: s.selectedId ?? "",
   };
 }
 
+// The classifier below is `himi docs recipe-four-state`'s, VERBATIM — a test holds
+// the two byte-identical, so the rules an agent copies from here are the documented ones.
 // The HTTP status rides in the message: `HTTP 503: …` on a device, `Wix 503 for …`
-// under `himi test` / `himi render`. Only a transport failure is "offline".
+// under `himi test` / `himi render`.
 const STATUS = /\b(?:HTTP|Wix) (\d{3})\b/;
 // No answer at all — what a dropped connection says on every platform.
 const TRANSPORT = /NSURLErrorDomain|(?:UnknownHost|Connect|SocketTimeout|NoRouteToHost|SSLHandshake)Exception|Failed to connect|Unable to resolve host|Connection (?:refused|reset)|Network is unreachable|Software caused connection abort|ECONNRESET|ETIMEDOUT|EPIPE|Broken pipe|stream was reset|unexpected end of stream|timed out|^timeout$|Failed to fetch|NetworkError|^(?:TypeError: )?Load failed$|net::ERR_|^[a-z0-9-]+(?:\.[a-z0-9-]+)+$/i;
@@ -88,21 +93,45 @@ const TRANSPORT = /NSURLErrorDomain|(?:UnknownHost|Connect|SocketTimeout|NoRoute
 // A pinned site with no member session: iOS `siteNotPermitted(requested: "account", …)`,
 // Android `site account is not the bound site …`; the web host `HTTP 501: {"error":"webwix_owner_no_session"}`.
 const SIGNED_OUT = /wixApi not enabled|session unavailable|PRINCIPAL_CHANGED|not signed in|siteNotPermitted\(requested: "account"|site account is not the bound site|webwix_owner_no_session/i;
+// The account is not a member of this site: iOS `NotSiteMember(metaSiteId: …)`,
+// Android `not a member of site …`. NOT `WDE0027` — that is Wix Data's generic
+// permission refusal, which a signed-in member and a visitor both get.
+const NOT_MEMBER = /\bNotSiteMember\b|\bnot a member of site\b/i;
 
-// The same classifier as `himi docs recipe-four-state`, except that a public screen with no sign-in flow shows the permission state for a sign-in failure.
-function classifyError(e: unknown): ErrorKind {
+function classifyError(e: unknown, authState: "signedIn" | "signedOut" | "unknown" = "unknown"): ErrorKind {
   const msg = String((e as Error)?.message ?? e ?? "");
-  const code = String((e as { code?: unknown })?.code ?? "");
+  // Some bridges put the Wix code in the response body rather than Error.code.
+  const code = String((e as { code?: unknown })?.code ?? /"(?:code|error)"\s*:\s*"([^"]+)"/.exec(msg)?.[1] ?? "");
   const status = Number(STATUS.exec(msg)?.[1] ?? 0);
-  if (status === 401) return "permission";
-  if (status === 403) return "permission";
-  if (SIGNED_OUT.test(msg)) return "permission";
-  if (code === "offline_write_blocked") return "offline"; // a write refused before it left
+  if (code === "AccountSessionExpired" || code === "webwix_account_signed_out" || SIGNED_OUT.test(msg)) return "signIn";
+  if (code === "NotSiteMember" || NOT_MEMBER.test(msg)) return "membership";
+  // A 401 is a missing or expired session — unless the host knows the user is signed
+  // in, when it is a policy refusal. Never "server": a retry sends the same 401 back.
+  if (status === 401) return authState === "signedIn" ? "permission" : "signIn";
+  // A 403 is a missing permission — but a visitor the host knows is signed out gets
+  // `403 WDE0027` on member-only data too, and signing in is what fixes that.
+  if (status === 403) return authState === "signedOut" ? "signIn" : "permission";
+  if (code === "offline_write_blocked") return "offline";   // a write refused before it left
   // A web call that never reached Wix arrives as
   // `HTTP 502: {"error":"webwix_direct_failed","detail":"Failed to fetch"}` — judge its detail.
-  if (status && !msg.includes("webwix_direct_failed")) return "server";
-  if (TRANSPORT.test(msg)) return "offline";
-  return "server"; // a bug or a malformed row is not the user's connection
+  // The top-level 502 is the bridge wrapper, not the underlying transport result.
+  const detail = msg.includes("webwix_direct_failed")
+    ? /"detail"\s*:\s*"([^"]+)"/.exec(msg)?.[1] ?? msg
+    : msg;
+  if (status && detail === msg) return "server";
+  if (TRANSPORT.test(detail)) return "offline";
+  return "server";   // anything else — a bug, a malformed row — is not the user's connection
+}
+
+// App-specific host integration. If the host does not expose auth state here, keep
+// "unknown": a 401 then reads as a session that ended.
+function currentAuthState(): "signedIn" | "signedOut" | "unknown" { return "unknown"; }
+
+// This screen has no sign-in flow, so a sign-in failure shows the permission state —
+// every class it can show has a node in the descriptor.
+function shownKind(e: unknown): ShownKind {
+  const kind = classifyError(e, currentAuthState());
+  return kind === "signIn" ? "permission" : kind || "server";
 }
 
 async function loadList(s: Partial<ProductsState>): Promise<ProductsState> {
@@ -111,9 +140,10 @@ async function loadList(s: Partial<ProductsState>): Promise<ProductsState> {
     const items = (res.products ?? []).filter((p) => p?.id).map(normalize);
     return shape({ status: "ready", items, selectedId: s.selectedId });
   } catch (e) {
-    const errorKind = classifyError(e);
+    const errorKind = shownKind(e);
     // Keep the rows on a refresh failure; clear them when access is gone.
-    const items = errorKind === "permission" ? [] : s.items ?? [];
+    const lostAccess = errorKind === "membership" || errorKind === "permission";
+    const items = lostAccess ? [] : s.items ?? [];
     return shape({ ...s, status: "error", items, errorKind });
   }
 }

package/guides/form-submit-t5.descriptor.json

@@ -78,8 +78,7 @@
                       "title": "Create post",
                       "style": "primary",
                       "fullWidth": true,
-                      "action": { "actionId": "tier5.postForm.submit" },
-                      "disabledPath": "$service:postForm.cannotSave"
+                      "action": { "actionId": "tier5.postForm.submit" }
                     }
                   }
                 }

package/guides/form-submit.service.ts

@@ -25,7 +25,6 @@ interface PostFormState {
   savedMessage: string;  // "" unless saved           → collapseWhenEmpty
   hideSavedLink: boolean; // gates the "Open post" button via hiddenPath
   savedScreenId: string;  // deep-link target for the created entity
-  cannotSave: boolean;    // true after a permission failure → the submit's disabledPath
 }
 
 function shape(s: Partial<PostFormState>): PostFormState {
@@ -39,22 +38,26 @@ function shape(s: Partial<PostFormState>): PostFormState {
     savedMessage: s.savedMessage ?? "",
     savedScreenId,
     hideSavedLink: status !== "saved" || !savedScreenId,
-    cannotSave: s.cannotSave ?? false,
   };
 }
 
 // A failed save is an ACTION error: one user-facing sentence per class, shown next to
 // the submit button, which is the retry (`himi docs recipe-four-state`). Never e.message.
-type ErrorKind = "offline" | "server" | "signIn" | "permission";
-const SAVE_FAILED: Record<ErrorKind, string> = {
+// Submit stays available after every class: the user retries once they reconnect,
+// sign in, join the site or are granted access — without restarting the form.
+type ErrorKind = "" | "offline" | "server" | "signIn" | "membership" | "permission";
+const SAVE_FAILED: Record<Exclude<ErrorKind, "">, string> = {
   offline: "You're offline, so nothing was saved. Try again when you reconnect.",
   server: "Couldn't save your changes. Try again.",
   signIn: "Your session has ended. Sign in, then save again.",
+  membership: "Join this site before saving.",
   permission: "You don't have permission to save this.",
 };
 
+// The classifier below is `himi docs recipe-four-state`'s, VERBATIM — a test holds
+// the two byte-identical, so the rules an agent copies from here are the documented ones.
 // The HTTP status rides in the message: `HTTP 503: …` on a device, `Wix 503 for …`
-// under `himi test` / `himi render`. Only a transport failure is "offline".
+// under `himi test` / `himi render`.
 const STATUS = /\b(?:HTTP|Wix) (\d{3})\b/;
 // No answer at all — what a dropped connection says on every platform.
 const TRANSPORT = /NSURLErrorDomain|(?:UnknownHost|Connect|SocketTimeout|NoRouteToHost|SSLHandshake)Exception|Failed to connect|Unable to resolve host|Connection (?:refused|reset)|Network is unreachable|Software caused connection abort|ECONNRESET|ETIMEDOUT|EPIPE|Broken pipe|stream was reset|unexpected end of stream|timed out|^timeout$|Failed to fetch|NetworkError|^(?:TypeError: )?Load failed$|net::ERR_|^[a-z0-9-]+(?:\.[a-z0-9-]+)+$/i;
@@ -63,37 +66,54 @@ const TRANSPORT = /NSURLErrorDomain|(?:UnknownHost|Connect|SocketTimeout|NoRoute
 // A pinned site with no member session: iOS `siteNotPermitted(requested: "account", …)`,
 // Android `site account is not the bound site …`; the web host `HTTP 501: {"error":"webwix_owner_no_session"}`.
 const SIGNED_OUT = /wixApi not enabled|session unavailable|PRINCIPAL_CHANGED|not signed in|siteNotPermitted\(requested: "account"|site account is not the bound site|webwix_owner_no_session/i;
+// The account is not a member of this site: iOS `NotSiteMember(metaSiteId: …)`,
+// Android `not a member of site …`. NOT `WDE0027` — that is Wix Data's generic
+// permission refusal, which a signed-in member and a visitor both get.
+const NOT_MEMBER = /\bNotSiteMember\b|\bnot a member of site\b/i;
 
-// The same classifier as `himi docs recipe-four-state`.
-function classifyError(e: unknown): ErrorKind {
+function classifyError(e: unknown, authState: "signedIn" | "signedOut" | "unknown" = "unknown"): ErrorKind {
   const msg = String((e as Error)?.message ?? e ?? "");
-  const code = String((e as { code?: unknown })?.code ?? "");
+  // Some bridges put the Wix code in the response body rather than Error.code.
+  const code = String((e as { code?: unknown })?.code ?? /"(?:code|error)"\s*:\s*"([^"]+)"/.exec(msg)?.[1] ?? "");
   const status = Number(STATUS.exec(msg)?.[1] ?? 0);
-  if (status === 401) return "signIn";
-  if (status === 403) return "permission";
-  if (SIGNED_OUT.test(msg)) return "signIn";
-  if (code === "offline_write_blocked") return "offline"; // a write refused before it left
+  if (code === "AccountSessionExpired" || code === "webwix_account_signed_out" || SIGNED_OUT.test(msg)) return "signIn";
+  if (code === "NotSiteMember" || NOT_MEMBER.test(msg)) return "membership";
+  // A 401 is a missing or expired session — unless the host knows the user is signed
+  // in, when it is a policy refusal. Never "server": a retry sends the same 401 back.
+  if (status === 401) return authState === "signedIn" ? "permission" : "signIn";
+  // A 403 is a missing permission — but a visitor the host knows is signed out gets
+  // `403 WDE0027` on member-only data too, and signing in is what fixes that.
+  if (status === 403) return authState === "signedOut" ? "signIn" : "permission";
+  if (code === "offline_write_blocked") return "offline";   // a write refused before it left
   // A web call that never reached Wix arrives as
   // `HTTP 502: {"error":"webwix_direct_failed","detail":"Failed to fetch"}` — judge its detail.
-  if (status && !msg.includes("webwix_direct_failed")) return "server";
-  if (TRANSPORT.test(msg)) return "offline";
-  return "server"; // a bug or a malformed row is not the user's connection
+  // The top-level 502 is the bridge wrapper, not the underlying transport result.
+  const detail = msg.includes("webwix_direct_failed")
+    ? /"detail"\s*:\s*"([^"]+)"/.exec(msg)?.[1] ?? msg
+    : msg;
+  if (status && detail === msg) return "server";
+  if (TRANSPORT.test(detail)) return "offline";
+  return "server";   // anything else — a bug, a malformed row — is not the user's connection
 }
 
+// App-specific host integration. If the host does not expose auth state here, keep
+// "unknown": a 401 then reads as a session that ended.
+function currentAuthState(): "signedIn" | "signedOut" | "unknown" { return "unknown"; }
+
 // Blog draft bodies are rich content — wrap the plain text minimally.
 function toRichContent(text: string): WixRichContent {
   return { nodes: [{ type: "PARAGRAPH", nodes: [{ type: "TEXT", textData: { text, decorations: [] } }] }] };
 }
 
 // Every key that describes the LAST attempt, not this run: a cold boot starts from the declared values.
-const OUTCOME_KEYS = ["status", "error", "savedMessage", "savedScreenId", "hideSavedLink", "cannotSave"] as const;
+const OUTCOME_KEYS = ["status", "error", "savedMessage", "savedScreenId", "hideSavedLink"] as const;
 
 const svc = defineService<PostFormState, {
   submit: (s: PostFormState, values?: Record<string, unknown>) => Promise<PostFormState>;
 }>("postForm", {
   state: shape({}),
-  // Outcome keys are per-attempt: a cold boot must not restore a stale error, or a submit
-  // disabled by a 403 the user has since been granted past.
+  // Outcome keys are per-attempt: a cold boot must not restore a stale error or a
+  // "Draft created." line from an earlier run.
   notHydrated: OUTCOME_KEYS,
   actions: {
     // `values` is the ONLY channel for what the user typed — keyed by FormField id.
@@ -115,18 +135,18 @@ const svc = defineService<PostFormState, {
           savedScreenId: id ? `my_post_${id}` : "", // wire a templated detail route per the tier-5 guide
         });
       } catch (e) {
-        const kind = classifyError(e);
+        const kind = classifyError(e, currentAuthState()) || "server";
         // Echo what the user typed back into the prefill, so a failed save loses nothing.
         // Clear the last success line: a failed attempt must not also read "Draft created.".
-        return shape({ ...s, title, body, status: "error", error: SAVE_FAILED[kind], savedMessage: "", cannotSave: kind === "permission" });
+        return shape({ ...s, title, body, status: "error", error: SAVE_FAILED[kind], savedMessage: "" });
       }
     },
   },
 });
 
 // An older runtime ignores `notHydrated` (it does not set `himalaya.hydrationOptOut`) and restores the
-// whole snapshot: reset the outcome keys in place before any action runs, or a 403's disabled submit
-// would come back on every launch with no way to clear it.
+// whole snapshot: reset the outcome keys in place before any action runs, or last run's error line
+// would come back on every launch.
 if ((globalThis as { himalaya?: { hydrationOptOut?: unknown } }).himalaya?.hydrationOptOut !== true) {
   const booted = (svc as unknown as { getState?: () => Record<string, unknown> | undefined }).getState?.();
   const fresh = shape({}) as unknown as Record<string, unknown>;

package/guides/recipe-four-state.md

@@ -67,8 +67,8 @@ const TRANSPORT = /NSURLErrorDomain|(?:UnknownHost|Connect|SocketTimeout|NoRoute
 // Android reports an unknown host as the bare hostname (`users.wix.com`) — hence the last form.
 // No session on the device: the native bridge refuses before any request leaves.
 // A pinned site with no member session: iOS `siteNotPermitted(requested: "account", …)`,
-// Android `site account is not the bound site …`.
-const SIGNED_OUT = /wixApi not enabled|session unavailable|PRINCIPAL_CHANGED|not signed in|siteNotPermitted\(requested: "account"|site account is not the bound site/i;
+// Android `site account is not the bound site …`; the web host `HTTP 501: {"error":"webwix_owner_no_session"}`.
+const SIGNED_OUT = /wixApi not enabled|session unavailable|PRINCIPAL_CHANGED|not signed in|siteNotPermitted\(requested: "account"|site account is not the bound site|webwix_owner_no_session/i;
 // The account is not a member of this site: iOS `NotSiteMember(metaSiteId: …)`,
 // Android `not a member of site …`. NOT `WDE0027` — that is Wix Data's generic
 // permission refusal, which a signed-in member and a visitor both get.

package/guides/search-list-t5.descriptor.json

@@ -110,6 +110,20 @@
               "hiddenPath": "$service:posts.hideServerError"
             }
           },
+          {
+            "id": "error.membership",
+            "body": {
+              "package": "himalaya",
+              "type": "EmptyState",
+              "props": {
+                "title": "Join this site to view posts",
+                "subtitle": "Ask the owner of this blog to add you as a member."
+              }
+            },
+            "modifiers": {
+              "hiddenPath": "$service:posts.hideMembershipError"
+            }
+          },
           {
             "id": "error.permission",
             "body": {

package/guides/search-list.service.ts

@@ -21,15 +21,17 @@ interface PostRow {
   categoryIds: string[];
 }
 
-// A public blog has no sign-in flow, so a 401 reads as "permission" here.
-type ErrorKind = "" | "offline" | "server" | "permission";
+// Every class the recipe's classifier returns …
+type ErrorKind = "" | "offline" | "server" | "signIn" | "membership" | "permission";
+// … and the ones this screen shows: it has no sign-in flow (see shownKind()).
+type ShownKind = Exclude<ErrorKind, "" | "signIn">;
 
 interface PostsState {
   status: "loading" | "ready" | "error";
   all: PostRow[];   // the full fetched set — NOT bound by the descriptor
   items: PostRow[]; // ← itemsPath binds here; ALWAYS derived from all + query
   query: string;
-  errorKind: ErrorKind;
+  errorKind: "" | ShownKind;
   // hiddenPath flags (hide when TRUE) — see `himi docs recipe-four-state`
   hideLoading: boolean;
   hideNoPosts: boolean;   // EmptyState: the blog has no posts at all
@@ -37,6 +39,7 @@ interface PostsState {
   notEmpty: boolean;      // false while either EmptyState shows
   hideOfflineError: boolean;
   hideServerError: boolean;
+  hideMembershipError: boolean;
   hidePermissionError: boolean;
   hideRefreshError: boolean;
 }
@@ -64,7 +67,7 @@ function shape(s: Partial<PostsState>): PostsState {
   const all = s.all ?? [];
   const query = s.query ?? "";
   const items = s.items ?? visible(all, query);
-  const errorKind: ErrorKind = status === "error" ? (s.errorKind || "server") : "";
+  const errorKind: "" | ShownKind = status === "error" ? (s.errorKind || "server") : "";
   const blank = all.length === 0; // nothing loaded to keep
   return {
     status,
@@ -80,13 +83,16 @@ function shape(s: Partial<PostsState>): PostsState {
     hideLoading: !(status === "loading" && blank),
     hideOfflineError: !(blank && errorKind === "offline"),
     hideServerError: !(blank && errorKind === "server"),
+    hideMembershipError: !(blank && errorKind === "membership"),
     hidePermissionError: !(blank && errorKind === "permission"),
     hideRefreshError: !(!blank && (errorKind === "offline" || errorKind === "server")),
   };
 }
 
+// The classifier below is `himi docs recipe-four-state`'s, VERBATIM — a test holds
+// the two byte-identical, so the rules an agent copies from here are the documented ones.
 // The HTTP status rides in the message: `HTTP 503: …` on a device, `Wix 503 for …`
-// under `himi test` / `himi render`. Only a transport failure is "offline".
+// under `himi test` / `himi render`.
 const STATUS = /\b(?:HTTP|Wix) (\d{3})\b/;
 // No answer at all — what a dropped connection says on every platform.
 const TRANSPORT = /NSURLErrorDomain|(?:UnknownHost|Connect|SocketTimeout|NoRouteToHost|SSLHandshake)Exception|Failed to connect|Unable to resolve host|Connection (?:refused|reset)|Network is unreachable|Software caused connection abort|ECONNRESET|ETIMEDOUT|EPIPE|Broken pipe|stream was reset|unexpected end of stream|timed out|^timeout$|Failed to fetch|NetworkError|^(?:TypeError: )?Load failed$|net::ERR_|^[a-z0-9-]+(?:\.[a-z0-9-]+)+$/i;
@@ -95,21 +101,45 @@ const TRANSPORT = /NSURLErrorDomain|(?:UnknownHost|Connect|SocketTimeout|NoRoute
 // A pinned site with no member session: iOS `siteNotPermitted(requested: "account", …)`,
 // Android `site account is not the bound site …`; the web host `HTTP 501: {"error":"webwix_owner_no_session"}`.
 const SIGNED_OUT = /wixApi not enabled|session unavailable|PRINCIPAL_CHANGED|not signed in|siteNotPermitted\(requested: "account"|site account is not the bound site|webwix_owner_no_session/i;
+// The account is not a member of this site: iOS `NotSiteMember(metaSiteId: …)`,
+// Android `not a member of site …`. NOT `WDE0027` — that is Wix Data's generic
+// permission refusal, which a signed-in member and a visitor both get.
+const NOT_MEMBER = /\bNotSiteMember\b|\bnot a member of site\b/i;
 
-// The same classifier as `himi docs recipe-four-state`, except that a public screen with no sign-in flow shows the permission state for a sign-in failure.
-function classifyError(e: unknown): ErrorKind {
+function classifyError(e: unknown, authState: "signedIn" | "signedOut" | "unknown" = "unknown"): ErrorKind {
   const msg = String((e as Error)?.message ?? e ?? "");
-  const code = String((e as { code?: unknown })?.code ?? "");
+  // Some bridges put the Wix code in the response body rather than Error.code.
+  const code = String((e as { code?: unknown })?.code ?? /"(?:code|error)"\s*:\s*"([^"]+)"/.exec(msg)?.[1] ?? "");
   const status = Number(STATUS.exec(msg)?.[1] ?? 0);
-  if (status === 401) return "permission";
-  if (status === 403) return "permission";
-  if (SIGNED_OUT.test(msg)) return "permission";
-  if (code === "offline_write_blocked") return "offline"; // a write refused before it left
+  if (code === "AccountSessionExpired" || code === "webwix_account_signed_out" || SIGNED_OUT.test(msg)) return "signIn";
+  if (code === "NotSiteMember" || NOT_MEMBER.test(msg)) return "membership";
+  // A 401 is a missing or expired session — unless the host knows the user is signed
+  // in, when it is a policy refusal. Never "server": a retry sends the same 401 back.
+  if (status === 401) return authState === "signedIn" ? "permission" : "signIn";
+  // A 403 is a missing permission — but a visitor the host knows is signed out gets
+  // `403 WDE0027` on member-only data too, and signing in is what fixes that.
+  if (status === 403) return authState === "signedOut" ? "signIn" : "permission";
+  if (code === "offline_write_blocked") return "offline";   // a write refused before it left
   // A web call that never reached Wix arrives as
   // `HTTP 502: {"error":"webwix_direct_failed","detail":"Failed to fetch"}` — judge its detail.
-  if (status && !msg.includes("webwix_direct_failed")) return "server";
-  if (TRANSPORT.test(msg)) return "offline";
-  return "server"; // a bug or a malformed row is not the user's connection
+  // The top-level 502 is the bridge wrapper, not the underlying transport result.
+  const detail = msg.includes("webwix_direct_failed")
+    ? /"detail"\s*:\s*"([^"]+)"/.exec(msg)?.[1] ?? msg
+    : msg;
+  if (status && detail === msg) return "server";
+  if (TRANSPORT.test(detail)) return "offline";
+  return "server";   // anything else — a bug, a malformed row — is not the user's connection
+}
+
+// App-specific host integration. If the host does not expose auth state here, keep
+// "unknown": a 401 then reads as a session that ended.
+function currentAuthState(): "signedIn" | "signedOut" | "unknown" { return "unknown"; }
+
+// This screen has no sign-in flow, so a sign-in failure shows the permission state —
+// every class it can show has a node in the descriptor.
+function shownKind(e: unknown): ShownKind {
+  const kind = classifyError(e, currentAuthState());
+  return kind === "signIn" ? "permission" : kind || "server";
 }
 
 // The SearchField onChange arg shape varies by surface — read it defensively.
@@ -132,9 +162,10 @@ async function loadList(s: Partial<PostsState>): Promise<PostsState> {
       .filter((r) => r.id);
     return shape({ status: "ready", all, query: currentQuery });
   } catch (e) {
-    const errorKind = classifyError(e);
+    const errorKind = shownKind(e);
     // Keep what was loaded on a refresh failure; clear it when access is gone.
-    const all = errorKind === "permission" ? [] : s.all ?? [];
+    const lostAccess = errorKind === "membership" || errorKind === "permission";
+    const all = lostAccess ? [] : s.all ?? [];
     return shape({ status: "error", all, query: currentQuery, errorKind });
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1484.0",
+  "version": "0.1485.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "310eec6f7de3de9c4b4e96b9c25cb5913642adb3b8408fde6c3fc8a2"
+  "falconPackageHash": "b348966433fe41b3836cc5030d8aac7869b50966ab9ac20254d62046"
 }