@wix/himalaya-cli 0.1484.0 → 0.1486.0

package/dist/cli.mjs

@@ -22144,6 +22144,7 @@ function resolveIdiom(tokens2, ctx = {}) {
 var IDIOM_CONTEXTS, UNSAFE_KEYS;
 var init_idiom = __esm({
   "../../core/ts/src/idiom.ts"() {
+    "use strict";
     IDIOM_CONTEXTS = {
       ios: { native: ["ios"] },
       android: { native: ["material"] },
@@ -187803,7 +187804,7 @@ var COMMANDS = [
   { name: "patch", summary: 'change ONE item of a published app \u2014 a screen descriptor, a Tier-5 bundle, tokens, or the app-config baseline \u2014 from a RAW FILE, with no content package and no build. The low-level door: it does not lint your package, because there is no package here; `himi push --only <selector>` is the same edit with the full build + lint gate and is what to reach for when the package is in hand. Derives a new release from the app\'s current LIVE release, or from `--from-release <id>`. An explicit `--draft` or `--live` is REQUIRED \u2014 a patch has no default blast radius \u2014 and `--notes` is required with `--live` on a screen or app-config patch, because off-repo `gitSha` is "dev" and the ledger notes are then the only durable record of bytes that correspond to no commit. A branch does not merge: activating one derived from an older release reverts every item the patch does not move, so that case is refused until `--accept-regressions`. A bundle patch must repoint a screen (`--for-screen`) or the bytes land under a manifest key nothing reads. It cannot ADD a screen (screens are git-only, RFC 0012), never claims a slug \u2014 the app must already be published \u2014 and carries no attestation, source archive, assets, icon or minBinaryVersion, each named in the output.', required: "screen <id> --file <descriptor.json> [--bundle <sha256|none>] | bundle --file <bundle.js> (--for-screen <id>[,<id>] | --no-rebind) | tokens --file <tokens.json> | app-config --file <app-config.json> ; (--draft|--live) --app <a> [--from-release <id>] [--accept-regressions] [--label <n>] [--notes <t>] [--force] [--allow-binary-gap] [--target <t>] (--control-token)" },
   { name: "flags", summary: "read and change the app's OPERATIONAL flags (RFC 0013) \u2014 `list` prints what the DEVICE door serves, `set <key> --definition` creates or replaces one, `ramp <key>` moves its rollout share or kills it, `rm <key>` deletes it and echoes the definition back so the removal is reversible. Every write is followed by a read of the same door the device uses, and the answer is reported as `servedNow`: flags are stored in the app's git-committed flags.json, so a control plane with no checkout accepts a write it will never serve.", required: "list|set|ramp|rm [<key>] [--definition <json|@file>] [--percent 0-100] [--enabled true|false] [--app <a>] (--control-token)" },
   { name: "visibility", summary: "read (no value) or set whether the public registry (/v1/apps + the Himi Player picker) LISTS the app. `public` lists it for everyone; `unlisted` hides it from listings while direct reads by app id \u2014 deep links, previews \u2014 keep working. App from --app or the content dir. Setting it needs no republish.", required: "[public|unlisted] [--app <a>] [--content <dir>] (--control-token)" },
-  { name: "dist", summary: "build an INSTALLABLE QA binary (signed IPA / APK) on the Wix Job Service Mac pool and return an install link \u2014 the serve plane brokers the job, the pool builds it. WAITS for the build by default (~4 min) and prints the install link; `--no-wait` returns a jobId immediately instead. Omitting `--release` builds whatever is LIVE for the app. A named draft is refused unless `--allow-draft` makes that exceptional build explicit. `status <jobId>` / `watch <jobId>` / `list --app <a>` / `cancel <jobId>` inspect and stop builds (`watch` reports up front whether the job mints its own signing identity or borrows one, so a doomed iOS build is cancellable in seconds rather than after the archive). Off-repo, name a target \u2014 `--target wix` for a self-serve Wix login or `--target bo` for the internal employee path (the in-repo default is a local dev plane that isn't reachable off-repo); self-serve callers may build their OWN apps under a tighter budget (2 in flight / 5 per 24h), while a manage-only owner-role credential is refused. `--shell` picks the native host to sign into (branded-lite | owner-lite | brandy | base44 | player | demo-app) and defaults to the content package's himalaya.content.json `shell` (templates carry the one they were written for), else branded-lite. The per-app shells ADD the release's declared capabilities to the binary, while Himi Player and demo-app refuse a release declaring one they lack; `--plan` previews it without building; `brandy` is the site shell \u2014 the customer's own website as native-framed tabs. `--signing` defaults to `wix-managed` \u2014 the Wix Apple account mints a per-app signing identity for the build, so the caller provisions no Apple credentials of their own; `--signing byo --site <id>` reuses an existing customer ad-hoc profile and certificate for iOS; requires an owned site and a completed personal signing binding. `--android-signing` is the Android counterpart and a SEPARATE axis (a keystore, not an Apple account): `qa-keystore` (default \u2014 the repo's committed QA key, identical on every pool machine, so a build installs over the previous one), `wix-keystore` (the Wix key the pool machine carries; the build FAILS naming the paths searched if it carries none, rather than quietly signing with something else), or `debug` (the old per-machine key \u2014 QA must uninstall any previous build first). `--aab` builds an Android App Bundle (.aab) for the owner to upload to Google Play AND an APK from the same build \u2014 a download link for the .aab, an install link and QR for the APK; Android only; the bundle is signed with the Wix production key (`wix-keystore`, the upload key Branded apps use) \u2014 any other `--android-signing` is refused \u2014 and the APK with the committed QA key; limited to internal callers (a self-serve caller gets 403 android_format_not_allowed). NOT the normal way to ship: screens, Tier-5 bundles, tokens and app-config all go over the air with `himi push` in seconds \u2014 a binary trip is only needed for a NATIVE delta (a new SDUI component, a new declared capability/entitlement, a new bundle id, or a minBinaryVersion floor bump). Refuses to build an app whose launcher icon is missing, a placeholder, or one a store would reject \u2014 the one thing a binary carries that no later OTA push can fix; `--force` builds anyway", required: "[--app <a>] [--platform ios,android] [--release <id>] [--allow-draft] [--target <t>] [--shell branded-lite|owner-lite|brandy|base44|player|demo-app] [--signing wix-managed|byo] [--site <id>] [--android-signing qa-keystore|wix-keystore|debug] [--aab] [--borrow-ios-id <bundleId>] [--no-wait] [--force] [--plan] | status <jobId> [--target <t>] | watch <jobId> [--target <t>] [--interval <ms>] | list --app <a> [--target <t>] | cancel <jobId> [--target <t>]" },
+  { name: "dist", summary: "build an INSTALLABLE QA binary (signed IPA / APK) on the Wix Job Service Mac pool and return an install link \u2014 the serve plane brokers the job, the pool builds it. WAITS for the build by default (~4 min) and prints the install link; `--no-wait` returns a jobId immediately instead. Omitting `--release` builds whatever is LIVE for the app. A named draft is refused unless `--allow-draft` makes that exceptional build explicit. `status <jobId>` / `watch <jobId>` / `list --app <a>` / `cancel <jobId>` inspect and stop builds (`watch` reports up front whether the job mints its own signing identity or borrows one, so a doomed iOS build is cancellable in seconds rather than after the archive). Off-repo, name a target \u2014 `--target wix` for a self-serve Wix login or `--target bo` for the internal employee path (the in-repo default is a local dev plane that isn't reachable off-repo); self-serve callers may build their OWN apps under a tighter budget (2 in flight / 5 per 24h), while a manage-only owner-role credential is refused. `--shell` picks the native host to sign into (branded-lite | owner-lite | brandy | base44 | player | demo-app) and defaults to the content package's himalaya.content.json `shell` (templates carry the one they were written for), else branded-lite. The per-app shells ADD the release's declared capabilities to the binary, while Himi Player and demo-app refuse a release declaring one they lack; `--plan` previews it without building; `brandy` is the site shell \u2014 the customer's own website as native-framed tabs. `--signing` defaults to `wix-managed` \u2014 the Wix Apple account mints a per-app signing identity for the build, so the caller provisions no Apple credentials of their own; `--signing byo --site <id>` reuses an existing customer ad-hoc profile and certificate for iOS; requires an owned site and a completed personal signing binding. `--android-signing` is the Android counterpart and a SEPARATE axis (a keystore, not an Apple account): `qa-keystore` (default \u2014 the repo's committed QA key, identical on every pool machine, so a build installs over the previous one), `wix-keystore` (the Wix key the pool machine carries; the build FAILS naming the paths searched if it carries none, rather than quietly signing with something else), or `debug` (the old per-machine key \u2014 QA must uninstall any previous build first). `--aab` builds an Android App Bundle (.aab) for the owner to upload to Google Play AND an APK from the same build \u2014 a download link for the .aab, an install link and QR for the APK; Android only; the bundle is signed with the Wix production key (`wix-keystore`, the upload key Branded apps use) \u2014 any other `--android-signing` is refused \u2014 and the APK with the committed QA key; a self-serve caller gets one only as the store build of its own Containers app (it must own the app's site, and `--aab` sends your Wix login); any other self-serve `--aab` gets 403 android_format_not_allowed. NOT the normal way to ship: screens, Tier-5 bundles, tokens and app-config all go over the air with `himi push` in seconds \u2014 a binary trip is only needed for a NATIVE delta (a new SDUI component, a new declared capability/entitlement, a new bundle id, or a minBinaryVersion floor bump). Refuses to build an app whose launcher icon is missing, a placeholder, or one a store would reject \u2014 the one thing a binary carries that no later OTA push can fix; `--force` builds anyway", required: "[--app <a>] [--platform ios,android] [--release <id>] [--allow-draft] [--target <t>] [--shell branded-lite|owner-lite|brandy|base44|player|demo-app] [--signing wix-managed|byo] [--site <id>] [--android-signing qa-keystore|wix-keystore|debug] [--aab] [--borrow-ios-id <bundleId>] [--no-wait] [--force] [--plan] | status <jobId> [--target <t>] | watch <jobId> [--target <t>] [--interval <ms>] | list --app <a> [--target <t>] | cancel <jobId> [--target <t>]" },
   { name: "testflight", summary: 'build, sign and upload an app to TestFlight (internal testers \u2014 no Beta App Review), then WAIT until App Store Connect finishes processing it. Sugar for `store upload --track testflight`. Prompts first: a build number is consumed permanently on a real Apple account and cannot be reused \u2014 `--yes` for CI, `--dry-run` to see the plan without touching anything. The wait is the real check, not a nicety: fastlane prints "Successfully uploaded" for a binary App Store Connect then rejects in processing, and a rejected binary leaves NO build record at all (the reason is emailed). Public App Store review is deliberately NOT automatable here \u2014 `--track appstore` is refused; use /submit-ios-app when you mean to go public', required: "<app> [--track testflight|internal] [--profile <name>] [--yes] [--dry-run] [--skip-build] [--no-wait] [--json]" },
   { name: "store", summary: "the App Store Connect group behind `testflight`. `preflight <app>` checks readiness offline (icon, entitlements, encryption flag, version, store.config ids, listing + review record); `upload <app>` is what `testflight` runs; `status <app>` reads live build + processing state. `--profile` selects WHICH App Store Connect account: an app built for a Wix customer ships under the CUSTOMER's Apple team (Apple guideline 4.2.6 forbids an app-generation service submitting on a client's behalf), declared per-app as ios.credentialProfile in store.config.yaml and resolved from ~/.himalaya/store-credentials/<name>.json \u2014 the .p8 itself never enters the repo. `iap draft|plan|apply|status|connect|screenshots` registers an app owner's digital products as in-app purchases (non-consumables, or consumable price tiers): draft reads the Wix catalog and writes the manifest, plan and status only read, apply is the one App Store mutation boundary, connect readies the Wix site to sell them (purchases app, In-App Purchase key, appleIAP provider, product mappings; --preview-tag routes only its Serve calls to a deploy preview), screenshots renders each product's purchase screen from the app (--content) as a bound iPhone shows it to a signed-in member and names the 1290\xD72796 PNG as the item's App Review screenshot, and none of them builds, signs or needs a checkout (`himi docs iap-products`)", required: "preflight <app> [--profile <n>] | upload <app> [--track <t>] [--profile <n>] [--yes] [--dry-run] | status <app> [--profile <n>] | iap draft --site <msid> --profile <n> --apple-app <id> --bundle <id> --base-territory <t> --out <f> [--territories <a,b>] [--locale <l>] [--mode per-item|tiers] [--merge <f>] [--report <f>] [--json] | iap plan --manifest <f> --profile <n> --out <f> [--json] | iap apply --plan <f> --profile <n> --out <f> [--yes] [--limit <n>] [--json] | iap status --manifest <f> --profile <n> [--out <f>] [--json] | iap connect --manifest <f> --profile <n> [--iap-key <AuthKey.p8> --iap-key-id <id>] [--content <dir>] [--preview-tag dp-<tag>] [--dry-run] [--yes] [--out <f>] [--json] | iap screenshots --manifest <f> --content <dir> [--profile <n>] [--out-dir <d>] [--only <id,\u2026>] [--force] [--dry-run] [--json]" },
   { name: "guide", summary: "print the Himalaya overview + headless dev loop + available topics (offline)", required: "[--json]" },

package/guides/dynamic-list-t5.descriptor.json

@@ -83,6 +83,20 @@
               "hiddenPath": "$service:products.hideServerError"
             }
           },
+          {
+            "id": "error.membership",
+            "body": {
+              "package": "himalaya",
+              "type": "EmptyState",
+              "props": {
+                "title": "Join this site to view products",
+                "subtitle": "Ask the owner of this store to add you as a member."
+              }
+            },
+            "modifiers": {
+              "hiddenPath": "$service:products.hideMembershipError"
+            }
+          },
           {
             "id": "error.permission",
             "body": {

package/guides/dynamic-list.service.ts

@@ -24,19 +24,21 @@ interface ProductRow {
   initial: string; // derived presentation field (avatar letter)
 }
 
-// A public catalog has no sign-in flow, so a 401 reads as "permission" here — every
-// class this worker can return has a node in the descriptor.
-type ErrorKind = "" | "offline" | "server" | "permission";
+// Every class the recipe's classifier returns …
+type ErrorKind = "" | "offline" | "server" | "signIn" | "membership" | "permission";
+// … and the ones this screen shows: it has no sign-in flow (see shownKind()).
+type ShownKind = Exclude<ErrorKind, "" | "signIn">;
 
 interface ProductsState {
   status: "loading" | "ready" | "error";
   items: ProductRow[]; // ← itemsPath binds here; MUST initialize as an array
-  errorKind: ErrorKind; // why the last load failed; "" unless status is "error"
+  errorKind: "" | ShownKind; // why the last load failed; "" unless status is "error"
   // hiddenPath hides a node when its flag is TRUE.
   hideLoading: boolean;         // skeleton: first load, nothing on screen
   notEmpty: boolean;            // EmptyState: ready with zero rows
   hideOfflineError: boolean;    // one EmptyState per error class …
   hideServerError: boolean;
+  hideMembershipError: boolean;
   hidePermissionError: boolean;
   hideRefreshError: boolean;    // … and a Banner when a refresh fails over kept rows
   selectedId: string;  // row identity from onTap params — drive a detail view from it
@@ -62,7 +64,7 @@ function normalize(raw: StoreProduct): ProductRow {
 function shape(s: Partial<ProductsState>): ProductsState {
   const status = s.status ?? "ready";
   const items = s.items ?? [];
-  const errorKind: ErrorKind = status === "error" ? (s.errorKind || "server") : "";
+  const errorKind: "" | ShownKind = status === "error" ? (s.errorKind || "server") : "";
   const blank = items.length === 0; // nothing on screen to keep
   return {
     status,
@@ -72,14 +74,17 @@ function shape(s: Partial<ProductsState>): ProductsState {
     notEmpty: !(status === "ready" && blank),
     hideOfflineError: !(blank && errorKind === "offline"),
     hideServerError: !(blank && errorKind === "server"),
+    hideMembershipError: !(blank && errorKind === "membership"),
     hidePermissionError: !(blank && errorKind === "permission"),
     hideRefreshError: !(!blank && (errorKind === "offline" || errorKind === "server")),
     selectedId: s.selectedId ?? "",
   };
 }
 
+// The classifier below is `himi docs recipe-four-state`'s, VERBATIM — a test holds
+// the two byte-identical, so the rules an agent copies from here are the documented ones.
 // The HTTP status rides in the message: `HTTP 503: …` on a device, `Wix 503 for …`
-// under `himi test` / `himi render`. Only a transport failure is "offline".
+// under `himi test` / `himi render`.
 const STATUS = /\b(?:HTTP|Wix) (\d{3})\b/;
 // No answer at all — what a dropped connection says on every platform.
 const TRANSPORT = /NSURLErrorDomain|(?:UnknownHost|Connect|SocketTimeout|NoRouteToHost|SSLHandshake)Exception|Failed to connect|Unable to resolve host|Connection (?:refused|reset)|Network is unreachable|Software caused connection abort|ECONNRESET|ETIMEDOUT|EPIPE|Broken pipe|stream was reset|unexpected end of stream|timed out|^timeout$|Failed to fetch|NetworkError|^(?:TypeError: )?Load failed$|net::ERR_|^[a-z0-9-]+(?:\.[a-z0-9-]+)+$/i;
@@ -88,21 +93,45 @@ const TRANSPORT = /NSURLErrorDomain|(?:UnknownHost|Connect|SocketTimeout|NoRoute
 // A pinned site with no member session: iOS `siteNotPermitted(requested: "account", …)`,
 // Android `site account is not the bound site …`; the web host `HTTP 501: {"error":"webwix_owner_no_session"}`.
 const SIGNED_OUT = /wixApi not enabled|session unavailable|PRINCIPAL_CHANGED|not signed in|siteNotPermitted\(requested: "account"|site account is not the bound site|webwix_owner_no_session/i;
+// The account is not a member of this site: iOS `NotSiteMember(metaSiteId: …)`,
+// Android `not a member of site …`. NOT `WDE0027` — that is Wix Data's generic
+// permission refusal, which a signed-in member and a visitor both get.
+const NOT_MEMBER = /\bNotSiteMember\b|\bnot a member of site\b/i;
 
-// The same classifier as `himi docs recipe-four-state`, except that a public screen with no sign-in flow shows the permission state for a sign-in failure.
-function classifyError(e: unknown): ErrorKind {
+function classifyError(e: unknown, authState: "signedIn" | "signedOut" | "unknown" = "unknown"): ErrorKind {
   const msg = String((e as Error)?.message ?? e ?? "");
-  const code = String((e as { code?: unknown })?.code ?? "");
+  // Some bridges put the Wix code in the response body rather than Error.code.
+  const code = String((e as { code?: unknown })?.code ?? /"(?:code|error)"\s*:\s*"([^"]+)"/.exec(msg)?.[1] ?? "");
   const status = Number(STATUS.exec(msg)?.[1] ?? 0);
-  if (status === 401) return "permission";
-  if (status === 403) return "permission";
-  if (SIGNED_OUT.test(msg)) return "permission";
-  if (code === "offline_write_blocked") return "offline"; // a write refused before it left
+  if (code === "AccountSessionExpired" || code === "webwix_account_signed_out" || SIGNED_OUT.test(msg)) return "signIn";
+  if (code === "NotSiteMember" || NOT_MEMBER.test(msg)) return "membership";
+  // A 401 is a missing or expired session — unless the host knows the user is signed
+  // in, when it is a policy refusal. Never "server": a retry sends the same 401 back.
+  if (status === 401) return authState === "signedIn" ? "permission" : "signIn";
+  // A 403 is a missing permission — but a visitor the host knows is signed out gets
+  // `403 WDE0027` on member-only data too, and signing in is what fixes that.
+  if (status === 403) return authState === "signedOut" ? "signIn" : "permission";
+  if (code === "offline_write_blocked") return "offline";   // a write refused before it left
   // A web call that never reached Wix arrives as
   // `HTTP 502: {"error":"webwix_direct_failed","detail":"Failed to fetch"}` — judge its detail.
-  if (status && !msg.includes("webwix_direct_failed")) return "server";
-  if (TRANSPORT.test(msg)) return "offline";
-  return "server"; // a bug or a malformed row is not the user's connection
+  // The top-level 502 is the bridge wrapper, not the underlying transport result.
+  const detail = msg.includes("webwix_direct_failed")
+    ? /"detail"\s*:\s*"([^"]+)"/.exec(msg)?.[1] ?? msg
+    : msg;
+  if (status && detail === msg) return "server";
+  if (TRANSPORT.test(detail)) return "offline";
+  return "server";   // anything else — a bug, a malformed row — is not the user's connection
+}
+
+// App-specific host integration. If the host does not expose auth state here, keep
+// "unknown": a 401 then reads as a session that ended.
+function currentAuthState(): "signedIn" | "signedOut" | "unknown" { return "unknown"; }
+
+// This screen has no sign-in flow, so a sign-in failure shows the permission state —
+// every class it can show has a node in the descriptor.
+function shownKind(e: unknown): ShownKind {
+  const kind = classifyError(e, currentAuthState());
+  return kind === "signIn" ? "permission" : kind || "server";
 }
 
 async function loadList(s: Partial<ProductsState>): Promise<ProductsState> {
@@ -111,9 +140,10 @@ async function loadList(s: Partial<ProductsState>): Promise<ProductsState> {
     const items = (res.products ?? []).filter((p) => p?.id).map(normalize);
     return shape({ status: "ready", items, selectedId: s.selectedId });
   } catch (e) {
-    const errorKind = classifyError(e);
+    const errorKind = shownKind(e);
     // Keep the rows on a refresh failure; clear them when access is gone.
-    const items = errorKind === "permission" ? [] : s.items ?? [];
+    const lostAccess = errorKind === "membership" || errorKind === "permission";
+    const items = lostAccess ? [] : s.items ?? [];
     return shape({ ...s, status: "error", items, errorKind });
   }
 }

package/guides/form-submit-t5.descriptor.json

@@ -78,8 +78,7 @@
                       "title": "Create post",
                       "style": "primary",
                       "fullWidth": true,
-                      "action": { "actionId": "tier5.postForm.submit" },
-                      "disabledPath": "$service:postForm.cannotSave"
+                      "action": { "actionId": "tier5.postForm.submit" }
                     }
                   }
                 }

package/guides/form-submit.service.ts

@@ -25,7 +25,6 @@ interface PostFormState {
   savedMessage: string;  // "" unless saved           → collapseWhenEmpty
   hideSavedLink: boolean; // gates the "Open post" button via hiddenPath
   savedScreenId: string;  // deep-link target for the created entity
-  cannotSave: boolean;    // true after a permission failure → the submit's disabledPath
 }
 
 function shape(s: Partial<PostFormState>): PostFormState {
@@ -39,22 +38,26 @@ function shape(s: Partial<PostFormState>): PostFormState {
     savedMessage: s.savedMessage ?? "",
     savedScreenId,
     hideSavedLink: status !== "saved" || !savedScreenId,
-    cannotSave: s.cannotSave ?? false,
   };
 }
 
 // A failed save is an ACTION error: one user-facing sentence per class, shown next to
 // the submit button, which is the retry (`himi docs recipe-four-state`). Never e.message.
-type ErrorKind = "offline" | "server" | "signIn" | "permission";
-const SAVE_FAILED: Record<ErrorKind, string> = {
+// Submit stays available after every class: the user retries once they reconnect,
+// sign in, join the site or are granted access — without restarting the form.
+type ErrorKind = "" | "offline" | "server" | "signIn" | "membership" | "permission";
+const SAVE_FAILED: Record<Exclude<ErrorKind, "">, string> = {
   offline: "You're offline, so nothing was saved. Try again when you reconnect.",
   server: "Couldn't save your changes. Try again.",
   signIn: "Your session has ended. Sign in, then save again.",
+  membership: "Join this site before saving.",
   permission: "You don't have permission to save this.",
 };
 
+// The classifier below is `himi docs recipe-four-state`'s, VERBATIM — a test holds
+// the two byte-identical, so the rules an agent copies from here are the documented ones.
 // The HTTP status rides in the message: `HTTP 503: …` on a device, `Wix 503 for …`
-// under `himi test` / `himi render`. Only a transport failure is "offline".
+// under `himi test` / `himi render`.
 const STATUS = /\b(?:HTTP|Wix) (\d{3})\b/;
 // No answer at all — what a dropped connection says on every platform.
 const TRANSPORT = /NSURLErrorDomain|(?:UnknownHost|Connect|SocketTimeout|NoRouteToHost|SSLHandshake)Exception|Failed to connect|Unable to resolve host|Connection (?:refused|reset)|Network is unreachable|Software caused connection abort|ECONNRESET|ETIMEDOUT|EPIPE|Broken pipe|stream was reset|unexpected end of stream|timed out|^timeout$|Failed to fetch|NetworkError|^(?:TypeError: )?Load failed$|net::ERR_|^[a-z0-9-]+(?:\.[a-z0-9-]+)+$/i;
@@ -63,37 +66,54 @@ const TRANSPORT = /NSURLErrorDomain|(?:UnknownHost|Connect|SocketTimeout|NoRoute
 // A pinned site with no member session: iOS `siteNotPermitted(requested: "account", …)`,
 // Android `site account is not the bound site …`; the web host `HTTP 501: {"error":"webwix_owner_no_session"}`.
 const SIGNED_OUT = /wixApi not enabled|session unavailable|PRINCIPAL_CHANGED|not signed in|siteNotPermitted\(requested: "account"|site account is not the bound site|webwix_owner_no_session/i;
+// The account is not a member of this site: iOS `NotSiteMember(metaSiteId: …)`,
+// Android `not a member of site …`. NOT `WDE0027` — that is Wix Data's generic
+// permission refusal, which a signed-in member and a visitor both get.
+const NOT_MEMBER = /\bNotSiteMember\b|\bnot a member of site\b/i;
 
-// The same classifier as `himi docs recipe-four-state`.
-function classifyError(e: unknown): ErrorKind {
+function classifyError(e: unknown, authState: "signedIn" | "signedOut" | "unknown" = "unknown"): ErrorKind {
   const msg = String((e as Error)?.message ?? e ?? "");
-  const code = String((e as { code?: unknown })?.code ?? "");
+  // Some bridges put the Wix code in the response body rather than Error.code.
+  const code = String((e as { code?: unknown })?.code ?? /"(?:code|error)"\s*:\s*"([^"]+)"/.exec(msg)?.[1] ?? "");
   const status = Number(STATUS.exec(msg)?.[1] ?? 0);
-  if (status === 401) return "signIn";
-  if (status === 403) return "permission";
-  if (SIGNED_OUT.test(msg)) return "signIn";
-  if (code === "offline_write_blocked") return "offline"; // a write refused before it left
+  if (code === "AccountSessionExpired" || code === "webwix_account_signed_out" || SIGNED_OUT.test(msg)) return "signIn";
+  if (code === "NotSiteMember" || NOT_MEMBER.test(msg)) return "membership";
+  // A 401 is a missing or expired session — unless the host knows the user is signed
+  // in, when it is a policy refusal. Never "server": a retry sends the same 401 back.
+  if (status === 401) return authState === "signedIn" ? "permission" : "signIn";
+  // A 403 is a missing permission — but a visitor the host knows is signed out gets
+  // `403 WDE0027` on member-only data too, and signing in is what fixes that.
+  if (status === 403) return authState === "signedOut" ? "signIn" : "permission";
+  if (code === "offline_write_blocked") return "offline";   // a write refused before it left
   // A web call that never reached Wix arrives as
   // `HTTP 502: {"error":"webwix_direct_failed","detail":"Failed to fetch"}` — judge its detail.
-  if (status && !msg.includes("webwix_direct_failed")) return "server";
-  if (TRANSPORT.test(msg)) return "offline";
-  return "server"; // a bug or a malformed row is not the user's connection
+  // The top-level 502 is the bridge wrapper, not the underlying transport result.
+  const detail = msg.includes("webwix_direct_failed")
+    ? /"detail"\s*:\s*"([^"]+)"/.exec(msg)?.[1] ?? msg
+    : msg;
+  if (status && detail === msg) return "server";
+  if (TRANSPORT.test(detail)) return "offline";
+  return "server";   // anything else — a bug, a malformed row — is not the user's connection
 }
 
+// App-specific host integration. If the host does not expose auth state here, keep
+// "unknown": a 401 then reads as a session that ended.
+function currentAuthState(): "signedIn" | "signedOut" | "unknown" { return "unknown"; }
+
 // Blog draft bodies are rich content — wrap the plain text minimally.
 function toRichContent(text: string): WixRichContent {
   return { nodes: [{ type: "PARAGRAPH", nodes: [{ type: "TEXT", textData: { text, decorations: [] } }] }] };
 }
 
 // Every key that describes the LAST attempt, not this run: a cold boot starts from the declared values.
-const OUTCOME_KEYS = ["status", "error", "savedMessage", "savedScreenId", "hideSavedLink", "cannotSave"] as const;
+const OUTCOME_KEYS = ["status", "error", "savedMessage", "savedScreenId", "hideSavedLink"] as const;
 
 const svc = defineService<PostFormState, {
   submit: (s: PostFormState, values?: Record<string, unknown>) => Promise<PostFormState>;
 }>("postForm", {
   state: shape({}),
-  // Outcome keys are per-attempt: a cold boot must not restore a stale error, or a submit
-  // disabled by a 403 the user has since been granted past.
+  // Outcome keys are per-attempt: a cold boot must not restore a stale error or a
+  // "Draft created." line from an earlier run.
   notHydrated: OUTCOME_KEYS,
   actions: {
     // `values` is the ONLY channel for what the user typed — keyed by FormField id.
@@ -115,18 +135,18 @@ const svc = defineService<PostFormState, {
           savedScreenId: id ? `my_post_${id}` : "", // wire a templated detail route per the tier-5 guide
         });
       } catch (e) {
-        const kind = classifyError(e);
+        const kind = classifyError(e, currentAuthState()) || "server";
         // Echo what the user typed back into the prefill, so a failed save loses nothing.
         // Clear the last success line: a failed attempt must not also read "Draft created.".
-        return shape({ ...s, title, body, status: "error", error: SAVE_FAILED[kind], savedMessage: "", cannotSave: kind === "permission" });
+        return shape({ ...s, title, body, status: "error", error: SAVE_FAILED[kind], savedMessage: "" });
       }
     },
   },
 });
 
 // An older runtime ignores `notHydrated` (it does not set `himalaya.hydrationOptOut`) and restores the
-// whole snapshot: reset the outcome keys in place before any action runs, or a 403's disabled submit
-// would come back on every launch with no way to clear it.
+// whole snapshot: reset the outcome keys in place before any action runs, or last run's error line
+// would come back on every launch.
 if ((globalThis as { himalaya?: { hydrationOptOut?: unknown } }).himalaya?.hydrationOptOut !== true) {
   const booted = (svc as unknown as { getState?: () => Record<string, unknown> | undefined }).getState?.();
   const fresh = shape({}) as unknown as Record<string, unknown>;

package/guides/qa-builds.md

@@ -1033,7 +1033,7 @@ and a bundle installs on nothing. `--aab` builds the bundle **and an APK from th
 an owner who uploads the bundle to Play Console themselves and installs the APK on a phone:
 
 ```sh
-himi login --dpx --target bo        # an INTERNAL caller: self-serve callers get 403 (see below)
+himi login --dpx --target bo        # an INTERNAL caller; a self-serve caller gets a bundle only as a Containers store build (see below)
 himi dist --app <app> --platform android --aab --wait --target bo
 ```
 
@@ -1046,8 +1046,9 @@ himi dist --app <app> --platform android --aab --wait --target bo
   (`apk.androidSigningUsed: "qa-keystore"`) and it sits in the bundle's own S3 bucket; otherwise the
   bundle still succeeds and the record says `companion_apk_dropped: …`. The record carries `androidFormat: "aab"`.
 - **Android only.** The default stays an APK, and iOS is untouched. It travels as
-  `androidFormat: "aab"` on `POST /v1/admin/dist` (every `/v1/owner/dist` caller is self-serve, so
-  that route always answers `403 android_format_not_allowed`), and reaches the pool as
+  `androidFormat: "aab"` on `POST /v1/admin/dist` (a self-serve caller, every `/v1/owner/dist`
+  caller included, gets `403 android_format_not_allowed` unless the build is a Containers app's
+  store build, below), and reaches the pool as
   `DIST_ANDROID_FORMAT=aab` in the `command` blob (see
   [why](#why-the-jobs-parameters-ride-in-command-not-envvars)). Refusals, all typed 400s before
   any pool time is spent: `invalid_android_format` (anything but `apk` / `aab`),
@@ -1115,7 +1116,8 @@ himi dist --app <app> --platform android --aab --wait --target bo
   The same checks are available WITHOUT a build, for the Containers editor to ask before it
   activates a draft release: `GET /v1/admin/site/store-build-check?app=&site=[&shell=]` answers
   `200 { ok: true, android: { packageName } }` or the same refusals, through `ValidateStoreBuild`'s
-  check-only mode, so it locks nothing. Until that mode is wired it answers
+  check-only mode, so it locks nothing. It names no release, so it cannot give
+  `409 release_predates_store_builds`; a draft the editor just built is on a current commit. Until that mode is wired it answers
   `501 store_builds_unconfigured`; it never falls back to the locking call.
 
 **Why the Wix production key, and only for the bundle.** There are two Android keys: the committed
@@ -1124,8 +1126,8 @@ app's bundle carries (`mobile-apps-engine` refuses any other certificate for a P
 Play App Signing on, so Google re-signs what users install. An `.aab` therefore signs with it —
 only its `WixOne` entry of `oneapp-production.keystore`: the alias is pinned for a bundle, whatever
 alias the pool's signing files name. Because the first upload binds a Play listing to that key for good, a **self-serve** caller
-gets no bundle at all (`403 android_format_not_allowed`): `--aab` is for internal callers until a
-Containers store build checks the app, its owner and its package name. A self-serve **APK** with
+gets a bundle only as a Containers app's store build, which checks the app, its owner and its
+package name first (above); any other self-serve `--aab` is `403 android_format_not_allowed`. A self-serve **APK** with
 `wix-keystore` keeps `403 android_signing_not_allowed`, unchanged. The APK built beside a bundle is
 QA-signed, so no installable APK carrying the WixOne signature is ever handed out; WixOne would not
 help it anyway, because the APKs Google Play delivers carry Google's app-signing key, so a phone with

package/guides/recipe-four-state.md

@@ -67,8 +67,8 @@ const TRANSPORT = /NSURLErrorDomain|(?:UnknownHost|Connect|SocketTimeout|NoRoute
 // Android reports an unknown host as the bare hostname (`users.wix.com`) — hence the last form.
 // No session on the device: the native bridge refuses before any request leaves.
 // A pinned site with no member session: iOS `siteNotPermitted(requested: "account", …)`,
-// Android `site account is not the bound site …`.
-const SIGNED_OUT = /wixApi not enabled|session unavailable|PRINCIPAL_CHANGED|not signed in|siteNotPermitted\(requested: "account"|site account is not the bound site/i;
+// Android `site account is not the bound site …`; the web host `HTTP 501: {"error":"webwix_owner_no_session"}`.
+const SIGNED_OUT = /wixApi not enabled|session unavailable|PRINCIPAL_CHANGED|not signed in|siteNotPermitted\(requested: "account"|site account is not the bound site|webwix_owner_no_session/i;
 // The account is not a member of this site: iOS `NotSiteMember(metaSiteId: …)`,
 // Android `not a member of site …`. NOT `WDE0027` — that is Wix Data's generic
 // permission refusal, which a signed-in member and a visitor both get.

package/guides/search-list-t5.descriptor.json

@@ -110,6 +110,20 @@
               "hiddenPath": "$service:posts.hideServerError"
             }
           },
+          {
+            "id": "error.membership",
+            "body": {
+              "package": "himalaya",
+              "type": "EmptyState",
+              "props": {
+                "title": "Join this site to view posts",
+                "subtitle": "Ask the owner of this blog to add you as a member."
+              }
+            },
+            "modifiers": {
+              "hiddenPath": "$service:posts.hideMembershipError"
+            }
+          },
           {
             "id": "error.permission",
             "body": {

package/guides/search-list.service.ts

@@ -21,15 +21,17 @@ interface PostRow {
   categoryIds: string[];
 }
 
-// A public blog has no sign-in flow, so a 401 reads as "permission" here.
-type ErrorKind = "" | "offline" | "server" | "permission";
+// Every class the recipe's classifier returns …
+type ErrorKind = "" | "offline" | "server" | "signIn" | "membership" | "permission";
+// … and the ones this screen shows: it has no sign-in flow (see shownKind()).
+type ShownKind = Exclude<ErrorKind, "" | "signIn">;
 
 interface PostsState {
   status: "loading" | "ready" | "error";
   all: PostRow[];   // the full fetched set — NOT bound by the descriptor
   items: PostRow[]; // ← itemsPath binds here; ALWAYS derived from all + query
   query: string;
-  errorKind: ErrorKind;
+  errorKind: "" | ShownKind;
   // hiddenPath flags (hide when TRUE) — see `himi docs recipe-four-state`
   hideLoading: boolean;
   hideNoPosts: boolean;   // EmptyState: the blog has no posts at all
@@ -37,6 +39,7 @@ interface PostsState {
   notEmpty: boolean;      // false while either EmptyState shows
   hideOfflineError: boolean;
   hideServerError: boolean;
+  hideMembershipError: boolean;
   hidePermissionError: boolean;
   hideRefreshError: boolean;
 }
@@ -64,7 +67,7 @@ function shape(s: Partial<PostsState>): PostsState {
   const all = s.all ?? [];
   const query = s.query ?? "";
   const items = s.items ?? visible(all, query);
-  const errorKind: ErrorKind = status === "error" ? (s.errorKind || "server") : "";
+  const errorKind: "" | ShownKind = status === "error" ? (s.errorKind || "server") : "";
   const blank = all.length === 0; // nothing loaded to keep
   return {
     status,
@@ -80,13 +83,16 @@ function shape(s: Partial<PostsState>): PostsState {
     hideLoading: !(status === "loading" && blank),
     hideOfflineError: !(blank && errorKind === "offline"),
     hideServerError: !(blank && errorKind === "server"),
+    hideMembershipError: !(blank && errorKind === "membership"),
     hidePermissionError: !(blank && errorKind === "permission"),
     hideRefreshError: !(!blank && (errorKind === "offline" || errorKind === "server")),
   };
 }
 
+// The classifier below is `himi docs recipe-four-state`'s, VERBATIM — a test holds
+// the two byte-identical, so the rules an agent copies from here are the documented ones.
 // The HTTP status rides in the message: `HTTP 503: …` on a device, `Wix 503 for …`
-// under `himi test` / `himi render`. Only a transport failure is "offline".
+// under `himi test` / `himi render`.
 const STATUS = /\b(?:HTTP|Wix) (\d{3})\b/;
 // No answer at all — what a dropped connection says on every platform.
 const TRANSPORT = /NSURLErrorDomain|(?:UnknownHost|Connect|SocketTimeout|NoRouteToHost|SSLHandshake)Exception|Failed to connect|Unable to resolve host|Connection (?:refused|reset)|Network is unreachable|Software caused connection abort|ECONNRESET|ETIMEDOUT|EPIPE|Broken pipe|stream was reset|unexpected end of stream|timed out|^timeout$|Failed to fetch|NetworkError|^(?:TypeError: )?Load failed$|net::ERR_|^[a-z0-9-]+(?:\.[a-z0-9-]+)+$/i;
@@ -95,21 +101,45 @@ const TRANSPORT = /NSURLErrorDomain|(?:UnknownHost|Connect|SocketTimeout|NoRoute
 // A pinned site with no member session: iOS `siteNotPermitted(requested: "account", …)`,
 // Android `site account is not the bound site …`; the web host `HTTP 501: {"error":"webwix_owner_no_session"}`.
 const SIGNED_OUT = /wixApi not enabled|session unavailable|PRINCIPAL_CHANGED|not signed in|siteNotPermitted\(requested: "account"|site account is not the bound site|webwix_owner_no_session/i;
+// The account is not a member of this site: iOS `NotSiteMember(metaSiteId: …)`,
+// Android `not a member of site …`. NOT `WDE0027` — that is Wix Data's generic
+// permission refusal, which a signed-in member and a visitor both get.
+const NOT_MEMBER = /\bNotSiteMember\b|\bnot a member of site\b/i;
 
-// The same classifier as `himi docs recipe-four-state`, except that a public screen with no sign-in flow shows the permission state for a sign-in failure.
-function classifyError(e: unknown): ErrorKind {
+function classifyError(e: unknown, authState: "signedIn" | "signedOut" | "unknown" = "unknown"): ErrorKind {
   const msg = String((e as Error)?.message ?? e ?? "");
-  const code = String((e as { code?: unknown })?.code ?? "");
+  // Some bridges put the Wix code in the response body rather than Error.code.
+  const code = String((e as { code?: unknown })?.code ?? /"(?:code|error)"\s*:\s*"([^"]+)"/.exec(msg)?.[1] ?? "");
   const status = Number(STATUS.exec(msg)?.[1] ?? 0);
-  if (status === 401) return "permission";
-  if (status === 403) return "permission";
-  if (SIGNED_OUT.test(msg)) return "permission";
-  if (code === "offline_write_blocked") return "offline"; // a write refused before it left
+  if (code === "AccountSessionExpired" || code === "webwix_account_signed_out" || SIGNED_OUT.test(msg)) return "signIn";
+  if (code === "NotSiteMember" || NOT_MEMBER.test(msg)) return "membership";
+  // A 401 is a missing or expired session — unless the host knows the user is signed
+  // in, when it is a policy refusal. Never "server": a retry sends the same 401 back.
+  if (status === 401) return authState === "signedIn" ? "permission" : "signIn";
+  // A 403 is a missing permission — but a visitor the host knows is signed out gets
+  // `403 WDE0027` on member-only data too, and signing in is what fixes that.
+  if (status === 403) return authState === "signedOut" ? "signIn" : "permission";
+  if (code === "offline_write_blocked") return "offline";   // a write refused before it left
   // A web call that never reached Wix arrives as
   // `HTTP 502: {"error":"webwix_direct_failed","detail":"Failed to fetch"}` — judge its detail.
-  if (status && !msg.includes("webwix_direct_failed")) return "server";
-  if (TRANSPORT.test(msg)) return "offline";
-  return "server"; // a bug or a malformed row is not the user's connection
+  // The top-level 502 is the bridge wrapper, not the underlying transport result.
+  const detail = msg.includes("webwix_direct_failed")
+    ? /"detail"\s*:\s*"([^"]+)"/.exec(msg)?.[1] ?? msg
+    : msg;
+  if (status && detail === msg) return "server";
+  if (TRANSPORT.test(detail)) return "offline";
+  return "server";   // anything else — a bug, a malformed row — is not the user's connection
+}
+
+// App-specific host integration. If the host does not expose auth state here, keep
+// "unknown": a 401 then reads as a session that ended.
+function currentAuthState(): "signedIn" | "signedOut" | "unknown" { return "unknown"; }
+
+// This screen has no sign-in flow, so a sign-in failure shows the permission state —
+// every class it can show has a node in the descriptor.
+function shownKind(e: unknown): ShownKind {
+  const kind = classifyError(e, currentAuthState());
+  return kind === "signIn" ? "permission" : kind || "server";
 }
 
 // The SearchField onChange arg shape varies by surface — read it defensively.
@@ -132,9 +162,10 @@ async function loadList(s: Partial<PostsState>): Promise<PostsState> {
       .filter((r) => r.id);
     return shape({ status: "ready", all, query: currentQuery });
   } catch (e) {
-    const errorKind = classifyError(e);
+    const errorKind = shownKind(e);
     // Keep what was loaded on a refresh failure; clear it when access is gone.
-    const all = errorKind === "permission" ? [] : s.all ?? [];
+    const lostAccess = errorKind === "membership" || errorKind === "permission";
+    const all = lostAccess ? [] : s.all ?? [];
     return shape({ status: "error", all, query: currentQuery, errorKind });
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1484.0",
+  "version": "0.1486.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "310eec6f7de3de9c4b4e96b9c25cb5913642adb3b8408fde6c3fc8a2"
+  "falconPackageHash": "90739efa8b897c00c4666dfd784b02c22d05fbd8ae637fe851d2da5f"
 }