@wix/himalaya-cli 0.1614.0 → 0.1615.0

package/templates/salon-spa/tier5-src/_shared/member-account-routes.ts

@@ -0,0 +1,52 @@
+// Can this host reach the member account routes My Addresses and My Wallet need?
+//
+// Both are served OFF www.wixapis.com (the address book on ecom.wix.com, saved cards on
+// the member's own site), so only a native runtime whose WixApiCapability pins them can
+// call them: HimalayaCore 1.4.0 and later. The web bridges refuse absolute URLs, and a
+// hosted app (Spaces) signs its calls with a capability pinned to www.wixapis.com. Saved
+// cards also need the shell to have bound its own site (app_info `memberSiteBound`): a
+// multi-app host such as Himi Player binds none, so its wallet route has no host. The
+// Account screen hides a link whose route is unreachable, and the screen says so instead
+// of failing a load.
+import { get as getAppInfo } from "@himalaya/app-info";
+import { isHostedWorker } from "./hosted-checkout.js";
+
+/** The HimalayaCore version whose WixApiCapability pins these routes. Checked here, at run
+ *  time: the screens declare no `minBinaryVersion`, because a release takes its highest
+ *  screen floor as its own and would then refuse every older binary. */
+export const MEMBER_ACCOUNT_ROUTES_MIN_BINARY = "1.4.0";
+export const MEMBER_MEDIA_FIELD_MIN_BINARY = "1.5.0";
+export const MEMBER_PASSWORD_ACTIONS_MIN_BINARY = "1.5.0";
+
+/** `version` (a HimalayaCore binary version, pre-release suffix ignored) is `floor` or later. */
+export function atLeast(version: string, floor: string): boolean {
+  const parts = (v: string) => v.split("-")[0].split(".").map((p) => Number.parseInt(p, 10) || 0);
+  const a = parts(version), b = parts(floor);
+  for (let i = 0; i < Math.max(a.length, b.length); i++) {
+    const x = a[i] ?? 0, y = b[i] ?? 0;
+    if (x !== y) return x > y;
+  }
+  return true;
+}
+
+export interface MemberAccountRoutes {
+  /** The address book on ecom.wix.com (My Addresses). */
+  addresses: boolean;
+  /** Saved cards on the member's own site (My Wallet). */
+  wallet: boolean;
+  /** Native MediaField image picking and presigned PUT support. */
+  mediaField: boolean;
+  /** Password credential actions introduced in HimalayaCore 1.5.0. */
+  passwordCredentials: boolean;
+}
+
+export async function memberAccountRoutes(): Promise<MemberAccountRoutes> {
+  if (isHostedWorker()) return { addresses: false, wallet: false, mediaField: false, passwordCredentials: false };
+  const info = await getAppInfo().catch(() => undefined);
+  if (!info) return { addresses: false, wallet: false, mediaField: false, passwordCredentials: false };
+  const native = info.platform === "ios" || info.platform === "android" || info.platform === "macos";
+  const addresses = native && atLeast(info.binaryVersion ?? "", MEMBER_ACCOUNT_ROUTES_MIN_BINARY);
+  const mediaField = native && atLeast(info.binaryVersion ?? "", MEMBER_MEDIA_FIELD_MIN_BINARY);
+  const passwordCredentials = native && atLeast(info.binaryVersion ?? "", MEMBER_PASSWORD_ACTIONS_MIN_BINARY);
+  return { addresses, wallet: addresses && info.memberSiteBound === true, mediaField, passwordCredentials };
+}

package/templates/salon-spa/tier5-src/_shared/member-bookings.ts

@@ -0,0 +1,94 @@
+import { queryBookings, type WixBooking } from "@himalaya/wix-bookings";
+import { memberAccess, assertMemberAccess, type MemberAccess } from "./member-access.js";
+import { offsetPage } from "./offset-page.js";
+import type { CollectionQuery } from "./collection-query.js";
+import { copyParam } from "./himi-copy.js";
+import { formatWeekdayDateTime } from "./engine-intl.js";
+import { dayKey } from "@himalaya/time";
+
+/** The statuses that put a booking in the Canceled tab. Upcoming and Past exclude them, so each
+ *  booking is in exactly one tab. */
+export const CANCELLED_STATUSES = ["CANCELED", "CANCELLED", "DECLINED"];
+
+export interface MemberBookingRow {
+  id: string; title: string; subtitle: string; status: string; revision: string;
+  start: string; end: string; day: string; serviceId: string;
+  canCancel: boolean; cannotCancel: boolean; cannotRebook: boolean;
+  // Added for the My Bookings redesign. Each is "" / 0 / false when the record has nothing for it.
+  /** The staff member (the slot's resource), "" when the booking names none. */
+  staff: string;
+  /** The location's name, else its address. */
+  placeName: string;
+  /** The location's formatted address. */
+  placeAddress: string;
+  /** `BUSINESS`, `CUSTOM` or `CUSTOMER` (the client's place), upper case. */
+  placeType: string;
+  participants: number;
+  /** Wix's raw payment status, upper case (`PAID`, `NOT_PAID`, …). */
+  paymentStatus: string;
+  /** Wix's raw booking status, upper case (`CONFIRMED`, `WAITING_LIST`, …). */
+  statusKey: string;
+  /** A course booking: it books a schedule, not a slot. */
+  isCourse: boolean;
+  courseStart: string;
+  courseEnd: string;
+}
+export function bookingStart(booking: WixBooking): string {
+  // Top-level instants are UTC. Slot dates may be LOCAL to slot.timezone.
+  const value = booking.startDate || booking.bookedEntity?.slot?.startDate || "";
+  return /(?:Z|[+-]\d{2}:?\d{2})$/i.test(value) && Number.isFinite(Date.parse(value)) ? value : "";
+}
+const instant = (value: unknown): string =>
+  typeof value === "string" && /(?:Z|[+-]\d{2}:?\d{2})$/i.test(value) && Number.isFinite(Date.parse(value)) ? value : "";
+const word = (value: unknown): string => typeof value === "string" ? value.trim() : "";
+export function memberBookingRow(booking: WixBooking): MemberBookingRow {
+  const start = bookingStart(booking);
+  const entity = booking.bookedEntity;
+  const slot = entity?.slot, schedule = entity?.schedule;
+  const status = (booking.status || "").toUpperCase();
+  const revision = String((booking as WixBooking & { revision?: string | number }).revision ?? "");
+  // A course booking carries a schedule, not a slot: its service id is on the schedule.
+  const serviceId = slot?.serviceId || schedule?.serviceId || "";
+  const canCancel = !!booking.id && !!revision && Date.parse(start) > Date.now() && !CANCELLED_STATUSES.includes(status);
+  const location = slot?.location ?? schedule?.location;
+  const placeAddress = word(location?.formattedAddress);
+  const participants = Number(booking.totalParticipants);
+  return { id: booking.id, title: entity?.title || copyParam("bookings.booking", "Booking"),
+    subtitle: start ? formatWeekdayDateTime(new Date(start)) : copyParam("bookings.timeUnavailable", "Time unavailable"),
+    status: status.replace(/_/g, " "), revision, start,
+    // Wix may carry the end only on the slot (same instant rule as the start).
+    end: booking.endDate || instant(slot?.endDate), day: start ? dayKey(new Date(start)) : "",
+    serviceId, canCancel, cannotCancel: !canCancel, cannotRebook: !serviceId,
+    staff: word(slot?.resource?.name),
+    placeName: word(location?.name) || placeAddress,
+    placeAddress,
+    placeType: word(location?.locationType).toUpperCase(),
+    participants: Number.isFinite(participants) && participants > 0 ? Math.floor(participants) : 0,
+    paymentStatus: word(booking.paymentStatus).toUpperCase(),
+    statusKey: status,
+    isCourse: !slot && !!schedule,
+    courseStart: instant(schedule?.firstSessionStart),
+    courseEnd: instant(schedule?.lastSessionEnd) };
+}
+export async function fetchMemberBookings(criteria: CollectionQuery, cursor: string, now: string, expected?: MemberAccess) {
+  const member = expected ?? await memberAccess();
+  const metadata = { email: member.email, scope: member.scope, needsSignIn: !member.email };
+  if (!member.email) return { items: [] as MemberBookingRow[], nextCursor: "", metadata };
+  await assertMemberAccess(member);
+  if (criteria.filter === "saved" && !criteria.savedIds.length) return { items: [] as MemberBookingRow[], nextCursor: "", metadata };
+  const filter: Record<string, unknown> = { "contactDetails.email": { $eq: member.email } };
+  if (criteria.query) filter.id = { $eq: criteria.query };
+  if (criteria.filter === "saved") filter.id = criteria.query ? { $in: criteria.savedIds.filter(id => id === criteria.query) } : { $in: criteria.savedIds };
+  if (criteria.filter === "value:Upcoming") { filter.startDate = { $gte: now }; filter.status = { $nin: CANCELLED_STATUSES }; }
+  // Past is what took place: a canceled or declined booking is in the Canceled tab only.
+  if (criteria.filter === "value:Past") { filter.startDate = { $lt: now }; filter.status = { $nin: CANCELLED_STATUSES }; }
+  if (criteria.filter === "value:Cancelled") filter.status = { $in: CANCELLED_STATUSES };
+  const response = await queryBookings({ query: { filter, paging: { limit: 50, offset: Number(cursor || 0) },
+    sort: [{ fieldName: "startDate", order: criteria.sort === "za" ? "DESC" : "ASC" }, { fieldName: "id", order: "ASC" }] } });
+  await assertMemberAccess(member);
+  const raw = response.bookings ?? [];
+  // Server authorization remains authoritative. This guard also rejects a
+  // malformed/cross-member row before any UI projection. No private disk cache.
+  const items = raw.filter(booking => booking.id && booking.contactDetails?.email?.trim().toLowerCase() === member.email).map(memberBookingRow);
+  return { items, ...offsetPage(cursor, raw.length, 50, response.pagingMetadata), metadata };
+}

package/templates/salon-spa/tier5-src/_shared/offset-page.ts

@@ -0,0 +1,10 @@
+/** Offset APIs keep the offset opaque to collection UI. Advance by raw rows,
+ * never by a member/status-filtered projection. A full page without a total is
+ * deliberately incomplete until a subsequent (possibly empty) page confirms it. */
+export function offsetPage(cursor: string, count: number, limit: number, metadata?: { total?: number }) {
+  const offset = cursor ? Number(cursor) : 0;
+  if (!Number.isSafeInteger(offset) || offset < 0) throw new Error("Invalid page offset");
+  const total = typeof metadata?.total === "number" && Number.isFinite(metadata.total) && metadata.total >= 0 ? metadata.total : undefined;
+  const next = offset + count;
+  return { nextCursor: count > 0 && (total === undefined ? count >= limit : next < total) ? String(next) : "", ...(total === undefined ? {} : { total }) };
+}

package/templates/salon-spa/tier5-src/_shared/online-actions.ts

@@ -0,0 +1,76 @@
+import { connectivity, defineService as register, type ServiceDefinition } from '@himalaya/state';
+
+// Template generation enables this behavior only in the selected two starter families.
+export const offlineWritesEnabled = false;
+
+export const offlineWriteMessage = 'You’re offline. Connect to save this change, then submit it again.';
+
+/** The guard runs before the reducer: entered values survive and no optimistic
+ * changes, success state, or queued writes can occur. It never submits on reconnect. */
+export function offlineWriteState<S extends object>(state: S): S {
+  const next: Record<string, unknown> = { ...state, error: offlineWriteMessage, message: offlineWriteMessage };
+  for (const key of ['saving', 'isSaving', 'submitting', 'isSubmitting', 'adding', 'added', 'bookingInFlight']) {
+    if (key in next) next[key] = false;
+  }
+  for (const key of ['savedMessage', 'successMessage']) {
+    if (key in next) next[key] = '';
+  }
+  // A saved/favourited item is business state, not a submission-success flag.
+  return next as S;
+}
+
+interface OfflineWriteOptions<S> {
+  derive?: (state: S) => S;
+  /** Exempt only non-mutating branches of a registered action. */
+  requiresConnectivity?: (action: string, state: S, argument?: unknown) => boolean;
+  messageFields?: readonly string[] | ((action: string) => readonly string[]);
+  draftFields?: readonly string[] | Readonly<Record<string, string>>;
+  secretFields?: readonly string[];
+}
+
+export function withOnlineWrites<S extends object>(registerService: typeof register, names: readonly string[], options: OfflineWriteOptions<S> = {}): typeof register {
+  if (!offlineWritesEnabled) return registerService;
+  return ((name: string, definition: ServiceDefinition<Record<string, unknown>>) => {
+    let currentState: (() => Record<string, unknown>) | undefined;
+    const handle = registerService(name, {
+      ...definition,
+      notHydrated: [...new Set([...(definition.notHydrated ?? []), ...(options.secretFields ?? [])])],
+      actions: Object.fromEntries(Object.entries(definition.actions ?? {}).map(([action, reduce]) => [action,
+        (state: Record<string, unknown>, ...args: never[]) => {
+          if (!names.includes(action)) return reduce(state, ...args);
+          if (options.requiresConnectivity?.(action, state as S, args[0]) === false) return reduce(state, ...args);
+          const fields = typeof options.messageFields === 'function' ? options.messageFields(action) : options.messageFields ?? ['message'];
+          if (connectivity().online) {
+            let cleared = false;
+            for (const field of ['error', 'message', ...fields]) {
+              if (state[field] === offlineWriteMessage) { state[field] = ''; cleared = true; }
+            }
+            // Keep the runtime's state object: reducers may mutate it and return undefined.
+            const result = reduce(state, ...args);
+            if (!cleared) return result;
+            // Publish cleared feedback even for a void reducer. An async completion must
+            // keep any newer state published by another action while it was awaiting.
+            const finish = (next: Record<string, unknown> | undefined) => next === undefined ? currentState?.() ?? state : next;
+            return result && typeof (result as Promise<unknown>).then === 'function'
+              ? Promise.resolve(result).then(finish)
+              : finish(result as Record<string, unknown> | undefined);
+          }
+          const draft = { ...state };
+          const argument = args[0] as Record<string, unknown> | undefined;
+          const draftFields = options.draftFields ?? [];
+          const entries = Array.isArray(draftFields) ? draftFields.map(key => [key, key]) : Object.entries(draftFields);
+          for (const [key, source] of entries) {
+            if (argument && key in state && typeof argument[source] === typeof state[key]) draft[key] = argument[source];
+          }
+          for (const key of options.secretFields ?? []) draft[key] = '';
+          const feedback = Object.fromEntries(fields.map(key => [key, offlineWriteMessage]));
+          let next = { ...offlineWriteState(draft), ...feedback };
+          if (options.derive) next = options.derive(next as S) as Record<string, unknown>;
+          return { ...next, ...feedback };
+        },
+      ])),
+    });
+    if (typeof handle.getState === 'function') currentState = () => handle.getState();
+    return handle;
+  }) as typeof register;
+}

package/templates/salon-spa/tier5-src/_shared/owner-load-error.ts

@@ -0,0 +1,348 @@
+import { copyParam } from "./himi-copy.js";
+
+/** Host-owned preview input. Absent on native and older hosts.
+ *
+ *  `"sample"` — the built-in demo records; `"live"` — the viewer's own business over the
+ *  owner rung; `"fixtures"` — a DEV web host over a sealed hermetic gateway, where
+ *  the dev fixtures are the sample data. `"fixtures"` is neither live nor demo, so a
+ *  worker READS through the bridge as it does on a device; it is still a preview host
+ *  (`isOwnerPreviewHost`), so failure copy may name the web preview. */
+function ownerPreviewMode(): unknown {
+  return (globalThis as unknown as { himalaya?: { input?: Record<string, unknown> } }).himalaya?.input?.__himiOwnerPreview;
+}
+
+export function isOwnerPreviewLive(): boolean {
+  return ownerPreviewMode() === "live";
+}
+
+/**
+ * Whether we are in the web preview AT ALL — i.e. the host declared a mode.
+ *
+ * `isBridgeUnavailable` cannot answer this: it reads "not live" as "preview",
+ * and on NATIVE there is no input at all, so `undefined` satisfies it. That is
+ * left alone for the other apps that use it to pick a demo fallback or to queue
+ * a write. Owner-lite reads ask `ownerDemoFallback` instead. It is NOT
+ * harmless for choosing COPY: native workers format their failures the same way (`"HTTP \(code): \(body)"`, JSWorker.swift;
+ * `"HTTP ${e.code}: ..."`, WebViewJSWorker.kt), so a transient `HTTP 503` on a
+ * phone would otherwise be answered with "open this app on a device" — on the
+ * device. Callers that pick a SENTENCE ask this instead.
+ */
+export function isOwnerPreviewHost(): boolean {
+  return ownerPreviewMode() !== undefined;
+}
+
+export function isOwnerPreviewDemo(): boolean {
+  return ownerPreviewMode() === "sample";
+}
+
+/** Legacy hosts can still request the old demo fallback. An explicit live
+ * preview must never replace an authentication failure or outage with samples. */
+export function isBridgeUnavailable(e: unknown): boolean {
+  if (ownerPreviewMode() === "live") return false;
+  return /HTTP (405|501|502|503)\b/.test(String((e as Error)?.message ?? e));
+}
+
+/**
+ * Whether a failed owner-lite READ may answer with the built-in demo records.
+ *
+ * Only where a demo was asked for: a web preview host that is not live. On a phone no
+ * mode is injected, so `isBridgeUnavailable` alone is `true` for a transient Wix
+ * `HTTP 503` — and the owner was shown sample appointments, orders and sites as if
+ * they were their business. Native falls through to the screen's error state.
+ * `isBridgeUnavailable` keeps its semantics: other apps' callers depend on it.
+ */
+export function ownerDemoFallback(e: unknown): boolean {
+  return isOwnerPreviewHost() && !isOwnerPreviewLive() && isBridgeUnavailable(e);
+}
+
+/**
+ * The sentence for an owner WRITE that failed because the device could not reach Wix at
+ * all (a transport failure). Nothing replays a queued write on any platform — every host's
+ * `drain` passes an empty closure — so the honest answer is that nothing was saved.
+ * Copy-as-configuration under `ownerCommon.`, which every owner screen forwards.
+ */
+export function ownerOfflineNotSaved(): string {
+  return copyParam(
+    "ownerCommon.offlineNotSaved",
+    "You’re offline — nothing was saved. Try again when you reconnect.",
+  );
+}
+
+/** The sentence for an owner WRITE that Wix answered with an unavailable status: the
+ *  device is online, so it is not "offline" — but nothing was saved all the same. */
+/**
+ * Whether a failed WRITE may have landed on Wix anyway, so the user must not be told it
+ * was not saved: a transport failure mid-request (timeout, reset, fetch rejection), the web
+ * host's after-send envelope (`HTTP 502 {…"sent":true}`), the serve bridge's mid-request
+ * `webwix_bridge_upstream_failed`, or a gateway status (502/503/504) that can arrive after
+ * the backend already ran. Only connect-time failures (`isOfflineFailure`) and the designed
+ * 405/501 bridge refusals prove nothing happened.
+ */
+export function writeMayHaveLanded(e: unknown): boolean {
+  if (isOfflineFailure(e)) return false;
+  if (isTransportFailure(e)) return true;
+  const msg = String((e as Error)?.message ?? e ?? "");
+  if (/"sent"\s*:\s*true/.test(msg)) return true;
+  // The web host's own envelope WITHOUT `sent: true` failed before the request left it, and
+  // a disabled owner rung / bridge refuses by design without sending anything.
+  if (/\bwebwix_(?:direct_failed|owner_disabled|bridge_disabled)\b/.test(msg)) return false;
+  // `webwix_bridge_upstream_failed` stays ambiguous: the same code covers a lookup that failed
+  // before sending and a serve-bridge failure mid-request, and nothing in it says which.
+  return /\bwebwix_bridge_upstream_failed\b/.test(msg) || /HTTP (502|503|504)\b/.test(msg);
+}
+
+/** Wix answered that the record does not exist (`HTTP 404`). A detail must not fall back to
+ *  its cached row then: that row is what a delete whose reply was lost leaves behind. */
+export function isNotFound(e: unknown): boolean {
+  if (/HTTP 404\b/.test(String((e as Error)?.message ?? e ?? ""))) return true;
+  // An SDK that answers a 404 with its own "not found" error keeps the HTTP one as `cause`
+  // (the blog SDK's getPost, after its query fallback also finds nothing).
+  const cause = (e as { cause?: unknown } | null | undefined)?.cause;
+  return cause !== undefined && cause !== e && /HTTP 404\b/.test(String((cause as Error)?.message ?? cause));
+}
+
+export function ownerUnavailableNotSaved(): string {
+  return copyParam(
+    "ownerCommon.unavailableNotSaved",
+    "Wix isn’t available right now — nothing was saved. Try again in a moment.",
+  );
+}
+
+/** The sentence for an owner WRITE that may have landed (`writeMayHaveLanded`): it can't
+ *  be called saved or not saved. */
+export function ownerWriteUnconfirmed(): string {
+  return copyParam(
+    "ownerCommon.writeUnconfirmed",
+    "Wix didn’t confirm this, so it may or may not have been saved. Check before trying again.",
+  );
+}
+
+/** Display copy for a failed owner write: `ownerOfflineNotSaved` when the request never
+ *  left the device, `ownerWriteUnconfirmed` when it may have landed, `ownerUnavailableNotSaved`
+ *  for the designed 405/501 bridge refusals outside a live preview, else `ownerLoadError`. */
+export function ownerWriteError(e: unknown): string {
+  if (isOfflineFailure(e)) return ownerOfflineNotSaved();
+  if (writeMayHaveLanded(e)) return ownerWriteUnconfirmed();
+  if (!isOwnerPreviewLive() && /HTTP (405|501)\b/.test(String((e as Error)?.message ?? e))) return ownerUnavailableNotSaved();
+  return ownerLoadError(e);
+}
+
+/** `HTTP 403: …` → "403", when the message carries a status at all. */
+const STATUS = /HTTP (\d{3})\b/;
+/** A wire body that is an HTML DOCUMENT, not a message. */
+const HTML_BODY = /<!DOCTYPE html|<html[\s>]|<head[\s>]/i;
+/** A wire body that is a JSON ENVELOPE, not a message. The serve bridge answers
+ *  its typed refusals this way — `HTTP 501: {"error":"webwix_owner_no_session",
+ *  "app":"…"}` — and it is short enough to slip under MAX_RAW, so truncation
+ *  never caught it and the owner read the machine's word for it. */
+const JSON_BODY = /HTTP \d{3}:\s*[[{]/;
+/** `HTTP <status> [SERVICE_CODE]: message` — the shape a Wix service uses when
+ *  it refuses with a named reason. */
+const CODED = /HTTP (\d{3}) \[([A-Z0-9_]+)\]/;
+/**
+ * The codes that all mean one thing to an owner: the session cannot address this
+ * business. Found on a real session whose account did not own the business the app
+ * had persisted — Home rendered
+ * `HTTP 428 [MISSING_METASITE_ID]: Couldn't extract metasiteId from the request
+ * context` where "6 orders" belongs.
+ */
+const SITE_CONTEXT_CODES = ["MISSING_METASITE_ID", "MISSING_REQUEST_SITE_CONTEXT", "MISSING_SITE_CONTEXT"];
+/** Longest raw upstream text worth showing. Beyond this it stops being a
+ *  message and starts being a payload dump. */
+const MAX_RAW = 200;
+
+/**
+ * A TRANSPORT failure: the request never got an HTTP answer at all.
+ *
+ * Each host describes one in its own platform's words, and every one of them is a
+ * diagnostic dump rather than a message. iOS's JSWorker hands a worker the Swift
+ * description of the `NSError` —
+ *   `Error Domain=NSURLErrorDomain Code=-1004 "Could not connect to the server."
+ *    UserInfo={… NSErrorFailingURLStringKey=http://127.0.0.1:8178/__dev/wix/proxy, …}`
+ * — which Aria painted verbatim: the domain, the code, and the local server's
+ * own URL. Android's bridge carries the `java.net` exception text, and a browser's
+ * fetch rejects with "Failed to fetch" / "Load failed" / "NetworkError …".
+ *
+ * Only a message with NO HTTP status qualifies: a status means Wix answered, and
+ * that case keeps its own reductions below.
+ */
+const TRANSPORT = [
+  /\bError Domain=\w+/,                       // any Cocoa NSError description
+  /\bNSURLErrorDomain\b/,
+  /\bjava\.(?:net|io)\.\w+(?:Exception|Error)\b/,
+  /\b(?:UnknownHost|Connect|SocketTimeout|NoRouteToHost|SSLHandshake)Exception\b/,
+  // Android's WebViewJSWorker bridges `e.message ?: e.javaClass.simpleName`, so
+  // the class name is usually absent and only OkHttp's own message arrives.
+  /^Failed to connect to \S/,
+  /^Unable to resolve host\b/,
+  /\b(?:Connection refused|Network is unreachable|Software caused connection abort)\b/,
+  // OkHttp / HttpURLConnection messages a dropped connection produces mid-request, which
+  // Android's bridge forwards without the exception class.
+  /\b(?:Connection reset|ECONNRESET|ETIMEDOUT|EPIPE|Broken pipe|stream was reset)\b/,
+  /^unexpected end of stream\b/i,
+  /^(?:timeout|Read timed out|connect timed out)$/i,
+  /\bFailed to fetch\b/,
+  /\bNetworkError when attempting to fetch\b/,
+  /^(?:TypeError: )?Load failed$/,
+  /\bnet::ERR_[A-Z_]+/,
+];
+
+/** Did this failure happen below HTTP — no answer from Wix at all? */
+export function isTransportFailure(e: unknown): boolean {
+  const msg = String((e as Error)?.message ?? e ?? "");
+  if (STATUS.test(msg)) return false;
+  return TRANSPORT.some((re) => re.test(msg));
+}
+
+/** A failed READ says nothing about the record's existence when Wix is
+ * unreachable, overloaded or failing. Unlike the legacy bridge predicate this
+ * is independent of preview mode; a live preview's gateway failure is one too. */
+export function readWasUnreachable(e: unknown): boolean {
+  const msg = String((e as Error)?.message ?? e ?? "");
+  return isTransportFailure(e) || /HTTP (?:408|429|5\d{2})\b/.test(msg);
+}
+
+/** Transport failures that happen while CONNECTING — no connection, no route, no such host,
+ *  connection refused — so the request provably never left the device. Every other
+ *  transport failure (a timeout, a reset, a bad or truncated response, a browser's fetch
+ *  rejection, which says nothing about when it failed) may come after Wix took the write. */
+const NEVER_SENT = [
+  /\bNSURLErrorDomain Code=-10(?:09|04|03|06|20|18)\b/,  // not connected / cannot connect / no host / DNS / data not allowed / roaming off
+  /\b(?:UnknownHost|Connect|NoRouteToHost)Exception\b/,
+  /^Failed to connect to \S/,
+  /^Unable to resolve host\b/,
+  /\b(?:Connection refused|Network is unreachable)\b/,
+  /\bnet::ERR_(?:INTERNET_DISCONNECTED|NAME_NOT_RESOLVED|CONNECTION_REFUSED|ADDRESS_UNREACHABLE|NETWORK_ACCESS_DENIED)\b/,
+];
+
+/** No HTTP answer, and the request provably never left the device: the user is offline, and
+ *  a write certainly did not happen. Anything else may have landed (see `NEVER_SENT`). */
+export function isOfflineFailure(e: unknown): boolean {
+  if (!isTransportFailure(e)) return false;
+  const msg = String((e as Error)?.message ?? e ?? "");
+  return NEVER_SENT.some((re) => re.test(msg));
+}
+
+/** The one sentence for a transport failure. Copy-as-configuration: the key is
+ *  under `ownerCommon.`, which every owner screen (Aria included) forwards. */
+export function ownerTransportFailureText(): string {
+  return copyParam(
+    "ownerCommon.networkUnreachable",
+    "Couldn’t reach Wix. Check your connection and try again.",
+  );
+}
+
+/**
+ * Reduce a wire failure to something a PERSON can read.
+ *
+ * Wix's edge answers some failures with a full HTML error page rather than JSON
+ * — a `403 Error: Forbidden | Wix.com` document. `ownerLoadError` used to return
+ * the raw body, so the Orders screen rendered an entire `<!DOCTYPE html>…<head>…`
+ * document as its error message (seen on iOS, and the same worker code runs on
+ * every surface). Keep the STATUS, which is the diagnosable part, and drop the
+ * markup; a long non-HTML body is truncated for the same reason.
+ */
+function humanWireError(msg: string): string {
+  if (isTransportFailure(msg)) return ownerTransportFailureText();
+  const status = STATUS.exec(msg)?.[1];
+  // A JSON ENVELOPE or a NAMED REASON CODE is the machine's word for it, and the
+  // owner gets neither. Both reductions used to live in `ownerDisplayError` only,
+  // on the belief that this function's output was parsed downstream — see the note
+  // on `ownerLoadError`, which records why that was wrong and how it was checked.
+  if (JSON_BODY.test(msg) && status) {
+    return copyParam(
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
+    );
+  }
+  const coded = CODED.exec(msg);
+  if (coded) {
+    if (SITE_CONTEXT_CODES.includes(coded[2])) {
+      return copyParam(
+        "ownerCommon.noSiteContext",
+        "This business isn’t available to your Wix account right now. Switch business, or sign in again as its owner.",
+      );
+    }
+    return copyParam(
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${coded[1]}). Try again in a moment.`,
+    );
+  }
+  if (HTML_BODY.test(msg)) {
+    if (status === "403") {
+      return copyParam(
+        "ownerCommon.forbidden",
+        "This account isn’t permitted to read that. Check the site’s permissions for your Wix user, then try again.",
+      );
+    }
+    return copyParam(
+      "ownerCommon.upstreamHtml",
+      status ? `Wix returned an error (HTTP ${status}). Try again in a moment.` : "Wix returned an unreadable error. Try again in a moment.",
+    );
+  }
+  return msg.length > MAX_RAW ? `${msg.slice(0, MAX_RAW).trimEnd()}…` : msg;
+}
+
+/**
+ * The one sentence every owner screen gives for the DESIGNED bridge boundary.
+ *
+ * Copy-as-configuration (himi-copy): the key lives under the `ownerCommon.`
+ * prefix the dev module forwards to all owner screens, so one pack retitles it
+ * everywhere. With no pack this returns the stock copy verbatim.
+ */
+export function ownerPreviewUnavailable(): string {
+  return copyParam(
+    "ownerCommon.bridgeUnavailable",
+    "Owner data isn’t available in the web preview — open this app on a device (▦ Open on phone) and sign in as the site owner.",
+  );
+}
+
+/**
+ * `ownerLoadError` for a screen that does nothing but RENDER the string.
+ *
+ * One difference left, and it is about WHERE the app is rather than what the
+ * error says: this names the web preview when there IS one. `isBridgeUnavailable`
+ * reads "not live" as "preview", and native injects no mode at all, so the
+ * default would answer a device-side `HTTP 503` with "open this app on a device"
+ * — on the device. That predicate is deliberately left alone: other apps'
+ * demo and write-queue decisions depend on exactly it.
+ *
+ * The reductions this used to add are now in `humanWireError`, so every owner
+ * screen gets them rather than the two that happened to call this.
+ */
+export function ownerDisplayError(e: unknown): string {
+  if (isOwnerPreviewHost() && isBridgeUnavailable(e)) return ownerPreviewUnavailable();
+  return humanWireError(String((e as Error)?.message ?? e));
+}
+
+/**
+ * The default. Reduces the same shapes as `ownerDisplayError`.
+ *
+ * It used to reduce LESS, on the stated grounds that its output is parsed
+ * downstream — "the products worker matches `CATALOG_V3_CALLING_CATALOG_V1_API`
+ * in it to choose its v1 fallback". **That was not true**, and it cost 17 owner
+ * screens their error copy: they printed `HTTP 428 [MISSING_METASITE_ID]: …`
+ * verbatim for a contract that does not exist.
+ *
+ * Checked before changing it, and worth recording so nobody restores the belief:
+ *
+ *  • the catalog v1/v3 decision is made INSIDE the Wix stores SDK, on the RAW
+ *    thrown error — its `catalogVersionFromMismatch` reads the error's own
+ *    `message`, and only that module calls it. It never sees this function's
+ *    output.
+ *  • `CATALOG_V3_CALLING_CATALOG_V1_API` appears nowhere else in the codebase
+ *    outside comments, tests and that one SDK module.
+ *  • the collection framework's `clearOnError` is handed the RAW error
+ *    (`error => /401|403|forbidden/i.test(String(error))`), separately from
+ *    `errorMessage: ownerLoadError` — so the one place that does match on a
+ *    failure is unaffected by what this returns.
+ *
+ * So: the raw error remains available to logic everywhere it was; this function's
+ * result is display copy, and now reads like it.
+ */
+export function ownerLoadError(e: unknown): string {
+  const msg = String((e as Error)?.message ?? e);
+  // Same host guard as `ownerDisplayError`: on a phone, "open this app on a device" is false.
+  if (isOwnerPreviewHost() && isBridgeUnavailable(e)) return ownerPreviewUnavailable();
+  return humanWireError(msg);
+}

package/templates/salon-spa/tier5-src/_shared/payment-setup.ts

@@ -0,0 +1,6 @@
+import { copyParam } from "./himi-copy.js";
+
+/** No provider or country guess: Wix only established that online payment is unavailable. */
+export function paymentSetupMessage(prefix: string): string {
+  return copyParam(`${prefix}.paymentSetupUnavailable`, "This site is not accepting online payments. Go back or contact the business for other payment options.");
+}