@wix/himalaya-cli 0.911.0 → 0.913.0

package/dist/cli.mjs

@@ -18526,7 +18526,6 @@ function shouldRevealError(args) {
 var EMAIL_RE, URL_HOST_RE, INTEGER_RE, NUMBER_RE;
 var init_validation = __esm({
   "../../core/ts/src/validation.ts"() {
-    "use strict";
     EMAIL_RE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/;
     URL_HOST_RE = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(:[0-9]+)?$/;
     INTEGER_RE = /^[+-]?[0-9]+$/;
@@ -21950,7 +21949,6 @@ function validateWorkerSubtree(raw, slotId, policy, actionCatalog) {
 var WORKER_SUBTREE_CEILINGS, ID_PART, ACTION_ID;
 var init_worker_subtree = __esm({
   "../../core/ts/src/worker-subtree.ts"() {
-    "use strict";
     init_worker_subtree_safe_types_generated();
     WORKER_SUBTREE_CEILINGS = Object.freeze({
       maxEncodedBytes: 65536,
@@ -53930,7 +53928,7 @@ ${guardrails.map((g) => `- ${g}`).join("\n")}
   descriptor pair; shows the *wiring* (state, \`$service\` bindings, actions).
 - \`examples/stocks-dashboard.descriptor.json\` \u2014 a fully-composed **real screen** (a Portfolio
   dashboard) to study for layout, spacing rhythm, and semantic color. This is what "good" looks like.
-- Full guides: run \`himi docs\` (list) / \`himi docs <topic>\`, or open the developer portal:
+- Full guides: run \`himi docs\` (list) / \`himi docs <topic>\`, or read them in a browser:
   ${idx.portalUrl}
 `;
 }
@@ -54119,7 +54117,7 @@ var PRODUCED_HINTS = {
   unbuilt: "this package has no dist/bundles, so there is nothing to measure \u2014 run `himi build` first. A package with no Tier-5 bundle can declare no widget at all.",
   "producer-unavailable": "the widget producer is not resolvable in this install, so production cannot be measured here at all \u2014 building this package will not change that. Ask a running app instead: GET /v1/widgets."
 };
-var DEVELOPER_PORTAL_URL = `${ADMIN_ORIGIN_BO}/#/developer`;
+var DEVELOPER_PORTAL_URL = `${SERVE_ORIGIN_PUBLIC_APPS}/docs`;
 var MAX_APP_SOURCE_BYTES_HELP = "4 MiB (4,194,304 bytes)";
 var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
 
@@ -54596,7 +54594,7 @@ Learn (works offline \u2014 no serve stack needed):
 Content dir defaults to the current directory (its himalaya.content.json / dir name is the app id).
 Transport: same targets/tokens as himi-serve \u2014 --target <local|prod|bo>, --serve-url/--control-url/
 --telemetry-url, --control-token/--telemetry-token, or HIMI_* env.
-Developer portal: ${DEVELOPER_PORTAL_URL}`;
+Guides: ${DEVELOPER_PORTAL_URL}`;
 var ONLY_USAGE = "himi push --only <selector>[,<selector>\u2026] (--draft|--live) [--from-release <id>] [--accept-regressions] [--accept-partial]";
 var PATCH_HELP = `himi patch \u2014 change ONE item of a published app, from a raw file, on a machine
              that does not have the content package.
@@ -55458,7 +55456,7 @@ ${cat}`);
       io.log("\n\u2014\u2014\u2014\n");
       io.log(readGuide("headless-loop") ?? "");
       io.log(`
-Developer portal: ${idx.portalUrl}`);
+Guides in your browser: ${idx.portalUrl}`);
       io.log("\nTopics \u2014 read one with `himi docs <id>`:");
       listByCategory();
       return 0;
@@ -55568,7 +55566,7 @@ Developer portal: ${idx.portalUrl}`);
       io.log("Himalaya authoring topics you can learn \u2014 read one with `himi docs <id>`:");
       listByCategory();
       io.log(`
-Seed your coding agent with \`himi agent-init\`. Portal: ${idx.portalUrl}`);
+Seed your coding agent with \`himi agent-init\`. Guides: ${idx.portalUrl}`);
       return 0;
     }
     case "agent-init": {

package/guides/getting-started.md

@@ -28,9 +28,9 @@ to guess the customer's data model.
 
 ## Two ways to begin
 
-**A. Open the developer portal** — https://bo.wix.com/_api/himalaya-admin/admin-standalone/#/developer
-Browse the component reference, the importable SDKs, every guide, and a copy-paste prompt that
-bootstraps a coding agent. (Wix employees only — it sits on the corporate network.)
+**A. Read the guides in your browser** — https://apps.wix.com/_api/himi-serve/docs
+Every guide, the component reference and the importable SDKs, as readable pages. Public: no Wix
+account, no corporate network. Append `/<topic>.md` for the raw markdown an agent should fetch.
 
 **B. From your terminal / coding agent:**
 

package/guides/index.json

@@ -4,7 +4,7 @@
     "componentCount": 82,
     "schemaSource": "core/ts/src/schema.ts"
   },
-  "portalUrl": "https://bo.wix.com/_api/himalaya-admin/admin-standalone/#/developer",
+  "portalUrl": "https://apps.wix.com/_api/himi-serve/docs",
   "bootstrapPrompt": "I want to create a mobile app for my business. Follow this skill:\nhttps://apps.wix.com/_api/himi-serve/skill.md",
   "categories": [
     "Overview",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.911.0",
+  "version": "0.913.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -64,5 +64,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "212114599a70158fe5cbefed85b7b784b0cd908f563d7061d4e87769"
+  "falconPackageHash": "74209736fe693e504b68490cef2bea93e7407a47b5ea88b4ba22e8ab"
 }

package/templates/beauty-salon/tier5-src/_shared/owner-load-error.ts

@@ -9,6 +9,23 @@ export function isOwnerPreviewLive(): boolean {
   return ownerPreviewMode() === "live";
 }
 
+/**
+ * Whether we are in the web preview AT ALL — i.e. the host declared a mode.
+ *
+ * `isBridgeUnavailable` cannot answer this: it reads "not live" as "preview",
+ * and on NATIVE there is no input at all, so `undefined` satisfies it. That is
+ * harmless for the callers that use it to pick a demo fallback or to queue a
+ * write, and it is deliberately left alone for them — native write-behind
+ * depends on it. It is NOT harmless for choosing COPY: native workers format
+ * their failures the same way (`"HTTP \(code): \(body)"`, JSWorker.swift;
+ * `"HTTP ${e.code}: ..."`, WebViewJSWorker.kt), so a transient `HTTP 503` on a
+ * phone would otherwise be answered with "open this app on a device" — on the
+ * device. Callers that pick a SENTENCE ask this instead.
+ */
+export function isOwnerPreviewHost(): boolean {
+  return ownerPreviewMode() !== undefined;
+}
+
 export function isOwnerPreviewDemo(): boolean {
   return ownerPreviewMode() === "sample";
 }
@@ -31,6 +48,11 @@ export function shouldQueueOwnerWrite(e: unknown): boolean {
 const STATUS = /HTTP (\d{3})\b/;
 /** A wire body that is an HTML DOCUMENT, not a message. */
 const HTML_BODY = /<!DOCTYPE html|<html[\s>]|<head[\s>]/i;
+/** A wire body that is a JSON ENVELOPE, not a message. The serve bridge answers
+ *  its typed refusals this way — `HTTP 501: {"error":"webwix_owner_no_session",
+ *  "app":"…"}` — and it is short enough to slip under MAX_RAW, so truncation
+ *  never caught it and the owner read the machine's word for it. */
+const JSON_BODY = /HTTP \d{3}:\s*[[{]/;
 /** Longest raw upstream text worth showing. Beyond this it stops being a
  *  message and starts being a payload dump. */
 const MAX_RAW = 200;
@@ -62,16 +84,55 @@ function humanWireError(msg: string): string {
   return msg.length > MAX_RAW ? `${msg.slice(0, MAX_RAW).trimEnd()}…` : msg;
 }
 
-export function ownerLoadError(e: unknown): string {
+/**
+ * The one sentence every owner screen gives for the DESIGNED bridge boundary.
+ *
+ * Copy-as-configuration (himi-copy): the key lives under the `ownerCommon.`
+ * prefix the dev module forwards to all owner screens, so one pack retitles it
+ * everywhere. With no pack this returns the stock copy verbatim.
+ */
+export function ownerPreviewUnavailable(): string {
+  return copyParam(
+    "ownerCommon.bridgeUnavailable",
+    "Owner data isn’t available in the web preview — open this app on a device (▦ Open on phone) and sign in as the site owner.",
+  );
+}
+
+/**
+ * `ownerLoadError` for a screen that does nothing but RENDER the string.
+ *
+ * Two things the default cannot do, each for a reason:
+ *
+ *  1. It only names the web preview when there IS one. `isBridgeUnavailable`
+ *     reads "not live" as "preview", and native injects no mode at all, so the
+ *     default would answer a device-side `HTTP 503` with "open this app on a
+ *     device" — on the device. That predicate is deliberately left alone:
+ *     native write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
+ *
+ *  2. It reduces a JSON ENVELOPE to its status. The default must NOT: its
+ *     output is PARSED downstream — the products worker matches
+ *     `CATALOG_V3_CALLING_CATALOG_V1_API` in it to choose its v1 fallback, and
+ *     `owner-load-error.test.ts` pins that verbatim. A display-only caller has
+ *     no such reader, and the bridge's typed refusals are JSON and short enough
+ *     (68 chars) to slip under MAX_RAW, so nothing else was catching them.
+ *
+ * So: use this ONLY where the value is rendered and never matched on.
+ */
+export function ownerDisplayError(e: unknown): string {
+  if (isOwnerPreviewHost() && isBridgeUnavailable(e)) return ownerPreviewUnavailable();
   const msg = String((e as Error)?.message ?? e);
-  if (isBridgeUnavailable(e)) {
-    // Copy-as-configuration (himi-copy): shared across every owner-lite worker,
-    // so the key lives under the ownerCommon. prefix the dev module forwards to
-    // all owner screens. With no pack this returns the stock copy verbatim.
+  const status = STATUS.exec(msg)?.[1];
+  if (JSON_BODY.test(msg) && status) {
     return copyParam(
-      "ownerCommon.bridgeUnavailable",
-      "Owner data isn’t available in the web preview — open this app on a device (▦ Open on phone) and sign in as the site owner.",
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
     );
   }
   return humanWireError(msg);
 }
+
+export function ownerLoadError(e: unknown): string {
+  const msg = String((e as Error)?.message ?? e);
+  if (isBridgeUnavailable(e)) return ownerPreviewUnavailable();
+  return humanWireError(msg);
+}

package/templates/beauty-salon-owner/tier5-src/_shared/owner-load-error.ts

@@ -9,6 +9,23 @@ export function isOwnerPreviewLive(): boolean {
   return ownerPreviewMode() === "live";
 }
 
+/**
+ * Whether we are in the web preview AT ALL — i.e. the host declared a mode.
+ *
+ * `isBridgeUnavailable` cannot answer this: it reads "not live" as "preview",
+ * and on NATIVE there is no input at all, so `undefined` satisfies it. That is
+ * harmless for the callers that use it to pick a demo fallback or to queue a
+ * write, and it is deliberately left alone for them — native write-behind
+ * depends on it. It is NOT harmless for choosing COPY: native workers format
+ * their failures the same way (`"HTTP \(code): \(body)"`, JSWorker.swift;
+ * `"HTTP ${e.code}: ..."`, WebViewJSWorker.kt), so a transient `HTTP 503` on a
+ * phone would otherwise be answered with "open this app on a device" — on the
+ * device. Callers that pick a SENTENCE ask this instead.
+ */
+export function isOwnerPreviewHost(): boolean {
+  return ownerPreviewMode() !== undefined;
+}
+
 export function isOwnerPreviewDemo(): boolean {
   return ownerPreviewMode() === "sample";
 }
@@ -31,6 +48,11 @@ export function shouldQueueOwnerWrite(e: unknown): boolean {
 const STATUS = /HTTP (\d{3})\b/;
 /** A wire body that is an HTML DOCUMENT, not a message. */
 const HTML_BODY = /<!DOCTYPE html|<html[\s>]|<head[\s>]/i;
+/** A wire body that is a JSON ENVELOPE, not a message. The serve bridge answers
+ *  its typed refusals this way — `HTTP 501: {"error":"webwix_owner_no_session",
+ *  "app":"…"}` — and it is short enough to slip under MAX_RAW, so truncation
+ *  never caught it and the owner read the machine's word for it. */
+const JSON_BODY = /HTTP \d{3}:\s*[[{]/;
 /** Longest raw upstream text worth showing. Beyond this it stops being a
  *  message and starts being a payload dump. */
 const MAX_RAW = 200;
@@ -62,16 +84,55 @@ function humanWireError(msg: string): string {
   return msg.length > MAX_RAW ? `${msg.slice(0, MAX_RAW).trimEnd()}…` : msg;
 }
 
-export function ownerLoadError(e: unknown): string {
+/**
+ * The one sentence every owner screen gives for the DESIGNED bridge boundary.
+ *
+ * Copy-as-configuration (himi-copy): the key lives under the `ownerCommon.`
+ * prefix the dev module forwards to all owner screens, so one pack retitles it
+ * everywhere. With no pack this returns the stock copy verbatim.
+ */
+export function ownerPreviewUnavailable(): string {
+  return copyParam(
+    "ownerCommon.bridgeUnavailable",
+    "Owner data isn’t available in the web preview — open this app on a device (▦ Open on phone) and sign in as the site owner.",
+  );
+}
+
+/**
+ * `ownerLoadError` for a screen that does nothing but RENDER the string.
+ *
+ * Two things the default cannot do, each for a reason:
+ *
+ *  1. It only names the web preview when there IS one. `isBridgeUnavailable`
+ *     reads "not live" as "preview", and native injects no mode at all, so the
+ *     default would answer a device-side `HTTP 503` with "open this app on a
+ *     device" — on the device. That predicate is deliberately left alone:
+ *     native write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
+ *
+ *  2. It reduces a JSON ENVELOPE to its status. The default must NOT: its
+ *     output is PARSED downstream — the products worker matches
+ *     `CATALOG_V3_CALLING_CATALOG_V1_API` in it to choose its v1 fallback, and
+ *     `owner-load-error.test.ts` pins that verbatim. A display-only caller has
+ *     no such reader, and the bridge's typed refusals are JSON and short enough
+ *     (68 chars) to slip under MAX_RAW, so nothing else was catching them.
+ *
+ * So: use this ONLY where the value is rendered and never matched on.
+ */
+export function ownerDisplayError(e: unknown): string {
+  if (isOwnerPreviewHost() && isBridgeUnavailable(e)) return ownerPreviewUnavailable();
   const msg = String((e as Error)?.message ?? e);
-  if (isBridgeUnavailable(e)) {
-    // Copy-as-configuration (himi-copy): shared across every owner-lite worker,
-    // so the key lives under the ownerCommon. prefix the dev module forwards to
-    // all owner screens. With no pack this returns the stock copy verbatim.
+  const status = STATUS.exec(msg)?.[1];
+  if (JSON_BODY.test(msg) && status) {
     return copyParam(
-      "ownerCommon.bridgeUnavailable",
-      "Owner data isn’t available in the web preview — open this app on a device (▦ Open on phone) and sign in as the site owner.",
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
     );
   }
   return humanWireError(msg);
 }
+
+export function ownerLoadError(e: unknown): string {
+  const msg = String((e as Error)?.message ?? e);
+  if (isBridgeUnavailable(e)) return ownerPreviewUnavailable();
+  return humanWireError(msg);
+}

package/templates/beauty-salon-owner/tier5-src/himi-owner-lite-analytics/index.ts

@@ -31,6 +31,7 @@ import { defineService } from "@himalaya/state";
 import { open } from "@himalaya/open-url";
 import { formatNumber } from "../_shared/engine-intl.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
+import { ownerDisplayError, isOwnerPreviewDemo, ownerPreviewUnavailable } from "../_shared/owner-load-error.js";
 import {
   getSiteAnalytics,
   getSiteTimeZone,
@@ -353,9 +354,41 @@ function withDetail(s: AnalyticsState, key: string): AnalyticsState {
   };
 }
 
+/**
+ * The error arm, shaped once.
+ *
+ * `message` is ALWAYS human-readable copy, never a wire body. This screen used
+ * to pass `String(e.message)` straight through, which is how an owner opening
+ * the web preview met `HTTP 501: {"error":"webwix_bridge_no_client_id",…}` in
+ * the card where every sibling screen says the same thing in a sentence.
+ */
+function errored(n: number, message: string): AnalyticsState {
+  return {
+    ...empty,
+    status: "error",
+    days: n,
+    rangeId: String(n),
+    range: rangeLabel(n),
+    notLoading: true,
+    notErrored: false,
+    hideContent: true,
+    noEmpty: true,
+    noCompare: true,
+    emptyText: "",
+    error: message,
+    handoffError: "",
+  };
+}
+
 /** Fetch + shape the metrics for a window of `days`. */
 async function compute(days: number): Promise<AnalyticsState> {
   const n = RANGES.includes(days) ? days : 30;
+  // SAMPLE preview mode, and this screen deliberately has no sample arm (see the
+  // descriptor's "NO demo banner" note — fabricated traffic and revenue would be
+  // indistinguishable from the real thing). So refuse HERE, in one sentence,
+  // instead of firing a request the host has already told us cannot be served
+  // and rendering the bridge's refusal at the owner.
+  if (isOwnerPreviewDemo()) return errored(n, ownerPreviewUnavailable());
   try {
     // A site with no zone set resolves undefined and legitimately falls back to
     // UTC — the API's own default. A FAILED request rejects and lands in the
@@ -426,22 +459,7 @@ async function compute(days: number): Promise<AnalyticsState> {
       handoffError: "",
     };
   } catch (e) {
-    const message = String((e as Error)?.message ?? e);
-    return {
-      ...empty,
-      status: "error",
-      days: n,
-      rangeId: String(n),
-      range: rangeLabel(n),
-      notLoading: true,
-      notErrored: false,
-      hideContent: true,
-      noEmpty: true,
-      noCompare: true,
-      emptyText: "",
-      error: message,
-      handoffError: "",
-    };
+    return errored(n, ownerDisplayError(e));
   }
 }
 

package/templates/beauty-salon-owner/tier5-src/himi-owner-lite-analytics/report.ts

@@ -46,6 +46,7 @@
 import { defineService } from "@himalaya/state";
 import { formatNumber } from "../_shared/engine-intl.js";
 import { copyParam, stashCopy } from "../_shared/himi-copy.js";
+import { ownerDisplayError, isOwnerPreviewDemo, ownerPreviewUnavailable } from "../_shared/owner-load-error.js";
 import {
   getSiteTimeZone,
   intervalForDays,
@@ -472,7 +473,7 @@ async function runQuery(s: ReportState, days: number): Promise<ReportState | Dec
     return out;
   } catch (e) {
     if (mine !== seq) return latest ?? s;
-    const out = errorState(s, String((e as Error)?.message ?? e));
+    const out = errorState(s, ownerDisplayError(e));
     latest = out;
     return out;
   }
@@ -494,6 +495,16 @@ const svc = defineService<ReportState, {
      */
     load: async (s, arg) => {
       stashCopy(arg);
+      // SAMPLE preview mode. Like the highlights service this screen has no
+      // sample arm on purpose — an invented subject area with invented rows is
+      // the "confident wrong number" this screen family exists to prevent — so
+      // it refuses in a sentence rather than issuing a call the host already
+      // knows cannot be served and surfacing the bridge's own refusal.
+      if (isOwnerPreviewDemo()) {
+        const out = errorState(s, ownerPreviewUnavailable());
+        latest = out;
+        return out;
+      }
       const mine = ++seq;
       try {
         const models = await listSemanticModels();
@@ -533,7 +544,7 @@ const svc = defineService<ReportState, {
         // made the failure path inconsistent with the success path right beside
         // it. (AI-review finding on #2533.)
         if (mine !== seq) return latest ?? s ?? { ...empty };
-        const out = errorState(s, String((e as Error)?.message ?? e));
+        const out = errorState(s, ownerDisplayError(e));
         latest = out;
         return out;
       }
@@ -607,7 +618,7 @@ const svc = defineService<ReportState, {
         // Same hole, same reason: tap subject A then B, and A's rejection
         // arriving late must not replace B's selection with the error arm.
         if (mine !== seq) return latest ?? s;
-        const out = errorState(s, String((e as Error)?.message ?? e));
+        const out = errorState(s, ownerDisplayError(e));
         latest = out;
         return out;
       } finally {

package/templates/branded-lite/tier5-src/_shared/owner-load-error.ts

@@ -9,6 +9,23 @@ export function isOwnerPreviewLive(): boolean {
   return ownerPreviewMode() === "live";
 }
 
+/**
+ * Whether we are in the web preview AT ALL — i.e. the host declared a mode.
+ *
+ * `isBridgeUnavailable` cannot answer this: it reads "not live" as "preview",
+ * and on NATIVE there is no input at all, so `undefined` satisfies it. That is
+ * harmless for the callers that use it to pick a demo fallback or to queue a
+ * write, and it is deliberately left alone for them — native write-behind
+ * depends on it. It is NOT harmless for choosing COPY: native workers format
+ * their failures the same way (`"HTTP \(code): \(body)"`, JSWorker.swift;
+ * `"HTTP ${e.code}: ..."`, WebViewJSWorker.kt), so a transient `HTTP 503` on a
+ * phone would otherwise be answered with "open this app on a device" — on the
+ * device. Callers that pick a SENTENCE ask this instead.
+ */
+export function isOwnerPreviewHost(): boolean {
+  return ownerPreviewMode() !== undefined;
+}
+
 export function isOwnerPreviewDemo(): boolean {
   return ownerPreviewMode() === "sample";
 }
@@ -31,6 +48,11 @@ export function shouldQueueOwnerWrite(e: unknown): boolean {
 const STATUS = /HTTP (\d{3})\b/;
 /** A wire body that is an HTML DOCUMENT, not a message. */
 const HTML_BODY = /<!DOCTYPE html|<html[\s>]|<head[\s>]/i;
+/** A wire body that is a JSON ENVELOPE, not a message. The serve bridge answers
+ *  its typed refusals this way — `HTTP 501: {"error":"webwix_owner_no_session",
+ *  "app":"…"}` — and it is short enough to slip under MAX_RAW, so truncation
+ *  never caught it and the owner read the machine's word for it. */
+const JSON_BODY = /HTTP \d{3}:\s*[[{]/;
 /** Longest raw upstream text worth showing. Beyond this it stops being a
  *  message and starts being a payload dump. */
 const MAX_RAW = 200;
@@ -62,16 +84,55 @@ function humanWireError(msg: string): string {
   return msg.length > MAX_RAW ? `${msg.slice(0, MAX_RAW).trimEnd()}…` : msg;
 }
 
-export function ownerLoadError(e: unknown): string {
+/**
+ * The one sentence every owner screen gives for the DESIGNED bridge boundary.
+ *
+ * Copy-as-configuration (himi-copy): the key lives under the `ownerCommon.`
+ * prefix the dev module forwards to all owner screens, so one pack retitles it
+ * everywhere. With no pack this returns the stock copy verbatim.
+ */
+export function ownerPreviewUnavailable(): string {
+  return copyParam(
+    "ownerCommon.bridgeUnavailable",
+    "Owner data isn’t available in the web preview — open this app on a device (▦ Open on phone) and sign in as the site owner.",
+  );
+}
+
+/**
+ * `ownerLoadError` for a screen that does nothing but RENDER the string.
+ *
+ * Two things the default cannot do, each for a reason:
+ *
+ *  1. It only names the web preview when there IS one. `isBridgeUnavailable`
+ *     reads "not live" as "preview", and native injects no mode at all, so the
+ *     default would answer a device-side `HTTP 503` with "open this app on a
+ *     device" — on the device. That predicate is deliberately left alone:
+ *     native write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
+ *
+ *  2. It reduces a JSON ENVELOPE to its status. The default must NOT: its
+ *     output is PARSED downstream — the products worker matches
+ *     `CATALOG_V3_CALLING_CATALOG_V1_API` in it to choose its v1 fallback, and
+ *     `owner-load-error.test.ts` pins that verbatim. A display-only caller has
+ *     no such reader, and the bridge's typed refusals are JSON and short enough
+ *     (68 chars) to slip under MAX_RAW, so nothing else was catching them.
+ *
+ * So: use this ONLY where the value is rendered and never matched on.
+ */
+export function ownerDisplayError(e: unknown): string {
+  if (isOwnerPreviewHost() && isBridgeUnavailable(e)) return ownerPreviewUnavailable();
   const msg = String((e as Error)?.message ?? e);
-  if (isBridgeUnavailable(e)) {
-    // Copy-as-configuration (himi-copy): shared across every owner-lite worker,
-    // so the key lives under the ownerCommon. prefix the dev module forwards to
-    // all owner screens. With no pack this returns the stock copy verbatim.
+  const status = STATUS.exec(msg)?.[1];
+  if (JSON_BODY.test(msg) && status) {
     return copyParam(
-      "ownerCommon.bridgeUnavailable",
-      "Owner data isn’t available in the web preview — open this app on a device (▦ Open on phone) and sign in as the site owner.",
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
     );
   }
   return humanWireError(msg);
 }
+
+export function ownerLoadError(e: unknown): string {
+  const msg = String((e as Error)?.message ?? e);
+  if (isBridgeUnavailable(e)) return ownerPreviewUnavailable();
+  return humanWireError(msg);
+}

package/templates/community-club/tier5-src/_shared/owner-load-error.ts

@@ -9,6 +9,23 @@ export function isOwnerPreviewLive(): boolean {
   return ownerPreviewMode() === "live";
 }
 
+/**
+ * Whether we are in the web preview AT ALL — i.e. the host declared a mode.
+ *
+ * `isBridgeUnavailable` cannot answer this: it reads "not live" as "preview",
+ * and on NATIVE there is no input at all, so `undefined` satisfies it. That is
+ * harmless for the callers that use it to pick a demo fallback or to queue a
+ * write, and it is deliberately left alone for them — native write-behind
+ * depends on it. It is NOT harmless for choosing COPY: native workers format
+ * their failures the same way (`"HTTP \(code): \(body)"`, JSWorker.swift;
+ * `"HTTP ${e.code}: ..."`, WebViewJSWorker.kt), so a transient `HTTP 503` on a
+ * phone would otherwise be answered with "open this app on a device" — on the
+ * device. Callers that pick a SENTENCE ask this instead.
+ */
+export function isOwnerPreviewHost(): boolean {
+  return ownerPreviewMode() !== undefined;
+}
+
 export function isOwnerPreviewDemo(): boolean {
   return ownerPreviewMode() === "sample";
 }
@@ -31,6 +48,11 @@ export function shouldQueueOwnerWrite(e: unknown): boolean {
 const STATUS = /HTTP (\d{3})\b/;
 /** A wire body that is an HTML DOCUMENT, not a message. */
 const HTML_BODY = /<!DOCTYPE html|<html[\s>]|<head[\s>]/i;
+/** A wire body that is a JSON ENVELOPE, not a message. The serve bridge answers
+ *  its typed refusals this way — `HTTP 501: {"error":"webwix_owner_no_session",
+ *  "app":"…"}` — and it is short enough to slip under MAX_RAW, so truncation
+ *  never caught it and the owner read the machine's word for it. */
+const JSON_BODY = /HTTP \d{3}:\s*[[{]/;
 /** Longest raw upstream text worth showing. Beyond this it stops being a
  *  message and starts being a payload dump. */
 const MAX_RAW = 200;
@@ -62,16 +84,55 @@ function humanWireError(msg: string): string {
   return msg.length > MAX_RAW ? `${msg.slice(0, MAX_RAW).trimEnd()}…` : msg;
 }
 
-export function ownerLoadError(e: unknown): string {
+/**
+ * The one sentence every owner screen gives for the DESIGNED bridge boundary.
+ *
+ * Copy-as-configuration (himi-copy): the key lives under the `ownerCommon.`
+ * prefix the dev module forwards to all owner screens, so one pack retitles it
+ * everywhere. With no pack this returns the stock copy verbatim.
+ */
+export function ownerPreviewUnavailable(): string {
+  return copyParam(
+    "ownerCommon.bridgeUnavailable",
+    "Owner data isn’t available in the web preview — open this app on a device (▦ Open on phone) and sign in as the site owner.",
+  );
+}
+
+/**
+ * `ownerLoadError` for a screen that does nothing but RENDER the string.
+ *
+ * Two things the default cannot do, each for a reason:
+ *
+ *  1. It only names the web preview when there IS one. `isBridgeUnavailable`
+ *     reads "not live" as "preview", and native injects no mode at all, so the
+ *     default would answer a device-side `HTTP 503` with "open this app on a
+ *     device" — on the device. That predicate is deliberately left alone:
+ *     native write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
+ *
+ *  2. It reduces a JSON ENVELOPE to its status. The default must NOT: its
+ *     output is PARSED downstream — the products worker matches
+ *     `CATALOG_V3_CALLING_CATALOG_V1_API` in it to choose its v1 fallback, and
+ *     `owner-load-error.test.ts` pins that verbatim. A display-only caller has
+ *     no such reader, and the bridge's typed refusals are JSON and short enough
+ *     (68 chars) to slip under MAX_RAW, so nothing else was catching them.
+ *
+ * So: use this ONLY where the value is rendered and never matched on.
+ */
+export function ownerDisplayError(e: unknown): string {
+  if (isOwnerPreviewHost() && isBridgeUnavailable(e)) return ownerPreviewUnavailable();
   const msg = String((e as Error)?.message ?? e);
-  if (isBridgeUnavailable(e)) {
-    // Copy-as-configuration (himi-copy): shared across every owner-lite worker,
-    // so the key lives under the ownerCommon. prefix the dev module forwards to
-    // all owner screens. With no pack this returns the stock copy verbatim.
+  const status = STATUS.exec(msg)?.[1];
+  if (JSON_BODY.test(msg) && status) {
     return copyParam(
-      "ownerCommon.bridgeUnavailable",
-      "Owner data isn’t available in the web preview — open this app on a device (▦ Open on phone) and sign in as the site owner.",
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
     );
   }
   return humanWireError(msg);
 }
+
+export function ownerLoadError(e: unknown): string {
+  const msg = String((e as Error)?.message ?? e);
+  if (isBridgeUnavailable(e)) return ownerPreviewUnavailable();
+  return humanWireError(msg);
+}