@wix/himalaya-cli 0.912.0 → 0.914.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.912.0",
+  "version": "0.914.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -64,5 +64,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "94415d57eb1b30c06a58cc4e9a3ca8fe75629dc32db71bba525dc552"
+  "falconPackageHash": "dcb937a54b33218d22d5a8e54fe90c7426b937a5bf3e791eb8dc26d5"
 }

package/templates/beauty-salon/tier5-src/_shared/owner-load-error.ts

@@ -9,6 +9,23 @@ export function isOwnerPreviewLive(): boolean {
   return ownerPreviewMode() === "live";
 }
 
+/**
+ * Whether we are in the web preview AT ALL — i.e. the host declared a mode.
+ *
+ * `isBridgeUnavailable` cannot answer this: it reads "not live" as "preview",
+ * and on NATIVE there is no input at all, so `undefined` satisfies it. That is
+ * harmless for the callers that use it to pick a demo fallback or to queue a
+ * write, and it is deliberately left alone for them — native write-behind
+ * depends on it. It is NOT harmless for choosing COPY: native workers format
+ * their failures the same way (`"HTTP \(code): \(body)"`, JSWorker.swift;
+ * `"HTTP ${e.code}: ..."`, WebViewJSWorker.kt), so a transient `HTTP 503` on a
+ * phone would otherwise be answered with "open this app on a device" — on the
+ * device. Callers that pick a SENTENCE ask this instead.
+ */
+export function isOwnerPreviewHost(): boolean {
+  return ownerPreviewMode() !== undefined;
+}
+
 export function isOwnerPreviewDemo(): boolean {
   return ownerPreviewMode() === "sample";
 }
@@ -31,6 +48,11 @@ export function shouldQueueOwnerWrite(e: unknown): boolean {
 const STATUS = /HTTP (\d{3})\b/;
 /** A wire body that is an HTML DOCUMENT, not a message. */
 const HTML_BODY = /<!DOCTYPE html|<html[\s>]|<head[\s>]/i;
+/** A wire body that is a JSON ENVELOPE, not a message. The serve bridge answers
+ *  its typed refusals this way — `HTTP 501: {"error":"webwix_owner_no_session",
+ *  "app":"…"}` — and it is short enough to slip under MAX_RAW, so truncation
+ *  never caught it and the owner read the machine's word for it. */
+const JSON_BODY = /HTTP \d{3}:\s*[[{]/;
 /** Longest raw upstream text worth showing. Beyond this it stops being a
  *  message and starts being a payload dump. */
 const MAX_RAW = 200;
@@ -62,16 +84,55 @@ function humanWireError(msg: string): string {
   return msg.length > MAX_RAW ? `${msg.slice(0, MAX_RAW).trimEnd()}…` : msg;
 }
 
-export function ownerLoadError(e: unknown): string {
+/**
+ * The one sentence every owner screen gives for the DESIGNED bridge boundary.
+ *
+ * Copy-as-configuration (himi-copy): the key lives under the `ownerCommon.`
+ * prefix the dev module forwards to all owner screens, so one pack retitles it
+ * everywhere. With no pack this returns the stock copy verbatim.
+ */
+export function ownerPreviewUnavailable(): string {
+  return copyParam(
+    "ownerCommon.bridgeUnavailable",
+    "Owner data isn’t available in the web preview — open this app on a device (▦ Open on phone) and sign in as the site owner.",
+  );
+}
+
+/**
+ * `ownerLoadError` for a screen that does nothing but RENDER the string.
+ *
+ * Two things the default cannot do, each for a reason:
+ *
+ *  1. It only names the web preview when there IS one. `isBridgeUnavailable`
+ *     reads "not live" as "preview", and native injects no mode at all, so the
+ *     default would answer a device-side `HTTP 503` with "open this app on a
+ *     device" — on the device. That predicate is deliberately left alone:
+ *     native write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
+ *
+ *  2. It reduces a JSON ENVELOPE to its status. The default must NOT: its
+ *     output is PARSED downstream — the products worker matches
+ *     `CATALOG_V3_CALLING_CATALOG_V1_API` in it to choose its v1 fallback, and
+ *     `owner-load-error.test.ts` pins that verbatim. A display-only caller has
+ *     no such reader, and the bridge's typed refusals are JSON and short enough
+ *     (68 chars) to slip under MAX_RAW, so nothing else was catching them.
+ *
+ * So: use this ONLY where the value is rendered and never matched on.
+ */
+export function ownerDisplayError(e: unknown): string {
+  if (isOwnerPreviewHost() && isBridgeUnavailable(e)) return ownerPreviewUnavailable();
   const msg = String((e as Error)?.message ?? e);
-  if (isBridgeUnavailable(e)) {
-    // Copy-as-configuration (himi-copy): shared across every owner-lite worker,
-    // so the key lives under the ownerCommon. prefix the dev module forwards to
-    // all owner screens. With no pack this returns the stock copy verbatim.
+  const status = STATUS.exec(msg)?.[1];
+  if (JSON_BODY.test(msg) && status) {
     return copyParam(
-      "ownerCommon.bridgeUnavailable",
-      "Owner data isn’t available in the web preview — open this app on a device (▦ Open on phone) and sign in as the site owner.",
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
     );
   }
   return humanWireError(msg);
 }
+
+export function ownerLoadError(e: unknown): string {
+  const msg = String((e as Error)?.message ?? e);
+  if (isBridgeUnavailable(e)) return ownerPreviewUnavailable();
+  return humanWireError(msg);
+}

package/templates/beauty-salon-owner/tier5-src/_shared/owner-load-error.ts

@@ -9,6 +9,23 @@ export function isOwnerPreviewLive(): boolean {
   return ownerPreviewMode() === "live";
 }
 
+/**
+ * Whether we are in the web preview AT ALL — i.e. the host declared a mode.
+ *
+ * `isBridgeUnavailable` cannot answer this: it reads "not live" as "preview",
+ * and on NATIVE there is no input at all, so `undefined` satisfies it. That is
+ * harmless for the callers that use it to pick a demo fallback or to queue a
+ * write, and it is deliberately left alone for them — native write-behind
+ * depends on it. It is NOT harmless for choosing COPY: native workers format
+ * their failures the same way (`"HTTP \(code): \(body)"`, JSWorker.swift;
+ * `"HTTP ${e.code}: ..."`, WebViewJSWorker.kt), so a transient `HTTP 503` on a
+ * phone would otherwise be answered with "open this app on a device" — on the
+ * device. Callers that pick a SENTENCE ask this instead.
+ */
+export function isOwnerPreviewHost(): boolean {
+  return ownerPreviewMode() !== undefined;
+}
+
 export function isOwnerPreviewDemo(): boolean {
   return ownerPreviewMode() === "sample";
 }
@@ -31,6 +48,11 @@ export function shouldQueueOwnerWrite(e: unknown): boolean {
 const STATUS = /HTTP (\d{3})\b/;
 /** A wire body that is an HTML DOCUMENT, not a message. */
 const HTML_BODY = /<!DOCTYPE html|<html[\s>]|<head[\s>]/i;
+/** A wire body that is a JSON ENVELOPE, not a message. The serve bridge answers
+ *  its typed refusals this way — `HTTP 501: {"error":"webwix_owner_no_session",
+ *  "app":"…"}` — and it is short enough to slip under MAX_RAW, so truncation
+ *  never caught it and the owner read the machine's word for it. */
+const JSON_BODY = /HTTP \d{3}:\s*[[{]/;
 /** Longest raw upstream text worth showing. Beyond this it stops being a
  *  message and starts being a payload dump. */
 const MAX_RAW = 200;
@@ -62,16 +84,55 @@ function humanWireError(msg: string): string {
   return msg.length > MAX_RAW ? `${msg.slice(0, MAX_RAW).trimEnd()}…` : msg;
 }
 
-export function ownerLoadError(e: unknown): string {
+/**
+ * The one sentence every owner screen gives for the DESIGNED bridge boundary.
+ *
+ * Copy-as-configuration (himi-copy): the key lives under the `ownerCommon.`
+ * prefix the dev module forwards to all owner screens, so one pack retitles it
+ * everywhere. With no pack this returns the stock copy verbatim.
+ */
+export function ownerPreviewUnavailable(): string {
+  return copyParam(
+    "ownerCommon.bridgeUnavailable",
+    "Owner data isn’t available in the web preview — open this app on a device (▦ Open on phone) and sign in as the site owner.",
+  );
+}
+
+/**
+ * `ownerLoadError` for a screen that does nothing but RENDER the string.
+ *
+ * Two things the default cannot do, each for a reason:
+ *
+ *  1. It only names the web preview when there IS one. `isBridgeUnavailable`
+ *     reads "not live" as "preview", and native injects no mode at all, so the
+ *     default would answer a device-side `HTTP 503` with "open this app on a
+ *     device" — on the device. That predicate is deliberately left alone:
+ *     native write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
+ *
+ *  2. It reduces a JSON ENVELOPE to its status. The default must NOT: its
+ *     output is PARSED downstream — the products worker matches
+ *     `CATALOG_V3_CALLING_CATALOG_V1_API` in it to choose its v1 fallback, and
+ *     `owner-load-error.test.ts` pins that verbatim. A display-only caller has
+ *     no such reader, and the bridge's typed refusals are JSON and short enough
+ *     (68 chars) to slip under MAX_RAW, so nothing else was catching them.
+ *
+ * So: use this ONLY where the value is rendered and never matched on.
+ */
+export function ownerDisplayError(e: unknown): string {
+  if (isOwnerPreviewHost() && isBridgeUnavailable(e)) return ownerPreviewUnavailable();
   const msg = String((e as Error)?.message ?? e);
-  if (isBridgeUnavailable(e)) {
-    // Copy-as-configuration (himi-copy): shared across every owner-lite worker,
-    // so the key lives under the ownerCommon. prefix the dev module forwards to
-    // all owner screens. With no pack this returns the stock copy verbatim.
+  const status = STATUS.exec(msg)?.[1];
+  if (JSON_BODY.test(msg) && status) {
     return copyParam(
-      "ownerCommon.bridgeUnavailable",
-      "Owner data isn’t available in the web preview — open this app on a device (▦ Open on phone) and sign in as the site owner.",
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
     );
   }
   return humanWireError(msg);
 }
+
+export function ownerLoadError(e: unknown): string {
+  const msg = String((e as Error)?.message ?? e);
+  if (isBridgeUnavailable(e)) return ownerPreviewUnavailable();
+  return humanWireError(msg);
+}

package/templates/beauty-salon-owner/tier5-src/himi-owner-lite-analytics/index.ts

@@ -31,6 +31,7 @@ import { defineService } from "@himalaya/state";
 import { open } from "@himalaya/open-url";
 import { formatNumber } from "../_shared/engine-intl.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
+import { ownerDisplayError, isOwnerPreviewDemo, ownerPreviewUnavailable } from "../_shared/owner-load-error.js";
 import {
   getSiteAnalytics,
   getSiteTimeZone,
@@ -353,9 +354,41 @@ function withDetail(s: AnalyticsState, key: string): AnalyticsState {
   };
 }
 
+/**
+ * The error arm, shaped once.
+ *
+ * `message` is ALWAYS human-readable copy, never a wire body. This screen used
+ * to pass `String(e.message)` straight through, which is how an owner opening
+ * the web preview met `HTTP 501: {"error":"webwix_bridge_no_client_id",…}` in
+ * the card where every sibling screen says the same thing in a sentence.
+ */
+function errored(n: number, message: string): AnalyticsState {
+  return {
+    ...empty,
+    status: "error",
+    days: n,
+    rangeId: String(n),
+    range: rangeLabel(n),
+    notLoading: true,
+    notErrored: false,
+    hideContent: true,
+    noEmpty: true,
+    noCompare: true,
+    emptyText: "",
+    error: message,
+    handoffError: "",
+  };
+}
+
 /** Fetch + shape the metrics for a window of `days`. */
 async function compute(days: number): Promise<AnalyticsState> {
   const n = RANGES.includes(days) ? days : 30;
+  // SAMPLE preview mode, and this screen deliberately has no sample arm (see the
+  // descriptor's "NO demo banner" note — fabricated traffic and revenue would be
+  // indistinguishable from the real thing). So refuse HERE, in one sentence,
+  // instead of firing a request the host has already told us cannot be served
+  // and rendering the bridge's refusal at the owner.
+  if (isOwnerPreviewDemo()) return errored(n, ownerPreviewUnavailable());
   try {
     // A site with no zone set resolves undefined and legitimately falls back to
     // UTC — the API's own default. A FAILED request rejects and lands in the
@@ -426,22 +459,7 @@ async function compute(days: number): Promise<AnalyticsState> {
       handoffError: "",
     };
   } catch (e) {
-    const message = String((e as Error)?.message ?? e);
-    return {
-      ...empty,
-      status: "error",
-      days: n,
-      rangeId: String(n),
-      range: rangeLabel(n),
-      notLoading: true,
-      notErrored: false,
-      hideContent: true,
-      noEmpty: true,
-      noCompare: true,
-      emptyText: "",
-      error: message,
-      handoffError: "",
-    };
+    return errored(n, ownerDisplayError(e));
   }
 }
 

package/templates/beauty-salon-owner/tier5-src/himi-owner-lite-analytics/report.ts

@@ -46,6 +46,7 @@
 import { defineService } from "@himalaya/state";
 import { formatNumber } from "../_shared/engine-intl.js";
 import { copyParam, stashCopy } from "../_shared/himi-copy.js";
+import { ownerDisplayError, isOwnerPreviewDemo, ownerPreviewUnavailable } from "../_shared/owner-load-error.js";
 import {
   getSiteTimeZone,
   intervalForDays,
@@ -472,7 +473,7 @@ async function runQuery(s: ReportState, days: number): Promise<ReportState | Dec
     return out;
   } catch (e) {
     if (mine !== seq) return latest ?? s;
-    const out = errorState(s, String((e as Error)?.message ?? e));
+    const out = errorState(s, ownerDisplayError(e));
     latest = out;
     return out;
   }
@@ -494,6 +495,16 @@ const svc = defineService<ReportState, {
      */
     load: async (s, arg) => {
       stashCopy(arg);
+      // SAMPLE preview mode. Like the highlights service this screen has no
+      // sample arm on purpose — an invented subject area with invented rows is
+      // the "confident wrong number" this screen family exists to prevent — so
+      // it refuses in a sentence rather than issuing a call the host already
+      // knows cannot be served and surfacing the bridge's own refusal.
+      if (isOwnerPreviewDemo()) {
+        const out = errorState(s, ownerPreviewUnavailable());
+        latest = out;
+        return out;
+      }
       const mine = ++seq;
       try {
         const models = await listSemanticModels();
@@ -533,7 +544,7 @@ const svc = defineService<ReportState, {
         // made the failure path inconsistent with the success path right beside
         // it. (AI-review finding on #2533.)
         if (mine !== seq) return latest ?? s ?? { ...empty };
-        const out = errorState(s, String((e as Error)?.message ?? e));
+        const out = errorState(s, ownerDisplayError(e));
         latest = out;
         return out;
       }
@@ -607,7 +618,7 @@ const svc = defineService<ReportState, {
         // Same hole, same reason: tap subject A then B, and A's rejection
         // arriving late must not replace B's selection with the error arm.
         if (mine !== seq) return latest ?? s;
-        const out = errorState(s, String((e as Error)?.message ?? e));
+        const out = errorState(s, ownerDisplayError(e));
         latest = out;
         return out;
       } finally {

package/templates/branded-lite/tier5-src/_shared/owner-load-error.ts

@@ -9,6 +9,23 @@ export function isOwnerPreviewLive(): boolean {
   return ownerPreviewMode() === "live";
 }
 
+/**
+ * Whether we are in the web preview AT ALL — i.e. the host declared a mode.
+ *
+ * `isBridgeUnavailable` cannot answer this: it reads "not live" as "preview",
+ * and on NATIVE there is no input at all, so `undefined` satisfies it. That is
+ * harmless for the callers that use it to pick a demo fallback or to queue a
+ * write, and it is deliberately left alone for them — native write-behind
+ * depends on it. It is NOT harmless for choosing COPY: native workers format
+ * their failures the same way (`"HTTP \(code): \(body)"`, JSWorker.swift;
+ * `"HTTP ${e.code}: ..."`, WebViewJSWorker.kt), so a transient `HTTP 503` on a
+ * phone would otherwise be answered with "open this app on a device" — on the
+ * device. Callers that pick a SENTENCE ask this instead.
+ */
+export function isOwnerPreviewHost(): boolean {
+  return ownerPreviewMode() !== undefined;
+}
+
 export function isOwnerPreviewDemo(): boolean {
   return ownerPreviewMode() === "sample";
 }
@@ -31,6 +48,11 @@ export function shouldQueueOwnerWrite(e: unknown): boolean {
 const STATUS = /HTTP (\d{3})\b/;
 /** A wire body that is an HTML DOCUMENT, not a message. */
 const HTML_BODY = /<!DOCTYPE html|<html[\s>]|<head[\s>]/i;
+/** A wire body that is a JSON ENVELOPE, not a message. The serve bridge answers
+ *  its typed refusals this way — `HTTP 501: {"error":"webwix_owner_no_session",
+ *  "app":"…"}` — and it is short enough to slip under MAX_RAW, so truncation
+ *  never caught it and the owner read the machine's word for it. */
+const JSON_BODY = /HTTP \d{3}:\s*[[{]/;
 /** Longest raw upstream text worth showing. Beyond this it stops being a
  *  message and starts being a payload dump. */
 const MAX_RAW = 200;
@@ -62,16 +84,55 @@ function humanWireError(msg: string): string {
   return msg.length > MAX_RAW ? `${msg.slice(0, MAX_RAW).trimEnd()}…` : msg;
 }
 
-export function ownerLoadError(e: unknown): string {
+/**
+ * The one sentence every owner screen gives for the DESIGNED bridge boundary.
+ *
+ * Copy-as-configuration (himi-copy): the key lives under the `ownerCommon.`
+ * prefix the dev module forwards to all owner screens, so one pack retitles it
+ * everywhere. With no pack this returns the stock copy verbatim.
+ */
+export function ownerPreviewUnavailable(): string {
+  return copyParam(
+    "ownerCommon.bridgeUnavailable",
+    "Owner data isn’t available in the web preview — open this app on a device (▦ Open on phone) and sign in as the site owner.",
+  );
+}
+
+/**
+ * `ownerLoadError` for a screen that does nothing but RENDER the string.
+ *
+ * Two things the default cannot do, each for a reason:
+ *
+ *  1. It only names the web preview when there IS one. `isBridgeUnavailable`
+ *     reads "not live" as "preview", and native injects no mode at all, so the
+ *     default would answer a device-side `HTTP 503` with "open this app on a
+ *     device" — on the device. That predicate is deliberately left alone:
+ *     native write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
+ *
+ *  2. It reduces a JSON ENVELOPE to its status. The default must NOT: its
+ *     output is PARSED downstream — the products worker matches
+ *     `CATALOG_V3_CALLING_CATALOG_V1_API` in it to choose its v1 fallback, and
+ *     `owner-load-error.test.ts` pins that verbatim. A display-only caller has
+ *     no such reader, and the bridge's typed refusals are JSON and short enough
+ *     (68 chars) to slip under MAX_RAW, so nothing else was catching them.
+ *
+ * So: use this ONLY where the value is rendered and never matched on.
+ */
+export function ownerDisplayError(e: unknown): string {
+  if (isOwnerPreviewHost() && isBridgeUnavailable(e)) return ownerPreviewUnavailable();
   const msg = String((e as Error)?.message ?? e);
-  if (isBridgeUnavailable(e)) {
-    // Copy-as-configuration (himi-copy): shared across every owner-lite worker,
-    // so the key lives under the ownerCommon. prefix the dev module forwards to
-    // all owner screens. With no pack this returns the stock copy verbatim.
+  const status = STATUS.exec(msg)?.[1];
+  if (JSON_BODY.test(msg) && status) {
     return copyParam(
-      "ownerCommon.bridgeUnavailable",
-      "Owner data isn’t available in the web preview — open this app on a device (▦ Open on phone) and sign in as the site owner.",
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
     );
   }
   return humanWireError(msg);
 }
+
+export function ownerLoadError(e: unknown): string {
+  const msg = String((e as Error)?.message ?? e);
+  if (isBridgeUnavailable(e)) return ownerPreviewUnavailable();
+  return humanWireError(msg);
+}

package/templates/community-club/tier5-src/_shared/owner-load-error.ts

@@ -9,6 +9,23 @@ export function isOwnerPreviewLive(): boolean {
   return ownerPreviewMode() === "live";
 }
 
+/**
+ * Whether we are in the web preview AT ALL — i.e. the host declared a mode.
+ *
+ * `isBridgeUnavailable` cannot answer this: it reads "not live" as "preview",
+ * and on NATIVE there is no input at all, so `undefined` satisfies it. That is
+ * harmless for the callers that use it to pick a demo fallback or to queue a
+ * write, and it is deliberately left alone for them — native write-behind
+ * depends on it. It is NOT harmless for choosing COPY: native workers format
+ * their failures the same way (`"HTTP \(code): \(body)"`, JSWorker.swift;
+ * `"HTTP ${e.code}: ..."`, WebViewJSWorker.kt), so a transient `HTTP 503` on a
+ * phone would otherwise be answered with "open this app on a device" — on the
+ * device. Callers that pick a SENTENCE ask this instead.
+ */
+export function isOwnerPreviewHost(): boolean {
+  return ownerPreviewMode() !== undefined;
+}
+
 export function isOwnerPreviewDemo(): boolean {
   return ownerPreviewMode() === "sample";
 }
@@ -31,6 +48,11 @@ export function shouldQueueOwnerWrite(e: unknown): boolean {
 const STATUS = /HTTP (\d{3})\b/;
 /** A wire body that is an HTML DOCUMENT, not a message. */
 const HTML_BODY = /<!DOCTYPE html|<html[\s>]|<head[\s>]/i;
+/** A wire body that is a JSON ENVELOPE, not a message. The serve bridge answers
+ *  its typed refusals this way — `HTTP 501: {"error":"webwix_owner_no_session",
+ *  "app":"…"}` — and it is short enough to slip under MAX_RAW, so truncation
+ *  never caught it and the owner read the machine's word for it. */
+const JSON_BODY = /HTTP \d{3}:\s*[[{]/;
 /** Longest raw upstream text worth showing. Beyond this it stops being a
  *  message and starts being a payload dump. */
 const MAX_RAW = 200;
@@ -62,16 +84,55 @@ function humanWireError(msg: string): string {
   return msg.length > MAX_RAW ? `${msg.slice(0, MAX_RAW).trimEnd()}…` : msg;
 }
 
-export function ownerLoadError(e: unknown): string {
+/**
+ * The one sentence every owner screen gives for the DESIGNED bridge boundary.
+ *
+ * Copy-as-configuration (himi-copy): the key lives under the `ownerCommon.`
+ * prefix the dev module forwards to all owner screens, so one pack retitles it
+ * everywhere. With no pack this returns the stock copy verbatim.
+ */
+export function ownerPreviewUnavailable(): string {
+  return copyParam(
+    "ownerCommon.bridgeUnavailable",
+    "Owner data isn’t available in the web preview — open this app on a device (▦ Open on phone) and sign in as the site owner.",
+  );
+}
+
+/**
+ * `ownerLoadError` for a screen that does nothing but RENDER the string.
+ *
+ * Two things the default cannot do, each for a reason:
+ *
+ *  1. It only names the web preview when there IS one. `isBridgeUnavailable`
+ *     reads "not live" as "preview", and native injects no mode at all, so the
+ *     default would answer a device-side `HTTP 503` with "open this app on a
+ *     device" — on the device. That predicate is deliberately left alone:
+ *     native write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
+ *
+ *  2. It reduces a JSON ENVELOPE to its status. The default must NOT: its
+ *     output is PARSED downstream — the products worker matches
+ *     `CATALOG_V3_CALLING_CATALOG_V1_API` in it to choose its v1 fallback, and
+ *     `owner-load-error.test.ts` pins that verbatim. A display-only caller has
+ *     no such reader, and the bridge's typed refusals are JSON and short enough
+ *     (68 chars) to slip under MAX_RAW, so nothing else was catching them.
+ *
+ * So: use this ONLY where the value is rendered and never matched on.
+ */
+export function ownerDisplayError(e: unknown): string {
+  if (isOwnerPreviewHost() && isBridgeUnavailable(e)) return ownerPreviewUnavailable();
   const msg = String((e as Error)?.message ?? e);
-  if (isBridgeUnavailable(e)) {
-    // Copy-as-configuration (himi-copy): shared across every owner-lite worker,
-    // so the key lives under the ownerCommon. prefix the dev module forwards to
-    // all owner screens. With no pack this returns the stock copy verbatim.
+  const status = STATUS.exec(msg)?.[1];
+  if (JSON_BODY.test(msg) && status) {
     return copyParam(
-      "ownerCommon.bridgeUnavailable",
-      "Owner data isn’t available in the web preview — open this app on a device (▦ Open on phone) and sign in as the site owner.",
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
     );
   }
   return humanWireError(msg);
 }
+
+export function ownerLoadError(e: unknown): string {
+  const msg = String((e as Error)?.message ?? e);
+  if (isBridgeUnavailable(e)) return ownerPreviewUnavailable();
+  return humanWireError(msg);
+}

package/templates/community-club-owner/tier5-src/_shared/owner-load-error.ts

@@ -9,6 +9,23 @@ export function isOwnerPreviewLive(): boolean {
   return ownerPreviewMode() === "live";
 }
 
+/**
+ * Whether we are in the web preview AT ALL — i.e. the host declared a mode.
+ *
+ * `isBridgeUnavailable` cannot answer this: it reads "not live" as "preview",
+ * and on NATIVE there is no input at all, so `undefined` satisfies it. That is
+ * harmless for the callers that use it to pick a demo fallback or to queue a
+ * write, and it is deliberately left alone for them — native write-behind
+ * depends on it. It is NOT harmless for choosing COPY: native workers format
+ * their failures the same way (`"HTTP \(code): \(body)"`, JSWorker.swift;
+ * `"HTTP ${e.code}: ..."`, WebViewJSWorker.kt), so a transient `HTTP 503` on a
+ * phone would otherwise be answered with "open this app on a device" — on the
+ * device. Callers that pick a SENTENCE ask this instead.
+ */
+export function isOwnerPreviewHost(): boolean {
+  return ownerPreviewMode() !== undefined;
+}
+
 export function isOwnerPreviewDemo(): boolean {
   return ownerPreviewMode() === "sample";
 }
@@ -31,6 +48,11 @@ export function shouldQueueOwnerWrite(e: unknown): boolean {
 const STATUS = /HTTP (\d{3})\b/;
 /** A wire body that is an HTML DOCUMENT, not a message. */
 const HTML_BODY = /<!DOCTYPE html|<html[\s>]|<head[\s>]/i;
+/** A wire body that is a JSON ENVELOPE, not a message. The serve bridge answers
+ *  its typed refusals this way — `HTTP 501: {"error":"webwix_owner_no_session",
+ *  "app":"…"}` — and it is short enough to slip under MAX_RAW, so truncation
+ *  never caught it and the owner read the machine's word for it. */
+const JSON_BODY = /HTTP \d{3}:\s*[[{]/;
 /** Longest raw upstream text worth showing. Beyond this it stops being a
  *  message and starts being a payload dump. */
 const MAX_RAW = 200;
@@ -62,16 +84,55 @@ function humanWireError(msg: string): string {
   return msg.length > MAX_RAW ? `${msg.slice(0, MAX_RAW).trimEnd()}…` : msg;
 }
 
-export function ownerLoadError(e: unknown): string {
+/**
+ * The one sentence every owner screen gives for the DESIGNED bridge boundary.
+ *
+ * Copy-as-configuration (himi-copy): the key lives under the `ownerCommon.`
+ * prefix the dev module forwards to all owner screens, so one pack retitles it
+ * everywhere. With no pack this returns the stock copy verbatim.
+ */
+export function ownerPreviewUnavailable(): string {
+  return copyParam(
+    "ownerCommon.bridgeUnavailable",
+    "Owner data isn’t available in the web preview — open this app on a device (▦ Open on phone) and sign in as the site owner.",
+  );
+}
+
+/**
+ * `ownerLoadError` for a screen that does nothing but RENDER the string.
+ *
+ * Two things the default cannot do, each for a reason:
+ *
+ *  1. It only names the web preview when there IS one. `isBridgeUnavailable`
+ *     reads "not live" as "preview", and native injects no mode at all, so the
+ *     default would answer a device-side `HTTP 503` with "open this app on a
+ *     device" — on the device. That predicate is deliberately left alone:
+ *     native write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
+ *
+ *  2. It reduces a JSON ENVELOPE to its status. The default must NOT: its
+ *     output is PARSED downstream — the products worker matches
+ *     `CATALOG_V3_CALLING_CATALOG_V1_API` in it to choose its v1 fallback, and
+ *     `owner-load-error.test.ts` pins that verbatim. A display-only caller has
+ *     no such reader, and the bridge's typed refusals are JSON and short enough
+ *     (68 chars) to slip under MAX_RAW, so nothing else was catching them.
+ *
+ * So: use this ONLY where the value is rendered and never matched on.
+ */
+export function ownerDisplayError(e: unknown): string {
+  if (isOwnerPreviewHost() && isBridgeUnavailable(e)) return ownerPreviewUnavailable();
   const msg = String((e as Error)?.message ?? e);
-  if (isBridgeUnavailable(e)) {
-    // Copy-as-configuration (himi-copy): shared across every owner-lite worker,
-    // so the key lives under the ownerCommon. prefix the dev module forwards to
-    // all owner screens. With no pack this returns the stock copy verbatim.
+  const status = STATUS.exec(msg)?.[1];
+  if (JSON_BODY.test(msg) && status) {
     return copyParam(
-      "ownerCommon.bridgeUnavailable",
-      "Owner data isn’t available in the web preview — open this app on a device (▦ Open on phone) and sign in as the site owner.",
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
     );
   }
   return humanWireError(msg);
 }
+
+export function ownerLoadError(e: unknown): string {
+  const msg = String((e as Error)?.message ?? e);
+  if (isBridgeUnavailable(e)) return ownerPreviewUnavailable();
+  return humanWireError(msg);
+}