@wix/himalaya-cli 0.944.0 → 0.946.0

package/dist/cli.mjs

@@ -18546,7 +18546,6 @@ function shouldRevealError(args) {
 var EMAIL_RE, URL_HOST_RE, INTEGER_RE, NUMBER_RE;
 var init_validation = __esm({
   "../../core/ts/src/validation.ts"() {
-    "use strict";
     EMAIL_RE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/;
     URL_HOST_RE = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(:[0-9]+)?$/;
     INTEGER_RE = /^[+-]?[0-9]+$/;
@@ -21970,7 +21969,6 @@ function validateWorkerSubtree(raw, slotId, policy, actionCatalog) {
 var WORKER_SUBTREE_CEILINGS, ID_PART, ACTION_ID;
 var init_worker_subtree = __esm({
   "../../core/ts/src/worker-subtree.ts"() {
-    "use strict";
     init_worker_subtree_safe_types_generated();
     WORKER_SUBTREE_CEILINGS = Object.freeze({
       maxEncodedBytes: 65536,
@@ -55209,7 +55207,10 @@ function ownerPlaneHint(status, error, target) {
     return { hint: "this environment has no token signing secret configured \u2014 an operator must set SERVE_CONTROL_SIGNING_SECRET" };
   }
   if (error === "owner_requires_selfserve_token") {
-    return { hint: `that credential is an operator token, not a self-serve one \u2014 run \`himi login --browser --target ${target}\` to get an owner identity` };
+    const base = `that credential is an operator token, not a self-serve one \u2014 run \`himi login --browser --target ${target}\` to get an owner identity`;
+    return {
+      hint: isPublicTarget(target) ? base : `${base}. On ${target} that REPLACES the employee token stored for this target, and \`himi dist\` then charges the self-serve tier instead of the employee one \u2014 deliberately the tightest of the three, so far fewer concurrent builds and far fewer per day. \`himi login --dpx --target ${target}\` switches back.`
+    };
   }
   if (error === "token_revoked") {
     return { hint: `this token was revoked \u2014 run \`himi login --browser --target ${target}\` to get a new one` };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.944.0",
+  "version": "0.946.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -64,5 +64,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "430cfb64da57b0b2bd12c6e873effe559a8b82eb6aaf60bfa1037748"
+  "falconPackageHash": "3f6060102b6c94b2c8e6ed84fd14f6c0e0091b8c611331ef95f97e2a"
 }

package/templates/beauty-salon/tier5-src/_shared/owner-load-error.ts

@@ -53,6 +53,17 @@ const HTML_BODY = /<!DOCTYPE html|<html[\s>]|<head[\s>]/i;
  *  "app":"…"}` — and it is short enough to slip under MAX_RAW, so truncation
  *  never caught it and the owner read the machine's word for it. */
 const JSON_BODY = /HTTP \d{3}:\s*[[{]/;
+/** `HTTP <status> [SERVICE_CODE]: message` — the shape a Wix service uses when
+ *  it refuses with a named reason. */
+const CODED = /HTTP (\d{3}) \[([A-Z0-9_]+)\]/;
+/**
+ * The codes that all mean one thing to an owner: the session cannot address this
+ * business. Found on a real session whose account did not own the business the app
+ * had persisted — Home rendered
+ * `HTTP 428 [MISSING_METASITE_ID]: Couldn't extract metasiteId from the request
+ * context` where "6 orders" belongs.
+ */
+const SITE_CONTEXT_CODES = ["MISSING_METASITE_ID", "MISSING_REQUEST_SITE_CONTEXT", "MISSING_SITE_CONTEXT"];
 /** Longest raw upstream text worth showing. Beyond this it stops being a
  *  message and starts being a payload dump. */
 const MAX_RAW = 200;
@@ -69,6 +80,29 @@ const MAX_RAW = 200;
  */
 function humanWireError(msg: string): string {
   const status = STATUS.exec(msg)?.[1];
+  // A JSON ENVELOPE or a NAMED REASON CODE is the machine's word for it, and the
+  // owner gets neither. Both reductions used to live in `ownerDisplayError` only,
+  // on the belief that this function's output was parsed downstream — see the note
+  // on `ownerLoadError`, which records why that was wrong and how it was checked.
+  if (JSON_BODY.test(msg) && status) {
+    return copyParam(
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
+    );
+  }
+  const coded = CODED.exec(msg);
+  if (coded) {
+    if (SITE_CONTEXT_CODES.includes(coded[2])) {
+      return copyParam(
+        "ownerCommon.noSiteContext",
+        "This business isn’t available to your Wix account right now. Switch business, or sign in again as its owner.",
+      );
+    }
+    return copyParam(
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${coded[1]}). Try again in a moment.`,
+    );
+  }
   if (HTML_BODY.test(msg)) {
     if (status === "403") {
       return copyParam(
@@ -101,36 +135,46 @@ export function ownerPreviewUnavailable(): string {
 /**
  * `ownerLoadError` for a screen that does nothing but RENDER the string.
  *
- * Two things the default cannot do, each for a reason:
- *
- *  1. It only names the web preview when there IS one. `isBridgeUnavailable`
- *     reads "not live" as "preview", and native injects no mode at all, so the
- *     default would answer a device-side `HTTP 503` with "open this app on a
- *     device" — on the device. That predicate is deliberately left alone:
- *     native write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
+ * One difference left, and it is about WHERE the app is rather than what the
+ * error says: this names the web preview when there IS one. `isBridgeUnavailable`
+ * reads "not live" as "preview", and native injects no mode at all, so the
+ * default would answer a device-side `HTTP 503` with "open this app on a device"
+ * — on the device. That predicate is deliberately left alone: native
+ * write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
  *
- *  2. It reduces a JSON ENVELOPE to its status. The default must NOT: its
- *     output is PARSED downstream — the products worker matches
- *     `CATALOG_V3_CALLING_CATALOG_V1_API` in it to choose its v1 fallback, and
- *     `owner-load-error.test.ts` pins that verbatim. A display-only caller has
- *     no such reader, and the bridge's typed refusals are JSON and short enough
- *     (68 chars) to slip under MAX_RAW, so nothing else was catching them.
- *
- * So: use this ONLY where the value is rendered and never matched on.
+ * The reductions this used to add are now in `humanWireError`, so every owner
+ * screen gets them rather than the two that happened to call this.
  */
 export function ownerDisplayError(e: unknown): string {
   if (isOwnerPreviewHost() && isBridgeUnavailable(e)) return ownerPreviewUnavailable();
-  const msg = String((e as Error)?.message ?? e);
-  const status = STATUS.exec(msg)?.[1];
-  if (JSON_BODY.test(msg) && status) {
-    return copyParam(
-      "ownerCommon.upstreamStatus",
-      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
-    );
-  }
-  return humanWireError(msg);
+  return humanWireError(String((e as Error)?.message ?? e));
 }
 
+/**
+ * The default. Reduces the same shapes as `ownerDisplayError`.
+ *
+ * It used to reduce LESS, on the stated grounds that its output is parsed
+ * downstream — "the products worker matches `CATALOG_V3_CALLING_CATALOG_V1_API`
+ * in it to choose its v1 fallback". **That was not true**, and it cost 17 owner
+ * screens their error copy: they printed `HTTP 428 [MISSING_METASITE_ID]: …`
+ * verbatim for a contract that does not exist.
+ *
+ * Checked before changing it, and worth recording so nobody restores the belief:
+ *
+ *  • the catalog v1/v3 decision is made INSIDE the Wix stores SDK, on the RAW
+ *    thrown error — its `catalogVersionFromMismatch` reads the error's own
+ *    `message`, and only that module calls it. It never sees this function's
+ *    output.
+ *  • `CATALOG_V3_CALLING_CATALOG_V1_API` appears nowhere else in the codebase
+ *    outside comments, tests and that one SDK module.
+ *  • the collection framework's `clearOnError` is handed the RAW error
+ *    (`error => /401|403|forbidden/i.test(String(error))`), separately from
+ *    `errorMessage: ownerLoadError` — so the one place that does match on a
+ *    failure is unaffected by what this returns.
+ *
+ * So: the raw error remains available to logic everywhere it was; this function's
+ * result is display copy, and now reads like it.
+ */
 export function ownerLoadError(e: unknown): string {
   const msg = String((e as Error)?.message ?? e);
   if (isBridgeUnavailable(e)) return ownerPreviewUnavailable();

package/templates/beauty-salon-owner/tier5-src/_shared/owner-load-error.ts

@@ -53,6 +53,17 @@ const HTML_BODY = /<!DOCTYPE html|<html[\s>]|<head[\s>]/i;
  *  "app":"…"}` — and it is short enough to slip under MAX_RAW, so truncation
  *  never caught it and the owner read the machine's word for it. */
 const JSON_BODY = /HTTP \d{3}:\s*[[{]/;
+/** `HTTP <status> [SERVICE_CODE]: message` — the shape a Wix service uses when
+ *  it refuses with a named reason. */
+const CODED = /HTTP (\d{3}) \[([A-Z0-9_]+)\]/;
+/**
+ * The codes that all mean one thing to an owner: the session cannot address this
+ * business. Found on a real session whose account did not own the business the app
+ * had persisted — Home rendered
+ * `HTTP 428 [MISSING_METASITE_ID]: Couldn't extract metasiteId from the request
+ * context` where "6 orders" belongs.
+ */
+const SITE_CONTEXT_CODES = ["MISSING_METASITE_ID", "MISSING_REQUEST_SITE_CONTEXT", "MISSING_SITE_CONTEXT"];
 /** Longest raw upstream text worth showing. Beyond this it stops being a
  *  message and starts being a payload dump. */
 const MAX_RAW = 200;
@@ -69,6 +80,29 @@ const MAX_RAW = 200;
  */
 function humanWireError(msg: string): string {
   const status = STATUS.exec(msg)?.[1];
+  // A JSON ENVELOPE or a NAMED REASON CODE is the machine's word for it, and the
+  // owner gets neither. Both reductions used to live in `ownerDisplayError` only,
+  // on the belief that this function's output was parsed downstream — see the note
+  // on `ownerLoadError`, which records why that was wrong and how it was checked.
+  if (JSON_BODY.test(msg) && status) {
+    return copyParam(
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
+    );
+  }
+  const coded = CODED.exec(msg);
+  if (coded) {
+    if (SITE_CONTEXT_CODES.includes(coded[2])) {
+      return copyParam(
+        "ownerCommon.noSiteContext",
+        "This business isn’t available to your Wix account right now. Switch business, or sign in again as its owner.",
+      );
+    }
+    return copyParam(
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${coded[1]}). Try again in a moment.`,
+    );
+  }
   if (HTML_BODY.test(msg)) {
     if (status === "403") {
       return copyParam(
@@ -101,36 +135,46 @@ export function ownerPreviewUnavailable(): string {
 /**
  * `ownerLoadError` for a screen that does nothing but RENDER the string.
  *
- * Two things the default cannot do, each for a reason:
- *
- *  1. It only names the web preview when there IS one. `isBridgeUnavailable`
- *     reads "not live" as "preview", and native injects no mode at all, so the
- *     default would answer a device-side `HTTP 503` with "open this app on a
- *     device" — on the device. That predicate is deliberately left alone:
- *     native write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
+ * One difference left, and it is about WHERE the app is rather than what the
+ * error says: this names the web preview when there IS one. `isBridgeUnavailable`
+ * reads "not live" as "preview", and native injects no mode at all, so the
+ * default would answer a device-side `HTTP 503` with "open this app on a device"
+ * — on the device. That predicate is deliberately left alone: native
+ * write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
  *
- *  2. It reduces a JSON ENVELOPE to its status. The default must NOT: its
- *     output is PARSED downstream — the products worker matches
- *     `CATALOG_V3_CALLING_CATALOG_V1_API` in it to choose its v1 fallback, and
- *     `owner-load-error.test.ts` pins that verbatim. A display-only caller has
- *     no such reader, and the bridge's typed refusals are JSON and short enough
- *     (68 chars) to slip under MAX_RAW, so nothing else was catching them.
- *
- * So: use this ONLY where the value is rendered and never matched on.
+ * The reductions this used to add are now in `humanWireError`, so every owner
+ * screen gets them rather than the two that happened to call this.
  */
 export function ownerDisplayError(e: unknown): string {
   if (isOwnerPreviewHost() && isBridgeUnavailable(e)) return ownerPreviewUnavailable();
-  const msg = String((e as Error)?.message ?? e);
-  const status = STATUS.exec(msg)?.[1];
-  if (JSON_BODY.test(msg) && status) {
-    return copyParam(
-      "ownerCommon.upstreamStatus",
-      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
-    );
-  }
-  return humanWireError(msg);
+  return humanWireError(String((e as Error)?.message ?? e));
 }
 
+/**
+ * The default. Reduces the same shapes as `ownerDisplayError`.
+ *
+ * It used to reduce LESS, on the stated grounds that its output is parsed
+ * downstream — "the products worker matches `CATALOG_V3_CALLING_CATALOG_V1_API`
+ * in it to choose its v1 fallback". **That was not true**, and it cost 17 owner
+ * screens their error copy: they printed `HTTP 428 [MISSING_METASITE_ID]: …`
+ * verbatim for a contract that does not exist.
+ *
+ * Checked before changing it, and worth recording so nobody restores the belief:
+ *
+ *  • the catalog v1/v3 decision is made INSIDE the Wix stores SDK, on the RAW
+ *    thrown error — its `catalogVersionFromMismatch` reads the error's own
+ *    `message`, and only that module calls it. It never sees this function's
+ *    output.
+ *  • `CATALOG_V3_CALLING_CATALOG_V1_API` appears nowhere else in the codebase
+ *    outside comments, tests and that one SDK module.
+ *  • the collection framework's `clearOnError` is handed the RAW error
+ *    (`error => /401|403|forbidden/i.test(String(error))`), separately from
+ *    `errorMessage: ownerLoadError` — so the one place that does match on a
+ *    failure is unaffected by what this returns.
+ *
+ * So: the raw error remains available to logic everywhere it was; this function's
+ * result is display copy, and now reads like it.
+ */
 export function ownerLoadError(e: unknown): string {
   const msg = String((e as Error)?.message ?? e);
   if (isBridgeUnavailable(e)) return ownerPreviewUnavailable();

package/templates/beauty-salon-owner/tier5-src/himi-owner-lite-home/index.ts

@@ -13,7 +13,11 @@ import { queryMembers } from "@himalaya/wix-members";
 import { queryReviews } from "@himalaya/wix-reviews";
 import { queryReservations } from "@himalaya/wix-table-reservations";
 import { getSiteAnalytics, getSiteTimeZone, localDateRange, localDateOf, localMidnightUtc } from "@himalaya/wix-analytics";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+// `ownerDisplayError`, not `ownerLoadError`: every string below is bound into a
+// `text(...)` and never matched on — the RAW reason is kept beside it in
+// `<part>Reason` for anything that needs it — so the display-only reduction is
+// both safe here and the reason a 428 reason code stopped reaching the owner.
+import { ownerDisplayError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
 import { DEMO_DASHBOARD, DEMO_NOTE, DEMO_TODAY } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam, copyTemplate } from "../_shared/himi-copy.js";
 import { formatCurrency } from "../_shared/engine-intl.js";
@@ -566,7 +570,7 @@ async function loadSource(source: HomeSourceId, parts = sourceParts(source)): Pr
     const item = settled[index];
     if (item.status === "fulfilled") result[part] = item.value.payload;
     else {
-      result[`${part}Error`] = ownerLoadError(item.reason);
+      result[`${part}Error`] = ownerDisplayError(item.reason);
       result[`${part}Reason`] = item.reason;
     }
   }
@@ -798,7 +802,7 @@ async function loadDashboard(s: HomeState, sources: HomeSourceId[]): Promise<Hom
     if (failedReasons.length > 0 && failedReasons.every((reason) => isBridgeUnavailable(reason))) {
       return demoDashboard(shape({ ...s, sourceStates: [], sourceFailures: [] }));
     }
-    return shape({ ...composeState(), status: "error", error: ownerLoadError(failedReasons[0]) });
+    return shape({ ...composeState(), status: "error", error: ownerDisplayError(failedReasons[0]) });
   }
   return filteredSchedule(composeState(), activeScheduleFilter);
 }

package/templates/branded-lite/tier5-src/_shared/owner-load-error.ts

@@ -53,6 +53,17 @@ const HTML_BODY = /<!DOCTYPE html|<html[\s>]|<head[\s>]/i;
  *  "app":"…"}` — and it is short enough to slip under MAX_RAW, so truncation
  *  never caught it and the owner read the machine's word for it. */
 const JSON_BODY = /HTTP \d{3}:\s*[[{]/;
+/** `HTTP <status> [SERVICE_CODE]: message` — the shape a Wix service uses when
+ *  it refuses with a named reason. */
+const CODED = /HTTP (\d{3}) \[([A-Z0-9_]+)\]/;
+/**
+ * The codes that all mean one thing to an owner: the session cannot address this
+ * business. Found on a real session whose account did not own the business the app
+ * had persisted — Home rendered
+ * `HTTP 428 [MISSING_METASITE_ID]: Couldn't extract metasiteId from the request
+ * context` where "6 orders" belongs.
+ */
+const SITE_CONTEXT_CODES = ["MISSING_METASITE_ID", "MISSING_REQUEST_SITE_CONTEXT", "MISSING_SITE_CONTEXT"];
 /** Longest raw upstream text worth showing. Beyond this it stops being a
  *  message and starts being a payload dump. */
 const MAX_RAW = 200;
@@ -69,6 +80,29 @@ const MAX_RAW = 200;
  */
 function humanWireError(msg: string): string {
   const status = STATUS.exec(msg)?.[1];
+  // A JSON ENVELOPE or a NAMED REASON CODE is the machine's word for it, and the
+  // owner gets neither. Both reductions used to live in `ownerDisplayError` only,
+  // on the belief that this function's output was parsed downstream — see the note
+  // on `ownerLoadError`, which records why that was wrong and how it was checked.
+  if (JSON_BODY.test(msg) && status) {
+    return copyParam(
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
+    );
+  }
+  const coded = CODED.exec(msg);
+  if (coded) {
+    if (SITE_CONTEXT_CODES.includes(coded[2])) {
+      return copyParam(
+        "ownerCommon.noSiteContext",
+        "This business isn’t available to your Wix account right now. Switch business, or sign in again as its owner.",
+      );
+    }
+    return copyParam(
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${coded[1]}). Try again in a moment.`,
+    );
+  }
   if (HTML_BODY.test(msg)) {
     if (status === "403") {
       return copyParam(
@@ -101,36 +135,46 @@ export function ownerPreviewUnavailable(): string {
 /**
  * `ownerLoadError` for a screen that does nothing but RENDER the string.
  *
- * Two things the default cannot do, each for a reason:
- *
- *  1. It only names the web preview when there IS one. `isBridgeUnavailable`
- *     reads "not live" as "preview", and native injects no mode at all, so the
- *     default would answer a device-side `HTTP 503` with "open this app on a
- *     device" — on the device. That predicate is deliberately left alone:
- *     native write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
+ * One difference left, and it is about WHERE the app is rather than what the
+ * error says: this names the web preview when there IS one. `isBridgeUnavailable`
+ * reads "not live" as "preview", and native injects no mode at all, so the
+ * default would answer a device-side `HTTP 503` with "open this app on a device"
+ * — on the device. That predicate is deliberately left alone: native
+ * write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
  *
- *  2. It reduces a JSON ENVELOPE to its status. The default must NOT: its
- *     output is PARSED downstream — the products worker matches
- *     `CATALOG_V3_CALLING_CATALOG_V1_API` in it to choose its v1 fallback, and
- *     `owner-load-error.test.ts` pins that verbatim. A display-only caller has
- *     no such reader, and the bridge's typed refusals are JSON and short enough
- *     (68 chars) to slip under MAX_RAW, so nothing else was catching them.
- *
- * So: use this ONLY where the value is rendered and never matched on.
+ * The reductions this used to add are now in `humanWireError`, so every owner
+ * screen gets them rather than the two that happened to call this.
  */
 export function ownerDisplayError(e: unknown): string {
   if (isOwnerPreviewHost() && isBridgeUnavailable(e)) return ownerPreviewUnavailable();
-  const msg = String((e as Error)?.message ?? e);
-  const status = STATUS.exec(msg)?.[1];
-  if (JSON_BODY.test(msg) && status) {
-    return copyParam(
-      "ownerCommon.upstreamStatus",
-      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
-    );
-  }
-  return humanWireError(msg);
+  return humanWireError(String((e as Error)?.message ?? e));
 }
 
+/**
+ * The default. Reduces the same shapes as `ownerDisplayError`.
+ *
+ * It used to reduce LESS, on the stated grounds that its output is parsed
+ * downstream — "the products worker matches `CATALOG_V3_CALLING_CATALOG_V1_API`
+ * in it to choose its v1 fallback". **That was not true**, and it cost 17 owner
+ * screens their error copy: they printed `HTTP 428 [MISSING_METASITE_ID]: …`
+ * verbatim for a contract that does not exist.
+ *
+ * Checked before changing it, and worth recording so nobody restores the belief:
+ *
+ *  • the catalog v1/v3 decision is made INSIDE the Wix stores SDK, on the RAW
+ *    thrown error — its `catalogVersionFromMismatch` reads the error's own
+ *    `message`, and only that module calls it. It never sees this function's
+ *    output.
+ *  • `CATALOG_V3_CALLING_CATALOG_V1_API` appears nowhere else in the codebase
+ *    outside comments, tests and that one SDK module.
+ *  • the collection framework's `clearOnError` is handed the RAW error
+ *    (`error => /401|403|forbidden/i.test(String(error))`), separately from
+ *    `errorMessage: ownerLoadError` — so the one place that does match on a
+ *    failure is unaffected by what this returns.
+ *
+ * So: the raw error remains available to logic everywhere it was; this function's
+ * result is display copy, and now reads like it.
+ */
 export function ownerLoadError(e: unknown): string {
   const msg = String((e as Error)?.message ?? e);
   if (isBridgeUnavailable(e)) return ownerPreviewUnavailable();

package/templates/community-club/tier5-src/_shared/owner-load-error.ts

@@ -53,6 +53,17 @@ const HTML_BODY = /<!DOCTYPE html|<html[\s>]|<head[\s>]/i;
  *  "app":"…"}` — and it is short enough to slip under MAX_RAW, so truncation
  *  never caught it and the owner read the machine's word for it. */
 const JSON_BODY = /HTTP \d{3}:\s*[[{]/;
+/** `HTTP <status> [SERVICE_CODE]: message` — the shape a Wix service uses when
+ *  it refuses with a named reason. */
+const CODED = /HTTP (\d{3}) \[([A-Z0-9_]+)\]/;
+/**
+ * The codes that all mean one thing to an owner: the session cannot address this
+ * business. Found on a real session whose account did not own the business the app
+ * had persisted — Home rendered
+ * `HTTP 428 [MISSING_METASITE_ID]: Couldn't extract metasiteId from the request
+ * context` where "6 orders" belongs.
+ */
+const SITE_CONTEXT_CODES = ["MISSING_METASITE_ID", "MISSING_REQUEST_SITE_CONTEXT", "MISSING_SITE_CONTEXT"];
 /** Longest raw upstream text worth showing. Beyond this it stops being a
  *  message and starts being a payload dump. */
 const MAX_RAW = 200;
@@ -69,6 +80,29 @@ const MAX_RAW = 200;
  */
 function humanWireError(msg: string): string {
   const status = STATUS.exec(msg)?.[1];
+  // A JSON ENVELOPE or a NAMED REASON CODE is the machine's word for it, and the
+  // owner gets neither. Both reductions used to live in `ownerDisplayError` only,
+  // on the belief that this function's output was parsed downstream — see the note
+  // on `ownerLoadError`, which records why that was wrong and how it was checked.
+  if (JSON_BODY.test(msg) && status) {
+    return copyParam(
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
+    );
+  }
+  const coded = CODED.exec(msg);
+  if (coded) {
+    if (SITE_CONTEXT_CODES.includes(coded[2])) {
+      return copyParam(
+        "ownerCommon.noSiteContext",
+        "This business isn’t available to your Wix account right now. Switch business, or sign in again as its owner.",
+      );
+    }
+    return copyParam(
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${coded[1]}). Try again in a moment.`,
+    );
+  }
   if (HTML_BODY.test(msg)) {
     if (status === "403") {
       return copyParam(
@@ -101,36 +135,46 @@ export function ownerPreviewUnavailable(): string {
 /**
  * `ownerLoadError` for a screen that does nothing but RENDER the string.
  *
- * Two things the default cannot do, each for a reason:
- *
- *  1. It only names the web preview when there IS one. `isBridgeUnavailable`
- *     reads "not live" as "preview", and native injects no mode at all, so the
- *     default would answer a device-side `HTTP 503` with "open this app on a
- *     device" — on the device. That predicate is deliberately left alone:
- *     native write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
+ * One difference left, and it is about WHERE the app is rather than what the
+ * error says: this names the web preview when there IS one. `isBridgeUnavailable`
+ * reads "not live" as "preview", and native injects no mode at all, so the
+ * default would answer a device-side `HTTP 503` with "open this app on a device"
+ * — on the device. That predicate is deliberately left alone: native
+ * write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
  *
- *  2. It reduces a JSON ENVELOPE to its status. The default must NOT: its
- *     output is PARSED downstream — the products worker matches
- *     `CATALOG_V3_CALLING_CATALOG_V1_API` in it to choose its v1 fallback, and
- *     `owner-load-error.test.ts` pins that verbatim. A display-only caller has
- *     no such reader, and the bridge's typed refusals are JSON and short enough
- *     (68 chars) to slip under MAX_RAW, so nothing else was catching them.
- *
- * So: use this ONLY where the value is rendered and never matched on.
+ * The reductions this used to add are now in `humanWireError`, so every owner
+ * screen gets them rather than the two that happened to call this.
  */
 export function ownerDisplayError(e: unknown): string {
   if (isOwnerPreviewHost() && isBridgeUnavailable(e)) return ownerPreviewUnavailable();
-  const msg = String((e as Error)?.message ?? e);
-  const status = STATUS.exec(msg)?.[1];
-  if (JSON_BODY.test(msg) && status) {
-    return copyParam(
-      "ownerCommon.upstreamStatus",
-      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
-    );
-  }
-  return humanWireError(msg);
+  return humanWireError(String((e as Error)?.message ?? e));
 }
 
+/**
+ * The default. Reduces the same shapes as `ownerDisplayError`.
+ *
+ * It used to reduce LESS, on the stated grounds that its output is parsed
+ * downstream — "the products worker matches `CATALOG_V3_CALLING_CATALOG_V1_API`
+ * in it to choose its v1 fallback". **That was not true**, and it cost 17 owner
+ * screens their error copy: they printed `HTTP 428 [MISSING_METASITE_ID]: …`
+ * verbatim for a contract that does not exist.
+ *
+ * Checked before changing it, and worth recording so nobody restores the belief:
+ *
+ *  • the catalog v1/v3 decision is made INSIDE the Wix stores SDK, on the RAW
+ *    thrown error — its `catalogVersionFromMismatch` reads the error's own
+ *    `message`, and only that module calls it. It never sees this function's
+ *    output.
+ *  • `CATALOG_V3_CALLING_CATALOG_V1_API` appears nowhere else in the codebase
+ *    outside comments, tests and that one SDK module.
+ *  • the collection framework's `clearOnError` is handed the RAW error
+ *    (`error => /401|403|forbidden/i.test(String(error))`), separately from
+ *    `errorMessage: ownerLoadError` — so the one place that does match on a
+ *    failure is unaffected by what this returns.
+ *
+ * So: the raw error remains available to logic everywhere it was; this function's
+ * result is display copy, and now reads like it.
+ */
 export function ownerLoadError(e: unknown): string {
   const msg = String((e as Error)?.message ?? e);
   if (isBridgeUnavailable(e)) return ownerPreviewUnavailable();