@wix/himalaya-cli 0.945.0 → 0.947.0

package/dist/cli.mjs

@@ -55607,6 +55607,17 @@ var TERMINAL_DIST_STATUSES = /* @__PURE__ */ new Set([
   "BLOCKED",
   "STATUS_UNKNOWN"
 ]);
+function shellShaDivergenceWarnings(jobs) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const j of jobs) {
+    const release = typeof j.release === "string" ? j.release : void 0;
+    const built = typeof j.gitCommitSha === "string" ? j.gitCommitSha : void 0;
+    if (j.shellShaSource === "release" && release && built && release !== built) seen.set(release, built);
+  }
+  return [...seen].map(
+    ([release, built]) => `\u26A0 this build compiles the native shell at ${built.slice(0, 12)}, not release ${release.slice(0, 12)} \u2014 the release was pushed from a branch whose HEAD is not on the default branch, so the Mac pool checks out the nearest default-branch ancestor. A native-shell or tools/mobile-dist/** change on that branch is NOT in this binary even if the job reports SUCCESS; re-push from a checkout whose HEAD is on origin/master to validate it.`
+  );
+}
 function materializeForPreview(appDir2, slug, displayName) {
   if (!isTemplateSourceTree(appDir2)) return appDir2;
   const files = readTemplateFiles(appDir2);
@@ -59821,6 +59832,7 @@ ${label2}`);
           return 1;
         }
         const jobs = r.json?.jobs ?? [];
+        for (const line of shellShaDivergenceWarnings(jobs)) (flags.json === true ? io.error : io.log)(line);
         const noWait = flags["no-wait"] === true || flags.wait === false;
         if (noWait) {
           print({ status: r.status, ...r.json ?? {} });
@@ -60760,6 +60772,7 @@ export {
   serveUnreachableError,
   serveUnreachableHint,
   servesAll,
+  shellShaDivergenceWarnings,
   switchFlagErrors,
   templatePreviewAuthError,
   tokenCoversApp,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.945.0",
+  "version": "0.947.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -64,5 +64,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "7c47343c4a5027aabc50c963502aa5034b2828f8bf4e1e133fec1b94"
+  "falconPackageHash": "e6f6c45f77b9ba2728e1098c0c46b7d7eb3e6fb922394d52a0797dd7"
 }

package/templates/beauty-salon/tier5-src/_shared/owner-load-error.ts

@@ -53,6 +53,17 @@ const HTML_BODY = /<!DOCTYPE html|<html[\s>]|<head[\s>]/i;
  *  "app":"…"}` — and it is short enough to slip under MAX_RAW, so truncation
  *  never caught it and the owner read the machine's word for it. */
 const JSON_BODY = /HTTP \d{3}:\s*[[{]/;
+/** `HTTP <status> [SERVICE_CODE]: message` — the shape a Wix service uses when
+ *  it refuses with a named reason. */
+const CODED = /HTTP (\d{3}) \[([A-Z0-9_]+)\]/;
+/**
+ * The codes that all mean one thing to an owner: the session cannot address this
+ * business. Found on a real session whose account did not own the business the app
+ * had persisted — Home rendered
+ * `HTTP 428 [MISSING_METASITE_ID]: Couldn't extract metasiteId from the request
+ * context` where "6 orders" belongs.
+ */
+const SITE_CONTEXT_CODES = ["MISSING_METASITE_ID", "MISSING_REQUEST_SITE_CONTEXT", "MISSING_SITE_CONTEXT"];
 /** Longest raw upstream text worth showing. Beyond this it stops being a
  *  message and starts being a payload dump. */
 const MAX_RAW = 200;
@@ -69,6 +80,29 @@ const MAX_RAW = 200;
  */
 function humanWireError(msg: string): string {
   const status = STATUS.exec(msg)?.[1];
+  // A JSON ENVELOPE or a NAMED REASON CODE is the machine's word for it, and the
+  // owner gets neither. Both reductions used to live in `ownerDisplayError` only,
+  // on the belief that this function's output was parsed downstream — see the note
+  // on `ownerLoadError`, which records why that was wrong and how it was checked.
+  if (JSON_BODY.test(msg) && status) {
+    return copyParam(
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
+    );
+  }
+  const coded = CODED.exec(msg);
+  if (coded) {
+    if (SITE_CONTEXT_CODES.includes(coded[2])) {
+      return copyParam(
+        "ownerCommon.noSiteContext",
+        "This business isn’t available to your Wix account right now. Switch business, or sign in again as its owner.",
+      );
+    }
+    return copyParam(
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${coded[1]}). Try again in a moment.`,
+    );
+  }
   if (HTML_BODY.test(msg)) {
     if (status === "403") {
       return copyParam(
@@ -101,36 +135,46 @@ export function ownerPreviewUnavailable(): string {
 /**
  * `ownerLoadError` for a screen that does nothing but RENDER the string.
  *
- * Two things the default cannot do, each for a reason:
- *
- *  1. It only names the web preview when there IS one. `isBridgeUnavailable`
- *     reads "not live" as "preview", and native injects no mode at all, so the
- *     default would answer a device-side `HTTP 503` with "open this app on a
- *     device" — on the device. That predicate is deliberately left alone:
- *     native write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
+ * One difference left, and it is about WHERE the app is rather than what the
+ * error says: this names the web preview when there IS one. `isBridgeUnavailable`
+ * reads "not live" as "preview", and native injects no mode at all, so the
+ * default would answer a device-side `HTTP 503` with "open this app on a device"
+ * — on the device. That predicate is deliberately left alone: native
+ * write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
  *
- *  2. It reduces a JSON ENVELOPE to its status. The default must NOT: its
- *     output is PARSED downstream — the products worker matches
- *     `CATALOG_V3_CALLING_CATALOG_V1_API` in it to choose its v1 fallback, and
- *     `owner-load-error.test.ts` pins that verbatim. A display-only caller has
- *     no such reader, and the bridge's typed refusals are JSON and short enough
- *     (68 chars) to slip under MAX_RAW, so nothing else was catching them.
- *
- * So: use this ONLY where the value is rendered and never matched on.
+ * The reductions this used to add are now in `humanWireError`, so every owner
+ * screen gets them rather than the two that happened to call this.
  */
 export function ownerDisplayError(e: unknown): string {
   if (isOwnerPreviewHost() && isBridgeUnavailable(e)) return ownerPreviewUnavailable();
-  const msg = String((e as Error)?.message ?? e);
-  const status = STATUS.exec(msg)?.[1];
-  if (JSON_BODY.test(msg) && status) {
-    return copyParam(
-      "ownerCommon.upstreamStatus",
-      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
-    );
-  }
-  return humanWireError(msg);
+  return humanWireError(String((e as Error)?.message ?? e));
 }
 
+/**
+ * The default. Reduces the same shapes as `ownerDisplayError`.
+ *
+ * It used to reduce LESS, on the stated grounds that its output is parsed
+ * downstream — "the products worker matches `CATALOG_V3_CALLING_CATALOG_V1_API`
+ * in it to choose its v1 fallback". **That was not true**, and it cost 17 owner
+ * screens their error copy: they printed `HTTP 428 [MISSING_METASITE_ID]: …`
+ * verbatim for a contract that does not exist.
+ *
+ * Checked before changing it, and worth recording so nobody restores the belief:
+ *
+ *  • the catalog v1/v3 decision is made INSIDE the Wix stores SDK, on the RAW
+ *    thrown error — its `catalogVersionFromMismatch` reads the error's own
+ *    `message`, and only that module calls it. It never sees this function's
+ *    output.
+ *  • `CATALOG_V3_CALLING_CATALOG_V1_API` appears nowhere else in the codebase
+ *    outside comments, tests and that one SDK module.
+ *  • the collection framework's `clearOnError` is handed the RAW error
+ *    (`error => /401|403|forbidden/i.test(String(error))`), separately from
+ *    `errorMessage: ownerLoadError` — so the one place that does match on a
+ *    failure is unaffected by what this returns.
+ *
+ * So: the raw error remains available to logic everywhere it was; this function's
+ * result is display copy, and now reads like it.
+ */
 export function ownerLoadError(e: unknown): string {
   const msg = String((e as Error)?.message ?? e);
   if (isBridgeUnavailable(e)) return ownerPreviewUnavailable();

package/templates/beauty-salon-owner/tier5-src/_shared/owner-load-error.ts

@@ -53,6 +53,17 @@ const HTML_BODY = /<!DOCTYPE html|<html[\s>]|<head[\s>]/i;
  *  "app":"…"}` — and it is short enough to slip under MAX_RAW, so truncation
  *  never caught it and the owner read the machine's word for it. */
 const JSON_BODY = /HTTP \d{3}:\s*[[{]/;
+/** `HTTP <status> [SERVICE_CODE]: message` — the shape a Wix service uses when
+ *  it refuses with a named reason. */
+const CODED = /HTTP (\d{3}) \[([A-Z0-9_]+)\]/;
+/**
+ * The codes that all mean one thing to an owner: the session cannot address this
+ * business. Found on a real session whose account did not own the business the app
+ * had persisted — Home rendered
+ * `HTTP 428 [MISSING_METASITE_ID]: Couldn't extract metasiteId from the request
+ * context` where "6 orders" belongs.
+ */
+const SITE_CONTEXT_CODES = ["MISSING_METASITE_ID", "MISSING_REQUEST_SITE_CONTEXT", "MISSING_SITE_CONTEXT"];
 /** Longest raw upstream text worth showing. Beyond this it stops being a
  *  message and starts being a payload dump. */
 const MAX_RAW = 200;
@@ -69,6 +80,29 @@ const MAX_RAW = 200;
  */
 function humanWireError(msg: string): string {
   const status = STATUS.exec(msg)?.[1];
+  // A JSON ENVELOPE or a NAMED REASON CODE is the machine's word for it, and the
+  // owner gets neither. Both reductions used to live in `ownerDisplayError` only,
+  // on the belief that this function's output was parsed downstream — see the note
+  // on `ownerLoadError`, which records why that was wrong and how it was checked.
+  if (JSON_BODY.test(msg) && status) {
+    return copyParam(
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
+    );
+  }
+  const coded = CODED.exec(msg);
+  if (coded) {
+    if (SITE_CONTEXT_CODES.includes(coded[2])) {
+      return copyParam(
+        "ownerCommon.noSiteContext",
+        "This business isn’t available to your Wix account right now. Switch business, or sign in again as its owner.",
+      );
+    }
+    return copyParam(
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${coded[1]}). Try again in a moment.`,
+    );
+  }
   if (HTML_BODY.test(msg)) {
     if (status === "403") {
       return copyParam(
@@ -101,36 +135,46 @@ export function ownerPreviewUnavailable(): string {
 /**
  * `ownerLoadError` for a screen that does nothing but RENDER the string.
  *
- * Two things the default cannot do, each for a reason:
- *
- *  1. It only names the web preview when there IS one. `isBridgeUnavailable`
- *     reads "not live" as "preview", and native injects no mode at all, so the
- *     default would answer a device-side `HTTP 503` with "open this app on a
- *     device" — on the device. That predicate is deliberately left alone:
- *     native write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
+ * One difference left, and it is about WHERE the app is rather than what the
+ * error says: this names the web preview when there IS one. `isBridgeUnavailable`
+ * reads "not live" as "preview", and native injects no mode at all, so the
+ * default would answer a device-side `HTTP 503` with "open this app on a device"
+ * — on the device. That predicate is deliberately left alone: native
+ * write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
  *
- *  2. It reduces a JSON ENVELOPE to its status. The default must NOT: its
- *     output is PARSED downstream — the products worker matches
- *     `CATALOG_V3_CALLING_CATALOG_V1_API` in it to choose its v1 fallback, and
- *     `owner-load-error.test.ts` pins that verbatim. A display-only caller has
- *     no such reader, and the bridge's typed refusals are JSON and short enough
- *     (68 chars) to slip under MAX_RAW, so nothing else was catching them.
- *
- * So: use this ONLY where the value is rendered and never matched on.
+ * The reductions this used to add are now in `humanWireError`, so every owner
+ * screen gets them rather than the two that happened to call this.
  */
 export function ownerDisplayError(e: unknown): string {
   if (isOwnerPreviewHost() && isBridgeUnavailable(e)) return ownerPreviewUnavailable();
-  const msg = String((e as Error)?.message ?? e);
-  const status = STATUS.exec(msg)?.[1];
-  if (JSON_BODY.test(msg) && status) {
-    return copyParam(
-      "ownerCommon.upstreamStatus",
-      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
-    );
-  }
-  return humanWireError(msg);
+  return humanWireError(String((e as Error)?.message ?? e));
 }
 
+/**
+ * The default. Reduces the same shapes as `ownerDisplayError`.
+ *
+ * It used to reduce LESS, on the stated grounds that its output is parsed
+ * downstream — "the products worker matches `CATALOG_V3_CALLING_CATALOG_V1_API`
+ * in it to choose its v1 fallback". **That was not true**, and it cost 17 owner
+ * screens their error copy: they printed `HTTP 428 [MISSING_METASITE_ID]: …`
+ * verbatim for a contract that does not exist.
+ *
+ * Checked before changing it, and worth recording so nobody restores the belief:
+ *
+ *  • the catalog v1/v3 decision is made INSIDE the Wix stores SDK, on the RAW
+ *    thrown error — its `catalogVersionFromMismatch` reads the error's own
+ *    `message`, and only that module calls it. It never sees this function's
+ *    output.
+ *  • `CATALOG_V3_CALLING_CATALOG_V1_API` appears nowhere else in the codebase
+ *    outside comments, tests and that one SDK module.
+ *  • the collection framework's `clearOnError` is handed the RAW error
+ *    (`error => /401|403|forbidden/i.test(String(error))`), separately from
+ *    `errorMessage: ownerLoadError` — so the one place that does match on a
+ *    failure is unaffected by what this returns.
+ *
+ * So: the raw error remains available to logic everywhere it was; this function's
+ * result is display copy, and now reads like it.
+ */
 export function ownerLoadError(e: unknown): string {
   const msg = String((e as Error)?.message ?? e);
   if (isBridgeUnavailable(e)) return ownerPreviewUnavailable();

package/templates/beauty-salon-owner/tier5-src/himi-owner-lite-home/index.ts

@@ -13,7 +13,11 @@ import { queryMembers } from "@himalaya/wix-members";
 import { queryReviews } from "@himalaya/wix-reviews";
 import { queryReservations } from "@himalaya/wix-table-reservations";
 import { getSiteAnalytics, getSiteTimeZone, localDateRange, localDateOf, localMidnightUtc } from "@himalaya/wix-analytics";
-import { ownerLoadError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
+// `ownerDisplayError`, not `ownerLoadError`: every string below is bound into a
+// `text(...)` and never matched on — the RAW reason is kept beside it in
+// `<part>Reason` for anything that needs it — so the display-only reduction is
+// both safe here and the reason a 428 reason code stopped reaching the owner.
+import { ownerDisplayError, isBridgeUnavailable, isOwnerPreviewDemo } from "../_shared/owner-load-error.js";
 import { DEMO_DASHBOARD, DEMO_NOTE, DEMO_TODAY } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam, copyTemplate } from "../_shared/himi-copy.js";
 import { formatCurrency } from "../_shared/engine-intl.js";
@@ -566,7 +570,7 @@ async function loadSource(source: HomeSourceId, parts = sourceParts(source)): Pr
     const item = settled[index];
     if (item.status === "fulfilled") result[part] = item.value.payload;
     else {
-      result[`${part}Error`] = ownerLoadError(item.reason);
+      result[`${part}Error`] = ownerDisplayError(item.reason);
       result[`${part}Reason`] = item.reason;
     }
   }
@@ -798,7 +802,7 @@ async function loadDashboard(s: HomeState, sources: HomeSourceId[]): Promise<Hom
     if (failedReasons.length > 0 && failedReasons.every((reason) => isBridgeUnavailable(reason))) {
       return demoDashboard(shape({ ...s, sourceStates: [], sourceFailures: [] }));
     }
-    return shape({ ...composeState(), status: "error", error: ownerLoadError(failedReasons[0]) });
+    return shape({ ...composeState(), status: "error", error: ownerDisplayError(failedReasons[0]) });
   }
   return filteredSchedule(composeState(), activeScheduleFilter);
 }

package/templates/branded-lite/tier5-src/_shared/owner-load-error.ts

@@ -53,6 +53,17 @@ const HTML_BODY = /<!DOCTYPE html|<html[\s>]|<head[\s>]/i;
  *  "app":"…"}` — and it is short enough to slip under MAX_RAW, so truncation
  *  never caught it and the owner read the machine's word for it. */
 const JSON_BODY = /HTTP \d{3}:\s*[[{]/;
+/** `HTTP <status> [SERVICE_CODE]: message` — the shape a Wix service uses when
+ *  it refuses with a named reason. */
+const CODED = /HTTP (\d{3}) \[([A-Z0-9_]+)\]/;
+/**
+ * The codes that all mean one thing to an owner: the session cannot address this
+ * business. Found on a real session whose account did not own the business the app
+ * had persisted — Home rendered
+ * `HTTP 428 [MISSING_METASITE_ID]: Couldn't extract metasiteId from the request
+ * context` where "6 orders" belongs.
+ */
+const SITE_CONTEXT_CODES = ["MISSING_METASITE_ID", "MISSING_REQUEST_SITE_CONTEXT", "MISSING_SITE_CONTEXT"];
 /** Longest raw upstream text worth showing. Beyond this it stops being a
  *  message and starts being a payload dump. */
 const MAX_RAW = 200;
@@ -69,6 +80,29 @@ const MAX_RAW = 200;
  */
 function humanWireError(msg: string): string {
   const status = STATUS.exec(msg)?.[1];
+  // A JSON ENVELOPE or a NAMED REASON CODE is the machine's word for it, and the
+  // owner gets neither. Both reductions used to live in `ownerDisplayError` only,
+  // on the belief that this function's output was parsed downstream — see the note
+  // on `ownerLoadError`, which records why that was wrong and how it was checked.
+  if (JSON_BODY.test(msg) && status) {
+    return copyParam(
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
+    );
+  }
+  const coded = CODED.exec(msg);
+  if (coded) {
+    if (SITE_CONTEXT_CODES.includes(coded[2])) {
+      return copyParam(
+        "ownerCommon.noSiteContext",
+        "This business isn’t available to your Wix account right now. Switch business, or sign in again as its owner.",
+      );
+    }
+    return copyParam(
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${coded[1]}). Try again in a moment.`,
+    );
+  }
   if (HTML_BODY.test(msg)) {
     if (status === "403") {
       return copyParam(
@@ -101,36 +135,46 @@ export function ownerPreviewUnavailable(): string {
 /**
  * `ownerLoadError` for a screen that does nothing but RENDER the string.
  *
- * Two things the default cannot do, each for a reason:
- *
- *  1. It only names the web preview when there IS one. `isBridgeUnavailable`
- *     reads "not live" as "preview", and native injects no mode at all, so the
- *     default would answer a device-side `HTTP 503` with "open this app on a
- *     device" — on the device. That predicate is deliberately left alone:
- *     native write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
+ * One difference left, and it is about WHERE the app is rather than what the
+ * error says: this names the web preview when there IS one. `isBridgeUnavailable`
+ * reads "not live" as "preview", and native injects no mode at all, so the
+ * default would answer a device-side `HTTP 503` with "open this app on a device"
+ * — on the device. That predicate is deliberately left alone: native
+ * write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
  *
- *  2. It reduces a JSON ENVELOPE to its status. The default must NOT: its
- *     output is PARSED downstream — the products worker matches
- *     `CATALOG_V3_CALLING_CATALOG_V1_API` in it to choose its v1 fallback, and
- *     `owner-load-error.test.ts` pins that verbatim. A display-only caller has
- *     no such reader, and the bridge's typed refusals are JSON and short enough
- *     (68 chars) to slip under MAX_RAW, so nothing else was catching them.
- *
- * So: use this ONLY where the value is rendered and never matched on.
+ * The reductions this used to add are now in `humanWireError`, so every owner
+ * screen gets them rather than the two that happened to call this.
  */
 export function ownerDisplayError(e: unknown): string {
   if (isOwnerPreviewHost() && isBridgeUnavailable(e)) return ownerPreviewUnavailable();
-  const msg = String((e as Error)?.message ?? e);
-  const status = STATUS.exec(msg)?.[1];
-  if (JSON_BODY.test(msg) && status) {
-    return copyParam(
-      "ownerCommon.upstreamStatus",
-      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
-    );
-  }
-  return humanWireError(msg);
+  return humanWireError(String((e as Error)?.message ?? e));
 }
 
+/**
+ * The default. Reduces the same shapes as `ownerDisplayError`.
+ *
+ * It used to reduce LESS, on the stated grounds that its output is parsed
+ * downstream — "the products worker matches `CATALOG_V3_CALLING_CATALOG_V1_API`
+ * in it to choose its v1 fallback". **That was not true**, and it cost 17 owner
+ * screens their error copy: they printed `HTTP 428 [MISSING_METASITE_ID]: …`
+ * verbatim for a contract that does not exist.
+ *
+ * Checked before changing it, and worth recording so nobody restores the belief:
+ *
+ *  • the catalog v1/v3 decision is made INSIDE the Wix stores SDK, on the RAW
+ *    thrown error — its `catalogVersionFromMismatch` reads the error's own
+ *    `message`, and only that module calls it. It never sees this function's
+ *    output.
+ *  • `CATALOG_V3_CALLING_CATALOG_V1_API` appears nowhere else in the codebase
+ *    outside comments, tests and that one SDK module.
+ *  • the collection framework's `clearOnError` is handed the RAW error
+ *    (`error => /401|403|forbidden/i.test(String(error))`), separately from
+ *    `errorMessage: ownerLoadError` — so the one place that does match on a
+ *    failure is unaffected by what this returns.
+ *
+ * So: the raw error remains available to logic everywhere it was; this function's
+ * result is display copy, and now reads like it.
+ */
 export function ownerLoadError(e: unknown): string {
   const msg = String((e as Error)?.message ?? e);
   if (isBridgeUnavailable(e)) return ownerPreviewUnavailable();

package/templates/community-club/tier5-src/_shared/owner-load-error.ts

@@ -53,6 +53,17 @@ const HTML_BODY = /<!DOCTYPE html|<html[\s>]|<head[\s>]/i;
  *  "app":"…"}` — and it is short enough to slip under MAX_RAW, so truncation
  *  never caught it and the owner read the machine's word for it. */
 const JSON_BODY = /HTTP \d{3}:\s*[[{]/;
+/** `HTTP <status> [SERVICE_CODE]: message` — the shape a Wix service uses when
+ *  it refuses with a named reason. */
+const CODED = /HTTP (\d{3}) \[([A-Z0-9_]+)\]/;
+/**
+ * The codes that all mean one thing to an owner: the session cannot address this
+ * business. Found on a real session whose account did not own the business the app
+ * had persisted — Home rendered
+ * `HTTP 428 [MISSING_METASITE_ID]: Couldn't extract metasiteId from the request
+ * context` where "6 orders" belongs.
+ */
+const SITE_CONTEXT_CODES = ["MISSING_METASITE_ID", "MISSING_REQUEST_SITE_CONTEXT", "MISSING_SITE_CONTEXT"];
 /** Longest raw upstream text worth showing. Beyond this it stops being a
  *  message and starts being a payload dump. */
 const MAX_RAW = 200;
@@ -69,6 +80,29 @@ const MAX_RAW = 200;
  */
 function humanWireError(msg: string): string {
   const status = STATUS.exec(msg)?.[1];
+  // A JSON ENVELOPE or a NAMED REASON CODE is the machine's word for it, and the
+  // owner gets neither. Both reductions used to live in `ownerDisplayError` only,
+  // on the belief that this function's output was parsed downstream — see the note
+  // on `ownerLoadError`, which records why that was wrong and how it was checked.
+  if (JSON_BODY.test(msg) && status) {
+    return copyParam(
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
+    );
+  }
+  const coded = CODED.exec(msg);
+  if (coded) {
+    if (SITE_CONTEXT_CODES.includes(coded[2])) {
+      return copyParam(
+        "ownerCommon.noSiteContext",
+        "This business isn’t available to your Wix account right now. Switch business, or sign in again as its owner.",
+      );
+    }
+    return copyParam(
+      "ownerCommon.upstreamStatus",
+      `Wix returned an error (HTTP ${coded[1]}). Try again in a moment.`,
+    );
+  }
   if (HTML_BODY.test(msg)) {
     if (status === "403") {
       return copyParam(
@@ -101,36 +135,46 @@ export function ownerPreviewUnavailable(): string {
 /**
  * `ownerLoadError` for a screen that does nothing but RENDER the string.
  *
- * Two things the default cannot do, each for a reason:
- *
- *  1. It only names the web preview when there IS one. `isBridgeUnavailable`
- *     reads "not live" as "preview", and native injects no mode at all, so the
- *     default would answer a device-side `HTTP 503` with "open this app on a
- *     device" — on the device. That predicate is deliberately left alone:
- *     native write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
+ * One difference left, and it is about WHERE the app is rather than what the
+ * error says: this names the web preview when there IS one. `isBridgeUnavailable`
+ * reads "not live" as "preview", and native injects no mode at all, so the
+ * default would answer a device-side `HTTP 503` with "open this app on a device"
+ * — on the device. That predicate is deliberately left alone: native
+ * write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
  *
- *  2. It reduces a JSON ENVELOPE to its status. The default must NOT: its
- *     output is PARSED downstream — the products worker matches
- *     `CATALOG_V3_CALLING_CATALOG_V1_API` in it to choose its v1 fallback, and
- *     `owner-load-error.test.ts` pins that verbatim. A display-only caller has
- *     no such reader, and the bridge's typed refusals are JSON and short enough
- *     (68 chars) to slip under MAX_RAW, so nothing else was catching them.
- *
- * So: use this ONLY where the value is rendered and never matched on.
+ * The reductions this used to add are now in `humanWireError`, so every owner
+ * screen gets them rather than the two that happened to call this.
  */
 export function ownerDisplayError(e: unknown): string {
   if (isOwnerPreviewHost() && isBridgeUnavailable(e)) return ownerPreviewUnavailable();
-  const msg = String((e as Error)?.message ?? e);
-  const status = STATUS.exec(msg)?.[1];
-  if (JSON_BODY.test(msg) && status) {
-    return copyParam(
-      "ownerCommon.upstreamStatus",
-      `Wix returned an error (HTTP ${status}). Try again in a moment.`,
-    );
-  }
-  return humanWireError(msg);
+  return humanWireError(String((e as Error)?.message ?? e));
 }
 
+/**
+ * The default. Reduces the same shapes as `ownerDisplayError`.
+ *
+ * It used to reduce LESS, on the stated grounds that its output is parsed
+ * downstream — "the products worker matches `CATALOG_V3_CALLING_CATALOG_V1_API`
+ * in it to choose its v1 fallback". **That was not true**, and it cost 17 owner
+ * screens their error copy: they printed `HTTP 428 [MISSING_METASITE_ID]: …`
+ * verbatim for a contract that does not exist.
+ *
+ * Checked before changing it, and worth recording so nobody restores the belief:
+ *
+ *  • the catalog v1/v3 decision is made INSIDE the Wix stores SDK, on the RAW
+ *    thrown error — its `catalogVersionFromMismatch` reads the error's own
+ *    `message`, and only that module calls it. It never sees this function's
+ *    output.
+ *  • `CATALOG_V3_CALLING_CATALOG_V1_API` appears nowhere else in the codebase
+ *    outside comments, tests and that one SDK module.
+ *  • the collection framework's `clearOnError` is handed the RAW error
+ *    (`error => /401|403|forbidden/i.test(String(error))`), separately from
+ *    `errorMessage: ownerLoadError` — so the one place that does match on a
+ *    failure is unaffected by what this returns.
+ *
+ * So: the raw error remains available to logic everywhere it was; this function's
+ * result is display copy, and now reads like it.
+ */
 export function ownerLoadError(e: unknown): string {
   const msg = String((e as Error)?.message ?? e);
   if (isBridgeUnavailable(e)) return ownerPreviewUnavailable();