@wix/himalaya-cli 0.1323.0 → 0.1325.0

package/guides/wix-api-usage.md

@@ -239,6 +239,11 @@ don't retry it):
 | Members Area profile of the *current* signed-in member | member only | — |
 | `site-properties/v4` — business name, address, logo, **display currency** | ❌ 403 | ✅ |
 | Site analytics totals, owner dashboards, CRM contacts | ❌ 403 | ✅ |
+| Social Groups browse/read (`queryGroups`, `getGroup`) (`@himalaya/wix-groups`) | ✅ visitor-readable, no sign-in needed | — |
+| Social Groups feed read (`listFeedItems`), member list (`queryMembers`), join/leave/post/react (`@himalaya/wix-groups`, `@himalaya/wix-social-feed`) | member session verified; whether a signed-out visitor can read a PUBLIC group's feed/member list is unconfirmed — needsLiveProbe | — |
+| Social Groups `createGroup` (`@himalaya/wix-groups`) — **CONFIRMED** (reproduced against a real site, 2026-10-07) | ❌ 403, even for the site owner's own member-login session | ✅ owner/admin-scoped API token only — no member-side workaround |
+| Social Groups `updateGroup`/`deleteGroup` (`@himalaya/wix-groups`) — same write-class as `createGroup`, VERY LIKELY the same gating, but not independently re-tested this round | ❌ 403 (unconfirmed — needsLiveProbe) | ✅ owner/admin-scoped API token (unconfirmed — needsLiveProbe) |
+| Social Groups moderation (join-request approve/reject, role assign/unassign, member removal) — documented as gated by in-group admin/manager ROLE, not independently confirmed | member session with the group's admin role (unverified) | — |
 
 When a value you need is owner-scoped, prefer a field the record already carries (e.g. price `amount` +
 `currency`, below) over an owner-only read that a visitor app can't make.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1323.0",
+  "version": "0.1325.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "cf21fad745ba30d4d9e15cc0503484ec0fd4367e51ef29a2d7622ed6"
+  "falconPackageHash": "59d136e19e06159bf0072aeaadce11576db7a226a5eef4c05f2d9023"
 }

package/templates/beauty-salon/config.ts

@@ -37,7 +37,7 @@ export default defineApp({
     actions: "http://localhost:8190/v1/actions",
     sync: "http://localhost:8190/v1/sync",
   },
-  capabilities: ["live_activity","push","share","secure_storage","open_url","calendar","local_database","wix_api","wix_platform","app_info","release_control","clipboard"],
+  capabilities: ["live_activity","push","share","secure_storage","open_url","calendar","local_database","wix_api","wix_platform","app_info","iap","release_control","clipboard"],
   designTokensPath: "./tokens.json",
   navigation: {
     "navKind": "responsive",

package/templates/beauty-salon/dev/index.ts

@@ -2384,7 +2384,9 @@ const SCREENS = runtimeSetting({
       "integrity": "",
       "contentType": "application/javascript+ts-bundle",
       "declaredCapabilities": [
-        "wix_api"
+        "wix_api",
+        "iap",
+        "app_info"
       ],
       "minBinaryVersion": "0.2.0",
       "bundleVersion": "0.0.1"
@@ -7875,7 +7877,9 @@ const SCREENS = runtimeSetting({
       "contentType": "application/javascript+ts-bundle",
       "declaredCapabilities": [
         "wix_api",
-        "local_database"
+        "local_database",
+        "iap",
+        "app_info"
       ],
       "minBinaryVersion": "0.1.0",
       "bundleVersion": "0.0.1"
@@ -8343,7 +8347,11 @@ const SCREENS = runtimeSetting({
       "url": "http://localhost:8190/v1/bundles/himi-store-saved",
       "integrity": "",
       "contentType": "application/javascript+ts-bundle",
-      "declaredCapabilities": [],
+      "declaredCapabilities": [
+        "wix_api",
+        "iap",
+        "app_info"
+      ],
       "minBinaryVersion": "0.1.0",
       "bundleVersion": "0.0.1"
     }
@@ -9869,7 +9877,9 @@ const SCREENS = runtimeSetting({
         "wix_cashier",
         "open_url",
         "local_database",
-        "wix_platform"
+        "wix_platform",
+        "iap",
+        "app_info"
       ],
       "minBinaryVersion": "0.1.0",
       "bundleVersion": "0.0.1"
@@ -18904,7 +18914,8 @@ const SCREENS = runtimeSetting({
                                                 "package": "himalaya",
                                                 "type": "Button",
                                                 "props": {
-                                                  "title": "Join on website",
+                                                  "title": "$item.joinLabel",
+                                                  "disabledPath": "$item.joinDisabled",
                                                   "style": "primary",
                                                   "fullWidth": true,
                                                   "action": {
@@ -18925,7 +18936,8 @@ const SCREENS = runtimeSetting({
                                                 "package": "himalaya",
                                                 "type": "Button",
                                                 "props": {
-                                                  "title": "Join on website",
+                                                  "title": "$item.joinLabel",
+                                                  "disabledPath": "$item.joinDisabled",
                                                   "style": "secondary",
                                                   "fullWidth": true,
                                                   "action": {
@@ -19106,7 +19118,8 @@ const SCREENS = runtimeSetting({
                                                         "package": "himalaya",
                                                         "type": "Button",
                                                         "props": {
-                                                          "title": "Join on website",
+                                                          "title": "$item.joinLabel",
+                                                          "disabledPath": "$item.joinDisabled",
                                                           "style": "primary",
                                                           "fullWidth": true,
                                                           "action": {
@@ -19127,7 +19140,8 @@ const SCREENS = runtimeSetting({
                                                         "package": "himalaya",
                                                         "type": "Button",
                                                         "props": {
-                                                          "title": "Join on website",
+                                                          "title": "$item.joinLabel",
+                                                          "disabledPath": "$item.joinDisabled",
                                                           "style": "secondary",
                                                           "fullWidth": true,
                                                           "action": {
@@ -19532,7 +19546,8 @@ const SCREENS = runtimeSetting({
                                                 "package": "himalaya",
                                                 "type": "Button",
                                                 "props": {
-                                                  "title": "Join on website",
+                                                  "title": "$item.joinLabel",
+                                                  "disabledPath": "$item.joinDisabled",
                                                   "style": "primary",
                                                   "fullWidth": true,
                                                   "action": {
@@ -19553,7 +19568,8 @@ const SCREENS = runtimeSetting({
                                                 "package": "himalaya",
                                                 "type": "Button",
                                                 "props": {
-                                                  "title": "Join on website",
+                                                  "title": "$item.joinLabel",
+                                                  "disabledPath": "$item.joinDisabled",
                                                   "style": "secondary",
                                                   "fullWidth": true,
                                                   "action": {
@@ -19734,7 +19750,8 @@ const SCREENS = runtimeSetting({
                                                         "package": "himalaya",
                                                         "type": "Button",
                                                         "props": {
-                                                          "title": "Join on website",
+                                                          "title": "$item.joinLabel",
+                                                          "disabledPath": "$item.joinDisabled",
                                                           "style": "primary",
                                                           "fullWidth": true,
                                                           "action": {
@@ -19755,7 +19772,8 @@ const SCREENS = runtimeSetting({
                                                         "package": "himalaya",
                                                         "type": "Button",
                                                         "props": {
-                                                          "title": "Join on website",
+                                                          "title": "$item.joinLabel",
+                                                          "disabledPath": "$item.joinDisabled",
                                                           "style": "secondary",
                                                           "fullWidth": true,
                                                           "action": {
@@ -20333,7 +20351,8 @@ const SCREENS = runtimeSetting({
                                               "package": "himalaya",
                                               "type": "Button",
                                               "props": {
-                                                "title": "Join on website",
+                                                "title": "$item.joinLabel",
+                                                "disabledPath": "$item.joinDisabled",
                                                 "style": "primary",
                                                 "fullWidth": true,
                                                 "action": {
@@ -20354,7 +20373,8 @@ const SCREENS = runtimeSetting({
                                               "package": "himalaya",
                                               "type": "Button",
                                               "props": {
-                                                "title": "Join on website",
+                                                "title": "$item.joinLabel",
+                                                "disabledPath": "$item.joinDisabled",
                                                 "style": "secondary",
                                                 "fullWidth": true,
                                                 "action": {
@@ -20632,7 +20652,9 @@ const SCREENS = runtimeSetting({
         "wix_api",
         "wix_cashier",
         "open_url",
-        "wix_platform"
+        "wix_platform",
+        "iap",
+        "app_info"
       ],
       "minBinaryVersion": "0.1.0",
       "bundleVersion": "0.0.1"
@@ -20888,7 +20910,9 @@ const SCREENS = runtimeSetting({
       "integrity": "",
       "contentType": "application/javascript+ts-bundle",
       "declaredCapabilities": [
-        "wix_api"
+        "wix_api",
+        "iap",
+        "app_info"
       ],
       "minBinaryVersion": "0.1.0",
       "bundleVersion": "0.0.1"
@@ -25683,7 +25707,9 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
       "declaredCapabilities": [
         "wix_api",
         "local_database",
-        "live_activity"
+        "live_activity",
+        "iap",
+        "app_info"
       ],
       "minBinaryVersion": "0.1.0",
       "bundleVersion": "0.0.1"
@@ -26565,7 +26591,9 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
         "wix_api",
         "share",
         "local_database",
-        "open_url"
+        "open_url",
+        "iap",
+        "app_info"
       ],
       "minBinaryVersion": "0.1.0",
       "bundleVersion": "0.0.1"

package/templates/beauty-salon/tier5-src/_shared/collection-contract.ts

@@ -87,7 +87,7 @@ export const COLLECTIONS: Record<string, CollectionConfig> = {
   himiBrandedOrders: { rows: 'rows', title: 'title', subtitle: 'subtitle', view: 'list', backendQuery: true,
     searchPlaceholder: 'Search by order number', countNoun: ['order', 'orders'], filterValues: ['Not fulfilled', 'Partially fulfilled', 'Fulfilled'],
     sortLabels: { default: 'Newest', az: 'Oldest', za: 'Order # ↓' } },
-  himiBrandedPlans: { rows: 'rows', title: 'name', subtitle: 'description', metadata: ['badge', 'priceLine', 'periodLine', 'trialBadge', 'perk1', 'perk2', 'perk3'], view: 'grid', gridColumns: 1, metaMaxLines: 8, countNoun: ['plan', 'plans'] },
+  himiBrandedPlans: { rows: 'rows', title: 'name', subtitle: 'description', metadata: ['badge', 'priceLine', 'periodLine', 'trialBadge', 'perk1', 'perk2', 'perk3', 'joinNote'], view: 'grid', gridColumns: 1, metaMaxLines: 8, countNoun: ['plan', 'plans'] },
   himiBrandedPrograms: { rows: 'rows', title: 'name', subtitle: 'description', image: 'image', view: 'grid' },
   himiBrandedCoupons: { rows: 'coupons', title: 'name', subtitle: 'subtitle', view: 'list', primaryVerb: { label: 'Get code' } },
   himiBrandedNotifications: { rows: 'items', title: 'name', subtitle: 'subtitle', image: 'photo', metadata: ['unreadDot'], view: 'list' },

package/templates/beauty-salon/tier5-src/_shared/collection-service.ts

@@ -323,6 +323,7 @@ export function decorateCollection(name: string, def: { state: State; actions?:
 /** Domain-owned page source with shared query controls. Publishing uses a normal
  * reducer and reads the private controller snapshot, never an SDUI payload. */
 export function defineBackendCollection<S extends object, Row extends object>(name: string, options: {
+  register?: typeof register;
   /** Revalidate already opened pages on navigation return; explicit refresh resets. */
   restorePagesOnLoad?: boolean;
   /** The load action's argument (onAppear params beyond `copy`), before the query runs — for a
@@ -342,7 +343,7 @@ export function defineBackendCollection<S extends object, Row extends object>(na
     controller: controller as unknown as BackendCollection['controller'],
     apply: (state, page) => options.apply(state as S, page as unknown as CollectionQueryState<Row>) as State,
   });
-  const handle = register(name, definition);
+  const handle = (options.register ?? register)(name, definition);
   publish = () => handle.collectionDataChanged();
   return handle;
 }
@@ -350,7 +351,7 @@ export function defineBackendCollection<S extends object, Row extends object>(na
 /** Keep the domain service's existing TypeScript API. Extra collection verbs are
  * dispatched through SDUI and do not widen the native capability surface. */
 export const defineService: typeof register = ((name: string, def: ServiceDefinition<unknown>) =>
-  register(name, decorateCollection(name, def as unknown as { state: State; actions?: Record<string, Reducer> }))) as typeof register;
+  register(name, { ...def, ...decorateCollection(name, def as unknown as { state: State; actions?: Record<string, Reducer> }) } as ServiceDefinition<State>)) as typeof register;
 
 /** Domains can supply their existing saved-items store without putting domain
  * data or mutations in the shared collection layer. */

package/templates/beauty-salon/tier5-src/_shared/himi-store-collection.ts

@@ -8,7 +8,7 @@ export const storeCollectionSaving: CollectionSaving = {
     for (const row of rows) {
       if (typeof row.id !== 'string' || typeof row.name !== 'string') continue;
       products.set(row.id, { id: row.id, name: row.name,
-        price: typeof row.subtitle === 'string' ? row.subtitle : '',
+        price: typeof row.commercePrice === 'string' ? row.commercePrice : typeof row.subtitle === 'string' ? row.subtitle : '',
         image: typeof row.image === 'string' ? row.image : '' });
     }
     const selected = ids.map(id => products.get(id));

package/templates/beauty-salon/tier5-src/_shared/home-service.ts

@@ -87,4 +87,5 @@ export function decorateHome(def: { state: State; actions?: Record<string, Actio
   actions.homeMoveDown = change(id => { const index = prefs.order.indexOf(id); if (index >= 0 && index < prefs.order.length - 1) [prefs.order[index], prefs.order[index + 1]] = [prefs.order[index + 1], prefs.order[index]]; });
   return { state: derive(def.state), actions };
 }
-export const defineService: typeof register = ((name: string, def: ServiceDefinition<unknown>) => register(name, decorateHome(def as unknown as { state: State; actions?: Record<string, Action> }))) as typeof register;
+export const defineService: typeof register = ((name: string, def: ServiceDefinition<unknown>) =>
+  register(name, { ...def, ...decorateHome(def as unknown as { state: State; actions?: Record<string, Action> }) })) as typeof register;

package/templates/beauty-salon/tier5-src/_shared/iap-presentation.ts

@@ -0,0 +1,53 @@
+import { defineService, type ServiceDefinition } from "@himalaya/state";
+import { createIapCommerce, type IapCommerce } from "@himalaya/iap-checkout";
+import { iapPriceFields, type IapCatalogItem } from "@himalaya/iap";
+import { iapPriceCopy, resetUnhydratedKeysOnOlderRuntime } from "./iap-worker.js";
+
+// Presentation only. Checkout, mapping, cache, session and refresh policy stay in the shared flow.
+export function withIapPresentation<S extends object>(options: {
+  register?: typeof defineService;
+  onCreate?(commerce: IapCommerce): void;
+  onContent?(state: S): void;
+  items(state: S): IapCatalogItem[];
+  present(state: S, price: (id: string, commercePrice?: string) => string, allowed: (id: string) => boolean): S;
+  contentActions: string[];
+  transientKeys: (keyof S & string)[];
+  prefix: string;
+}): typeof defineService {
+  return ((name: string, definition: ServiceDefinition<S>) => {
+    const commerce = createIapCommerce({ onChange: () => { void service.iapPublish(); } });
+    options.onCreate?.(commerce);
+    let items: IapCatalogItem[] = [];
+    let contentVersion = 0;
+    const project = (state: S): S => {
+      const price = (id: string, commercePrice?: string) => {
+        const item = items.find(item => item.reference.id === id);
+        if (!item) return "";
+        const view = commerce.pricing.view(item.reference);
+        return view.route === "disabled" || view.route === "regular" ? commercePrice ?? item.commerceDisplayPrice ?? "" : iapPriceFields(view, iapPriceCopy(options.prefix)).priceText;
+      };
+      const allowed = (id: string) => commerce.pricing.checkoutGuard({ kind: "storesProduct", id }).allowed;
+      const poll = commerce.pollDirective(`${name}.iapPoll`);
+      return { ...options.present(state, price, allowed), ...(poll ? { _poll: poll } : {}) };
+    };
+    const actions = Object.fromEntries(Object.entries(definition.actions ?? {}).map(([action, reduce]) => [action, async (state: S, ...args: never[]) => {
+      const content = options.contentActions.includes(action);
+      const version = action === "load" ? ++contentVersion : contentVersion;
+      const next = await reduce(state, ...args);
+      if (!next || (content && version !== contentVersion)) return undefined;
+      if (content) {
+        options.onContent?.(next);
+        items = options.items(next);
+        void commerce.loadPrices(items);
+      }
+      return project(next);
+    }]));
+    const service = (options.register ?? defineService)(name, {
+      ...definition, notHydrated: [...(definition.notHydrated ?? []), ...options.transientKeys],
+      actions: { ...actions, iapPublish: project, iapPoll: async () => { await commerce.poll(); return undefined; },
+        iapRefresh: async () => { await commerce.loadPrices(items); return undefined; } },
+    });
+    resetUnhydratedKeysOnOlderRuntime(service, definition.state, options.transientKeys);
+    return service;
+  }) as unknown as typeof defineService;
+}

package/templates/beauty-salon/tier5-src/_shared/iap-worker.ts

@@ -0,0 +1,42 @@
+// Worker-side glue for the shared IAP layer (`@himalaya/iap` catalog pricing and
+// `@himalaya/iap-checkout` → createIapCommerce), shared by every screen that shows or sells an
+// IAP-backed item. Mapping, Apple prices, payment guards, the host scope and the sale live in the
+// SDK; this only supplies the copy and the hydration reset.
+import type { IapPriceCopy } from "@himalaya/iap";
+import type { IapPurchaseCopy } from "@himalaya/iap-checkout";
+import { copyParam } from "./himi-copy.js";
+
+/** Price labels from the screen's copy pack (`<prefix>.priceLoadingText`, …). */
+export function iapPriceCopy(prefix: string): IapPriceCopy {
+  return {
+    loading: copyParam(`${prefix}.priceLoadingText`, "Loading price…"),
+    unavailable: copyParam(`${prefix}.priceUnavailableText`, "Price unavailable"),
+    oneTimePurchase: copyParam(`${prefix}.oneTimePurchaseLabel`, "One-time purchase"),
+    purchaseUnavailable: copyParam(`${prefix}.purchaseUnavailableText`, "Purchasing is not available yet."),
+  };
+}
+
+/** App Store purchase labels from the screen's copy pack (`<prefix>.buyCta`, …), for
+ *  `iapPurchaseFields`. Customer copy only: no backend names, ids or diagnostics. */
+export function iapPurchaseCopy(prefix: string): IapPurchaseCopy {
+  return {
+    buy: copyParam(`${prefix}.buyCta`, "Get access"),
+    processing: copyParam(`${prefix}.purchaseProcessingText`, "Processing your purchase…"),
+    awaitingApproval: copyParam(`${prefix}.purchaseAwaitingApprovalText`, "Waiting for approval"),
+    unavailable: copyParam(`${prefix}.purchaseTemporarilyUnavailableText`, "Purchasing is temporarily unavailable."),
+    signInRequired: copyParam(`${prefix}.purchaseSignInText`, "Sign in to buy."),
+    retry: copyParam(`${prefix}.purchaseRetryText`, "Something went wrong. Try again."),
+    priceChanged: copyParam(`${prefix}.purchasePriceChangedText`, "The price changed. Check it and try again."),
+    support: copyParam(`${prefix}.purchaseSupportText`, "We couldn't finish this purchase. Contact support."),
+  };
+}
+
+/** What `notHydrated` does, for a runtime that ignores the option (a binary older than it, still
+ *  served new bundles): put the listed keys back to their declared values before any action runs,
+ *  so a persisted price or an enabled purchase action never paints as this run's. */
+export function resetUnhydratedKeysOnOlderRuntime<S extends object>(svc: { getState(): S }, declared: S, keys: readonly (keyof S & string)[]): void {
+  if ((globalThis as { himalaya?: { hydrationOptOut?: unknown } }).himalaya?.hydrationOptOut === true) return;
+  const booted = svc.getState();
+  if (!booted || typeof booted !== "object") return;
+  for (const key of keys) booted[key] = declared[key];
+}

package/templates/beauty-salon/tier5-src/himi-branded-lite-cart/index.ts

@@ -1,4 +1,7 @@
-import { defineService } from "@himalaya/state";
+import { getStoreProduct } from "../_shared/himi-store.js";
+import { iapPriceCopy } from "../_shared/iap-worker.js";
+import { withIapPresentation } from "../_shared/iap-presentation.js";
+import { type IapCommerce, classifyCart } from "@himalaya/iap-checkout";
 import { createCheckoutFromCurrentCart, createOrder, getCurrentCart, removeLineItemsFromCurrentCart, updateLineItemsQuantity, type WixCartLineItemDetail } from "@himalaya/wix-ecom";
 import { createRedirectSession } from "@himalaya/wix-redirects";
 import { session as wixPlatformSession } from "@himalaya/wix-platform";
@@ -6,6 +9,7 @@ import { payCashierOrder } from "@himalaya/checkout";
 
 /** Wix Stores appDefId — the vertical that owns a cart/ecom order, and therefore the
  *  `appId` its cashier order is paid under. (Same constant Wix's own tooling uses.) */
+const WIX_STORES_CATALOG_ID = "215238eb-22a5-4c36-9e7b-e7c08025e04e";
 const WIX_STORES_APP_ID = "1380b703-ce81-ff05-f115-39571d94dfcd";
 
 /** The site's metaSiteId for the cashier payment config. Best-effort — the native
@@ -40,6 +44,7 @@ async function cacheDrop(id: string): Promise<void> { try { await dbRemove(ENTIT
 async function queueWrite(actionId: string, params: Record<string, string>): Promise<void> { try { await enqueue(actionId, params); } catch { /* capability not granted */ } }
 
 interface Row {
+  catalogReference?: { appId: string; catalogItemId: string; options?: Record<string, unknown> };
   id: string;
   name: string;
   title: string;
@@ -50,6 +55,7 @@ interface Row {
   /** The "−" control at qty 1 removes the line, so it never dead-ends. */
   atMinQuantity: boolean;
   total: string;
+  commerceTotal: string;
   image: string;
   initial: string;
   hasImage: boolean;
@@ -59,6 +65,7 @@ interface State {
   status: "loading" | "ready" | "error";
   items: Row[];
   subtotal: string;
+  commerceSubtotal?: string;
   emptyText: string;
   checkoutHint: string;
   isLoading: boolean;
@@ -118,6 +125,7 @@ function row(item: WixCartLineItemDetail, index: number): Row {
   const name = item.productName?.original || copyParam("cart.itemFallbackName", "Cart item");
   const image = mediaUrl(item);
   return {
+    catalogReference: (item as WixCartLineItemDetail & { catalogReference?: Row["catalogReference"] }).catalogReference,
     id: item.id || `line-${index}`,
     name,
     title: name,
@@ -126,6 +134,7 @@ function row(item: WixCartLineItemDetail, index: number): Row {
     quantityLabel: `${quantity}`,
     atMinQuantity: quantity <= 1,
     total: item.price?.formattedAmount ?? "",
+    commerceTotal: item.price?.formattedAmount ?? "",
     image,
     initial: (name.trim()[0] || "C").toUpperCase(),
     hasImage: Boolean(image),
@@ -163,6 +172,7 @@ async function refresh(state: State, checkoutHint = ""): Promise<State> {
     status: "ready",
     items,
     subtotal: cart.subtotal?.formattedAmount ?? "",
+    commerceSubtotal: cart.subtotal?.formattedAmount ?? "",
     emptyText: items.length ? "" : copyParam("cart.emptyText", "Your cart is empty."),
     checkoutHint,
   });
@@ -190,6 +200,16 @@ function cartConsumedByOrder(): Pick<State, "items" | "subtotal" | "emptyText" |
   };
 }
 
+let cartPricing: IapCommerce;
+const defineService = withIapPresentation<State>({
+  onCreate: commerce => { cartPricing = commerce; },
+  prefix: "cart", transientKeys: ["items", "subtotal"], contentActions: ["load", "remove", "increment", "decrement"],
+  items: state => state.items.flatMap(row => row.catalogReference?.catalogItemId ? [{ reference: { kind: "storesProduct", id: row.catalogReference.catalogItemId }, commerceDisplayPrice: row.commerceTotal ?? row.total }] : []),
+  present: (state, price, allowed) => ({ ...state,
+    items: state.items.map(row => ({ ...row, total: row.catalogReference?.catalogItemId ? price(row.catalogReference.catalogItemId, row.commerceTotal ?? row.total) : row.total })),
+    subtotal: state.items.length > 0 && state.items.every(row => row.catalogReference?.catalogItemId && allowed(row.catalogReference.catalogItemId)) ? state.commerceSubtotal ?? state.subtotal : "" }),
+});
+
 const svc = defineService<State, {
   load: (state: State, arg?: unknown) => Promise<State>;
   remove: (state: State, arg?: unknown) => Promise<State>;
@@ -272,6 +292,25 @@ const svc = defineService<State, {
     // `createOrder` returning no paymentGatewayOrderId means there is nothing to
     // charge (fully covered / zero total) — the order already stands.
     checkout: async (state) => {
+      let validatedLines: WixCartLineItemDetail[] = [];
+      const signature = (lines: WixCartLineItemDetail[]) => JSON.stringify(lines.map(line => [line.id, line.quantity, (line as WixCartLineItemDetail & { catalogReference?: Row["catalogReference"] }).catalogReference]));
+      try {
+        const cart = await getCurrentCart();
+        const lines = cart.lineItems ?? [];
+        if (!lines.length) return derive({ ...state, checkoutHint: copyParam("cart.checkoutEmptyMessage", "Add an item before checkout.") });
+        const commerce = cartPricing;
+        const items = lines.map(line => (line as WixCartLineItemDetail & { catalogReference?: Row["catalogReference"] }).catalogReference);
+        if (items.some(item => !item?.catalogItemId || !item.appId)) return derive({ ...state, checkoutHint: iapPriceCopy("cart").purchaseUnavailable });
+        await commerce.loadPrices(items.map((item, index) => ({ reference: { kind: "storesProduct", id: item!.catalogItemId }, commerceDisplayPrice: lines[index].price?.formattedAmount })));
+        const classification = classifyCart(items.map((item, index) => ({ route: commerce.pricing.view({ kind: "storesProduct", id: item!.catalogItemId }).route, quantity: lines[index].quantity ?? 1 })));
+        if (classification !== "regular") return derive({ ...state, checkoutHint: classification === "mixedRefused" ? copyParam("cart.iapSingleItemOnly", "Buy digital items individually, with quantity 1 and no options.") : iapPriceCopy("cart").purchaseUnavailable });
+        const products = await Promise.all(items.map(async item => item!.appId === WIX_STORES_CATALOG_ID ? (await getStoreProduct(item!.catalogItemId)).product : undefined));
+        if (products.some(product => product?.productType?.toLowerCase() !== "physical")) return derive({ ...state, checkoutHint: iapPriceCopy("cart").purchaseUnavailable });
+        const latest = await getCurrentCart();
+        if (signature(latest.lineItems ?? []) !== signature(lines)) return derive({ ...state, checkoutHint: copyParam("cart.changedBeforeCheckout", "Your cart changed. Review it before checking out.") });
+        validatedLines = lines;
+      } catch { return derive({ ...state, checkoutHint: iapPriceCopy("cart").purchaseUnavailable }); }
+
       if (!state.items.length) return derive({ ...state, checkoutHint: copyParam("cart.checkoutEmptyMessage", "Add an item before checkout.") });
       try {
         const checkout = await createCheckoutFromCurrentCart();
@@ -288,6 +327,14 @@ const svc = defineService<State, {
           appId: WIX_STORES_APP_ID,
           snapshotId,
           msid: await resolveMsid(),
+          mayCharge: async () => {
+            const latest = await getCurrentCart();
+            if (signature(latest.lineItems ?? []) !== signature(validatedLines)) return false;
+            return validatedLines.every(line => {
+              const reference = (line as WixCartLineItemDetail & { catalogReference?: Row["catalogReference"] }).catalogReference;
+              return !!reference && cartPricing.pricing.continueCheckoutGuard({ kind: "storesProduct", id: reference.catalogItemId }).allowed;
+            });
+          },
           cashierUrl: async () => {
             const redirect = await createRedirectSession({
               ecomCheckout: { checkoutId },

package/templates/beauty-salon/tier5-src/himi-branded-lite-home/index.ts

@@ -1,6 +1,7 @@
 import { fetchMemberBookings, type MemberBookingRow } from "../_shared/member-bookings.js";
 import { memberAccess, assertMemberAccess } from "../_shared/member-access.js";
-import { defineService } from "../_shared/home-service.js";
+import { defineService as registerHome } from "../_shared/home-service.js";
+import { withIapPresentation } from "../_shared/iap-presentation.js";
 import { queryServices, type WixService } from "@himalaya/wix-bookings";
 import { getPost, queryPosts, type WixPost } from "@himalaya/wix-blog";
 import { queryGroups, type WixGroup } from "@himalaya/wix-groups";
@@ -68,6 +69,7 @@ interface ProductFeature {
 /** Device-local catalog saves are useful to visitors too; they are never
  * presented as account-synced data or mixed with member-only bookings. */
 interface SavedProductCard {
+  commercePrice: string;
   id: string;
   name: string;
   price: string;
@@ -573,7 +575,7 @@ function postCard(post: WixPost): PostCard {
 function savedProductCard(product: SavedProduct): SavedProductCard {
   const name = cleanTitle(product.name) || copyParam("home.savedProductFallbackName", "Saved item");
   const image = product.image ? wixMediaUrl(product.image) : "";
-  return { id: product.id, name, price: product.price, image, initial: initials(name), hasImage: !!image, noImage: !image, detailScreenId: "himi_product" };
+  return { id: product.id, name, price: product.price, commercePrice: product.price, image, initial: initials(name), hasImage: !!image, noImage: !image, detailScreenId: "himi_product" };
 }
 
 function savedPostCard(post: WixPost): SavedPostCard {
@@ -1111,6 +1113,18 @@ async function refresh(state: State, arg?: unknown): Promise<State | undefined>
     weeklyClassCount: current.weeklyClassCount, weeklyClassGoalFraction: current.weeklyClassGoalFraction, weeklyGoalLabel: current.weeklyGoalLabel });
 }
 
+const defineService = withIapPresentation<State>({
+  register: registerHome, prefix: "home", transientKeys: ["featuredProducts", "savedProducts", "heroPrice"], contentActions: ["refresh"],
+  items: state => [
+    ...state.featuredProducts.map(row => ({ reference: { kind: "storesProduct", id: row.id }, commerceDisplayPrice: row.price })),
+    ...state.savedProducts.map(row => ({ reference: { kind: "storesProduct", id: row.id }, commerceDisplayPrice: row.commercePrice })),
+  ],
+  present: (state, price) => derive({ ...state,
+    featuredProducts: state.featuredProducts.map(row => ({ ...row, price: price(row.id) })),
+    savedProducts: state.savedProducts.map(row => ({ ...row, price: price(row.id, row.commercePrice) })),
+  }),
+});
+
 const svc = defineService<State, {
   // `State | undefined`, matching the implementation: `refresh` returns undefined on a
   // STALE generation (`if (gen !== refreshGen) return undefined`) so the runtime keeps

package/templates/beauty-salon/tier5-src/himi-branded-lite-order/index.ts

@@ -1,3 +1,6 @@
+import { createIapCommerce, classifyCart } from "@himalaya/iap-checkout";
+import { getStoreProduct } from "../_shared/himi-store.js";
+import { iapPriceCopy } from "../_shared/iap-worker.js";
 import { defineService } from "@himalaya/state";
 import { orderMember, assertOrderMember, ownedOrderCache, orderAccessDenied, orderAccessChanged, type OrderMember } from "../_shared/member-orders.js";
 import { addToCurrentCart, getOrder, searchOrders, type WixOrder } from "@himalaya/wix-ecom";
@@ -38,6 +41,8 @@ interface LineRow {
 
 /** What reorder re-adds: catalog item id + quantity per line (internal). */
 interface ReorderRef {
+  appId?: string;
+  options?: Record<string, unknown>;
   catalogItemId: string;
   quantity: number;
 }
@@ -164,10 +169,10 @@ function lineRows(order: WixOrder): LineRow[] {
 /** Catalog references for the reorder CTA — only store-catalog lines re-add. */
 function reorderRefs(order: WixOrder): ReorderRef[] {
   return (order.lineItems ?? []).flatMap((item) => {
-    const ref = (item as { catalogReference?: { catalogItemId?: string } }).catalogReference;
+    const ref = (item as { catalogReference?: { catalogItemId?: string; appId?: string; options?: Record<string, unknown> } }).catalogReference;
     const catalogItemId = ref?.catalogItemId;
     return typeof catalogItemId === "string" && catalogItemId
-      ? [{ catalogItemId, quantity: item.quantity || 1 }]
+      ? [{ catalogItemId, appId: ref.appId, ...(ref.options ? { options: ref.options } : {}), quantity: item.quantity || 1 }]
       : [];
   });
 }
@@ -307,6 +312,7 @@ async function load(state: State, arg?: unknown): Promise<State | undefined> {
  */
 const FOLLOW_TTL_SECONDS = 24 * 60 * 60;
 
+const reorderPricing = createIapCommerce();
 const svc = defineService<State, {
   load: (state: State, arg?: unknown) => Promise<State | undefined>;
   retry: (state: State) => Promise<State | undefined>;
@@ -401,8 +407,23 @@ const svc = defineService<State, {
       catch { return version === loadVersion ? derive({ ...clearOrder(state), status: "error", emptyText: copyParam("order.signInEmptyText", "Sign in to view this order.") }) : undefined; }
       if (version !== loadVersion) return undefined;
       if (!state.reorderRefs.length) return derive({ ...state, reorderMessage: copyParam("order.reorderNoneMessage", "Nothing on this order can be re-added.") });
+      try {
+        const refs = state.reorderRefs;
+        if (refs.some(ref => ref.appId !== "215238eb-22a5-4c36-9e7b-e7c08025e04e")) return derive({ ...state, reorderMessage: iapPriceCopy("order").purchaseUnavailable });
+        await reorderPricing.loadPrices(refs.map(ref => ({ reference: { kind: "storesProduct", id: ref.catalogItemId } })));
+        const route = classifyCart(refs.map(ref => ({ route: reorderPricing.pricing.view({ kind: "storesProduct", id: ref.catalogItemId }).route, quantity: ref.quantity })));
+        const products = await Promise.all(refs.map(async ref => (await getStoreProduct(ref.catalogItemId)).product));
+        if (route !== "regular" || products.some(product => product?.productType?.toLowerCase() !== "physical")) return derive({ ...state, reorderMessage: iapPriceCopy("order").purchaseUnavailable });
+        await assertOrderMember(member);
+        if (version !== loadVersion) return undefined;
+      } catch {
+        if (version !== loadVersion) return undefined;
+        try { await assertOrderMember(member); }
+        catch { return derive({ ...clearOrder(state), status: "error", emptyText: copyParam("order.signInEmptyText", "Sign in to view this order.") }); }
+        return derive({ ...state, reorderMessage: iapPriceCopy("order").purchaseUnavailable });
+      }
       const results = await Promise.allSettled(
-        state.reorderRefs.map((ref) => addToCurrentCart(ref.catalogItemId, ref.quantity)),
+        state.reorderRefs.map((ref) => addToCurrentCart(ref.catalogItemId, ref.quantity, ref.options)),
       );
       // A pending mutation must never restore an older order after navigation or sign-out.
       if (version !== loadVersion) return undefined;