@wix/himalaya-cli 0.1345.0 → 0.1348.0

package/guides/sdk-reference.json

@@ -3543,7 +3543,7 @@
       {
         "name": "putFile",
         "kind": "function",
-        "jsdoc": "/**\n * Upload a stored file's bytes to a pre-signed URL, read straight from the\n * `@himalaya/files` substrate — the bytes never cross the worker bridge, so this is\n * the path for photos and voice notes.\n *\n * DECLARE \"files\" TOO. This verb reads the app's document substrate, so a bundle that\n * uses it is doing file access and its declared list should say so — the privacy\n * manifest and the generated native config are built from that list.\n *\n * Be aware of what is and is not enforced. The runtime gate keys on the capability id in\n * the action name, so `capability.presigned_upload.putFile` is admitted by declaring\n * `presigned_upload` alone: today a bundle can reach a substrate path without declaring\n * `files`. That is a gap in the gate, not a licence — and it is deliberately NOT closed\n * by adding `presigned_upload → files` to CAPABILITY_IMPLIES, because that table grants\n * supersets, and granting the WHOLE files capability (write, remove, list) to anything\n * that can upload would be a wider hole than the one it patched. Closing it properly\n * needs a requires-relation the gate does not have yet.\n */",
+        "jsdoc": "/**\n * Upload a stored file's bytes to a pre-signed URL, read straight from the\n * `@himalaya/files` substrate — the bytes never cross the worker bridge, so this is\n * the path for photos and voice notes.\n *\n * DECLARE \"files\" TOO — it is REQUIRED. This verb reads the app's document substrate, so\n * the worker gate on every runtime (iOS, macOS, Android, web) refuses\n * `capability.presigned_upload.putFile` to a bundle that does not also declare `files`.\n * Deliberately a requirement and NOT a `presigned_upload → files` implication:\n * declaring `presigned_upload` grants none of the files surface (write, remove, list).\n */",
         "decl": "export async function putFile(\n  url: string,\n  ref: FileHandle | string,\n  opts?: UploadOptions,\n): Promise<UploadResult>;"
       },
       {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1345.0",
+  "version": "0.1348.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "2527f3bb9a9636577600b4f087d1a8bbd2c243ad80d31b17d53a6751"
+  "falconPackageHash": "ff7251a5688611526e72aaae9882c46d2f4f3667bbd4f0fa94b5343f"
 }

package/templates/beauty-salon/tier5-src/_shared/hosted-checkout.ts

@@ -0,0 +1,42 @@
+// Hosted checkout (#4089 B3). A Branded Lite hosted in a host shell (Spaces)
+// pays as the member the host lent it: Headless `createRedirectSession` does not take a Member
+// instance, so the HOST opens the site's checkout signed in as that member. The worker names only
+// its ecom checkout; the host reads Wix's checkout URL, mints a one-time member session and opens
+// the site's `createSessionCookie` → checkout. The session token never reaches this worker.
+
+import { dispatch } from "@himalaya/dispatch";
+import { hostSiteFromInput } from "./branded-lite-hosted.js";
+
+/** The host verbs (registered by the host shell, never by the app itself). The first prepares the
+ *  checkout and answers a one-time ticket; the second opens it. Two steps so the caller's charge guard
+ *  is re-read after the host's network round trips and right before the checkout opens — the prepared
+ *  URL (which carries the member's session token) stays in the host; only the ticket crosses here. */
+export const HOSTED_CHECKOUT_ACTION = "himi.host.memberCheckout";
+export const HOSTED_CHECKOUT_OPEN_ACTION = "himi.host.memberCheckout.open";
+
+/** Whether this worker runs inside a host that opened a site for it. */
+export function isHostedWorker(): boolean {
+  return hostSiteFromInput((globalThis as { himalaya?: { input?: unknown } }).himalaya?.input) !== null;
+}
+
+type HostAnswer = { opened?: unknown; ticket?: unknown; payload?: { opened?: unknown; ticket?: unknown } } | null;
+
+/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
+ *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
+ *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
+export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn"> {
+  return async (stillMayCharge) => {
+    try {
+      const prepared = await dispatch(HOSTED_CHECKOUT_ACTION, { checkoutId }) as HostAnswer;
+      const ticket = prepared?.ticket ?? prepared?.payload?.ticket;
+      if (typeof ticket !== "string" || !ticket) return false;
+      // An unopened ticket simply expires in the host: nothing to cancel.
+      if (!(await stillMayCharge())) return "withdrawn";
+      const result = await dispatch(HOSTED_CHECKOUT_OPEN_ACTION, { ticket }) as HostAnswer;
+      const opened = result?.opened ?? result?.payload?.opened;
+      return opened === true || opened === "true";
+    } catch {
+      return false;
+    }
+  };
+}

package/templates/beauty-salon/tier5-src/himi-booking-time/index.ts

@@ -9,6 +9,7 @@ import { bookSlot, getService, queryServiceAvailability, type WixBookingSlotFull
 import { createCheckout, createOrder } from "@himalaya/wix-ecom";
 import { createRedirectSession, type WixSlot } from "@himalaya/wix-redirects";
 import { payCashierOrder } from "@himalaya/checkout";
+import { hostedCheckoutOpener, isHostedWorker } from "../_shared/hosted-checkout.js";
 import { session as wixPlatformSession } from "@himalaya/wix-platform";
 import { displayName, getMyData, type WixMyData } from "@himalaya/wix-users";
 import { formatServicePrice, serviceIsChargeable } from "../_shared/wix-service-price.js";
@@ -662,9 +663,12 @@ const svc = defineService<S, {
           // 3. Create the Wix-managed order — mints the cashier snapshot when a
           //    balance is due. No paymentGatewayOrderId ⇒ nothing to charge
           //    (covered / zero total) ⇒ the booking is already confirmed.
-          const orderRes = await createOrder(checkoutId);
-          const snapshotId = orderRes.paymentGatewayOrderId;
-          if (!snapshotId) {
+          // Hosted (Spaces): the site's own checkout page creates the order (as
+          // RN does) — creating it here first fails on a site with no payment method set up.
+          const hosted = isHostedWorker();
+          const orderRes = hosted ? { paymentGatewayOrderId: "" } : await createOrder(checkoutId);
+          const snapshotId = orderRes.paymentGatewayOrderId ?? "";
+          if (!snapshotId && !hosted) {
             return derive({ ...pending, bookingInFlight: false, successMessage: copyParam("time.successMessage", "Booked. Your confirmation is ready in My Bookings."), message: "" });
           }
           // 4. Collect payment IN-APP — wallet when this app has one wired, otherwise
@@ -676,6 +680,8 @@ const svc = defineService<S, {
             appId: WIX_BOOKINGS_APP_ID,
             snapshotId,
             msid: await resolveMsid(),
+            // Hosted (Spaces): the host opens this booking's checkout as the lent member.
+            ...(hosted ? { openCashier: hostedCheckoutOpener(checkoutId) } : {}),
             cashierUrl: async () => {
               const redirect = await createRedirectSession({
                 bookingsCheckout: { slotAvailability: { slot: slot as unknown as WixSlot } },

package/templates/beauty-salon/tier5-src/himi-branded-lite-cart/index.ts

@@ -6,6 +6,7 @@ import { createCheckoutFromCurrentCart, createOrder, getCurrentCart, removeLineI
 import { createRedirectSession } from "@himalaya/wix-redirects";
 import { session as wixPlatformSession } from "@himalaya/wix-platform";
 import { payCashierOrder } from "@himalaya/checkout";
+import { hostedCheckoutOpener, isHostedWorker } from "../_shared/hosted-checkout.js";
 
 /** Wix Stores appDefId — the vertical that owns a cart/ecom order, and therefore the
  *  `appId` its cashier order is paid under. (Same constant Wix's own tooling uses.) */
@@ -317,9 +318,13 @@ const svc = defineService<State, {
         if (!checkout.checkoutId) return derive({ ...state, checkoutHint: copyParam("cart.checkoutIdMissingMessage", "Wix did not return a checkout id.") });
         const checkoutId = checkout.checkoutId;
 
-        const order = await createOrder(checkoutId);
-        const snapshotId = order.paymentGatewayOrderId;
-        if (!snapshotId) {
+        // Hosted (Spaces): the site's own checkout page creates the order (RN's
+        // route) — creating it here first fails on a site with no payment method set up, before the
+        // member ever reaches the checkout. The host opens the checkout as the lent member.
+        const hosted = isHostedWorker();
+        const order = hosted ? { paymentGatewayOrderId: "" } : await createOrder(checkoutId);
+        const snapshotId = order.paymentGatewayOrderId ?? "";
+        if (!snapshotId && !hosted) {
           return derive({ ...state, ...cartConsumedByOrder() });
         }
 
@@ -335,6 +340,9 @@ const svc = defineService<State, {
               return !!reference && cartPricing.pricing.continueCheckoutGuard({ kind: "storesProduct", id: reference.catalogItemId }).allowed;
             });
           },
+          // Hosted (Spaces): the host opens the checkout as the lent member — Headless redirect
+          // sessions do not take a Member instance.
+          ...(hosted ? { openCashier: hostedCheckoutOpener(checkoutId) } : {}),
           cashierUrl: async () => {
             const redirect = await createRedirectSession({
               ecomCheckout: { checkoutId },

package/templates/branded-lite/tier5-src/_shared/hosted-checkout.ts

@@ -0,0 +1,42 @@
+// Hosted checkout (#4089 B3). A Branded Lite hosted in a host shell (Spaces)
+// pays as the member the host lent it: Headless `createRedirectSession` does not take a Member
+// instance, so the HOST opens the site's checkout signed in as that member. The worker names only
+// its ecom checkout; the host reads Wix's checkout URL, mints a one-time member session and opens
+// the site's `createSessionCookie` → checkout. The session token never reaches this worker.
+
+import { dispatch } from "@himalaya/dispatch";
+import { hostSiteFromInput } from "./branded-lite-hosted.js";
+
+/** The host verbs (registered by the host shell, never by the app itself). The first prepares the
+ *  checkout and answers a one-time ticket; the second opens it. Two steps so the caller's charge guard
+ *  is re-read after the host's network round trips and right before the checkout opens — the prepared
+ *  URL (which carries the member's session token) stays in the host; only the ticket crosses here. */
+export const HOSTED_CHECKOUT_ACTION = "himi.host.memberCheckout";
+export const HOSTED_CHECKOUT_OPEN_ACTION = "himi.host.memberCheckout.open";
+
+/** Whether this worker runs inside a host that opened a site for it. */
+export function isHostedWorker(): boolean {
+  return hostSiteFromInput((globalThis as { himalaya?: { input?: unknown } }).himalaya?.input) !== null;
+}
+
+type HostAnswer = { opened?: unknown; ticket?: unknown; payload?: { opened?: unknown; ticket?: unknown } } | null;
+
+/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
+ *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
+ *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
+export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn"> {
+  return async (stillMayCharge) => {
+    try {
+      const prepared = await dispatch(HOSTED_CHECKOUT_ACTION, { checkoutId }) as HostAnswer;
+      const ticket = prepared?.ticket ?? prepared?.payload?.ticket;
+      if (typeof ticket !== "string" || !ticket) return false;
+      // An unopened ticket simply expires in the host: nothing to cancel.
+      if (!(await stillMayCharge())) return "withdrawn";
+      const result = await dispatch(HOSTED_CHECKOUT_OPEN_ACTION, { ticket }) as HostAnswer;
+      const opened = result?.opened ?? result?.payload?.opened;
+      return opened === true || opened === "true";
+    } catch {
+      return false;
+    }
+  };
+}

package/templates/branded-lite/tier5-src/himi-booking-time/index.ts

@@ -9,6 +9,7 @@ import { bookSlot, getService, queryServiceAvailability, type WixBookingSlotFull
 import { createCheckout, createOrder } from "@himalaya/wix-ecom";
 import { createRedirectSession, type WixSlot } from "@himalaya/wix-redirects";
 import { payCashierOrder } from "@himalaya/checkout";
+import { hostedCheckoutOpener, isHostedWorker } from "../_shared/hosted-checkout.js";
 import { session as wixPlatformSession } from "@himalaya/wix-platform";
 import { displayName, getMyData, type WixMyData } from "@himalaya/wix-users";
 import { formatServicePrice, serviceIsChargeable } from "../_shared/wix-service-price.js";
@@ -662,9 +663,12 @@ const svc = defineService<S, {
           // 3. Create the Wix-managed order — mints the cashier snapshot when a
           //    balance is due. No paymentGatewayOrderId ⇒ nothing to charge
           //    (covered / zero total) ⇒ the booking is already confirmed.
-          const orderRes = await createOrder(checkoutId);
-          const snapshotId = orderRes.paymentGatewayOrderId;
-          if (!snapshotId) {
+          // Hosted (Spaces): the site's own checkout page creates the order (as
+          // RN does) — creating it here first fails on a site with no payment method set up.
+          const hosted = isHostedWorker();
+          const orderRes = hosted ? { paymentGatewayOrderId: "" } : await createOrder(checkoutId);
+          const snapshotId = orderRes.paymentGatewayOrderId ?? "";
+          if (!snapshotId && !hosted) {
             return derive({ ...pending, bookingInFlight: false, successMessage: copyParam("time.successMessage", "Booked. Your confirmation is ready in My Bookings."), message: "" });
           }
           // 4. Collect payment IN-APP — wallet when this app has one wired, otherwise
@@ -676,6 +680,8 @@ const svc = defineService<S, {
             appId: WIX_BOOKINGS_APP_ID,
             snapshotId,
             msid: await resolveMsid(),
+            // Hosted (Spaces): the host opens this booking's checkout as the lent member.
+            ...(hosted ? { openCashier: hostedCheckoutOpener(checkoutId) } : {}),
             cashierUrl: async () => {
               const redirect = await createRedirectSession({
                 bookingsCheckout: { slotAvailability: { slot: slot as unknown as WixSlot } },

package/templates/branded-lite/tier5-src/himi-branded-lite-cart/index.ts

@@ -6,6 +6,7 @@ import { createCheckoutFromCurrentCart, createOrder, getCurrentCart, removeLineI
 import { createRedirectSession } from "@himalaya/wix-redirects";
 import { session as wixPlatformSession } from "@himalaya/wix-platform";
 import { payCashierOrder } from "@himalaya/checkout";
+import { hostedCheckoutOpener, isHostedWorker } from "../_shared/hosted-checkout.js";
 
 /** Wix Stores appDefId — the vertical that owns a cart/ecom order, and therefore the
  *  `appId` its cashier order is paid under. (Same constant Wix's own tooling uses.) */
@@ -317,9 +318,13 @@ const svc = defineService<State, {
         if (!checkout.checkoutId) return derive({ ...state, checkoutHint: copyParam("cart.checkoutIdMissingMessage", "Wix did not return a checkout id.") });
         const checkoutId = checkout.checkoutId;
 
-        const order = await createOrder(checkoutId);
-        const snapshotId = order.paymentGatewayOrderId;
-        if (!snapshotId) {
+        // Hosted (Spaces): the site's own checkout page creates the order (RN's
+        // route) — creating it here first fails on a site with no payment method set up, before the
+        // member ever reaches the checkout. The host opens the checkout as the lent member.
+        const hosted = isHostedWorker();
+        const order = hosted ? { paymentGatewayOrderId: "" } : await createOrder(checkoutId);
+        const snapshotId = order.paymentGatewayOrderId ?? "";
+        if (!snapshotId && !hosted) {
           return derive({ ...state, ...cartConsumedByOrder() });
         }
 
@@ -335,6 +340,9 @@ const svc = defineService<State, {
               return !!reference && cartPricing.pricing.continueCheckoutGuard({ kind: "storesProduct", id: reference.catalogItemId }).allowed;
             });
           },
+          // Hosted (Spaces): the host opens the checkout as the lent member — Headless redirect
+          // sessions do not take a Member instance.
+          ...(hosted ? { openCashier: hostedCheckoutOpener(checkoutId) } : {}),
           cashierUrl: async () => {
             const redirect = await createRedirectSession({
               ecomCheckout: { checkoutId },

package/templates/gym-fitness/tier5-src/_shared/hosted-checkout.ts

@@ -0,0 +1,42 @@
+// Hosted checkout (#4089 B3). A Branded Lite hosted in a host shell (Spaces)
+// pays as the member the host lent it: Headless `createRedirectSession` does not take a Member
+// instance, so the HOST opens the site's checkout signed in as that member. The worker names only
+// its ecom checkout; the host reads Wix's checkout URL, mints a one-time member session and opens
+// the site's `createSessionCookie` → checkout. The session token never reaches this worker.
+
+import { dispatch } from "@himalaya/dispatch";
+import { hostSiteFromInput } from "./branded-lite-hosted.js";
+
+/** The host verbs (registered by the host shell, never by the app itself). The first prepares the
+ *  checkout and answers a one-time ticket; the second opens it. Two steps so the caller's charge guard
+ *  is re-read after the host's network round trips and right before the checkout opens — the prepared
+ *  URL (which carries the member's session token) stays in the host; only the ticket crosses here. */
+export const HOSTED_CHECKOUT_ACTION = "himi.host.memberCheckout";
+export const HOSTED_CHECKOUT_OPEN_ACTION = "himi.host.memberCheckout.open";
+
+/** Whether this worker runs inside a host that opened a site for it. */
+export function isHostedWorker(): boolean {
+  return hostSiteFromInput((globalThis as { himalaya?: { input?: unknown } }).himalaya?.input) !== null;
+}
+
+type HostAnswer = { opened?: unknown; ticket?: unknown; payload?: { opened?: unknown; ticket?: unknown } } | null;
+
+/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
+ *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
+ *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
+export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn"> {
+  return async (stillMayCharge) => {
+    try {
+      const prepared = await dispatch(HOSTED_CHECKOUT_ACTION, { checkoutId }) as HostAnswer;
+      const ticket = prepared?.ticket ?? prepared?.payload?.ticket;
+      if (typeof ticket !== "string" || !ticket) return false;
+      // An unopened ticket simply expires in the host: nothing to cancel.
+      if (!(await stillMayCharge())) return "withdrawn";
+      const result = await dispatch(HOSTED_CHECKOUT_OPEN_ACTION, { ticket }) as HostAnswer;
+      const opened = result?.opened ?? result?.payload?.opened;
+      return opened === true || opened === "true";
+    } catch {
+      return false;
+    }
+  };
+}

package/templates/gym-fitness/tier5-src/himi-booking-time/index.ts

@@ -9,6 +9,7 @@ import { bookSlot, getService, queryServiceAvailability, type WixBookingSlotFull
 import { createCheckout, createOrder } from "@himalaya/wix-ecom";
 import { createRedirectSession, type WixSlot } from "@himalaya/wix-redirects";
 import { payCashierOrder } from "@himalaya/checkout";
+import { hostedCheckoutOpener, isHostedWorker } from "../_shared/hosted-checkout.js";
 import { session as wixPlatformSession } from "@himalaya/wix-platform";
 import { displayName, getMyData, type WixMyData } from "@himalaya/wix-users";
 import { formatServicePrice, serviceIsChargeable } from "../_shared/wix-service-price.js";
@@ -662,9 +663,12 @@ const svc = defineService<S, {
           // 3. Create the Wix-managed order — mints the cashier snapshot when a
           //    balance is due. No paymentGatewayOrderId ⇒ nothing to charge
           //    (covered / zero total) ⇒ the booking is already confirmed.
-          const orderRes = await createOrder(checkoutId);
-          const snapshotId = orderRes.paymentGatewayOrderId;
-          if (!snapshotId) {
+          // Hosted (Spaces): the site's own checkout page creates the order (as
+          // RN does) — creating it here first fails on a site with no payment method set up.
+          const hosted = isHostedWorker();
+          const orderRes = hosted ? { paymentGatewayOrderId: "" } : await createOrder(checkoutId);
+          const snapshotId = orderRes.paymentGatewayOrderId ?? "";
+          if (!snapshotId && !hosted) {
             return derive({ ...pending, bookingInFlight: false, successMessage: copyParam("time.successMessage", "Booked. Your confirmation is ready in My Bookings."), message: "" });
           }
           // 4. Collect payment IN-APP — wallet when this app has one wired, otherwise
@@ -676,6 +680,8 @@ const svc = defineService<S, {
             appId: WIX_BOOKINGS_APP_ID,
             snapshotId,
             msid: await resolveMsid(),
+            // Hosted (Spaces): the host opens this booking's checkout as the lent member.
+            ...(hosted ? { openCashier: hostedCheckoutOpener(checkoutId) } : {}),
             cashierUrl: async () => {
               const redirect = await createRedirectSession({
                 bookingsCheckout: { slotAvailability: { slot: slot as unknown as WixSlot } },

package/templates/gym-fitness/tier5-src/himi-branded-lite-cart/index.ts

@@ -6,6 +6,7 @@ import { createCheckoutFromCurrentCart, createOrder, getCurrentCart, removeLineI
 import { createRedirectSession } from "@himalaya/wix-redirects";
 import { session as wixPlatformSession } from "@himalaya/wix-platform";
 import { payCashierOrder } from "@himalaya/checkout";
+import { hostedCheckoutOpener, isHostedWorker } from "../_shared/hosted-checkout.js";
 
 /** Wix Stores appDefId — the vertical that owns a cart/ecom order, and therefore the
  *  `appId` its cashier order is paid under. (Same constant Wix's own tooling uses.) */
@@ -317,9 +318,13 @@ const svc = defineService<State, {
         if (!checkout.checkoutId) return derive({ ...state, checkoutHint: copyParam("cart.checkoutIdMissingMessage", "Wix did not return a checkout id.") });
         const checkoutId = checkout.checkoutId;
 
-        const order = await createOrder(checkoutId);
-        const snapshotId = order.paymentGatewayOrderId;
-        if (!snapshotId) {
+        // Hosted (Spaces): the site's own checkout page creates the order (RN's
+        // route) — creating it here first fails on a site with no payment method set up, before the
+        // member ever reaches the checkout. The host opens the checkout as the lent member.
+        const hosted = isHostedWorker();
+        const order = hosted ? { paymentGatewayOrderId: "" } : await createOrder(checkoutId);
+        const snapshotId = order.paymentGatewayOrderId ?? "";
+        if (!snapshotId && !hosted) {
           return derive({ ...state, ...cartConsumedByOrder() });
         }
 
@@ -335,6 +340,9 @@ const svc = defineService<State, {
               return !!reference && cartPricing.pricing.continueCheckoutGuard({ kind: "storesProduct", id: reference.catalogItemId }).allowed;
             });
           },
+          // Hosted (Spaces): the host opens the checkout as the lent member — Headless redirect
+          // sessions do not take a Member instance.
+          ...(hosted ? { openCashier: hostedCheckoutOpener(checkoutId) } : {}),
           cashierUrl: async () => {
             const redirect = await createRedirectSession({
               ecomCheckout: { checkoutId },

package/templates/portfolio-creative/tier5-src/_shared/hosted-checkout.ts

@@ -0,0 +1,42 @@
+// Hosted checkout (#4089 B3). A Branded Lite hosted in a host shell (Spaces)
+// pays as the member the host lent it: Headless `createRedirectSession` does not take a Member
+// instance, so the HOST opens the site's checkout signed in as that member. The worker names only
+// its ecom checkout; the host reads Wix's checkout URL, mints a one-time member session and opens
+// the site's `createSessionCookie` → checkout. The session token never reaches this worker.
+
+import { dispatch } from "@himalaya/dispatch";
+import { hostSiteFromInput } from "./branded-lite-hosted.js";
+
+/** The host verbs (registered by the host shell, never by the app itself). The first prepares the
+ *  checkout and answers a one-time ticket; the second opens it. Two steps so the caller's charge guard
+ *  is re-read after the host's network round trips and right before the checkout opens — the prepared
+ *  URL (which carries the member's session token) stays in the host; only the ticket crosses here. */
+export const HOSTED_CHECKOUT_ACTION = "himi.host.memberCheckout";
+export const HOSTED_CHECKOUT_OPEN_ACTION = "himi.host.memberCheckout.open";
+
+/** Whether this worker runs inside a host that opened a site for it. */
+export function isHostedWorker(): boolean {
+  return hostSiteFromInput((globalThis as { himalaya?: { input?: unknown } }).himalaya?.input) !== null;
+}
+
+type HostAnswer = { opened?: unknown; ticket?: unknown; payload?: { opened?: unknown; ticket?: unknown } } | null;
+
+/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
+ *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
+ *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
+export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn"> {
+  return async (stillMayCharge) => {
+    try {
+      const prepared = await dispatch(HOSTED_CHECKOUT_ACTION, { checkoutId }) as HostAnswer;
+      const ticket = prepared?.ticket ?? prepared?.payload?.ticket;
+      if (typeof ticket !== "string" || !ticket) return false;
+      // An unopened ticket simply expires in the host: nothing to cancel.
+      if (!(await stillMayCharge())) return "withdrawn";
+      const result = await dispatch(HOSTED_CHECKOUT_OPEN_ACTION, { ticket }) as HostAnswer;
+      const opened = result?.opened ?? result?.payload?.opened;
+      return opened === true || opened === "true";
+    } catch {
+      return false;
+    }
+  };
+}

package/templates/portfolio-creative/tier5-src/himi-branded-lite-cart/index.ts

@@ -6,6 +6,7 @@ import { createCheckoutFromCurrentCart, createOrder, getCurrentCart, removeLineI
 import { createRedirectSession } from "@himalaya/wix-redirects";
 import { session as wixPlatformSession } from "@himalaya/wix-platform";
 import { payCashierOrder } from "@himalaya/checkout";
+import { hostedCheckoutOpener, isHostedWorker } from "../_shared/hosted-checkout.js";
 
 /** Wix Stores appDefId — the vertical that owns a cart/ecom order, and therefore the
  *  `appId` its cashier order is paid under. (Same constant Wix's own tooling uses.) */
@@ -317,9 +318,13 @@ const svc = defineService<State, {
         if (!checkout.checkoutId) return derive({ ...state, checkoutHint: copyParam("cart.checkoutIdMissingMessage", "Wix did not return a checkout id.") });
         const checkoutId = checkout.checkoutId;
 
-        const order = await createOrder(checkoutId);
-        const snapshotId = order.paymentGatewayOrderId;
-        if (!snapshotId) {
+        // Hosted (Spaces): the site's own checkout page creates the order (RN's
+        // route) — creating it here first fails on a site with no payment method set up, before the
+        // member ever reaches the checkout. The host opens the checkout as the lent member.
+        const hosted = isHostedWorker();
+        const order = hosted ? { paymentGatewayOrderId: "" } : await createOrder(checkoutId);
+        const snapshotId = order.paymentGatewayOrderId ?? "";
+        if (!snapshotId && !hosted) {
           return derive({ ...state, ...cartConsumedByOrder() });
         }
 
@@ -335,6 +340,9 @@ const svc = defineService<State, {
               return !!reference && cartPricing.pricing.continueCheckoutGuard({ kind: "storesProduct", id: reference.catalogItemId }).allowed;
             });
           },
+          // Hosted (Spaces): the host opens the checkout as the lent member — Headless redirect
+          // sessions do not take a Member instance.
+          ...(hosted ? { openCashier: hostedCheckoutOpener(checkoutId) } : {}),
           cashierUrl: async () => {
             const redirect = await createRedirectSession({
               ecomCheckout: { checkoutId },

package/templates/retail-store/tier5-src/_shared/hosted-checkout.ts

@@ -0,0 +1,42 @@
+// Hosted checkout (#4089 B3). A Branded Lite hosted in a host shell (Spaces)
+// pays as the member the host lent it: Headless `createRedirectSession` does not take a Member
+// instance, so the HOST opens the site's checkout signed in as that member. The worker names only
+// its ecom checkout; the host reads Wix's checkout URL, mints a one-time member session and opens
+// the site's `createSessionCookie` → checkout. The session token never reaches this worker.
+
+import { dispatch } from "@himalaya/dispatch";
+import { hostSiteFromInput } from "./branded-lite-hosted.js";
+
+/** The host verbs (registered by the host shell, never by the app itself). The first prepares the
+ *  checkout and answers a one-time ticket; the second opens it. Two steps so the caller's charge guard
+ *  is re-read after the host's network round trips and right before the checkout opens — the prepared
+ *  URL (which carries the member's session token) stays in the host; only the ticket crosses here. */
+export const HOSTED_CHECKOUT_ACTION = "himi.host.memberCheckout";
+export const HOSTED_CHECKOUT_OPEN_ACTION = "himi.host.memberCheckout.open";
+
+/** Whether this worker runs inside a host that opened a site for it. */
+export function isHostedWorker(): boolean {
+  return hostSiteFromInput((globalThis as { himalaya?: { input?: unknown } }).himalaya?.input) !== null;
+}
+
+type HostAnswer = { opened?: unknown; ticket?: unknown; payload?: { opened?: unknown; ticket?: unknown } } | null;
+
+/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
+ *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
+ *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
+export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn"> {
+  return async (stillMayCharge) => {
+    try {
+      const prepared = await dispatch(HOSTED_CHECKOUT_ACTION, { checkoutId }) as HostAnswer;
+      const ticket = prepared?.ticket ?? prepared?.payload?.ticket;
+      if (typeof ticket !== "string" || !ticket) return false;
+      // An unopened ticket simply expires in the host: nothing to cancel.
+      if (!(await stillMayCharge())) return "withdrawn";
+      const result = await dispatch(HOSTED_CHECKOUT_OPEN_ACTION, { ticket }) as HostAnswer;
+      const opened = result?.opened ?? result?.payload?.opened;
+      return opened === true || opened === "true";
+    } catch {
+      return false;
+    }
+  };
+}

package/templates/retail-store/tier5-src/himi-branded-lite-cart/index.ts

@@ -6,6 +6,7 @@ import { createCheckoutFromCurrentCart, createOrder, getCurrentCart, removeLineI
 import { createRedirectSession } from "@himalaya/wix-redirects";
 import { session as wixPlatformSession } from "@himalaya/wix-platform";
 import { payCashierOrder } from "@himalaya/checkout";
+import { hostedCheckoutOpener, isHostedWorker } from "../_shared/hosted-checkout.js";
 
 /** Wix Stores appDefId — the vertical that owns a cart/ecom order, and therefore the
  *  `appId` its cashier order is paid under. (Same constant Wix's own tooling uses.) */
@@ -317,9 +318,13 @@ const svc = defineService<State, {
         if (!checkout.checkoutId) return derive({ ...state, checkoutHint: copyParam("cart.checkoutIdMissingMessage", "Wix did not return a checkout id.") });
         const checkoutId = checkout.checkoutId;
 
-        const order = await createOrder(checkoutId);
-        const snapshotId = order.paymentGatewayOrderId;
-        if (!snapshotId) {
+        // Hosted (Spaces): the site's own checkout page creates the order (RN's
+        // route) — creating it here first fails on a site with no payment method set up, before the
+        // member ever reaches the checkout. The host opens the checkout as the lent member.
+        const hosted = isHostedWorker();
+        const order = hosted ? { paymentGatewayOrderId: "" } : await createOrder(checkoutId);
+        const snapshotId = order.paymentGatewayOrderId ?? "";
+        if (!snapshotId && !hosted) {
           return derive({ ...state, ...cartConsumedByOrder() });
         }
 
@@ -335,6 +340,9 @@ const svc = defineService<State, {
               return !!reference && cartPricing.pricing.continueCheckoutGuard({ kind: "storesProduct", id: reference.catalogItemId }).allowed;
             });
           },
+          // Hosted (Spaces): the host opens the checkout as the lent member — Headless redirect
+          // sessions do not take a Member instance.
+          ...(hosted ? { openCashier: hostedCheckoutOpener(checkoutId) } : {}),
           cashierUrl: async () => {
             const redirect = await createRedirectSession({
               ecomCheckout: { checkoutId },

package/templates/yoga-studio/tier5-src/_shared/hosted-checkout.ts

@@ -0,0 +1,42 @@
+// Hosted checkout (#4089 B3). A Branded Lite hosted in a host shell (Spaces)
+// pays as the member the host lent it: Headless `createRedirectSession` does not take a Member
+// instance, so the HOST opens the site's checkout signed in as that member. The worker names only
+// its ecom checkout; the host reads Wix's checkout URL, mints a one-time member session and opens
+// the site's `createSessionCookie` → checkout. The session token never reaches this worker.
+
+import { dispatch } from "@himalaya/dispatch";
+import { hostSiteFromInput } from "./branded-lite-hosted.js";
+
+/** The host verbs (registered by the host shell, never by the app itself). The first prepares the
+ *  checkout and answers a one-time ticket; the second opens it. Two steps so the caller's charge guard
+ *  is re-read after the host's network round trips and right before the checkout opens — the prepared
+ *  URL (which carries the member's session token) stays in the host; only the ticket crosses here. */
+export const HOSTED_CHECKOUT_ACTION = "himi.host.memberCheckout";
+export const HOSTED_CHECKOUT_OPEN_ACTION = "himi.host.memberCheckout.open";
+
+/** Whether this worker runs inside a host that opened a site for it. */
+export function isHostedWorker(): boolean {
+  return hostSiteFromInput((globalThis as { himalaya?: { input?: unknown } }).himalaya?.input) !== null;
+}
+
+type HostAnswer = { opened?: unknown; ticket?: unknown; payload?: { opened?: unknown; ticket?: unknown } } | null;
+
+/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
+ *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
+ *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
+export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn"> {
+  return async (stillMayCharge) => {
+    try {
+      const prepared = await dispatch(HOSTED_CHECKOUT_ACTION, { checkoutId }) as HostAnswer;
+      const ticket = prepared?.ticket ?? prepared?.payload?.ticket;
+      if (typeof ticket !== "string" || !ticket) return false;
+      // An unopened ticket simply expires in the host: nothing to cancel.
+      if (!(await stillMayCharge())) return "withdrawn";
+      const result = await dispatch(HOSTED_CHECKOUT_OPEN_ACTION, { ticket }) as HostAnswer;
+      const opened = result?.opened ?? result?.payload?.opened;
+      return opened === true || opened === "true";
+    } catch {
+      return false;
+    }
+  };
+}

package/templates/yoga-studio/tier5-src/himi-booking-time/index.ts

@@ -9,6 +9,7 @@ import { bookSlot, getService, queryServiceAvailability, type WixBookingSlotFull
 import { createCheckout, createOrder } from "@himalaya/wix-ecom";
 import { createRedirectSession, type WixSlot } from "@himalaya/wix-redirects";
 import { payCashierOrder } from "@himalaya/checkout";
+import { hostedCheckoutOpener, isHostedWorker } from "../_shared/hosted-checkout.js";
 import { session as wixPlatformSession } from "@himalaya/wix-platform";
 import { displayName, getMyData, type WixMyData } from "@himalaya/wix-users";
 import { formatServicePrice, serviceIsChargeable } from "../_shared/wix-service-price.js";
@@ -662,9 +663,12 @@ const svc = defineService<S, {
           // 3. Create the Wix-managed order — mints the cashier snapshot when a
           //    balance is due. No paymentGatewayOrderId ⇒ nothing to charge
           //    (covered / zero total) ⇒ the booking is already confirmed.
-          const orderRes = await createOrder(checkoutId);
-          const snapshotId = orderRes.paymentGatewayOrderId;
-          if (!snapshotId) {
+          // Hosted (Spaces): the site's own checkout page creates the order (as
+          // RN does) — creating it here first fails on a site with no payment method set up.
+          const hosted = isHostedWorker();
+          const orderRes = hosted ? { paymentGatewayOrderId: "" } : await createOrder(checkoutId);
+          const snapshotId = orderRes.paymentGatewayOrderId ?? "";
+          if (!snapshotId && !hosted) {
             return derive({ ...pending, bookingInFlight: false, successMessage: copyParam("time.successMessage", "Booked. Your confirmation is ready in My Bookings."), message: "" });
           }
           // 4. Collect payment IN-APP — wallet when this app has one wired, otherwise
@@ -676,6 +680,8 @@ const svc = defineService<S, {
             appId: WIX_BOOKINGS_APP_ID,
             snapshotId,
             msid: await resolveMsid(),
+            // Hosted (Spaces): the host opens this booking's checkout as the lent member.
+            ...(hosted ? { openCashier: hostedCheckoutOpener(checkoutId) } : {}),
             cashierUrl: async () => {
               const redirect = await createRedirectSession({
                 bookingsCheckout: { slotAvailability: { slot: slot as unknown as WixSlot } },