@wix/himalaya-cli 0.1346.0 → 0.1349.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/flows/checkout/src/index.d.ts

@@ -62,6 +62,13 @@ export interface PayRequest {
     currency?: string;
     /** Mints the in-app cashier URL. Called ONLY when the wallet rail cannot settle. */
     cashierUrl?: () => Promise<string | undefined>;
+    /** Opens the cashier ITSELF, in place of `cashierUrl` + an in-app browser: a host that must sign
+     *  the member in on the site first (a hosted app's checkout, RFC 0071 §4 Step 4b) owns the URL,
+     *  which carries a session token no worker may see. Resolves whether the cashier opened, or
+     *  "withdrawn" when [stillMayCharge] — the caller's `mayCharge`, re-read — said no once the host had
+     *  prepared it: preparing takes network round trips, during which the caller's route can change, so
+     *  the host asks again right before it opens. */
+    openCashier?: (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn">;
     /** Re-read immediately before money moves (the wallet charge, the cashier opening). The caller's
      *  own route can change while a rail is being chosen; false stops the flow with nothing charged. */
     mayCharge?: () => boolean | Promise<boolean>;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/checkout.mjs

@@ -140,7 +140,7 @@ async function isEntitled() {
 }
 var WITHDRAWN = { kind: "failed", reason: "the caller withdrew the charge" };
 async function payOrder(req) {
-  if (!req.snapshotId && !req.cashierUrl) {
+  if (!req.snapshotId && !req.cashierUrl && !req.openCashier) {
     return { kind: "failed", reason: "no order to settle" };
   }
   const availability = await isAvailable().catch(() => "unavailable");
@@ -163,7 +163,12 @@ async function payOrder(req) {
     }
     if (r.status === "cancelled") return { kind: "cancelled" };
   }
-  if (req.cashierUrl) {
+  if (req.openCashier) {
+    if (await req.mayCharge?.() === false) return WITHDRAWN;
+    const opened = await req.openCashier(async () => await req.mayCharge?.() !== false).catch(() => false);
+    if (opened === "withdrawn") return WITHDRAWN;
+    if (opened === true) return { kind: "handoff" };
+  } else if (req.cashierUrl) {
     const url = await req.cashierUrl().catch(() => void 0);
     if (url) {
       if (await req.mayCharge?.() === false) return WITHDRAWN;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/screens.mjs

@@ -224,7 +224,7 @@ async function entitlement(planId) {
 }
 var WITHDRAWN = { kind: "failed", reason: "the caller withdrew the charge" };
 async function payOrder(req) {
-  if (!req.snapshotId && !req.cashierUrl) {
+  if (!req.snapshotId && !req.cashierUrl && !req.openCashier) {
     return { kind: "failed", reason: "no order to settle" };
   }
   const availability = await isAvailable().catch(() => "unavailable");
@@ -247,7 +247,12 @@ async function payOrder(req) {
     }
     if (r.status === "cancelled") return { kind: "cancelled" };
   }
-  if (req.cashierUrl) {
+  if (req.openCashier) {
+    if (await req.mayCharge?.() === false) return WITHDRAWN;
+    const opened = await req.openCashier(async () => await req.mayCharge?.() !== false).catch(() => false);
+    if (opened === "withdrawn") return WITHDRAWN;
+    if (opened === true) return { kind: "handoff" };
+  } else if (req.cashierUrl) {
     const url = await req.cashierUrl().catch(() => void 0);
     if (url) {
       if (await req.mayCharge?.() === false) return WITHDRAWN;

package/dist/cli.mjs

@@ -7706,7 +7706,6 @@ function resolveTranslation(value, catalog3, sourceCatalog) {
 var BINDING_SIGILS, BINDING_SIGIL_RE, TRANSLATION_PREFIX, TRANSLATION_KEY_RE;
 var init_bindings = __esm({
   "../../core/ts/src/bindings.ts"() {
-    "use strict";
     BINDING_SIGILS = ["service", "flag", "item", "t"];
     BINDING_SIGIL_RE = new RegExp(
       `^\\$(?:${BINDING_SIGILS.filter((s2) => s2 !== "t").join("|")})\\b|^\\$t:`
@@ -22951,6 +22950,7 @@ __export(gen_native_config_exports, {
   LABEL_MODULES_ANDROID_INCLUDE: () => LABEL_MODULES_ANDROID_INCLUDE,
   LABEL_MODULES_ANDROID_INSTALLERS: () => LABEL_MODULES_ANDROID_INSTALLERS,
   LABEL_MODULES_ANDROID_LINK: () => LABEL_MODULES_ANDROID_LINK,
+  LABEL_MODULES_IOS_FLAGS: () => LABEL_MODULES_IOS_FLAGS,
   LABEL_MODULES_IOS_LINK: () => LABEL_MODULES_IOS_LINK,
   LABEL_MODULES_IOS_PACKAGE: () => LABEL_MODULES_IOS_PACKAGE,
   LABEL_MODULES_SWIFT_IMPORT: () => LABEL_MODULES_SWIFT_IMPORT,
@@ -22963,7 +22963,9 @@ __export(gen_native_config_exports, {
   androidPlanFor: () => androidPlanFor,
   androidSettingsGradle: () => androidSettingsGradle,
   androidTvLeanbackPlan: () => androidTvLeanbackPlan,
+  applyModuleFlags: () => applyModuleFlags,
   applyToFile: () => applyToFile,
+  assertModuleFlagsMarkers: () => assertModuleFlagsMarkers,
   assertSingleMarkerPair: () => assertSingleMarkerPair,
   assertSingleModuleInstall: () => assertSingleModuleInstall,
   automotiveAppDescPath: () => automotiveAppDescPath,
@@ -22983,6 +22985,7 @@ __export(gen_native_config_exports, {
   iosPlanFor: () => iosPlanFor,
   kotlinBootSourcesUnder: () => kotlinBootSourcesUnder,
   kotlinFilesWithModuleInstall: () => kotlinFilesWithModuleInstall,
+  linkedFlag: () => linkedFlag,
   loadOverrides: () => loadOverrides,
   macosPlanFor: () => macosPlanFor,
   moduleLinkRenderers: () => moduleLinkRenderers,
@@ -23001,6 +23004,7 @@ __export(gen_native_config_exports, {
   renderModulesAndroidInstallers: () => renderModulesAndroidInstallers,
   renderModulesAndroidLink: () => renderModulesAndroidLink,
   renderModulesAndroidLinkBinary: () => renderModulesAndroidLinkBinary,
+  renderModulesIosFlags: () => renderModulesIosFlags,
   renderModulesIosLink: () => renderModulesIosLink,
   renderModulesIosLinkBinary: () => renderModulesIosLinkBinary,
   renderModulesIosPackage: () => renderModulesIosPackage,
@@ -23226,13 +23230,16 @@ function renderModulesAndroidLinkBinary(projects, coreVersion, indent) {
 function moduleLinkRenderers(modules, binary) {
   if (!binary) {
     return {
+      iosLinked: () => modules.spm,
       iosPackage: (i2) => renderModulesIosPackage(modules.spm, i2),
       iosLink: (i2) => renderModulesIosLink(modules.spm, i2),
       androidInclude: (i2) => renderModulesAndroidInclude(modules.gradle, i2),
       androidLink: (i2) => renderModulesAndroidLink(modules.gradle, i2)
     };
   }
+  const iosLinked = () => modules.spm.length && coreVersionHasModules(binary.coreVersion()) ? modules.spm : [];
   return {
+    iosLinked,
     iosPackage: (i2) => modules.spm.length && coreVersionHasModules(binary.coreVersion()) ? renderModulesIosPackageBinary(modules.spm, binary.corePackagePath?.(), i2) : [],
     // Same version rule as Android: a pre-split core carries the capabilities and has no products.
     iosLink: (i2) => modules.spm.length && coreVersionHasModules(binary.coreVersion()) ? renderModulesIosLinkBinary(modules.spm, i2) : [],
@@ -23246,14 +23253,17 @@ function moduleLinkRenderers(modules, binary) {
     }
   };
 }
+function renderModulesIosFlags(products, indent) {
+  return [`${indent}OTHER_SWIFT_FLAGS: "${["$(inherited)", ...products.map((p2) => `-D${linkedFlag(p2)}`)].join(" ")}"`];
+}
 function renderModulesSwiftImport(indent) {
   return NATIVE_MODULES.flatMap(
-    (m2) => m2.ios ? [`${indent}#if canImport(${m2.ios.product})`, `${indent}import ${m2.ios.product}`, `${indent}#endif`] : []
+    (m2) => m2.ios ? [`${indent}#if canImport(${m2.ios.product}) && ${linkedFlag(m2.ios.product)}`, `${indent}import ${m2.ios.product}`, `${indent}#endif`] : []
   );
 }
 function renderModulesSwiftInstall(indent) {
   return NATIVE_MODULES.flatMap(
-    (m2) => m2.ios ? [`${indent}#if canImport(${m2.ios.product})`, `${indent}${m2.ios.product}.install()`, `${indent}#endif`] : []
+    (m2) => m2.ios ? [`${indent}#if canImport(${m2.ios.product}) && ${linkedFlag(m2.ios.product)}`, `${indent}${m2.ios.product}.install()`, `${indent}#endif`] : []
   );
 }
 function renderModulesAndroidInstallers(indent) {
@@ -23433,6 +23443,19 @@ function applyToFile(path2, kind, label2, render, check) {
   writeFileSync13(path2, after);
   return { path: path2, outcome: "written" };
 }
+function assertModuleFlagsMarkers(paths) {
+  for (const path2 of paths) {
+    if (!existsSync34(path2)) continue;
+    const text9 = readFileSync33(path2, "utf8");
+    if (hasMarkers(text9, "yaml", LABEL_MODULES_IOS_LINK) && !hasMarkers(text9, "yaml", LABEL_MODULES_IOS_FLAGS)) {
+      throw new Error(`${path2} links modules (${LABEL_MODULES_IOS_LINK}) but has no ${LABEL_MODULES_IOS_FLAGS} block under its project-level settings:, so no module would install. Add the markers (see apps/_template).`);
+    }
+  }
+}
+function applyModuleFlags(path2, products, check) {
+  assertModuleFlagsMarkers([path2]);
+  return applyToFile(path2, "yaml", LABEL_MODULES_IOS_FLAGS, (i2) => renderModulesIosFlags(products, i2), check);
+}
 function applyWholeFile(path2, content, check) {
   const current = existsSync34(path2) ? readFileSync33(path2, "utf8") : null;
   if (current === content) return { path: path2, outcome: "unchanged" };
@@ -23485,6 +23508,7 @@ function genNativeConfig(app, opts = {}) {
   const check = opts.check ?? false;
   assertSingleModuleInstall(app, swiftFilesWithModuleMarkers(app));
   assertSingleModuleInstall(app, kotlinFilesWithModuleInstall(app));
+  assertModuleFlagsMarkers([iosProjectYml(app), macosProjectYml(app)]);
   const configPath = appConfigTs(app);
   const configTs = existsSync34(configPath) ? readFileSync33(configPath, "utf8") : "";
   const capabilities = parseStringArray(configTs, "capabilities");
@@ -23589,9 +23613,11 @@ function genNativeConfig(app, opts = {}) {
     // published AARs (#4055): no source package, no settings include.
     applyToFile(iosProjectYml(app), "yaml", LABEL_MODULES_IOS_PACKAGE, moduleLinks.iosPackage, check),
     applyToFile(iosProjectYml(app), "yaml", LABEL_MODULES_IOS_LINK, moduleLinks.iosLink, check),
+    applyModuleFlags(iosProjectYml(app), moduleLinks.iosLinked(), check),
     // macOS (RFC 0046) reuses the iOS boot, so it links the same macOS-capable modules.
     applyToFile(macosProjectYml(app), "yaml", LABEL_MODULES_IOS_PACKAGE, (i2) => renderModulesIosPackage(modules.macos, i2), check),
     applyToFile(macosProjectYml(app), "yaml", LABEL_MODULES_IOS_LINK, (i2) => renderModulesIosLink(modules.macos, i2), check),
+    applyModuleFlags(macosProjectYml(app), modules.macos, check),
     applyToFile(androidSettingsGradle(app), "slash", LABEL_MODULES_ANDROID_INCLUDE, moduleLinks.androidInclude, check),
     applyToFile(androidAppGradle(app), "slash", LABEL_MODULES_ANDROID_LINK, moduleLinks.androidLink, check),
     // watchOS (RFC 0047): the watch runtime mode/serve, declared once in config.ts. A watch
@@ -23685,7 +23711,7 @@ function genNativeConfig(app, opts = {}) {
   );
   return { app, buildSet: ids, files, drift: files.some((f2) => f2.outcome === "drift") };
 }
-var LABEL_IOS_INFO, LABEL_IOS_ENTITLEMENTS, LABEL_ANDROID, LABEL_ANDROID_SERVICES, LABEL_MODULES_IOS_PACKAGE, LABEL_MODULES_IOS_LINK, LABEL_MODULES_ANDROID_INCLUDE, LABEL_MODULES_ANDROID_LINK, LABEL_MODULES_SWIFT_IMPORT, LABEL_MODULES_SWIFT_INSTALL, LABEL_MODULES_ANDROID_INSTALLERS, LABEL_WATCH, LABEL_TV, LABEL_ANDROID_TV, LABEL_ORIENTATION, LABEL_CAR, IOS_ORIENTATION, ALL_ORIENTATIONS, HEALTH_PERMISSION_COPY_META, FROM_APP_PLATFORM_DIR, CORE_ANDROID_CAPABILITY_MODULES, ANDROID_MAX_DEPTH, BOOT_SOURCE_MAX_BYTES, IOS_BUILD_CAPABILITIES_KEY, IOS_DIST_CAPABILITIES_KEY, ANDROID_BUILD_CAPABILITIES_META, ANDROID_DIST_CAPABILITIES_META;
+var LABEL_IOS_INFO, LABEL_IOS_ENTITLEMENTS, LABEL_ANDROID, LABEL_ANDROID_SERVICES, LABEL_MODULES_IOS_PACKAGE, LABEL_MODULES_IOS_LINK, LABEL_MODULES_ANDROID_INCLUDE, LABEL_MODULES_ANDROID_LINK, LABEL_MODULES_IOS_FLAGS, LABEL_MODULES_SWIFT_IMPORT, LABEL_MODULES_SWIFT_INSTALL, LABEL_MODULES_ANDROID_INSTALLERS, LABEL_WATCH, LABEL_TV, LABEL_ANDROID_TV, LABEL_ORIENTATION, LABEL_CAR, IOS_ORIENTATION, ALL_ORIENTATIONS, HEALTH_PERMISSION_COPY_META, FROM_APP_PLATFORM_DIR, linkedFlag, CORE_ANDROID_CAPABILITY_MODULES, ANDROID_MAX_DEPTH, BOOT_SOURCE_MAX_BYTES, IOS_BUILD_CAPABILITIES_KEY, IOS_DIST_CAPABILITIES_KEY, ANDROID_BUILD_CAPABILITIES_META, ANDROID_DIST_CAPABILITIES_META;
 var init_gen_native_config = __esm({
   "../native-config/gen-native-config.ts"() {
     init_src2();
@@ -23708,6 +23734,7 @@ var init_gen_native_config = __esm({
     LABEL_MODULES_IOS_LINK = "himalaya:modules:link";
     LABEL_MODULES_ANDROID_INCLUDE = "himalaya:modules:include";
     LABEL_MODULES_ANDROID_LINK = "himalaya:modules:dep";
+    LABEL_MODULES_IOS_FLAGS = "himalaya:modules:flags";
     LABEL_MODULES_SWIFT_IMPORT = "himalaya:modules:import";
     LABEL_MODULES_SWIFT_INSTALL = "himalaya:modules:install";
     LABEL_MODULES_ANDROID_INSTALLERS = "himalaya:modules:installers";
@@ -23725,6 +23752,7 @@ var init_gen_native_config = __esm({
     ALL_ORIENTATIONS = ["portrait", "portraitUpsideDown", "landscapeLeft", "landscapeRight"];
     HEALTH_PERMISSION_COPY_META = "io.himalaya.health.permissionCopy";
     FROM_APP_PLATFORM_DIR = "../../../";
+    linkedFlag = (product) => `HIMALAYA_LINKED_${product}`;
     CORE_ANDROID_CAPABILITY_MODULES = join34(
       dirname21(fileURLToPath14(import.meta.url)),
       "../../core/runtime/android/io/himalaya/core/src/main/kotlin/io/himalaya/core/CapabilityModules.kt"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1346.0",
+  "version": "0.1349.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "d5621e3868f8ab4e19fa7e96c23ab61fd87096ddaa12ed3f7a1f8f31"
+  "falconPackageHash": "9279a00f8a3383291b5d42997cd4086dac34b4ccf1c4b62d3869dd44"
 }

package/templates/beauty-salon/tier5-src/_shared/hosted-checkout.ts

@@ -0,0 +1,42 @@
+// Hosted checkout (#4089 B3). A Branded Lite hosted in a host shell (Spaces)
+// pays as the member the host lent it: Headless `createRedirectSession` does not take a Member
+// instance, so the HOST opens the site's checkout signed in as that member. The worker names only
+// its ecom checkout; the host reads Wix's checkout URL, mints a one-time member session and opens
+// the site's `createSessionCookie` → checkout. The session token never reaches this worker.
+
+import { dispatch } from "@himalaya/dispatch";
+import { hostSiteFromInput } from "./branded-lite-hosted.js";
+
+/** The host verbs (registered by the host shell, never by the app itself). The first prepares the
+ *  checkout and answers a one-time ticket; the second opens it. Two steps so the caller's charge guard
+ *  is re-read after the host's network round trips and right before the checkout opens — the prepared
+ *  URL (which carries the member's session token) stays in the host; only the ticket crosses here. */
+export const HOSTED_CHECKOUT_ACTION = "himi.host.memberCheckout";
+export const HOSTED_CHECKOUT_OPEN_ACTION = "himi.host.memberCheckout.open";
+
+/** Whether this worker runs inside a host that opened a site for it. */
+export function isHostedWorker(): boolean {
+  return hostSiteFromInput((globalThis as { himalaya?: { input?: unknown } }).himalaya?.input) !== null;
+}
+
+type HostAnswer = { opened?: unknown; ticket?: unknown; payload?: { opened?: unknown; ticket?: unknown } } | null;
+
+/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
+ *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
+ *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
+export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn"> {
+  return async (stillMayCharge) => {
+    try {
+      const prepared = await dispatch(HOSTED_CHECKOUT_ACTION, { checkoutId }) as HostAnswer;
+      const ticket = prepared?.ticket ?? prepared?.payload?.ticket;
+      if (typeof ticket !== "string" || !ticket) return false;
+      // An unopened ticket simply expires in the host: nothing to cancel.
+      if (!(await stillMayCharge())) return "withdrawn";
+      const result = await dispatch(HOSTED_CHECKOUT_OPEN_ACTION, { ticket }) as HostAnswer;
+      const opened = result?.opened ?? result?.payload?.opened;
+      return opened === true || opened === "true";
+    } catch {
+      return false;
+    }
+  };
+}

package/templates/beauty-salon/tier5-src/himi-booking-time/index.ts

@@ -9,6 +9,7 @@ import { bookSlot, getService, queryServiceAvailability, type WixBookingSlotFull
 import { createCheckout, createOrder } from "@himalaya/wix-ecom";
 import { createRedirectSession, type WixSlot } from "@himalaya/wix-redirects";
 import { payCashierOrder } from "@himalaya/checkout";
+import { hostedCheckoutOpener, isHostedWorker } from "../_shared/hosted-checkout.js";
 import { session as wixPlatformSession } from "@himalaya/wix-platform";
 import { displayName, getMyData, type WixMyData } from "@himalaya/wix-users";
 import { formatServicePrice, serviceIsChargeable } from "../_shared/wix-service-price.js";
@@ -662,9 +663,12 @@ const svc = defineService<S, {
           // 3. Create the Wix-managed order — mints the cashier snapshot when a
           //    balance is due. No paymentGatewayOrderId ⇒ nothing to charge
           //    (covered / zero total) ⇒ the booking is already confirmed.
-          const orderRes = await createOrder(checkoutId);
-          const snapshotId = orderRes.paymentGatewayOrderId;
-          if (!snapshotId) {
+          // Hosted (Spaces): the site's own checkout page creates the order (as
+          // RN does) — creating it here first fails on a site with no payment method set up.
+          const hosted = isHostedWorker();
+          const orderRes = hosted ? { paymentGatewayOrderId: "" } : await createOrder(checkoutId);
+          const snapshotId = orderRes.paymentGatewayOrderId ?? "";
+          if (!snapshotId && !hosted) {
             return derive({ ...pending, bookingInFlight: false, successMessage: copyParam("time.successMessage", "Booked. Your confirmation is ready in My Bookings."), message: "" });
           }
           // 4. Collect payment IN-APP — wallet when this app has one wired, otherwise
@@ -676,6 +680,8 @@ const svc = defineService<S, {
             appId: WIX_BOOKINGS_APP_ID,
             snapshotId,
             msid: await resolveMsid(),
+            // Hosted (Spaces): the host opens this booking's checkout as the lent member.
+            ...(hosted ? { openCashier: hostedCheckoutOpener(checkoutId) } : {}),
             cashierUrl: async () => {
               const redirect = await createRedirectSession({
                 bookingsCheckout: { slotAvailability: { slot: slot as unknown as WixSlot } },

package/templates/beauty-salon/tier5-src/himi-branded-lite-cart/index.ts

@@ -6,6 +6,7 @@ import { createCheckoutFromCurrentCart, createOrder, getCurrentCart, removeLineI
 import { createRedirectSession } from "@himalaya/wix-redirects";
 import { session as wixPlatformSession } from "@himalaya/wix-platform";
 import { payCashierOrder } from "@himalaya/checkout";
+import { hostedCheckoutOpener, isHostedWorker } from "../_shared/hosted-checkout.js";
 
 /** Wix Stores appDefId — the vertical that owns a cart/ecom order, and therefore the
  *  `appId` its cashier order is paid under. (Same constant Wix's own tooling uses.) */
@@ -317,9 +318,13 @@ const svc = defineService<State, {
         if (!checkout.checkoutId) return derive({ ...state, checkoutHint: copyParam("cart.checkoutIdMissingMessage", "Wix did not return a checkout id.") });
         const checkoutId = checkout.checkoutId;
 
-        const order = await createOrder(checkoutId);
-        const snapshotId = order.paymentGatewayOrderId;
-        if (!snapshotId) {
+        // Hosted (Spaces): the site's own checkout page creates the order (RN's
+        // route) — creating it here first fails on a site with no payment method set up, before the
+        // member ever reaches the checkout. The host opens the checkout as the lent member.
+        const hosted = isHostedWorker();
+        const order = hosted ? { paymentGatewayOrderId: "" } : await createOrder(checkoutId);
+        const snapshotId = order.paymentGatewayOrderId ?? "";
+        if (!snapshotId && !hosted) {
           return derive({ ...state, ...cartConsumedByOrder() });
         }
 
@@ -335,6 +340,9 @@ const svc = defineService<State, {
               return !!reference && cartPricing.pricing.continueCheckoutGuard({ kind: "storesProduct", id: reference.catalogItemId }).allowed;
             });
           },
+          // Hosted (Spaces): the host opens the checkout as the lent member — Headless redirect
+          // sessions do not take a Member instance.
+          ...(hosted ? { openCashier: hostedCheckoutOpener(checkoutId) } : {}),
           cashierUrl: async () => {
             const redirect = await createRedirectSession({
               ecomCheckout: { checkoutId },

package/templates/branded-lite/tier5-src/_shared/hosted-checkout.ts

@@ -0,0 +1,42 @@
+// Hosted checkout (#4089 B3). A Branded Lite hosted in a host shell (Spaces)
+// pays as the member the host lent it: Headless `createRedirectSession` does not take a Member
+// instance, so the HOST opens the site's checkout signed in as that member. The worker names only
+// its ecom checkout; the host reads Wix's checkout URL, mints a one-time member session and opens
+// the site's `createSessionCookie` → checkout. The session token never reaches this worker.
+
+import { dispatch } from "@himalaya/dispatch";
+import { hostSiteFromInput } from "./branded-lite-hosted.js";
+
+/** The host verbs (registered by the host shell, never by the app itself). The first prepares the
+ *  checkout and answers a one-time ticket; the second opens it. Two steps so the caller's charge guard
+ *  is re-read after the host's network round trips and right before the checkout opens — the prepared
+ *  URL (which carries the member's session token) stays in the host; only the ticket crosses here. */
+export const HOSTED_CHECKOUT_ACTION = "himi.host.memberCheckout";
+export const HOSTED_CHECKOUT_OPEN_ACTION = "himi.host.memberCheckout.open";
+
+/** Whether this worker runs inside a host that opened a site for it. */
+export function isHostedWorker(): boolean {
+  return hostSiteFromInput((globalThis as { himalaya?: { input?: unknown } }).himalaya?.input) !== null;
+}
+
+type HostAnswer = { opened?: unknown; ticket?: unknown; payload?: { opened?: unknown; ticket?: unknown } } | null;
+
+/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
+ *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
+ *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
+export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn"> {
+  return async (stillMayCharge) => {
+    try {
+      const prepared = await dispatch(HOSTED_CHECKOUT_ACTION, { checkoutId }) as HostAnswer;
+      const ticket = prepared?.ticket ?? prepared?.payload?.ticket;
+      if (typeof ticket !== "string" || !ticket) return false;
+      // An unopened ticket simply expires in the host: nothing to cancel.
+      if (!(await stillMayCharge())) return "withdrawn";
+      const result = await dispatch(HOSTED_CHECKOUT_OPEN_ACTION, { ticket }) as HostAnswer;
+      const opened = result?.opened ?? result?.payload?.opened;
+      return opened === true || opened === "true";
+    } catch {
+      return false;
+    }
+  };
+}

package/templates/branded-lite/tier5-src/himi-booking-time/index.ts

@@ -9,6 +9,7 @@ import { bookSlot, getService, queryServiceAvailability, type WixBookingSlotFull
 import { createCheckout, createOrder } from "@himalaya/wix-ecom";
 import { createRedirectSession, type WixSlot } from "@himalaya/wix-redirects";
 import { payCashierOrder } from "@himalaya/checkout";
+import { hostedCheckoutOpener, isHostedWorker } from "../_shared/hosted-checkout.js";
 import { session as wixPlatformSession } from "@himalaya/wix-platform";
 import { displayName, getMyData, type WixMyData } from "@himalaya/wix-users";
 import { formatServicePrice, serviceIsChargeable } from "../_shared/wix-service-price.js";
@@ -662,9 +663,12 @@ const svc = defineService<S, {
           // 3. Create the Wix-managed order — mints the cashier snapshot when a
           //    balance is due. No paymentGatewayOrderId ⇒ nothing to charge
           //    (covered / zero total) ⇒ the booking is already confirmed.
-          const orderRes = await createOrder(checkoutId);
-          const snapshotId = orderRes.paymentGatewayOrderId;
-          if (!snapshotId) {
+          // Hosted (Spaces): the site's own checkout page creates the order (as
+          // RN does) — creating it here first fails on a site with no payment method set up.
+          const hosted = isHostedWorker();
+          const orderRes = hosted ? { paymentGatewayOrderId: "" } : await createOrder(checkoutId);
+          const snapshotId = orderRes.paymentGatewayOrderId ?? "";
+          if (!snapshotId && !hosted) {
             return derive({ ...pending, bookingInFlight: false, successMessage: copyParam("time.successMessage", "Booked. Your confirmation is ready in My Bookings."), message: "" });
           }
           // 4. Collect payment IN-APP — wallet when this app has one wired, otherwise
@@ -676,6 +680,8 @@ const svc = defineService<S, {
             appId: WIX_BOOKINGS_APP_ID,
             snapshotId,
             msid: await resolveMsid(),
+            // Hosted (Spaces): the host opens this booking's checkout as the lent member.
+            ...(hosted ? { openCashier: hostedCheckoutOpener(checkoutId) } : {}),
             cashierUrl: async () => {
               const redirect = await createRedirectSession({
                 bookingsCheckout: { slotAvailability: { slot: slot as unknown as WixSlot } },

package/templates/branded-lite/tier5-src/himi-branded-lite-cart/index.ts

@@ -6,6 +6,7 @@ import { createCheckoutFromCurrentCart, createOrder, getCurrentCart, removeLineI
 import { createRedirectSession } from "@himalaya/wix-redirects";
 import { session as wixPlatformSession } from "@himalaya/wix-platform";
 import { payCashierOrder } from "@himalaya/checkout";
+import { hostedCheckoutOpener, isHostedWorker } from "../_shared/hosted-checkout.js";
 
 /** Wix Stores appDefId — the vertical that owns a cart/ecom order, and therefore the
  *  `appId` its cashier order is paid under. (Same constant Wix's own tooling uses.) */
@@ -317,9 +318,13 @@ const svc = defineService<State, {
         if (!checkout.checkoutId) return derive({ ...state, checkoutHint: copyParam("cart.checkoutIdMissingMessage", "Wix did not return a checkout id.") });
         const checkoutId = checkout.checkoutId;
 
-        const order = await createOrder(checkoutId);
-        const snapshotId = order.paymentGatewayOrderId;
-        if (!snapshotId) {
+        // Hosted (Spaces): the site's own checkout page creates the order (RN's
+        // route) — creating it here first fails on a site with no payment method set up, before the
+        // member ever reaches the checkout. The host opens the checkout as the lent member.
+        const hosted = isHostedWorker();
+        const order = hosted ? { paymentGatewayOrderId: "" } : await createOrder(checkoutId);
+        const snapshotId = order.paymentGatewayOrderId ?? "";
+        if (!snapshotId && !hosted) {
           return derive({ ...state, ...cartConsumedByOrder() });
         }
 
@@ -335,6 +340,9 @@ const svc = defineService<State, {
               return !!reference && cartPricing.pricing.continueCheckoutGuard({ kind: "storesProduct", id: reference.catalogItemId }).allowed;
             });
           },
+          // Hosted (Spaces): the host opens the checkout as the lent member — Headless redirect
+          // sessions do not take a Member instance.
+          ...(hosted ? { openCashier: hostedCheckoutOpener(checkoutId) } : {}),
           cashierUrl: async () => {
             const redirect = await createRedirectSession({
               ecomCheckout: { checkoutId },

package/templates/gym-fitness/tier5-src/_shared/hosted-checkout.ts

@@ -0,0 +1,42 @@
+// Hosted checkout (#4089 B3). A Branded Lite hosted in a host shell (Spaces)
+// pays as the member the host lent it: Headless `createRedirectSession` does not take a Member
+// instance, so the HOST opens the site's checkout signed in as that member. The worker names only
+// its ecom checkout; the host reads Wix's checkout URL, mints a one-time member session and opens
+// the site's `createSessionCookie` → checkout. The session token never reaches this worker.
+
+import { dispatch } from "@himalaya/dispatch";
+import { hostSiteFromInput } from "./branded-lite-hosted.js";
+
+/** The host verbs (registered by the host shell, never by the app itself). The first prepares the
+ *  checkout and answers a one-time ticket; the second opens it. Two steps so the caller's charge guard
+ *  is re-read after the host's network round trips and right before the checkout opens — the prepared
+ *  URL (which carries the member's session token) stays in the host; only the ticket crosses here. */
+export const HOSTED_CHECKOUT_ACTION = "himi.host.memberCheckout";
+export const HOSTED_CHECKOUT_OPEN_ACTION = "himi.host.memberCheckout.open";
+
+/** Whether this worker runs inside a host that opened a site for it. */
+export function isHostedWorker(): boolean {
+  return hostSiteFromInput((globalThis as { himalaya?: { input?: unknown } }).himalaya?.input) !== null;
+}
+
+type HostAnswer = { opened?: unknown; ticket?: unknown; payload?: { opened?: unknown; ticket?: unknown } } | null;
+
+/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
+ *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
+ *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
+export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn"> {
+  return async (stillMayCharge) => {
+    try {
+      const prepared = await dispatch(HOSTED_CHECKOUT_ACTION, { checkoutId }) as HostAnswer;
+      const ticket = prepared?.ticket ?? prepared?.payload?.ticket;
+      if (typeof ticket !== "string" || !ticket) return false;
+      // An unopened ticket simply expires in the host: nothing to cancel.
+      if (!(await stillMayCharge())) return "withdrawn";
+      const result = await dispatch(HOSTED_CHECKOUT_OPEN_ACTION, { ticket }) as HostAnswer;
+      const opened = result?.opened ?? result?.payload?.opened;
+      return opened === true || opened === "true";
+    } catch {
+      return false;
+    }
+  };
+}

package/templates/gym-fitness/tier5-src/himi-booking-time/index.ts

@@ -9,6 +9,7 @@ import { bookSlot, getService, queryServiceAvailability, type WixBookingSlotFull
 import { createCheckout, createOrder } from "@himalaya/wix-ecom";
 import { createRedirectSession, type WixSlot } from "@himalaya/wix-redirects";
 import { payCashierOrder } from "@himalaya/checkout";
+import { hostedCheckoutOpener, isHostedWorker } from "../_shared/hosted-checkout.js";
 import { session as wixPlatformSession } from "@himalaya/wix-platform";
 import { displayName, getMyData, type WixMyData } from "@himalaya/wix-users";
 import { formatServicePrice, serviceIsChargeable } from "../_shared/wix-service-price.js";
@@ -662,9 +663,12 @@ const svc = defineService<S, {
           // 3. Create the Wix-managed order — mints the cashier snapshot when a
           //    balance is due. No paymentGatewayOrderId ⇒ nothing to charge
           //    (covered / zero total) ⇒ the booking is already confirmed.
-          const orderRes = await createOrder(checkoutId);
-          const snapshotId = orderRes.paymentGatewayOrderId;
-          if (!snapshotId) {
+          // Hosted (Spaces): the site's own checkout page creates the order (as
+          // RN does) — creating it here first fails on a site with no payment method set up.
+          const hosted = isHostedWorker();
+          const orderRes = hosted ? { paymentGatewayOrderId: "" } : await createOrder(checkoutId);
+          const snapshotId = orderRes.paymentGatewayOrderId ?? "";
+          if (!snapshotId && !hosted) {
             return derive({ ...pending, bookingInFlight: false, successMessage: copyParam("time.successMessage", "Booked. Your confirmation is ready in My Bookings."), message: "" });
           }
           // 4. Collect payment IN-APP — wallet when this app has one wired, otherwise
@@ -676,6 +680,8 @@ const svc = defineService<S, {
             appId: WIX_BOOKINGS_APP_ID,
             snapshotId,
             msid: await resolveMsid(),
+            // Hosted (Spaces): the host opens this booking's checkout as the lent member.
+            ...(hosted ? { openCashier: hostedCheckoutOpener(checkoutId) } : {}),
             cashierUrl: async () => {
               const redirect = await createRedirectSession({
                 bookingsCheckout: { slotAvailability: { slot: slot as unknown as WixSlot } },

package/templates/gym-fitness/tier5-src/himi-branded-lite-cart/index.ts

@@ -6,6 +6,7 @@ import { createCheckoutFromCurrentCart, createOrder, getCurrentCart, removeLineI
 import { createRedirectSession } from "@himalaya/wix-redirects";
 import { session as wixPlatformSession } from "@himalaya/wix-platform";
 import { payCashierOrder } from "@himalaya/checkout";
+import { hostedCheckoutOpener, isHostedWorker } from "../_shared/hosted-checkout.js";
 
 /** Wix Stores appDefId — the vertical that owns a cart/ecom order, and therefore the
  *  `appId` its cashier order is paid under. (Same constant Wix's own tooling uses.) */
@@ -317,9 +318,13 @@ const svc = defineService<State, {
         if (!checkout.checkoutId) return derive({ ...state, checkoutHint: copyParam("cart.checkoutIdMissingMessage", "Wix did not return a checkout id.") });
         const checkoutId = checkout.checkoutId;
 
-        const order = await createOrder(checkoutId);
-        const snapshotId = order.paymentGatewayOrderId;
-        if (!snapshotId) {
+        // Hosted (Spaces): the site's own checkout page creates the order (RN's
+        // route) — creating it here first fails on a site with no payment method set up, before the
+        // member ever reaches the checkout. The host opens the checkout as the lent member.
+        const hosted = isHostedWorker();
+        const order = hosted ? { paymentGatewayOrderId: "" } : await createOrder(checkoutId);
+        const snapshotId = order.paymentGatewayOrderId ?? "";
+        if (!snapshotId && !hosted) {
           return derive({ ...state, ...cartConsumedByOrder() });
         }
 
@@ -335,6 +340,9 @@ const svc = defineService<State, {
               return !!reference && cartPricing.pricing.continueCheckoutGuard({ kind: "storesProduct", id: reference.catalogItemId }).allowed;
             });
           },
+          // Hosted (Spaces): the host opens the checkout as the lent member — Headless redirect
+          // sessions do not take a Member instance.
+          ...(hosted ? { openCashier: hostedCheckoutOpener(checkoutId) } : {}),
           cashierUrl: async () => {
             const redirect = await createRedirectSession({
               ecomCheckout: { checkoutId },

package/templates/portfolio-creative/tier5-src/_shared/hosted-checkout.ts

@@ -0,0 +1,42 @@
+// Hosted checkout (#4089 B3). A Branded Lite hosted in a host shell (Spaces)
+// pays as the member the host lent it: Headless `createRedirectSession` does not take a Member
+// instance, so the HOST opens the site's checkout signed in as that member. The worker names only
+// its ecom checkout; the host reads Wix's checkout URL, mints a one-time member session and opens
+// the site's `createSessionCookie` → checkout. The session token never reaches this worker.
+
+import { dispatch } from "@himalaya/dispatch";
+import { hostSiteFromInput } from "./branded-lite-hosted.js";
+
+/** The host verbs (registered by the host shell, never by the app itself). The first prepares the
+ *  checkout and answers a one-time ticket; the second opens it. Two steps so the caller's charge guard
+ *  is re-read after the host's network round trips and right before the checkout opens — the prepared
+ *  URL (which carries the member's session token) stays in the host; only the ticket crosses here. */
+export const HOSTED_CHECKOUT_ACTION = "himi.host.memberCheckout";
+export const HOSTED_CHECKOUT_OPEN_ACTION = "himi.host.memberCheckout.open";
+
+/** Whether this worker runs inside a host that opened a site for it. */
+export function isHostedWorker(): boolean {
+  return hostSiteFromInput((globalThis as { himalaya?: { input?: unknown } }).himalaya?.input) !== null;
+}
+
+type HostAnswer = { opened?: unknown; ticket?: unknown; payload?: { opened?: unknown; ticket?: unknown } } | null;
+
+/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
+ *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
+ *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
+export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn"> {
+  return async (stillMayCharge) => {
+    try {
+      const prepared = await dispatch(HOSTED_CHECKOUT_ACTION, { checkoutId }) as HostAnswer;
+      const ticket = prepared?.ticket ?? prepared?.payload?.ticket;
+      if (typeof ticket !== "string" || !ticket) return false;
+      // An unopened ticket simply expires in the host: nothing to cancel.
+      if (!(await stillMayCharge())) return "withdrawn";
+      const result = await dispatch(HOSTED_CHECKOUT_OPEN_ACTION, { ticket }) as HostAnswer;
+      const opened = result?.opened ?? result?.payload?.opened;
+      return opened === true || opened === "true";
+    } catch {
+      return false;
+    }
+  };
+}

package/templates/portfolio-creative/tier5-src/himi-branded-lite-cart/index.ts

@@ -6,6 +6,7 @@ import { createCheckoutFromCurrentCart, createOrder, getCurrentCart, removeLineI
 import { createRedirectSession } from "@himalaya/wix-redirects";
 import { session as wixPlatformSession } from "@himalaya/wix-platform";
 import { payCashierOrder } from "@himalaya/checkout";
+import { hostedCheckoutOpener, isHostedWorker } from "../_shared/hosted-checkout.js";
 
 /** Wix Stores appDefId — the vertical that owns a cart/ecom order, and therefore the
  *  `appId` its cashier order is paid under. (Same constant Wix's own tooling uses.) */
@@ -317,9 +318,13 @@ const svc = defineService<State, {
         if (!checkout.checkoutId) return derive({ ...state, checkoutHint: copyParam("cart.checkoutIdMissingMessage", "Wix did not return a checkout id.") });
         const checkoutId = checkout.checkoutId;
 
-        const order = await createOrder(checkoutId);
-        const snapshotId = order.paymentGatewayOrderId;
-        if (!snapshotId) {
+        // Hosted (Spaces): the site's own checkout page creates the order (RN's
+        // route) — creating it here first fails on a site with no payment method set up, before the
+        // member ever reaches the checkout. The host opens the checkout as the lent member.
+        const hosted = isHostedWorker();
+        const order = hosted ? { paymentGatewayOrderId: "" } : await createOrder(checkoutId);
+        const snapshotId = order.paymentGatewayOrderId ?? "";
+        if (!snapshotId && !hosted) {
           return derive({ ...state, ...cartConsumedByOrder() });
         }
 
@@ -335,6 +340,9 @@ const svc = defineService<State, {
               return !!reference && cartPricing.pricing.continueCheckoutGuard({ kind: "storesProduct", id: reference.catalogItemId }).allowed;
             });
           },
+          // Hosted (Spaces): the host opens the checkout as the lent member — Headless redirect
+          // sessions do not take a Member instance.
+          ...(hosted ? { openCashier: hostedCheckoutOpener(checkoutId) } : {}),
           cashierUrl: async () => {
             const redirect = await createRedirectSession({
               ecomCheckout: { checkoutId },

package/templates/retail-store/tier5-src/_shared/hosted-checkout.ts

@@ -0,0 +1,42 @@
+// Hosted checkout (#4089 B3). A Branded Lite hosted in a host shell (Spaces)
+// pays as the member the host lent it: Headless `createRedirectSession` does not take a Member
+// instance, so the HOST opens the site's checkout signed in as that member. The worker names only
+// its ecom checkout; the host reads Wix's checkout URL, mints a one-time member session and opens
+// the site's `createSessionCookie` → checkout. The session token never reaches this worker.
+
+import { dispatch } from "@himalaya/dispatch";
+import { hostSiteFromInput } from "./branded-lite-hosted.js";
+
+/** The host verbs (registered by the host shell, never by the app itself). The first prepares the
+ *  checkout and answers a one-time ticket; the second opens it. Two steps so the caller's charge guard
+ *  is re-read after the host's network round trips and right before the checkout opens — the prepared
+ *  URL (which carries the member's session token) stays in the host; only the ticket crosses here. */
+export const HOSTED_CHECKOUT_ACTION = "himi.host.memberCheckout";
+export const HOSTED_CHECKOUT_OPEN_ACTION = "himi.host.memberCheckout.open";
+
+/** Whether this worker runs inside a host that opened a site for it. */
+export function isHostedWorker(): boolean {
+  return hostSiteFromInput((globalThis as { himalaya?: { input?: unknown } }).himalaya?.input) !== null;
+}
+
+type HostAnswer = { opened?: unknown; ticket?: unknown; payload?: { opened?: unknown; ticket?: unknown } } | null;
+
+/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
+ *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
+ *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
+export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn"> {
+  return async (stillMayCharge) => {
+    try {
+      const prepared = await dispatch(HOSTED_CHECKOUT_ACTION, { checkoutId }) as HostAnswer;
+      const ticket = prepared?.ticket ?? prepared?.payload?.ticket;
+      if (typeof ticket !== "string" || !ticket) return false;
+      // An unopened ticket simply expires in the host: nothing to cancel.
+      if (!(await stillMayCharge())) return "withdrawn";
+      const result = await dispatch(HOSTED_CHECKOUT_OPEN_ACTION, { ticket }) as HostAnswer;
+      const opened = result?.opened ?? result?.payload?.opened;
+      return opened === true || opened === "true";
+    } catch {
+      return false;
+    }
+  };
+}

package/templates/retail-store/tier5-src/himi-branded-lite-cart/index.ts

@@ -6,6 +6,7 @@ import { createCheckoutFromCurrentCart, createOrder, getCurrentCart, removeLineI
 import { createRedirectSession } from "@himalaya/wix-redirects";
 import { session as wixPlatformSession } from "@himalaya/wix-platform";
 import { payCashierOrder } from "@himalaya/checkout";
+import { hostedCheckoutOpener, isHostedWorker } from "../_shared/hosted-checkout.js";
 
 /** Wix Stores appDefId — the vertical that owns a cart/ecom order, and therefore the
  *  `appId` its cashier order is paid under. (Same constant Wix's own tooling uses.) */
@@ -317,9 +318,13 @@ const svc = defineService<State, {
         if (!checkout.checkoutId) return derive({ ...state, checkoutHint: copyParam("cart.checkoutIdMissingMessage", "Wix did not return a checkout id.") });
         const checkoutId = checkout.checkoutId;
 
-        const order = await createOrder(checkoutId);
-        const snapshotId = order.paymentGatewayOrderId;
-        if (!snapshotId) {
+        // Hosted (Spaces): the site's own checkout page creates the order (RN's
+        // route) — creating it here first fails on a site with no payment method set up, before the
+        // member ever reaches the checkout. The host opens the checkout as the lent member.
+        const hosted = isHostedWorker();
+        const order = hosted ? { paymentGatewayOrderId: "" } : await createOrder(checkoutId);
+        const snapshotId = order.paymentGatewayOrderId ?? "";
+        if (!snapshotId && !hosted) {
           return derive({ ...state, ...cartConsumedByOrder() });
         }
 
@@ -335,6 +340,9 @@ const svc = defineService<State, {
               return !!reference && cartPricing.pricing.continueCheckoutGuard({ kind: "storesProduct", id: reference.catalogItemId }).allowed;
             });
           },
+          // Hosted (Spaces): the host opens the checkout as the lent member — Headless redirect
+          // sessions do not take a Member instance.
+          ...(hosted ? { openCashier: hostedCheckoutOpener(checkoutId) } : {}),
           cashierUrl: async () => {
             const redirect = await createRedirectSession({
               ecomCheckout: { checkoutId },

package/templates/yoga-studio/tier5-src/_shared/hosted-checkout.ts

@@ -0,0 +1,42 @@
+// Hosted checkout (#4089 B3). A Branded Lite hosted in a host shell (Spaces)
+// pays as the member the host lent it: Headless `createRedirectSession` does not take a Member
+// instance, so the HOST opens the site's checkout signed in as that member. The worker names only
+// its ecom checkout; the host reads Wix's checkout URL, mints a one-time member session and opens
+// the site's `createSessionCookie` → checkout. The session token never reaches this worker.
+
+import { dispatch } from "@himalaya/dispatch";
+import { hostSiteFromInput } from "./branded-lite-hosted.js";
+
+/** The host verbs (registered by the host shell, never by the app itself). The first prepares the
+ *  checkout and answers a one-time ticket; the second opens it. Two steps so the caller's charge guard
+ *  is re-read after the host's network round trips and right before the checkout opens — the prepared
+ *  URL (which carries the member's session token) stays in the host; only the ticket crosses here. */
+export const HOSTED_CHECKOUT_ACTION = "himi.host.memberCheckout";
+export const HOSTED_CHECKOUT_OPEN_ACTION = "himi.host.memberCheckout.open";
+
+/** Whether this worker runs inside a host that opened a site for it. */
+export function isHostedWorker(): boolean {
+  return hostSiteFromInput((globalThis as { himalaya?: { input?: unknown } }).himalaya?.input) !== null;
+}
+
+type HostAnswer = { opened?: unknown; ticket?: unknown; payload?: { opened?: unknown; ticket?: unknown } } | null;
+
+/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
+ *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
+ *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
+export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn"> {
+  return async (stillMayCharge) => {
+    try {
+      const prepared = await dispatch(HOSTED_CHECKOUT_ACTION, { checkoutId }) as HostAnswer;
+      const ticket = prepared?.ticket ?? prepared?.payload?.ticket;
+      if (typeof ticket !== "string" || !ticket) return false;
+      // An unopened ticket simply expires in the host: nothing to cancel.
+      if (!(await stillMayCharge())) return "withdrawn";
+      const result = await dispatch(HOSTED_CHECKOUT_OPEN_ACTION, { ticket }) as HostAnswer;
+      const opened = result?.opened ?? result?.payload?.opened;
+      return opened === true || opened === "true";
+    } catch {
+      return false;
+    }
+  };
+}

package/templates/yoga-studio/tier5-src/himi-booking-time/index.ts

@@ -9,6 +9,7 @@ import { bookSlot, getService, queryServiceAvailability, type WixBookingSlotFull
 import { createCheckout, createOrder } from "@himalaya/wix-ecom";
 import { createRedirectSession, type WixSlot } from "@himalaya/wix-redirects";
 import { payCashierOrder } from "@himalaya/checkout";
+import { hostedCheckoutOpener, isHostedWorker } from "../_shared/hosted-checkout.js";
 import { session as wixPlatformSession } from "@himalaya/wix-platform";
 import { displayName, getMyData, type WixMyData } from "@himalaya/wix-users";
 import { formatServicePrice, serviceIsChargeable } from "../_shared/wix-service-price.js";
@@ -662,9 +663,12 @@ const svc = defineService<S, {
           // 3. Create the Wix-managed order — mints the cashier snapshot when a
           //    balance is due. No paymentGatewayOrderId ⇒ nothing to charge
           //    (covered / zero total) ⇒ the booking is already confirmed.
-          const orderRes = await createOrder(checkoutId);
-          const snapshotId = orderRes.paymentGatewayOrderId;
-          if (!snapshotId) {
+          // Hosted (Spaces): the site's own checkout page creates the order (as
+          // RN does) — creating it here first fails on a site with no payment method set up.
+          const hosted = isHostedWorker();
+          const orderRes = hosted ? { paymentGatewayOrderId: "" } : await createOrder(checkoutId);
+          const snapshotId = orderRes.paymentGatewayOrderId ?? "";
+          if (!snapshotId && !hosted) {
             return derive({ ...pending, bookingInFlight: false, successMessage: copyParam("time.successMessage", "Booked. Your confirmation is ready in My Bookings."), message: "" });
           }
           // 4. Collect payment IN-APP — wallet when this app has one wired, otherwise
@@ -676,6 +680,8 @@ const svc = defineService<S, {
             appId: WIX_BOOKINGS_APP_ID,
             snapshotId,
             msid: await resolveMsid(),
+            // Hosted (Spaces): the host opens this booking's checkout as the lent member.
+            ...(hosted ? { openCashier: hostedCheckoutOpener(checkoutId) } : {}),
             cashierUrl: async () => {
               const redirect = await createRedirectSession({
                 bookingsCheckout: { slotAvailability: { slot: slot as unknown as WixSlot } },