@wix/himalaya-cli 0.1352.0 → 0.1353.0

package/templates/nonprofit-cause/tier5-src/_shared/hosted-checkout.ts

@@ -0,0 +1,42 @@
+// Hosted checkout (#4089 B3). A Branded Lite hosted in a host shell (Spaces)
+// pays as the member the host lent it: Headless `createRedirectSession` does not take a Member
+// instance, so the HOST opens the site's checkout signed in as that member. The worker names only
+// its ecom checkout; the host reads Wix's checkout URL, mints a one-time member session and opens
+// the site's `createSessionCookie` → checkout. The session token never reaches this worker.
+
+import { dispatch } from "@himalaya/dispatch";
+import { hostSiteFromInput } from "./branded-lite-hosted.js";
+
+/** The host verbs (registered by the host shell, never by the app itself). The first prepares the
+ *  checkout and answers a one-time ticket; the second opens it. Two steps so the caller's charge guard
+ *  is re-read after the host's network round trips and right before the checkout opens — the prepared
+ *  URL (which carries the member's session token) stays in the host; only the ticket crosses here. */
+export const HOSTED_CHECKOUT_ACTION = "himi.host.memberCheckout";
+export const HOSTED_CHECKOUT_OPEN_ACTION = "himi.host.memberCheckout.open";
+
+/** Whether this worker runs inside a host that opened a site for it. */
+export function isHostedWorker(): boolean {
+  return hostSiteFromInput((globalThis as { himalaya?: { input?: unknown } }).himalaya?.input) !== null;
+}
+
+type HostAnswer = { opened?: unknown; ticket?: unknown; payload?: { opened?: unknown; ticket?: unknown } } | null;
+
+/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
+ *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
+ *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
+export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn"> {
+  return async (stillMayCharge) => {
+    try {
+      const prepared = await dispatch(HOSTED_CHECKOUT_ACTION, { checkoutId }) as HostAnswer;
+      const ticket = prepared?.ticket ?? prepared?.payload?.ticket;
+      if (typeof ticket !== "string" || !ticket) return false;
+      // An unopened ticket simply expires in the host: nothing to cancel.
+      if (!(await stillMayCharge())) return "withdrawn";
+      const result = await dispatch(HOSTED_CHECKOUT_OPEN_ACTION, { ticket }) as HostAnswer;
+      const opened = result?.opened ?? result?.payload?.opened;
+      return opened === true || opened === "true";
+    } catch {
+      return false;
+    }
+  };
+}

package/templates/nonprofit-cause/tier5-src/himi-branded-lite-plans/index.ts

@@ -9,6 +9,7 @@ import { hostSessionFromGlobal, iapPriceFields, type IapCatalogItem } from "@him
 import { createIapCommerce, pricingPlanOrders } from "@himalaya/iap-checkout";
 import { iapPriceCopy, iapPurchaseCopy, resetUnhydratedKeysOnOlderRuntime } from "../_shared/iap-worker.js";
 import { formatCurrency } from "../_shared/engine-intl.js";
+import { isHostedWorker } from "../_shared/hosted-checkout.js";
 
 /** Wix Pricing Plans appDefId — the vertical that owns a plan order, so the `appId` its
  *  cashier order is paid under (mirrors AppDefId.PRICING_PLANS in Wix's RN apps). */
@@ -49,6 +50,8 @@ interface PlanRow {
   hasBadge: boolean;
   /** Purchasable URL when the plan data carries one; "" otherwise. */
   joinUrl: string;
+  /** No price (or a zero price): an online order activates it at once, with nothing to pay. */
+  free: boolean;
   joined: boolean;
   appleSupported: boolean;
   joinLabel: string;
@@ -117,6 +120,11 @@ function joinUrl(plan: WixPlan): string {
   return "";
 }
 
+function isFreePlan(plan: WixPlan): boolean {
+  const raw = plan.pricing?.price?.value;
+  return raw == null || raw === "" || Number(raw) === 0;
+}
+
 function planRow(plan: WixPlan): PlanRow {
   const name = (plan.name || copyParam("plans.planFallbackName", "Plan")).trim();
   const perks = (plan.perks?.values ?? [])
@@ -142,6 +150,7 @@ function planRow(plan: WixPlan): PlanRow {
     noBadge: !badge,
     hasBadge: !!badge,
     joinUrl: joinUrl(plan),
+    free: isFreePlan(plan),
     appleSupported: plan.pricing?.singlePaymentUnlimited === true,
     joined: false, joinLabel: copyParam("plans.joinCta", "Join"), joinDisabled: true, joinNote: "",
   };
@@ -215,6 +224,14 @@ async function regularJoinMessage(row: PlanRow, reference: { kind: string; id: s
     } catch {
     }
   }
+  // Hosted inside a host shell (Spaces) a plan cannot be paid in-app: classic Pricing Plans is not on
+  // ecom, so the host's member checkout has no checkout to open, and the redirect session needs a
+  // headless OAuth client a hosted app does not have. An online order created here would only be
+  // left behind as a DRAFT, so none is — the member joins on the site. A FREE plan has nothing to
+  // pay: its online order activates at once, so it still joins in-app.
+  if (isHostedWorker() && !row.free) {
+    return copyTemplate("plans.joinOnSiteMessage", "Memberships are purchased on the website — visit the site to join {name}.", { name: row.name });
+  }
   try {
     const created = await createOnlineOrder(row.id);
     const snapshotId = created.purchaseFlowId;

package/templates/nonprofit-cause/tier5-src/himi-events-detail/index.ts

@@ -13,6 +13,7 @@ import {
   queryAvailableTickets,
   queryEvents,
   type WixAvailableTicket,
+  type WixEventFieldset,
   type WixEvent,
   type WixGuestRsvp,
   type WixGuestTicket,
@@ -34,6 +35,7 @@ import {
   type EventRow,
 } from "../_shared/himi-events";
 import { initials } from "../_shared/himi-text.js";
+import { isHostedWorker } from "../_shared/hosted-checkout.js";
 import { stashCopy, copyParam, copyTemplate } from "../_shared/himi-copy.js";
 import { openRichLink } from "../_shared/rich-content-link.js";
 import { richBody } from "../_shared/rich-body.js";
@@ -281,6 +283,10 @@ function calendarFallbackUrl(s: S, end: number): string {
   return `https://calendar.google.com/calendar/render?${parts.join("&")}`;
 }
 
+/** The Events v3 fieldsets the detail reads (see `WixEventFieldset`). DETAILS carries mainImage and
+ *  shortDescription: REGISTRATION fills eventType, which skips the query enrichment that used to supply them. */
+export const EVENT_DETAIL_FIELDSETS: WixEventFieldset[] = ["DETAILS", "TEXTS", "REGISTRATION", "URLS"];
+
 /** Map the decoded registration/eventType onto the CTA variant. The decoded
  *  `eventType` already folds registration.type / registration.initialType /
  *  the legacy flat `type` (decodeEvent, #478). Unknown ⇒ RSVP (historical). */
@@ -458,8 +464,11 @@ const svc = defineService<S, {
       const id = s.id || inputId();
       if (!id) return derive({ ...s, status: "ready", errored: true });
       try {
-        // TEXTS adds the Ricos `description` to the base fieldset (a bare read returns none).
-        const res = await getEvent(id, { fields: ["TEXTS"] });
+        // TEXTS adds the Ricos `description` to the base fieldset (a bare read returns none);
+        // REGISTRATION adds `registration` (the CTA's type, and an external event's own URL);
+        // URLS adds `eventPageUrl` — the registration fallback and the share link. Without URLS a
+        // ticket flow that cannot complete in-app had no page to send the buyer to.
+        const res = await getEvent(id, { fields: EVENT_DETAIL_FIELDSETS });
         let e = ((res as unknown as { event?: WixEvent }).event ?? res) as WixEvent;
         e = await enrichRegistration(id, e);
         const attendees = await attendeeSummary(id);
@@ -566,7 +575,12 @@ const svc = defineService<S, {
       // Every failure degrades one rung at a time, never to a dead button:
       //   native chain → hosted eventsCheckout (pinned to the SAME reservation
       //   when we got one, else the slug) → the event page / registration URL.
-      if (s.registrationKind === "tickets" && s.id) {
+      // Hosted inside a host shell (Spaces) neither in-app rung can finish: the classic
+      // `checkoutReservation` needs a buyer + guest form this screen does not collect, and the
+      // redirect session needs a headless OAuth client a hosted app does not have. Skip both —
+      // the native chain would also leave a ticket reservation held for nothing — and open the
+      // event's own page, where the member registers on the site.
+      if (s.registrationKind === "tickets" && s.id && !isHostedWorker()) {
         let reservationId = "";
         try {
           // Buy what the buyer PICKED. `load` seeds the pick with the cheapest

package/templates/nonprofit-cause/tier5-src/wix-spaces-plan-detail/index.ts

@@ -1,7 +1,13 @@
 // Tier-5 bundle: Wix Spaces clone — Pricing plan detail (ON-DEVICE, site-scoped).
-// himalaya.input.id carries the plan id; fetched via getPlan.
+// himalaya.input.id carries the plan id.
+//
+// Read from the PUBLIC plans (GET /pricing-plans/v2/plans/public — what the plans list
+// shows), not from getPlan: GET /pricing-plans/v2/plans/{id} is the management read, and a
+// hosted site's member or visitor gets a 403 from it, which rendered "couldn't be loaded"
+// for every plan the list had just shown. getPlan stays as the fallback for a plan that is
+// not public, for a caller that may read it (an owner-scope host).
 import { withIapPresentation } from "../_shared/iap-presentation.js";
-import { getPlan, type WixPlan } from "@himalaya/wix-pricing-plans";
+import { getPlan, listPublicPlans, type WixPlan } from "@himalaya/wix-pricing-plans";
 import { presence, presenceAfterError, detailInputId, type PresenceFlags } from "../_shared/detail-presence.js";
 
 interface S extends PresenceFlags { status: "loading" | "ready"; name: string; price: string; description: string; perks: string }
@@ -12,6 +18,26 @@ function priceOf(p: WixPlan): string {
   return m.formattedAmount || [m.amount ?? m.value, m.currency].filter(Boolean).join(" ");
 }
 
+/** The plan, or null when it is not public and the caller may not read it otherwise. */
+async function readPlan(id: string): Promise<WixPlan | null> {
+  let publicRead = false;
+  try {
+    const listed = await listPublicPlans();
+    publicRead = true;
+    const hit = (listed?.plans ?? []).find((plan) => plan?.id === id);
+    if (hit) return hit;
+  } catch (e) { void e; }
+  try {
+    const res = await getPlan(id);
+    return ((res as unknown as { plan?: WixPlan }).plan) ?? (res as unknown as WixPlan);
+  } catch (e) {
+    // The public read worked, so the device is online: a refused or empty management
+    // read means this plan is not one the viewer can see — not-found, not offline.
+    if (publicRead) return null;
+    throw e;
+  }
+}
+
 const defineService = withIapPresentation<S>({
   prefix: "plans", transientKeys: ["price"], contentActions: ["load"],
   items: state => detailInputId() ? [{ reference: { kind: "pricingPlan", id: detailInputId() }, commerceDisplayPrice: state.price }] : [],
@@ -24,8 +50,8 @@ const svc = defineService<S, { load: (s: S) => Promise<S> }>("spacesPlanDetail",
       const id = detailInputId();
       if (!id) return { ...s, status: "ready", ...presence("missing") };
       try {
-        const res = await getPlan(id);
-        const p = ((res as unknown as { plan?: WixPlan }).plan) ?? (res as unknown as WixPlan);
+        const p = await readPlan(id);
+        if (!p) return { ...s, status: "ready", ...presence("missing") };
         const perks = (p.perks?.values ?? []).map((v) => `• ${v}`).join("\n");
         return { status: "ready", name: p.name || "Plan", price: priceOf(p), description: p.description || "", perks, ...presence("found") };
       } catch (e) { return { ...s, status: "ready", ...presenceAfterError(e) }; }

package/templates/podcast-creator/tier5-src/_shared/hosted-checkout.ts

@@ -0,0 +1,42 @@
+// Hosted checkout (#4089 B3). A Branded Lite hosted in a host shell (Spaces)
+// pays as the member the host lent it: Headless `createRedirectSession` does not take a Member
+// instance, so the HOST opens the site's checkout signed in as that member. The worker names only
+// its ecom checkout; the host reads Wix's checkout URL, mints a one-time member session and opens
+// the site's `createSessionCookie` → checkout. The session token never reaches this worker.
+
+import { dispatch } from "@himalaya/dispatch";
+import { hostSiteFromInput } from "./branded-lite-hosted.js";
+
+/** The host verbs (registered by the host shell, never by the app itself). The first prepares the
+ *  checkout and answers a one-time ticket; the second opens it. Two steps so the caller's charge guard
+ *  is re-read after the host's network round trips and right before the checkout opens — the prepared
+ *  URL (which carries the member's session token) stays in the host; only the ticket crosses here. */
+export const HOSTED_CHECKOUT_ACTION = "himi.host.memberCheckout";
+export const HOSTED_CHECKOUT_OPEN_ACTION = "himi.host.memberCheckout.open";
+
+/** Whether this worker runs inside a host that opened a site for it. */
+export function isHostedWorker(): boolean {
+  return hostSiteFromInput((globalThis as { himalaya?: { input?: unknown } }).himalaya?.input) !== null;
+}
+
+type HostAnswer = { opened?: unknown; ticket?: unknown; payload?: { opened?: unknown; ticket?: unknown } } | null;
+
+/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
+ *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
+ *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
+export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn"> {
+  return async (stillMayCharge) => {
+    try {
+      const prepared = await dispatch(HOSTED_CHECKOUT_ACTION, { checkoutId }) as HostAnswer;
+      const ticket = prepared?.ticket ?? prepared?.payload?.ticket;
+      if (typeof ticket !== "string" || !ticket) return false;
+      // An unopened ticket simply expires in the host: nothing to cancel.
+      if (!(await stillMayCharge())) return "withdrawn";
+      const result = await dispatch(HOSTED_CHECKOUT_OPEN_ACTION, { ticket }) as HostAnswer;
+      const opened = result?.opened ?? result?.payload?.opened;
+      return opened === true || opened === "true";
+    } catch {
+      return false;
+    }
+  };
+}

package/templates/podcast-creator/tier5-src/himi-branded-lite-plans/index.ts

@@ -9,6 +9,7 @@ import { hostSessionFromGlobal, iapPriceFields, type IapCatalogItem } from "@him
 import { createIapCommerce, pricingPlanOrders } from "@himalaya/iap-checkout";
 import { iapPriceCopy, iapPurchaseCopy, resetUnhydratedKeysOnOlderRuntime } from "../_shared/iap-worker.js";
 import { formatCurrency } from "../_shared/engine-intl.js";
+import { isHostedWorker } from "../_shared/hosted-checkout.js";
 
 /** Wix Pricing Plans appDefId — the vertical that owns a plan order, so the `appId` its
  *  cashier order is paid under (mirrors AppDefId.PRICING_PLANS in Wix's RN apps). */
@@ -49,6 +50,8 @@ interface PlanRow {
   hasBadge: boolean;
   /** Purchasable URL when the plan data carries one; "" otherwise. */
   joinUrl: string;
+  /** No price (or a zero price): an online order activates it at once, with nothing to pay. */
+  free: boolean;
   joined: boolean;
   appleSupported: boolean;
   joinLabel: string;
@@ -117,6 +120,11 @@ function joinUrl(plan: WixPlan): string {
   return "";
 }
 
+function isFreePlan(plan: WixPlan): boolean {
+  const raw = plan.pricing?.price?.value;
+  return raw == null || raw === "" || Number(raw) === 0;
+}
+
 function planRow(plan: WixPlan): PlanRow {
   const name = (plan.name || copyParam("plans.planFallbackName", "Plan")).trim();
   const perks = (plan.perks?.values ?? [])
@@ -142,6 +150,7 @@ function planRow(plan: WixPlan): PlanRow {
     noBadge: !badge,
     hasBadge: !!badge,
     joinUrl: joinUrl(plan),
+    free: isFreePlan(plan),
     appleSupported: plan.pricing?.singlePaymentUnlimited === true,
     joined: false, joinLabel: copyParam("plans.joinCta", "Join"), joinDisabled: true, joinNote: "",
   };
@@ -215,6 +224,14 @@ async function regularJoinMessage(row: PlanRow, reference: { kind: string; id: s
     } catch {
     }
   }
+  // Hosted inside a host shell (Spaces) a plan cannot be paid in-app: classic Pricing Plans is not on
+  // ecom, so the host's member checkout has no checkout to open, and the redirect session needs a
+  // headless OAuth client a hosted app does not have. An online order created here would only be
+  // left behind as a DRAFT, so none is — the member joins on the site. A FREE plan has nothing to
+  // pay: its online order activates at once, so it still joins in-app.
+  if (isHostedWorker() && !row.free) {
+    return copyTemplate("plans.joinOnSiteMessage", "Memberships are purchased on the website — visit the site to join {name}.", { name: row.name });
+  }
   try {
     const created = await createOnlineOrder(row.id);
     const snapshotId = created.purchaseFlowId;

package/templates/podcast-creator/tier5-src/himi-events-detail/index.ts

@@ -13,6 +13,7 @@ import {
   queryAvailableTickets,
   queryEvents,
   type WixAvailableTicket,
+  type WixEventFieldset,
   type WixEvent,
   type WixGuestRsvp,
   type WixGuestTicket,
@@ -34,6 +35,7 @@ import {
   type EventRow,
 } from "../_shared/himi-events";
 import { initials } from "../_shared/himi-text.js";
+import { isHostedWorker } from "../_shared/hosted-checkout.js";
 import { stashCopy, copyParam, copyTemplate } from "../_shared/himi-copy.js";
 import { openRichLink } from "../_shared/rich-content-link.js";
 import { richBody } from "../_shared/rich-body.js";
@@ -281,6 +283,10 @@ function calendarFallbackUrl(s: S, end: number): string {
   return `https://calendar.google.com/calendar/render?${parts.join("&")}`;
 }
 
+/** The Events v3 fieldsets the detail reads (see `WixEventFieldset`). DETAILS carries mainImage and
+ *  shortDescription: REGISTRATION fills eventType, which skips the query enrichment that used to supply them. */
+export const EVENT_DETAIL_FIELDSETS: WixEventFieldset[] = ["DETAILS", "TEXTS", "REGISTRATION", "URLS"];
+
 /** Map the decoded registration/eventType onto the CTA variant. The decoded
  *  `eventType` already folds registration.type / registration.initialType /
  *  the legacy flat `type` (decodeEvent, #478). Unknown ⇒ RSVP (historical). */
@@ -458,8 +464,11 @@ const svc = defineService<S, {
       const id = s.id || inputId();
       if (!id) return derive({ ...s, status: "ready", errored: true });
       try {
-        // TEXTS adds the Ricos `description` to the base fieldset (a bare read returns none).
-        const res = await getEvent(id, { fields: ["TEXTS"] });
+        // TEXTS adds the Ricos `description` to the base fieldset (a bare read returns none);
+        // REGISTRATION adds `registration` (the CTA's type, and an external event's own URL);
+        // URLS adds `eventPageUrl` — the registration fallback and the share link. Without URLS a
+        // ticket flow that cannot complete in-app had no page to send the buyer to.
+        const res = await getEvent(id, { fields: EVENT_DETAIL_FIELDSETS });
         let e = ((res as unknown as { event?: WixEvent }).event ?? res) as WixEvent;
         e = await enrichRegistration(id, e);
         const attendees = await attendeeSummary(id);
@@ -566,7 +575,12 @@ const svc = defineService<S, {
       // Every failure degrades one rung at a time, never to a dead button:
       //   native chain → hosted eventsCheckout (pinned to the SAME reservation
       //   when we got one, else the slug) → the event page / registration URL.
-      if (s.registrationKind === "tickets" && s.id) {
+      // Hosted inside a host shell (Spaces) neither in-app rung can finish: the classic
+      // `checkoutReservation` needs a buyer + guest form this screen does not collect, and the
+      // redirect session needs a headless OAuth client a hosted app does not have. Skip both —
+      // the native chain would also leave a ticket reservation held for nothing — and open the
+      // event's own page, where the member registers on the site.
+      if (s.registrationKind === "tickets" && s.id && !isHostedWorker()) {
         let reservationId = "";
         try {
           // Buy what the buyer PICKED. `load` seeds the pick with the cheapest

package/templates/podcast-creator/tier5-src/wix-spaces-plan-detail/index.ts

@@ -1,7 +1,13 @@
 // Tier-5 bundle: Wix Spaces clone — Pricing plan detail (ON-DEVICE, site-scoped).
-// himalaya.input.id carries the plan id; fetched via getPlan.
+// himalaya.input.id carries the plan id.
+//
+// Read from the PUBLIC plans (GET /pricing-plans/v2/plans/public — what the plans list
+// shows), not from getPlan: GET /pricing-plans/v2/plans/{id} is the management read, and a
+// hosted site's member or visitor gets a 403 from it, which rendered "couldn't be loaded"
+// for every plan the list had just shown. getPlan stays as the fallback for a plan that is
+// not public, for a caller that may read it (an owner-scope host).
 import { withIapPresentation } from "../_shared/iap-presentation.js";
-import { getPlan, type WixPlan } from "@himalaya/wix-pricing-plans";
+import { getPlan, listPublicPlans, type WixPlan } from "@himalaya/wix-pricing-plans";
 import { presence, presenceAfterError, detailInputId, type PresenceFlags } from "../_shared/detail-presence.js";
 
 interface S extends PresenceFlags { status: "loading" | "ready"; name: string; price: string; description: string; perks: string }
@@ -12,6 +18,26 @@ function priceOf(p: WixPlan): string {
   return m.formattedAmount || [m.amount ?? m.value, m.currency].filter(Boolean).join(" ");
 }
 
+/** The plan, or null when it is not public and the caller may not read it otherwise. */
+async function readPlan(id: string): Promise<WixPlan | null> {
+  let publicRead = false;
+  try {
+    const listed = await listPublicPlans();
+    publicRead = true;
+    const hit = (listed?.plans ?? []).find((plan) => plan?.id === id);
+    if (hit) return hit;
+  } catch (e) { void e; }
+  try {
+    const res = await getPlan(id);
+    return ((res as unknown as { plan?: WixPlan }).plan) ?? (res as unknown as WixPlan);
+  } catch (e) {
+    // The public read worked, so the device is online: a refused or empty management
+    // read means this plan is not one the viewer can see — not-found, not offline.
+    if (publicRead) return null;
+    throw e;
+  }
+}
+
 const defineService = withIapPresentation<S>({
   prefix: "plans", transientKeys: ["price"], contentActions: ["load"],
   items: state => detailInputId() ? [{ reference: { kind: "pricingPlan", id: detailInputId() }, commerceDisplayPrice: state.price }] : [],
@@ -24,8 +50,8 @@ const svc = defineService<S, { load: (s: S) => Promise<S> }>("spacesPlanDetail",
       const id = detailInputId();
       if (!id) return { ...s, status: "ready", ...presence("missing") };
       try {
-        const res = await getPlan(id);
-        const p = ((res as unknown as { plan?: WixPlan }).plan) ?? (res as unknown as WixPlan);
+        const p = await readPlan(id);
+        if (!p) return { ...s, status: "ready", ...presence("missing") };
         const perks = (p.perks?.values ?? []).map((v) => `• ${v}`).join("\n");
         return { status: "ready", name: p.name || "Plan", price: priceOf(p), description: p.description || "", perks, ...presence("found") };
       } catch (e) { return { ...s, status: "ready", ...presenceAfterError(e) }; }

package/templates/portfolio-creative/tier5-src/himi-events-detail/index.ts

@@ -13,6 +13,7 @@ import {
   queryAvailableTickets,
   queryEvents,
   type WixAvailableTicket,
+  type WixEventFieldset,
   type WixEvent,
   type WixGuestRsvp,
   type WixGuestTicket,
@@ -34,6 +35,7 @@ import {
   type EventRow,
 } from "../_shared/himi-events";
 import { initials } from "../_shared/himi-text.js";
+import { isHostedWorker } from "../_shared/hosted-checkout.js";
 import { stashCopy, copyParam, copyTemplate } from "../_shared/himi-copy.js";
 import { openRichLink } from "../_shared/rich-content-link.js";
 import { richBody } from "../_shared/rich-body.js";
@@ -281,6 +283,10 @@ function calendarFallbackUrl(s: S, end: number): string {
   return `https://calendar.google.com/calendar/render?${parts.join("&")}`;
 }
 
+/** The Events v3 fieldsets the detail reads (see `WixEventFieldset`). DETAILS carries mainImage and
+ *  shortDescription: REGISTRATION fills eventType, which skips the query enrichment that used to supply them. */
+export const EVENT_DETAIL_FIELDSETS: WixEventFieldset[] = ["DETAILS", "TEXTS", "REGISTRATION", "URLS"];
+
 /** Map the decoded registration/eventType onto the CTA variant. The decoded
  *  `eventType` already folds registration.type / registration.initialType /
  *  the legacy flat `type` (decodeEvent, #478). Unknown ⇒ RSVP (historical). */
@@ -458,8 +464,11 @@ const svc = defineService<S, {
       const id = s.id || inputId();
       if (!id) return derive({ ...s, status: "ready", errored: true });
       try {
-        // TEXTS adds the Ricos `description` to the base fieldset (a bare read returns none).
-        const res = await getEvent(id, { fields: ["TEXTS"] });
+        // TEXTS adds the Ricos `description` to the base fieldset (a bare read returns none);
+        // REGISTRATION adds `registration` (the CTA's type, and an external event's own URL);
+        // URLS adds `eventPageUrl` — the registration fallback and the share link. Without URLS a
+        // ticket flow that cannot complete in-app had no page to send the buyer to.
+        const res = await getEvent(id, { fields: EVENT_DETAIL_FIELDSETS });
         let e = ((res as unknown as { event?: WixEvent }).event ?? res) as WixEvent;
         e = await enrichRegistration(id, e);
         const attendees = await attendeeSummary(id);
@@ -566,7 +575,12 @@ const svc = defineService<S, {
       // Every failure degrades one rung at a time, never to a dead button:
       //   native chain → hosted eventsCheckout (pinned to the SAME reservation
       //   when we got one, else the slug) → the event page / registration URL.
-      if (s.registrationKind === "tickets" && s.id) {
+      // Hosted inside a host shell (Spaces) neither in-app rung can finish: the classic
+      // `checkoutReservation` needs a buyer + guest form this screen does not collect, and the
+      // redirect session needs a headless OAuth client a hosted app does not have. Skip both —
+      // the native chain would also leave a ticket reservation held for nothing — and open the
+      // event's own page, where the member registers on the site.
+      if (s.registrationKind === "tickets" && s.id && !isHostedWorker()) {
         let reservationId = "";
         try {
           // Buy what the buyer PICKED. `load` seeds the pick with the cheapest

package/templates/restaurant/tier5-src/_shared/hosted-checkout.ts

@@ -0,0 +1,42 @@
+// Hosted checkout (#4089 B3). A Branded Lite hosted in a host shell (Spaces)
+// pays as the member the host lent it: Headless `createRedirectSession` does not take a Member
+// instance, so the HOST opens the site's checkout signed in as that member. The worker names only
+// its ecom checkout; the host reads Wix's checkout URL, mints a one-time member session and opens
+// the site's `createSessionCookie` → checkout. The session token never reaches this worker.
+
+import { dispatch } from "@himalaya/dispatch";
+import { hostSiteFromInput } from "./branded-lite-hosted.js";
+
+/** The host verbs (registered by the host shell, never by the app itself). The first prepares the
+ *  checkout and answers a one-time ticket; the second opens it. Two steps so the caller's charge guard
+ *  is re-read after the host's network round trips and right before the checkout opens — the prepared
+ *  URL (which carries the member's session token) stays in the host; only the ticket crosses here. */
+export const HOSTED_CHECKOUT_ACTION = "himi.host.memberCheckout";
+export const HOSTED_CHECKOUT_OPEN_ACTION = "himi.host.memberCheckout.open";
+
+/** Whether this worker runs inside a host that opened a site for it. */
+export function isHostedWorker(): boolean {
+  return hostSiteFromInput((globalThis as { himalaya?: { input?: unknown } }).himalaya?.input) !== null;
+}
+
+type HostAnswer = { opened?: unknown; ticket?: unknown; payload?: { opened?: unknown; ticket?: unknown } } | null;
+
+/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
+ *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
+ *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
+export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn"> {
+  return async (stillMayCharge) => {
+    try {
+      const prepared = await dispatch(HOSTED_CHECKOUT_ACTION, { checkoutId }) as HostAnswer;
+      const ticket = prepared?.ticket ?? prepared?.payload?.ticket;
+      if (typeof ticket !== "string" || !ticket) return false;
+      // An unopened ticket simply expires in the host: nothing to cancel.
+      if (!(await stillMayCharge())) return "withdrawn";
+      const result = await dispatch(HOSTED_CHECKOUT_OPEN_ACTION, { ticket }) as HostAnswer;
+      const opened = result?.opened ?? result?.payload?.opened;
+      return opened === true || opened === "true";
+    } catch {
+      return false;
+    }
+  };
+}

package/templates/restaurant/tier5-src/himi-events-detail/index.ts

@@ -13,6 +13,7 @@ import {
   queryAvailableTickets,
   queryEvents,
   type WixAvailableTicket,
+  type WixEventFieldset,
   type WixEvent,
   type WixGuestRsvp,
   type WixGuestTicket,
@@ -34,6 +35,7 @@ import {
   type EventRow,
 } from "../_shared/himi-events";
 import { initials } from "../_shared/himi-text.js";
+import { isHostedWorker } from "../_shared/hosted-checkout.js";
 import { stashCopy, copyParam, copyTemplate } from "../_shared/himi-copy.js";
 import { openRichLink } from "../_shared/rich-content-link.js";
 import { richBody } from "../_shared/rich-body.js";
@@ -281,6 +283,10 @@ function calendarFallbackUrl(s: S, end: number): string {
   return `https://calendar.google.com/calendar/render?${parts.join("&")}`;
 }
 
+/** The Events v3 fieldsets the detail reads (see `WixEventFieldset`). DETAILS carries mainImage and
+ *  shortDescription: REGISTRATION fills eventType, which skips the query enrichment that used to supply them. */
+export const EVENT_DETAIL_FIELDSETS: WixEventFieldset[] = ["DETAILS", "TEXTS", "REGISTRATION", "URLS"];
+
 /** Map the decoded registration/eventType onto the CTA variant. The decoded
  *  `eventType` already folds registration.type / registration.initialType /
  *  the legacy flat `type` (decodeEvent, #478). Unknown ⇒ RSVP (historical). */
@@ -458,8 +464,11 @@ const svc = defineService<S, {
       const id = s.id || inputId();
       if (!id) return derive({ ...s, status: "ready", errored: true });
       try {
-        // TEXTS adds the Ricos `description` to the base fieldset (a bare read returns none).
-        const res = await getEvent(id, { fields: ["TEXTS"] });
+        // TEXTS adds the Ricos `description` to the base fieldset (a bare read returns none);
+        // REGISTRATION adds `registration` (the CTA's type, and an external event's own URL);
+        // URLS adds `eventPageUrl` — the registration fallback and the share link. Without URLS a
+        // ticket flow that cannot complete in-app had no page to send the buyer to.
+        const res = await getEvent(id, { fields: EVENT_DETAIL_FIELDSETS });
         let e = ((res as unknown as { event?: WixEvent }).event ?? res) as WixEvent;
         e = await enrichRegistration(id, e);
         const attendees = await attendeeSummary(id);
@@ -566,7 +575,12 @@ const svc = defineService<S, {
       // Every failure degrades one rung at a time, never to a dead button:
       //   native chain → hosted eventsCheckout (pinned to the SAME reservation
       //   when we got one, else the slug) → the event page / registration URL.
-      if (s.registrationKind === "tickets" && s.id) {
+      // Hosted inside a host shell (Spaces) neither in-app rung can finish: the classic
+      // `checkoutReservation` needs a buyer + guest form this screen does not collect, and the
+      // redirect session needs a headless OAuth client a hosted app does not have. Skip both —
+      // the native chain would also leave a ticket reservation held for nothing — and open the
+      // event's own page, where the member registers on the site.
+      if (s.registrationKind === "tickets" && s.id && !isHostedWorker()) {
         let reservationId = "";
         try {
           // Buy what the buyer PICKED. `load` seeds the pick with the cheapest

package/templates/yoga-studio/tier5-src/himi-branded-lite-plans/index.ts

@@ -9,6 +9,7 @@ import { hostSessionFromGlobal, iapPriceFields, type IapCatalogItem } from "@him
 import { createIapCommerce, pricingPlanOrders } from "@himalaya/iap-checkout";
 import { iapPriceCopy, iapPurchaseCopy, resetUnhydratedKeysOnOlderRuntime } from "../_shared/iap-worker.js";
 import { formatCurrency } from "../_shared/engine-intl.js";
+import { isHostedWorker } from "../_shared/hosted-checkout.js";
 
 /** Wix Pricing Plans appDefId — the vertical that owns a plan order, so the `appId` its
  *  cashier order is paid under (mirrors AppDefId.PRICING_PLANS in Wix's RN apps). */
@@ -49,6 +50,8 @@ interface PlanRow {
   hasBadge: boolean;
   /** Purchasable URL when the plan data carries one; "" otherwise. */
   joinUrl: string;
+  /** No price (or a zero price): an online order activates it at once, with nothing to pay. */
+  free: boolean;
   joined: boolean;
   appleSupported: boolean;
   joinLabel: string;
@@ -117,6 +120,11 @@ function joinUrl(plan: WixPlan): string {
   return "";
 }
 
+function isFreePlan(plan: WixPlan): boolean {
+  const raw = plan.pricing?.price?.value;
+  return raw == null || raw === "" || Number(raw) === 0;
+}
+
 function planRow(plan: WixPlan): PlanRow {
   const name = (plan.name || copyParam("plans.planFallbackName", "Plan")).trim();
   const perks = (plan.perks?.values ?? [])
@@ -142,6 +150,7 @@ function planRow(plan: WixPlan): PlanRow {
     noBadge: !badge,
     hasBadge: !!badge,
     joinUrl: joinUrl(plan),
+    free: isFreePlan(plan),
     appleSupported: plan.pricing?.singlePaymentUnlimited === true,
     joined: false, joinLabel: copyParam("plans.joinCta", "Join"), joinDisabled: true, joinNote: "",
   };
@@ -215,6 +224,14 @@ async function regularJoinMessage(row: PlanRow, reference: { kind: string; id: s
     } catch {
     }
   }
+  // Hosted inside a host shell (Spaces) a plan cannot be paid in-app: classic Pricing Plans is not on
+  // ecom, so the host's member checkout has no checkout to open, and the redirect session needs a
+  // headless OAuth client a hosted app does not have. An online order created here would only be
+  // left behind as a DRAFT, so none is — the member joins on the site. A FREE plan has nothing to
+  // pay: its online order activates at once, so it still joins in-app.
+  if (isHostedWorker() && !row.free) {
+    return copyTemplate("plans.joinOnSiteMessage", "Memberships are purchased on the website — visit the site to join {name}.", { name: row.name });
+  }
   try {
     const created = await createOnlineOrder(row.id);
     const snapshotId = created.purchaseFlowId;