@wix/himalaya-cli 0.1352.0 → 0.1354.0

package/dist/cli.mjs

@@ -22017,7 +22017,7 @@ function usageStringCopyFor(permissionCopy) {
   }
   return out2;
 }
-var BRIDGE_CAPABILITY_IDS, KNOWN_CAPABILITY_IDS, CAPABILITY_LITERAL, BRIDGE_MARKERS, NEEDS_BOOT_WIRING, AWAITING_THIRD_PARTY_SIGN_OFF, NOT_DIST_ADDABLE;
+var BRIDGE_CAPABILITY_IDS, KNOWN_CAPABILITY_IDS, CAPABILITY_LITERAL, BRIDGE_MARKERS, NEEDS_BOOT_WIRING, NOT_DIST_ADDABLE;
 var init_known = __esm({
   "../../core/sdk/capability-catalog/src/known.ts"() {
     init_builtins();
@@ -22059,13 +22059,7 @@ var init_known = __esm({
       // on Android the shell must pick Godot's libc++_shared over the core's (himi-game's godotStl).
       godot: "needs the shell's GameSurface view and, on Android, its libc++_shared pick for the engine, which a build cannot add"
     });
-    AWAITING_THIRD_PARTY_SIGN_OFF = Object.freeze({
-      calls: "links the community libwebrtc engine (HimalayaCoreCalls / :himalaya-core-calls), whose third-party sign-off for store-shipping apps is still open, so a dist build does not add it to a customer binary"
-    });
-    NOT_DIST_ADDABLE = Object.freeze({
-      ...NEEDS_BOOT_WIRING,
-      ...AWAITING_THIRD_PARTY_SIGN_OFF
-    });
+    NOT_DIST_ADDABLE = NEEDS_BOOT_WIRING;
   }
 });
 
@@ -35387,6 +35381,69 @@ function resolveServeBase() {
   }
   return (raw ?? "").replace(/\/$/, "");
 }
+function resolvePlaneControlReadBase() {
+  const explicit = process.env.HIMALAYA_PLAYER_CONTROL_URL;
+  if (explicit) return explicit.replace(/\/$/, "");
+  const override = process.env.HIMALAYA_PLAYER_SERVE_URL;
+  if (override) {
+    const base = resolveServeBase();
+    return sameOrigin(base, LOCAL_ORIGINS.serve) ? LOCAL_ORIGINS.control : base;
+  }
+  let control = "";
+  try {
+    control = resolveTarget().control ?? "";
+  } catch {
+  }
+  const serve = resolveServeBase();
+  return isLocalHostUrl(control) && isLocalHostUrl(serve) && !sameUrlOrigin(control, serve) ? control.replace(/\/$/, "") : serve;
+}
+function isLocalHostUrl(url) {
+  let h2;
+  try {
+    h2 = new URL(url).hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  } catch {
+    return false;
+  }
+  if (h2 === "localhost" || h2 === "::1" || h2.endsWith(".local")) return true;
+  const p2 = h2.split(".").map(Number);
+  if (p2.length !== 4 || p2.some((n2) => !Number.isInteger(n2))) return false;
+  return p2[0] === 127 || p2[0] === 10 || p2[0] === 192 && p2[1] === 168 || p2[0] === 169 && p2[1] === 254 || p2[0] === 172 && p2[1] >= 16 && p2[1] <= 31;
+}
+function sameUrlOrigin(a2, b2) {
+  try {
+    return new URL(a2).origin === new URL(b2).origin;
+  } catch {
+    return false;
+  }
+}
+function isLoopbackUrl(url) {
+  try {
+    return ["127.0.0.1", "localhost", "[::1]"].includes(new URL(url).hostname);
+  } catch {
+    return false;
+  }
+}
+function sameOrigin(url, local) {
+  try {
+    const a2 = new URL(url);
+    const b2 = new URL(local);
+    return isLoopbackUrl(url) && a2.port === b2.port && a2.protocol === b2.protocol && (a2.pathname === "/" || a2.pathname === "");
+  } catch {
+    return false;
+  }
+}
+function tenantHostPlaneRead(url, headers2, hostApp, method = "GET") {
+  if (!hostApp || !isTenantHost(hostApp) || method !== "GET" && method !== "HEAD") return null;
+  const [path2, query = ""] = url.split("?");
+  if (path2 === "/v1/site/member-app/resolve") return resolvePlaneControlReadBase() || null;
+  if (path2 === "/v1/release/current") {
+    const app = new URLSearchParams(query).get("app")?.trim();
+    if (!app || app === hostApp || HOSTED_TENANTS[hostApp].includes(app)) return null;
+    if (targetTenant(url, headers2, hostApp) !== null) return null;
+    return resolveServeBase() || null;
+  }
+  return null;
+}
 function targetTenant(url, headers2, hostApp) {
   const hdr = headers2["x-himalaya-app"];
   const headerApp = Array.isArray(hdr) ? hdr[0] : hdr;
@@ -35454,6 +35511,7 @@ var PLAYER_APP_ID, HOSTED_TENANTS, TENANT_PREFIX, LOOPBACK_PEERS, STRIP_RESPONSE
 var init_player_proxy = __esm({
   "../../core/dev-server/src/player-proxy.ts"() {
     init_config();
+    init_serve_origins();
     PLAYER_APP_ID = "himi-player";
     HOSTED_TENANTS = {
       "himi-spaces-lite": ["himi-branded-lite"]
@@ -132468,6 +132526,8 @@ function createDevServer(opts = {}) {
               forwardAs: clientHost ? { host: clientHost, prefix: `${TENANT_PREFIX}${encodeURIComponent(tenant)}` } : void 0
             });
           }
+          const planeRead = tenantHostPlaneRead(url, req.headers, state.appName, req.method);
+          if (planeRead) return await proxyToServe(planeRead, req, res);
         }
         if (url.split("?")[0] === "/v1/app-icon" && req.method === "GET") {
           const iconApp = new URLSearchParams(url.split("?")[1] ?? "").get("app") ?? "";
@@ -156718,25 +156778,25 @@ var init_preview_assets_generated = __esm({
   "../../packages/serve/src/preview-assets.generated.ts"() {
     init_preview_assets_format();
     PREVIEW_ASSET_MANIFEST = [
-      { key: "assets/index-BDNhcRLx.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1271913, sha256: "b78f7b3400ea25a2066e24c6b771199b819a833b624499d221edbc5f1b01a18b" },
-      { key: "assets/pdf-mXRF2YFr.js", contentType: "application/javascript; charset=utf-8", offset: 1271921, length: 488199, sha256: "3ecd61c959307bee0f74d6d9a3c6ab94dbf7b7305d6d67e2f0167dbf3bc6034a" },
-      { key: "assets/pdf.worker.min-BQa_JDET.js", contentType: "application/javascript; charset=utf-8", offset: 1760120, length: 73, sha256: "41bcfda4f3c8c0a81c785ea87c69afc8e7d0ed8c333324aee94c273d881bb6aa" },
-      { key: "assets/pdf.worker.min-BmVo14Nb.mjs", contentType: "application/javascript; charset=utf-8", offset: 1760193, length: 1317034, sha256: "a33cfe728c584fdba4fcc1fd54bcdc2f9f2f13889ddbb5b2bd1d0f8cbe49b84e" },
-      { key: "assets/pdfDocument-BZIqh5sA.js", contentType: "application/javascript; charset=utf-8", offset: 3077227, length: 2858, sha256: "32abe2da16ae5c22ce831a4a75bdb6e6121dc99fdae72be8ec22038d6982dd81" },
-      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 3080085, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
-      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 3084695, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
-      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 3573279, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
-      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 3664203, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
-      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 3755187, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
-      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 3846167, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
-      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 3937039, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
-      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 4028019, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
-      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 4136655, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
-      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 4245739, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
-      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 4354787, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
-      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 4462487, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
-      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 4550595, length: 4947, sha256: "475486545202c2973900224ffffa48ffbd7313e49b559cbcf9be678b068bff82" },
-      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 4555542, length: 17512, sha256: "c5c8612a8b3f5a1828d0c6593106036a180eea11da80232f5181548a50679137" }
+      { key: "assets/index-CfDtWTd9.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1271649, sha256: "b09aff3c4ca8b6d279140f389c9c2c85988dd12e78414ac3e1584f72456ee566" },
+      { key: "assets/pdf-CVazw9Ub.js", contentType: "application/javascript; charset=utf-8", offset: 1271657, length: 488199, sha256: "e42ce9b09b54fe70642b68c38e7209b4a357177f277ef8c40faa3262f1853cde" },
+      { key: "assets/pdf.worker.min-BQa_JDET.js", contentType: "application/javascript; charset=utf-8", offset: 1759856, length: 73, sha256: "41bcfda4f3c8c0a81c785ea87c69afc8e7d0ed8c333324aee94c273d881bb6aa" },
+      { key: "assets/pdf.worker.min-BmVo14Nb.mjs", contentType: "application/javascript; charset=utf-8", offset: 1759929, length: 1317034, sha256: "a33cfe728c584fdba4fcc1fd54bcdc2f9f2f13889ddbb5b2bd1d0f8cbe49b84e" },
+      { key: "assets/pdfDocument-HGrmnRP0.js", contentType: "application/javascript; charset=utf-8", offset: 3076963, length: 2858, sha256: "abf488e7017dd90516a2ada53ec9f0f9bf9402173c8f5b7483917c4d60b03411" },
+      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 3079821, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
+      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 3084431, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
+      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 3573015, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
+      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 3663939, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
+      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 3754923, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
+      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 3845903, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
+      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 3936775, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
+      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 4027755, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
+      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 4136391, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
+      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 4245475, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
+      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 4354523, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
+      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 4462223, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
+      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 4550331, length: 4947, sha256: "d9b156d2824937902486f47a6250a5589f6e33f224eef7bd512506612779159e" },
+      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 4555278, length: 17512, sha256: "c5c8612a8b3f5a1828d0c6593106036a180eea11da80232f5181548a50679137" }
     ];
   }
 });

package/guides/web-page-native-sdk.md

@@ -39,10 +39,9 @@ Your page can only use capabilities the **app owner** turned on for your site. I
   `capabilities`, allowing **every** method the capability's page lists — except
   `presigned_upload.putFile`, which reads a device file and is allowed only when `files` is enabled
   too. So enabling a capability is enough; the owner does not list methods.
-- **What a Brandy app cannot enable:** `app_info`, `calls`, `godot`, `himi_apps`, `live_activity`,
+- **What a Brandy app cannot enable:** `app_info`, `godot`, `himi_apps`, `live_activity`,
   `local_database`, `release_control`, `system_intents`, `ui` and `wix_platform` — most need wiring
-  a website app's shell does not have, and `calls` waits on a third-party sign-off for its WebRTC
-  engine, so plan your page without them. `base44` works only when the
+  a website app's shell does not have, so plan your page without them. `base44` works only when the
   app also has a Base44 binding. Every other capability in the reference can be enabled; other Himi
   apps (not Brandy) may offer these too.
 - Enabling a capability changes the app's native permissions, so the owner ships a **new app

package/guides/web-page-sdk-reference.md

@@ -20,7 +20,7 @@ the SDK sources, so it matches the shipped SDKs.
 - [`biometrics`](https://apps.wix.com/_api/himi-serve/authoring/resource/web-sdk%2Fbiometrics?format=md) — Biometric authentication capability. 2 methods.
 - [`browser_auth`](https://apps.wix.com/_api/himi-serve/authoring/resource/web-sdk%2Fbrowser_auth?format=md) — Native browser SSO. 1 method.
 - [`calendar`](https://apps.wix.com/_api/himi-serve/authoring/resource/web-sdk%2Fcalendar?format=md) — Device calendar. 6 methods.
-- [`calls`](https://apps.wix.com/_api/himi-serve/authoring/resource/web-sdk%2Fcalls?format=md) — Real-time 1:1 audio calls (Stage 1). 16 methods · not in Brandy.
+- [`calls`](https://apps.wix.com/_api/himi-serve/authoring/resource/web-sdk%2Fcalls?format=md) — Real-time 1:1 audio calls (Stage 1). 16 methods.
 - [`camera`](https://apps.wix.com/_api/himi-serve/authoring/resource/web-sdk%2Fcamera?format=md) — Camera capability. 3 methods.
 - [`clipboard`](https://apps.wix.com/_api/himi-serve/authoring/resource/web-sdk%2Fclipboard?format=md) — System clipboard. 3 methods.
 - [`contacts`](https://apps.wix.com/_api/himi-serve/authoring/resource/web-sdk%2Fcontacts?format=md) — Device address book. 4 methods.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1352.0",
+  "version": "0.1354.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "3d6e10a135511ba6f09d842a8dd9aee9013e5b36a3f4d79fe5a3f266"
+  "falconPackageHash": "07e69214f20355a26a4e813ff46d40f5f5e4f8eaff658f0598038078"
 }

package/templates/beauty-salon/tier5-src/himi-branded-lite-plans/index.ts

@@ -9,6 +9,7 @@ import { hostSessionFromGlobal, iapPriceFields, type IapCatalogItem } from "@him
 import { createIapCommerce, pricingPlanOrders } from "@himalaya/iap-checkout";
 import { iapPriceCopy, iapPurchaseCopy, resetUnhydratedKeysOnOlderRuntime } from "../_shared/iap-worker.js";
 import { formatCurrency } from "../_shared/engine-intl.js";
+import { isHostedWorker } from "../_shared/hosted-checkout.js";
 
 /** Wix Pricing Plans appDefId — the vertical that owns a plan order, so the `appId` its
  *  cashier order is paid under (mirrors AppDefId.PRICING_PLANS in Wix's RN apps). */
@@ -49,6 +50,8 @@ interface PlanRow {
   hasBadge: boolean;
   /** Purchasable URL when the plan data carries one; "" otherwise. */
   joinUrl: string;
+  /** No price (or a zero price): an online order activates it at once, with nothing to pay. */
+  free: boolean;
   joined: boolean;
   appleSupported: boolean;
   joinLabel: string;
@@ -117,6 +120,11 @@ function joinUrl(plan: WixPlan): string {
   return "";
 }
 
+function isFreePlan(plan: WixPlan): boolean {
+  const raw = plan.pricing?.price?.value;
+  return raw == null || raw === "" || Number(raw) === 0;
+}
+
 function planRow(plan: WixPlan): PlanRow {
   const name = (plan.name || copyParam("plans.planFallbackName", "Plan")).trim();
   const perks = (plan.perks?.values ?? [])
@@ -142,6 +150,7 @@ function planRow(plan: WixPlan): PlanRow {
     noBadge: !badge,
     hasBadge: !!badge,
     joinUrl: joinUrl(plan),
+    free: isFreePlan(plan),
     appleSupported: plan.pricing?.singlePaymentUnlimited === true,
     joined: false, joinLabel: copyParam("plans.joinCta", "Join"), joinDisabled: true, joinNote: "",
   };
@@ -215,6 +224,14 @@ async function regularJoinMessage(row: PlanRow, reference: { kind: string; id: s
     } catch {
     }
   }
+  // Hosted inside a host shell (Spaces) a plan cannot be paid in-app: classic Pricing Plans is not on
+  // ecom, so the host's member checkout has no checkout to open, and the redirect session needs a
+  // headless OAuth client a hosted app does not have. An online order created here would only be
+  // left behind as a DRAFT, so none is — the member joins on the site. A FREE plan has nothing to
+  // pay: its online order activates at once, so it still joins in-app.
+  if (isHostedWorker() && !row.free) {
+    return copyTemplate("plans.joinOnSiteMessage", "Memberships are purchased on the website — visit the site to join {name}.", { name: row.name });
+  }
   try {
     const created = await createOnlineOrder(row.id);
     const snapshotId = created.purchaseFlowId;

package/templates/beauty-salon/tier5-src/wix-spaces-plan-detail/index.ts

@@ -1,7 +1,13 @@
 // Tier-5 bundle: Wix Spaces clone — Pricing plan detail (ON-DEVICE, site-scoped).
-// himalaya.input.id carries the plan id; fetched via getPlan.
+// himalaya.input.id carries the plan id.
+//
+// Read from the PUBLIC plans (GET /pricing-plans/v2/plans/public — what the plans list
+// shows), not from getPlan: GET /pricing-plans/v2/plans/{id} is the management read, and a
+// hosted site's member or visitor gets a 403 from it, which rendered "couldn't be loaded"
+// for every plan the list had just shown. getPlan stays as the fallback for a plan that is
+// not public, for a caller that may read it (an owner-scope host).
 import { withIapPresentation } from "../_shared/iap-presentation.js";
-import { getPlan, type WixPlan } from "@himalaya/wix-pricing-plans";
+import { getPlan, listPublicPlans, type WixPlan } from "@himalaya/wix-pricing-plans";
 import { presence, presenceAfterError, detailInputId, type PresenceFlags } from "../_shared/detail-presence.js";
 
 interface S extends PresenceFlags { status: "loading" | "ready"; name: string; price: string; description: string; perks: string }
@@ -12,6 +18,26 @@ function priceOf(p: WixPlan): string {
   return m.formattedAmount || [m.amount ?? m.value, m.currency].filter(Boolean).join(" ");
 }
 
+/** The plan, or null when it is not public and the caller may not read it otherwise. */
+async function readPlan(id: string): Promise<WixPlan | null> {
+  let publicRead = false;
+  try {
+    const listed = await listPublicPlans();
+    publicRead = true;
+    const hit = (listed?.plans ?? []).find((plan) => plan?.id === id);
+    if (hit) return hit;
+  } catch (e) { void e; }
+  try {
+    const res = await getPlan(id);
+    return ((res as unknown as { plan?: WixPlan }).plan) ?? (res as unknown as WixPlan);
+  } catch (e) {
+    // The public read worked, so the device is online: a refused or empty management
+    // read means this plan is not one the viewer can see — not-found, not offline.
+    if (publicRead) return null;
+    throw e;
+  }
+}
+
 const defineService = withIapPresentation<S>({
   prefix: "plans", transientKeys: ["price"], contentActions: ["load"],
   items: state => detailInputId() ? [{ reference: { kind: "pricingPlan", id: detailInputId() }, commerceDisplayPrice: state.price }] : [],
@@ -24,8 +50,8 @@ const svc = defineService<S, { load: (s: S) => Promise<S> }>("spacesPlanDetail",
       const id = detailInputId();
       if (!id) return { ...s, status: "ready", ...presence("missing") };
       try {
-        const res = await getPlan(id);
-        const p = ((res as unknown as { plan?: WixPlan }).plan) ?? (res as unknown as WixPlan);
+        const p = await readPlan(id);
+        if (!p) return { ...s, status: "ready", ...presence("missing") };
         const perks = (p.perks?.values ?? []).map((v) => `• ${v}`).join("\n");
         return { status: "ready", name: p.name || "Plan", price: priceOf(p), description: p.description || "", perks, ...presence("found") };
       } catch (e) { return { ...s, status: "ready", ...presenceAfterError(e) }; }

package/templates/branded-lite/tier5-src/himi-branded-lite-plans/index.ts

@@ -9,6 +9,7 @@ import { hostSessionFromGlobal, iapPriceFields, type IapCatalogItem } from "@him
 import { createIapCommerce, pricingPlanOrders } from "@himalaya/iap-checkout";
 import { iapPriceCopy, iapPurchaseCopy, resetUnhydratedKeysOnOlderRuntime } from "../_shared/iap-worker.js";
 import { formatCurrency } from "../_shared/engine-intl.js";
+import { isHostedWorker } from "../_shared/hosted-checkout.js";
 
 /** Wix Pricing Plans appDefId — the vertical that owns a plan order, so the `appId` its
  *  cashier order is paid under (mirrors AppDefId.PRICING_PLANS in Wix's RN apps). */
@@ -49,6 +50,8 @@ interface PlanRow {
   hasBadge: boolean;
   /** Purchasable URL when the plan data carries one; "" otherwise. */
   joinUrl: string;
+  /** No price (or a zero price): an online order activates it at once, with nothing to pay. */
+  free: boolean;
   joined: boolean;
   appleSupported: boolean;
   joinLabel: string;
@@ -117,6 +120,11 @@ function joinUrl(plan: WixPlan): string {
   return "";
 }
 
+function isFreePlan(plan: WixPlan): boolean {
+  const raw = plan.pricing?.price?.value;
+  return raw == null || raw === "" || Number(raw) === 0;
+}
+
 function planRow(plan: WixPlan): PlanRow {
   const name = (plan.name || copyParam("plans.planFallbackName", "Plan")).trim();
   const perks = (plan.perks?.values ?? [])
@@ -142,6 +150,7 @@ function planRow(plan: WixPlan): PlanRow {
     noBadge: !badge,
     hasBadge: !!badge,
     joinUrl: joinUrl(plan),
+    free: isFreePlan(plan),
     appleSupported: plan.pricing?.singlePaymentUnlimited === true,
     joined: false, joinLabel: copyParam("plans.joinCta", "Join"), joinDisabled: true, joinNote: "",
   };
@@ -215,6 +224,14 @@ async function regularJoinMessage(row: PlanRow, reference: { kind: string; id: s
     } catch {
     }
   }
+  // Hosted inside a host shell (Spaces) a plan cannot be paid in-app: classic Pricing Plans is not on
+  // ecom, so the host's member checkout has no checkout to open, and the redirect session needs a
+  // headless OAuth client a hosted app does not have. An online order created here would only be
+  // left behind as a DRAFT, so none is — the member joins on the site. A FREE plan has nothing to
+  // pay: its online order activates at once, so it still joins in-app.
+  if (isHostedWorker() && !row.free) {
+    return copyTemplate("plans.joinOnSiteMessage", "Memberships are purchased on the website — visit the site to join {name}.", { name: row.name });
+  }
   try {
     const created = await createOnlineOrder(row.id);
     const snapshotId = created.purchaseFlowId;

package/templates/branded-lite/tier5-src/himi-events-detail/index.ts

@@ -13,6 +13,7 @@ import {
   queryAvailableTickets,
   queryEvents,
   type WixAvailableTicket,
+  type WixEventFieldset,
   type WixEvent,
   type WixGuestRsvp,
   type WixGuestTicket,
@@ -34,6 +35,7 @@ import {
   type EventRow,
 } from "../_shared/himi-events";
 import { initials } from "../_shared/himi-text.js";
+import { isHostedWorker } from "../_shared/hosted-checkout.js";
 import { stashCopy, copyParam, copyTemplate } from "../_shared/himi-copy.js";
 import { openRichLink } from "../_shared/rich-content-link.js";
 import { richBody } from "../_shared/rich-body.js";
@@ -281,6 +283,10 @@ function calendarFallbackUrl(s: S, end: number): string {
   return `https://calendar.google.com/calendar/render?${parts.join("&")}`;
 }
 
+/** The Events v3 fieldsets the detail reads (see `WixEventFieldset`). DETAILS carries mainImage and
+ *  shortDescription: REGISTRATION fills eventType, which skips the query enrichment that used to supply them. */
+export const EVENT_DETAIL_FIELDSETS: WixEventFieldset[] = ["DETAILS", "TEXTS", "REGISTRATION", "URLS"];
+
 /** Map the decoded registration/eventType onto the CTA variant. The decoded
  *  `eventType` already folds registration.type / registration.initialType /
  *  the legacy flat `type` (decodeEvent, #478). Unknown ⇒ RSVP (historical). */
@@ -458,8 +464,11 @@ const svc = defineService<S, {
       const id = s.id || inputId();
       if (!id) return derive({ ...s, status: "ready", errored: true });
       try {
-        // TEXTS adds the Ricos `description` to the base fieldset (a bare read returns none).
-        const res = await getEvent(id, { fields: ["TEXTS"] });
+        // TEXTS adds the Ricos `description` to the base fieldset (a bare read returns none);
+        // REGISTRATION adds `registration` (the CTA's type, and an external event's own URL);
+        // URLS adds `eventPageUrl` — the registration fallback and the share link. Without URLS a
+        // ticket flow that cannot complete in-app had no page to send the buyer to.
+        const res = await getEvent(id, { fields: EVENT_DETAIL_FIELDSETS });
         let e = ((res as unknown as { event?: WixEvent }).event ?? res) as WixEvent;
         e = await enrichRegistration(id, e);
         const attendees = await attendeeSummary(id);
@@ -566,7 +575,12 @@ const svc = defineService<S, {
       // Every failure degrades one rung at a time, never to a dead button:
       //   native chain → hosted eventsCheckout (pinned to the SAME reservation
       //   when we got one, else the slug) → the event page / registration URL.
-      if (s.registrationKind === "tickets" && s.id) {
+      // Hosted inside a host shell (Spaces) neither in-app rung can finish: the classic
+      // `checkoutReservation` needs a buyer + guest form this screen does not collect, and the
+      // redirect session needs a headless OAuth client a hosted app does not have. Skip both —
+      // the native chain would also leave a ticket reservation held for nothing — and open the
+      // event's own page, where the member registers on the site.
+      if (s.registrationKind === "tickets" && s.id && !isHostedWorker()) {
         let reservationId = "";
         try {
           // Buy what the buyer PICKED. `load` seeds the pick with the cheapest

package/templates/branded-lite/tier5-src/wix-spaces-plan-detail/index.ts

@@ -1,7 +1,13 @@
 // Tier-5 bundle: Wix Spaces clone — Pricing plan detail (ON-DEVICE, site-scoped).
-// himalaya.input.id carries the plan id; fetched via getPlan.
+// himalaya.input.id carries the plan id.
+//
+// Read from the PUBLIC plans (GET /pricing-plans/v2/plans/public — what the plans list
+// shows), not from getPlan: GET /pricing-plans/v2/plans/{id} is the management read, and a
+// hosted site's member or visitor gets a 403 from it, which rendered "couldn't be loaded"
+// for every plan the list had just shown. getPlan stays as the fallback for a plan that is
+// not public, for a caller that may read it (an owner-scope host).
 import { withIapPresentation } from "../_shared/iap-presentation.js";
-import { getPlan, type WixPlan } from "@himalaya/wix-pricing-plans";
+import { getPlan, listPublicPlans, type WixPlan } from "@himalaya/wix-pricing-plans";
 import { presence, presenceAfterError, detailInputId, type PresenceFlags } from "../_shared/detail-presence.js";
 
 interface S extends PresenceFlags { status: "loading" | "ready"; name: string; price: string; description: string; perks: string }
@@ -12,6 +18,26 @@ function priceOf(p: WixPlan): string {
   return m.formattedAmount || [m.amount ?? m.value, m.currency].filter(Boolean).join(" ");
 }
 
+/** The plan, or null when it is not public and the caller may not read it otherwise. */
+async function readPlan(id: string): Promise<WixPlan | null> {
+  let publicRead = false;
+  try {
+    const listed = await listPublicPlans();
+    publicRead = true;
+    const hit = (listed?.plans ?? []).find((plan) => plan?.id === id);
+    if (hit) return hit;
+  } catch (e) { void e; }
+  try {
+    const res = await getPlan(id);
+    return ((res as unknown as { plan?: WixPlan }).plan) ?? (res as unknown as WixPlan);
+  } catch (e) {
+    // The public read worked, so the device is online: a refused or empty management
+    // read means this plan is not one the viewer can see — not-found, not offline.
+    if (publicRead) return null;
+    throw e;
+  }
+}
+
 const defineService = withIapPresentation<S>({
   prefix: "plans", transientKeys: ["price"], contentActions: ["load"],
   items: state => detailInputId() ? [{ reference: { kind: "pricingPlan", id: detailInputId() }, commerceDisplayPrice: state.price }] : [],
@@ -24,8 +50,8 @@ const svc = defineService<S, { load: (s: S) => Promise<S> }>("spacesPlanDetail",
       const id = detailInputId();
       if (!id) return { ...s, status: "ready", ...presence("missing") };
       try {
-        const res = await getPlan(id);
-        const p = ((res as unknown as { plan?: WixPlan }).plan) ?? (res as unknown as WixPlan);
+        const p = await readPlan(id);
+        if (!p) return { ...s, status: "ready", ...presence("missing") };
         const perks = (p.perks?.values ?? []).map((v) => `• ${v}`).join("\n");
         return { status: "ready", name: p.name || "Plan", price: priceOf(p), description: p.description || "", perks, ...presence("found") };
       } catch (e) { return { ...s, status: "ready", ...presenceAfterError(e) }; }

package/templates/community-club/tier5-src/_shared/hosted-checkout.ts

@@ -0,0 +1,42 @@
+// Hosted checkout (#4089 B3). A Branded Lite hosted in a host shell (Spaces)
+// pays as the member the host lent it: Headless `createRedirectSession` does not take a Member
+// instance, so the HOST opens the site's checkout signed in as that member. The worker names only
+// its ecom checkout; the host reads Wix's checkout URL, mints a one-time member session and opens
+// the site's `createSessionCookie` → checkout. The session token never reaches this worker.
+
+import { dispatch } from "@himalaya/dispatch";
+import { hostSiteFromInput } from "./branded-lite-hosted.js";
+
+/** The host verbs (registered by the host shell, never by the app itself). The first prepares the
+ *  checkout and answers a one-time ticket; the second opens it. Two steps so the caller's charge guard
+ *  is re-read after the host's network round trips and right before the checkout opens — the prepared
+ *  URL (which carries the member's session token) stays in the host; only the ticket crosses here. */
+export const HOSTED_CHECKOUT_ACTION = "himi.host.memberCheckout";
+export const HOSTED_CHECKOUT_OPEN_ACTION = "himi.host.memberCheckout.open";
+
+/** Whether this worker runs inside a host that opened a site for it. */
+export function isHostedWorker(): boolean {
+  return hostSiteFromInput((globalThis as { himalaya?: { input?: unknown } }).himalaya?.input) !== null;
+}
+
+type HostAnswer = { opened?: unknown; ticket?: unknown; payload?: { opened?: unknown; ticket?: unknown } } | null;
+
+/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
+ *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
+ *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
+export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn"> {
+  return async (stillMayCharge) => {
+    try {
+      const prepared = await dispatch(HOSTED_CHECKOUT_ACTION, { checkoutId }) as HostAnswer;
+      const ticket = prepared?.ticket ?? prepared?.payload?.ticket;
+      if (typeof ticket !== "string" || !ticket) return false;
+      // An unopened ticket simply expires in the host: nothing to cancel.
+      if (!(await stillMayCharge())) return "withdrawn";
+      const result = await dispatch(HOSTED_CHECKOUT_OPEN_ACTION, { ticket }) as HostAnswer;
+      const opened = result?.opened ?? result?.payload?.opened;
+      return opened === true || opened === "true";
+    } catch {
+      return false;
+    }
+  };
+}

package/templates/community-club/tier5-src/himi-events-detail/index.ts

@@ -13,6 +13,7 @@ import {
   queryAvailableTickets,
   queryEvents,
   type WixAvailableTicket,
+  type WixEventFieldset,
   type WixEvent,
   type WixGuestRsvp,
   type WixGuestTicket,
@@ -34,6 +35,7 @@ import {
   type EventRow,
 } from "../_shared/himi-events";
 import { initials } from "../_shared/himi-text.js";
+import { isHostedWorker } from "../_shared/hosted-checkout.js";
 import { stashCopy, copyParam, copyTemplate } from "../_shared/himi-copy.js";
 import { openRichLink } from "../_shared/rich-content-link.js";
 import { richBody } from "../_shared/rich-body.js";
@@ -281,6 +283,10 @@ function calendarFallbackUrl(s: S, end: number): string {
   return `https://calendar.google.com/calendar/render?${parts.join("&")}`;
 }
 
+/** The Events v3 fieldsets the detail reads (see `WixEventFieldset`). DETAILS carries mainImage and
+ *  shortDescription: REGISTRATION fills eventType, which skips the query enrichment that used to supply them. */
+export const EVENT_DETAIL_FIELDSETS: WixEventFieldset[] = ["DETAILS", "TEXTS", "REGISTRATION", "URLS"];
+
 /** Map the decoded registration/eventType onto the CTA variant. The decoded
  *  `eventType` already folds registration.type / registration.initialType /
  *  the legacy flat `type` (decodeEvent, #478). Unknown ⇒ RSVP (historical). */
@@ -458,8 +464,11 @@ const svc = defineService<S, {
       const id = s.id || inputId();
       if (!id) return derive({ ...s, status: "ready", errored: true });
       try {
-        // TEXTS adds the Ricos `description` to the base fieldset (a bare read returns none).
-        const res = await getEvent(id, { fields: ["TEXTS"] });
+        // TEXTS adds the Ricos `description` to the base fieldset (a bare read returns none);
+        // REGISTRATION adds `registration` (the CTA's type, and an external event's own URL);
+        // URLS adds `eventPageUrl` — the registration fallback and the share link. Without URLS a
+        // ticket flow that cannot complete in-app had no page to send the buyer to.
+        const res = await getEvent(id, { fields: EVENT_DETAIL_FIELDSETS });
         let e = ((res as unknown as { event?: WixEvent }).event ?? res) as WixEvent;
         e = await enrichRegistration(id, e);
         const attendees = await attendeeSummary(id);
@@ -566,7 +575,12 @@ const svc = defineService<S, {
       // Every failure degrades one rung at a time, never to a dead button:
       //   native chain → hosted eventsCheckout (pinned to the SAME reservation
       //   when we got one, else the slug) → the event page / registration URL.
-      if (s.registrationKind === "tickets" && s.id) {
+      // Hosted inside a host shell (Spaces) neither in-app rung can finish: the classic
+      // `checkoutReservation` needs a buyer + guest form this screen does not collect, and the
+      // redirect session needs a headless OAuth client a hosted app does not have. Skip both —
+      // the native chain would also leave a ticket reservation held for nothing — and open the
+      // event's own page, where the member registers on the site.
+      if (s.registrationKind === "tickets" && s.id && !isHostedWorker()) {
         let reservationId = "";
         try {
           // Buy what the buyer PICKED. `load` seeds the pick with the cheapest

package/templates/events-meetups/tier5-src/_shared/hosted-checkout.ts

@@ -0,0 +1,42 @@
+// Hosted checkout (#4089 B3). A Branded Lite hosted in a host shell (Spaces)
+// pays as the member the host lent it: Headless `createRedirectSession` does not take a Member
+// instance, so the HOST opens the site's checkout signed in as that member. The worker names only
+// its ecom checkout; the host reads Wix's checkout URL, mints a one-time member session and opens
+// the site's `createSessionCookie` → checkout. The session token never reaches this worker.
+
+import { dispatch } from "@himalaya/dispatch";
+import { hostSiteFromInput } from "./branded-lite-hosted.js";
+
+/** The host verbs (registered by the host shell, never by the app itself). The first prepares the
+ *  checkout and answers a one-time ticket; the second opens it. Two steps so the caller's charge guard
+ *  is re-read after the host's network round trips and right before the checkout opens — the prepared
+ *  URL (which carries the member's session token) stays in the host; only the ticket crosses here. */
+export const HOSTED_CHECKOUT_ACTION = "himi.host.memberCheckout";
+export const HOSTED_CHECKOUT_OPEN_ACTION = "himi.host.memberCheckout.open";
+
+/** Whether this worker runs inside a host that opened a site for it. */
+export function isHostedWorker(): boolean {
+  return hostSiteFromInput((globalThis as { himalaya?: { input?: unknown } }).himalaya?.input) !== null;
+}
+
+type HostAnswer = { opened?: unknown; ticket?: unknown; payload?: { opened?: unknown; ticket?: unknown } } | null;
+
+/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
+ *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
+ *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
+export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn"> {
+  return async (stillMayCharge) => {
+    try {
+      const prepared = await dispatch(HOSTED_CHECKOUT_ACTION, { checkoutId }) as HostAnswer;
+      const ticket = prepared?.ticket ?? prepared?.payload?.ticket;
+      if (typeof ticket !== "string" || !ticket) return false;
+      // An unopened ticket simply expires in the host: nothing to cancel.
+      if (!(await stillMayCharge())) return "withdrawn";
+      const result = await dispatch(HOSTED_CHECKOUT_OPEN_ACTION, { ticket }) as HostAnswer;
+      const opened = result?.opened ?? result?.payload?.opened;
+      return opened === true || opened === "true";
+    } catch {
+      return false;
+    }
+  };
+}