@wix/himalaya-cli 0.1354.0 → 0.1356.0

package/templates/nonprofit-cause/tier5-src/_shared/hosted-checkout.ts

@@ -1,8 +1,12 @@
-// Hosted checkout (#4089 B3). A Branded Lite hosted in a host shell (Spaces)
-// pays as the member the host lent it: Headless `createRedirectSession` does not take a Member
-// instance, so the HOST opens the site's checkout signed in as that member. The worker names only
-// its ecom checkout; the host reads Wix's checkout URL, mints a one-time member session and opens
-// the site's `createSessionCookie` → checkout. The session token never reaches this worker.
+// Hosted checkout. A Branded Lite hosted in a host shell (Spaces) pays as the member the host
+// lent it: Headless `createRedirectSession` does not take a Member instance, so the HOST opens the site's
+// checkout signed in as that member. The worker names only its ecom checkout; the host reads Wix's
+// checkout URL, mints a one-time member session and opens the site's `createSessionCookie` → checkout.
+// The session token never reaches this worker.
+//
+// Classic Wix Events tickets and classic Pricing Plans have no ecom checkout: for those the
+// worker names the page by id (`himi.host.memberSitePage`) and the host opens the site's own event or
+// plans page the same way, signed in — where the member picks and pays on the site.
 
 import { dispatch } from "@himalaya/dispatch";
 import { hostSiteFromInput } from "./branded-lite-hosted.js";
@@ -13,6 +17,12 @@ import { hostSiteFromInput } from "./branded-lite-hosted.js";
  *  URL (which carries the member's session token) stays in the host; only the ticket crosses here. */
 export const HOSTED_CHECKOUT_ACTION = "himi.host.memberCheckout";
 export const HOSTED_CHECKOUT_OPEN_ACTION = "himi.host.memberCheckout.open";
+/** Prepares a site PAGE (not an ecom checkout) the same way; opened with [HOSTED_CHECKOUT_OPEN_ACTION]. */
+export const HOSTED_SITE_PAGE_ACTION = "himi.host.memberSitePage";
+
+/** A site page a hosted worker may ask its host for — ids only, never a URL: the host reads the URL
+ *  from Wix itself and decides whether the member may be signed in there. */
+export type HostedSitePage = { page: "event"; eventId: string } | { page: "plans"; planId?: string };
 
 /** Whether this worker runs inside a host that opened a site for it. */
 export function isHostedWorker(): boolean {
@@ -20,14 +30,14 @@ export function isHostedWorker(): boolean {
 }
 
 type HostAnswer = { opened?: unknown; ticket?: unknown; payload?: { opened?: unknown; ticket?: unknown } } | null;
+type HostOpener = (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn">;
 
-/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
- *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
- *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
-export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn"> {
+/** Prepare with [action] [params] → re-read the guard → open by ticket. A host without the verbs, or one
+ *  that refused (Wix named no page, an unsafe URL, no account session), → false, never a throw. */
+function hostOpener(action: string, params: Record<string, string>): HostOpener {
   return async (stillMayCharge) => {
     try {
-      const prepared = await dispatch(HOSTED_CHECKOUT_ACTION, { checkoutId }) as HostAnswer;
+      const prepared = await dispatch(action, params) as HostAnswer;
       const ticket = prepared?.ticket ?? prepared?.payload?.ticket;
       if (typeof ticket !== "string" || !ticket) return false;
       // An unopened ticket simply expires in the host: nothing to cancel.
@@ -40,3 +50,19 @@ export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () =>
     }
   };
 }
+
+/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
+ *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
+ *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
+export function hostedCheckoutOpener(checkoutId: string): HostOpener {
+  return hostOpener(HOSTED_CHECKOUT_ACTION, { checkoutId });
+}
+
+/** The site's own [page] opened by the host, signed in as the lent member where the host deems it safe
+ *  (a visitor otherwise) — the same two steps and answers as [hostedCheckoutOpener]. */
+export function hostedSitePageOpener(page: HostedSitePage): HostOpener {
+  const params: Record<string, string> = page.page === "event"
+    ? { page: "event", eventId: page.eventId }
+    : { page: "plans", ...(page.planId ? { planId: page.planId } : {}) };
+  return hostOpener(HOSTED_SITE_PAGE_ACTION, params);
+}

package/templates/nonprofit-cause/tier5-src/himi-events-detail/index.ts

@@ -35,7 +35,10 @@ import {
   type EventRow,
 } from "../_shared/himi-events";
 import { initials } from "../_shared/himi-text.js";
-import { isHostedWorker } from "../_shared/hosted-checkout.js";
+import { hostedSitePageOpener, isHostedWorker } from "../_shared/hosted-checkout.js";
+
+/** A hosted signed-in event-page open is in flight (see openRegistration). */
+let hostedOpenInFlight = false;
 import { stashCopy, copyParam, copyTemplate } from "../_shared/himi-copy.js";
 import { openRichLink } from "../_shared/rich-content-link.js";
 import { richBody } from "../_shared/rich-body.js";
@@ -579,7 +582,8 @@ const svc = defineService<S, {
       // `checkoutReservation` needs a buyer + guest form this screen does not collect, and the
       // redirect session needs a headless OAuth client a hosted app does not have. Skip both —
       // the native chain would also leave a ticket reservation held for nothing — and open the
-      // event's own page, where the member registers on the site.
+      // event's own page, where the member registers on the site: signed in by the host where it can
+      // (`himi.host.memberSitePage`), else as a visitor.
       if (s.registrationKind === "tickets" && s.id && !isHostedWorker()) {
         let reservationId = "";
         try {
@@ -658,6 +662,31 @@ const svc = defineService<S, {
           // fall through to registrationUrl
         }
       }
+      // Hosted: the HOST opens the event's own page signed in as the lent member — ids only; it
+      // reads the page URL from Wix and refuses (a custom domain → a visitor page; no published Events
+      // page → nothing) on its own. Nothing here can change between its prepare and its open (the event
+      // is fixed and the page is where the member chooses and pays), so the guard has nothing to re-read.
+      // A host that refused or failed leaves the visitor page below.
+      if (isHostedWorker() && s.id && (s.registrationKind === "tickets" || s.registrationKind === "rsvp")) {
+        // One signed-in open at a time: the host keeps a single one-time ticket, so a second tap would
+        // replace the first tap's ticket and drop that tap into the signed-OUT visitor page below.
+        if (hostedOpenInFlight) return s;
+        hostedOpenInFlight = true;
+        let opened: boolean | "withdrawn";
+        try {
+          opened = await hostedSitePageOpener({ page: "event", eventId: s.id })(async () => true);
+        } finally {
+          hostedOpenInFlight = false;
+        }
+        if (opened === true) {
+          return derive({
+            ...s,
+            actionMessage: s.registrationKind === "tickets"
+              ? copyParam("event.checkoutOpened", "Complete checkout in the browser to get your tickets.")
+              : "",
+          });
+        }
+      }
       if (!s.registrationUrl) {
         return derive({ ...s, actionMessage: copyParam("event.registrationOnPage", "Registration for this event happens on the event page.") });
       }

package/templates/podcast-creator/tier5-src/_shared/hosted-checkout.ts

@@ -1,8 +1,12 @@
-// Hosted checkout (#4089 B3). A Branded Lite hosted in a host shell (Spaces)
-// pays as the member the host lent it: Headless `createRedirectSession` does not take a Member
-// instance, so the HOST opens the site's checkout signed in as that member. The worker names only
-// its ecom checkout; the host reads Wix's checkout URL, mints a one-time member session and opens
-// the site's `createSessionCookie` → checkout. The session token never reaches this worker.
+// Hosted checkout. A Branded Lite hosted in a host shell (Spaces) pays as the member the host
+// lent it: Headless `createRedirectSession` does not take a Member instance, so the HOST opens the site's
+// checkout signed in as that member. The worker names only its ecom checkout; the host reads Wix's
+// checkout URL, mints a one-time member session and opens the site's `createSessionCookie` → checkout.
+// The session token never reaches this worker.
+//
+// Classic Wix Events tickets and classic Pricing Plans have no ecom checkout: for those the
+// worker names the page by id (`himi.host.memberSitePage`) and the host opens the site's own event or
+// plans page the same way, signed in — where the member picks and pays on the site.
 
 import { dispatch } from "@himalaya/dispatch";
 import { hostSiteFromInput } from "./branded-lite-hosted.js";
@@ -13,6 +17,12 @@ import { hostSiteFromInput } from "./branded-lite-hosted.js";
  *  URL (which carries the member's session token) stays in the host; only the ticket crosses here. */
 export const HOSTED_CHECKOUT_ACTION = "himi.host.memberCheckout";
 export const HOSTED_CHECKOUT_OPEN_ACTION = "himi.host.memberCheckout.open";
+/** Prepares a site PAGE (not an ecom checkout) the same way; opened with [HOSTED_CHECKOUT_OPEN_ACTION]. */
+export const HOSTED_SITE_PAGE_ACTION = "himi.host.memberSitePage";
+
+/** A site page a hosted worker may ask its host for — ids only, never a URL: the host reads the URL
+ *  from Wix itself and decides whether the member may be signed in there. */
+export type HostedSitePage = { page: "event"; eventId: string } | { page: "plans"; planId?: string };
 
 /** Whether this worker runs inside a host that opened a site for it. */
 export function isHostedWorker(): boolean {
@@ -20,14 +30,14 @@ export function isHostedWorker(): boolean {
 }
 
 type HostAnswer = { opened?: unknown; ticket?: unknown; payload?: { opened?: unknown; ticket?: unknown } } | null;
+type HostOpener = (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn">;
 
-/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
- *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
- *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
-export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn"> {
+/** Prepare with [action] [params] → re-read the guard → open by ticket. A host without the verbs, or one
+ *  that refused (Wix named no page, an unsafe URL, no account session), → false, never a throw. */
+function hostOpener(action: string, params: Record<string, string>): HostOpener {
   return async (stillMayCharge) => {
     try {
-      const prepared = await dispatch(HOSTED_CHECKOUT_ACTION, { checkoutId }) as HostAnswer;
+      const prepared = await dispatch(action, params) as HostAnswer;
       const ticket = prepared?.ticket ?? prepared?.payload?.ticket;
       if (typeof ticket !== "string" || !ticket) return false;
       // An unopened ticket simply expires in the host: nothing to cancel.
@@ -40,3 +50,19 @@ export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () =>
     }
   };
 }
+
+/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
+ *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
+ *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
+export function hostedCheckoutOpener(checkoutId: string): HostOpener {
+  return hostOpener(HOSTED_CHECKOUT_ACTION, { checkoutId });
+}
+
+/** The site's own [page] opened by the host, signed in as the lent member where the host deems it safe
+ *  (a visitor otherwise) — the same two steps and answers as [hostedCheckoutOpener]. */
+export function hostedSitePageOpener(page: HostedSitePage): HostOpener {
+  const params: Record<string, string> = page.page === "event"
+    ? { page: "event", eventId: page.eventId }
+    : { page: "plans", ...(page.planId ? { planId: page.planId } : {}) };
+  return hostOpener(HOSTED_SITE_PAGE_ACTION, params);
+}

package/templates/podcast-creator/tier5-src/himi-events-detail/index.ts

@@ -35,7 +35,10 @@ import {
   type EventRow,
 } from "../_shared/himi-events";
 import { initials } from "../_shared/himi-text.js";
-import { isHostedWorker } from "../_shared/hosted-checkout.js";
+import { hostedSitePageOpener, isHostedWorker } from "../_shared/hosted-checkout.js";
+
+/** A hosted signed-in event-page open is in flight (see openRegistration). */
+let hostedOpenInFlight = false;
 import { stashCopy, copyParam, copyTemplate } from "../_shared/himi-copy.js";
 import { openRichLink } from "../_shared/rich-content-link.js";
 import { richBody } from "../_shared/rich-body.js";
@@ -579,7 +582,8 @@ const svc = defineService<S, {
       // `checkoutReservation` needs a buyer + guest form this screen does not collect, and the
       // redirect session needs a headless OAuth client a hosted app does not have. Skip both —
       // the native chain would also leave a ticket reservation held for nothing — and open the
-      // event's own page, where the member registers on the site.
+      // event's own page, where the member registers on the site: signed in by the host where it can
+      // (`himi.host.memberSitePage`), else as a visitor.
       if (s.registrationKind === "tickets" && s.id && !isHostedWorker()) {
         let reservationId = "";
         try {
@@ -658,6 +662,31 @@ const svc = defineService<S, {
           // fall through to registrationUrl
         }
       }
+      // Hosted: the HOST opens the event's own page signed in as the lent member — ids only; it
+      // reads the page URL from Wix and refuses (a custom domain → a visitor page; no published Events
+      // page → nothing) on its own. Nothing here can change between its prepare and its open (the event
+      // is fixed and the page is where the member chooses and pays), so the guard has nothing to re-read.
+      // A host that refused or failed leaves the visitor page below.
+      if (isHostedWorker() && s.id && (s.registrationKind === "tickets" || s.registrationKind === "rsvp")) {
+        // One signed-in open at a time: the host keeps a single one-time ticket, so a second tap would
+        // replace the first tap's ticket and drop that tap into the signed-OUT visitor page below.
+        if (hostedOpenInFlight) return s;
+        hostedOpenInFlight = true;
+        let opened: boolean | "withdrawn";
+        try {
+          opened = await hostedSitePageOpener({ page: "event", eventId: s.id })(async () => true);
+        } finally {
+          hostedOpenInFlight = false;
+        }
+        if (opened === true) {
+          return derive({
+            ...s,
+            actionMessage: s.registrationKind === "tickets"
+              ? copyParam("event.checkoutOpened", "Complete checkout in the browser to get your tickets.")
+              : "",
+          });
+        }
+      }
       if (!s.registrationUrl) {
         return derive({ ...s, actionMessage: copyParam("event.registrationOnPage", "Registration for this event happens on the event page.") });
       }

package/templates/portfolio-creative/tier5-src/_shared/hosted-checkout.ts

@@ -1,8 +1,12 @@
-// Hosted checkout (#4089 B3). A Branded Lite hosted in a host shell (Spaces)
-// pays as the member the host lent it: Headless `createRedirectSession` does not take a Member
-// instance, so the HOST opens the site's checkout signed in as that member. The worker names only
-// its ecom checkout; the host reads Wix's checkout URL, mints a one-time member session and opens
-// the site's `createSessionCookie` → checkout. The session token never reaches this worker.
+// Hosted checkout. A Branded Lite hosted in a host shell (Spaces) pays as the member the host
+// lent it: Headless `createRedirectSession` does not take a Member instance, so the HOST opens the site's
+// checkout signed in as that member. The worker names only its ecom checkout; the host reads Wix's
+// checkout URL, mints a one-time member session and opens the site's `createSessionCookie` → checkout.
+// The session token never reaches this worker.
+//
+// Classic Wix Events tickets and classic Pricing Plans have no ecom checkout: for those the
+// worker names the page by id (`himi.host.memberSitePage`) and the host opens the site's own event or
+// plans page the same way, signed in — where the member picks and pays on the site.
 
 import { dispatch } from "@himalaya/dispatch";
 import { hostSiteFromInput } from "./branded-lite-hosted.js";
@@ -13,6 +17,12 @@ import { hostSiteFromInput } from "./branded-lite-hosted.js";
  *  URL (which carries the member's session token) stays in the host; only the ticket crosses here. */
 export const HOSTED_CHECKOUT_ACTION = "himi.host.memberCheckout";
 export const HOSTED_CHECKOUT_OPEN_ACTION = "himi.host.memberCheckout.open";
+/** Prepares a site PAGE (not an ecom checkout) the same way; opened with [HOSTED_CHECKOUT_OPEN_ACTION]. */
+export const HOSTED_SITE_PAGE_ACTION = "himi.host.memberSitePage";
+
+/** A site page a hosted worker may ask its host for — ids only, never a URL: the host reads the URL
+ *  from Wix itself and decides whether the member may be signed in there. */
+export type HostedSitePage = { page: "event"; eventId: string } | { page: "plans"; planId?: string };
 
 /** Whether this worker runs inside a host that opened a site for it. */
 export function isHostedWorker(): boolean {
@@ -20,14 +30,14 @@ export function isHostedWorker(): boolean {
 }
 
 type HostAnswer = { opened?: unknown; ticket?: unknown; payload?: { opened?: unknown; ticket?: unknown } } | null;
+type HostOpener = (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn">;
 
-/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
- *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
- *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
-export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn"> {
+/** Prepare with [action] [params] → re-read the guard → open by ticket. A host without the verbs, or one
+ *  that refused (Wix named no page, an unsafe URL, no account session), → false, never a throw. */
+function hostOpener(action: string, params: Record<string, string>): HostOpener {
   return async (stillMayCharge) => {
     try {
-      const prepared = await dispatch(HOSTED_CHECKOUT_ACTION, { checkoutId }) as HostAnswer;
+      const prepared = await dispatch(action, params) as HostAnswer;
       const ticket = prepared?.ticket ?? prepared?.payload?.ticket;
       if (typeof ticket !== "string" || !ticket) return false;
       // An unopened ticket simply expires in the host: nothing to cancel.
@@ -40,3 +50,19 @@ export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () =>
     }
   };
 }
+
+/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
+ *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
+ *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
+export function hostedCheckoutOpener(checkoutId: string): HostOpener {
+  return hostOpener(HOSTED_CHECKOUT_ACTION, { checkoutId });
+}
+
+/** The site's own [page] opened by the host, signed in as the lent member where the host deems it safe
+ *  (a visitor otherwise) — the same two steps and answers as [hostedCheckoutOpener]. */
+export function hostedSitePageOpener(page: HostedSitePage): HostOpener {
+  const params: Record<string, string> = page.page === "event"
+    ? { page: "event", eventId: page.eventId }
+    : { page: "plans", ...(page.planId ? { planId: page.planId } : {}) };
+  return hostOpener(HOSTED_SITE_PAGE_ACTION, params);
+}

package/templates/portfolio-creative/tier5-src/himi-events-detail/index.ts

@@ -35,7 +35,10 @@ import {
   type EventRow,
 } from "../_shared/himi-events";
 import { initials } from "../_shared/himi-text.js";
-import { isHostedWorker } from "../_shared/hosted-checkout.js";
+import { hostedSitePageOpener, isHostedWorker } from "../_shared/hosted-checkout.js";
+
+/** A hosted signed-in event-page open is in flight (see openRegistration). */
+let hostedOpenInFlight = false;
 import { stashCopy, copyParam, copyTemplate } from "../_shared/himi-copy.js";
 import { openRichLink } from "../_shared/rich-content-link.js";
 import { richBody } from "../_shared/rich-body.js";
@@ -579,7 +582,8 @@ const svc = defineService<S, {
       // `checkoutReservation` needs a buyer + guest form this screen does not collect, and the
       // redirect session needs a headless OAuth client a hosted app does not have. Skip both —
       // the native chain would also leave a ticket reservation held for nothing — and open the
-      // event's own page, where the member registers on the site.
+      // event's own page, where the member registers on the site: signed in by the host where it can
+      // (`himi.host.memberSitePage`), else as a visitor.
       if (s.registrationKind === "tickets" && s.id && !isHostedWorker()) {
         let reservationId = "";
         try {
@@ -658,6 +662,31 @@ const svc = defineService<S, {
           // fall through to registrationUrl
         }
       }
+      // Hosted: the HOST opens the event's own page signed in as the lent member — ids only; it
+      // reads the page URL from Wix and refuses (a custom domain → a visitor page; no published Events
+      // page → nothing) on its own. Nothing here can change between its prepare and its open (the event
+      // is fixed and the page is where the member chooses and pays), so the guard has nothing to re-read.
+      // A host that refused or failed leaves the visitor page below.
+      if (isHostedWorker() && s.id && (s.registrationKind === "tickets" || s.registrationKind === "rsvp")) {
+        // One signed-in open at a time: the host keeps a single one-time ticket, so a second tap would
+        // replace the first tap's ticket and drop that tap into the signed-OUT visitor page below.
+        if (hostedOpenInFlight) return s;
+        hostedOpenInFlight = true;
+        let opened: boolean | "withdrawn";
+        try {
+          opened = await hostedSitePageOpener({ page: "event", eventId: s.id })(async () => true);
+        } finally {
+          hostedOpenInFlight = false;
+        }
+        if (opened === true) {
+          return derive({
+            ...s,
+            actionMessage: s.registrationKind === "tickets"
+              ? copyParam("event.checkoutOpened", "Complete checkout in the browser to get your tickets.")
+              : "",
+          });
+        }
+      }
       if (!s.registrationUrl) {
         return derive({ ...s, actionMessage: copyParam("event.registrationOnPage", "Registration for this event happens on the event page.") });
       }

package/templates/restaurant/tier5-src/_shared/hosted-checkout.ts

@@ -1,8 +1,12 @@
-// Hosted checkout (#4089 B3). A Branded Lite hosted in a host shell (Spaces)
-// pays as the member the host lent it: Headless `createRedirectSession` does not take a Member
-// instance, so the HOST opens the site's checkout signed in as that member. The worker names only
-// its ecom checkout; the host reads Wix's checkout URL, mints a one-time member session and opens
-// the site's `createSessionCookie` → checkout. The session token never reaches this worker.
+// Hosted checkout. A Branded Lite hosted in a host shell (Spaces) pays as the member the host
+// lent it: Headless `createRedirectSession` does not take a Member instance, so the HOST opens the site's
+// checkout signed in as that member. The worker names only its ecom checkout; the host reads Wix's
+// checkout URL, mints a one-time member session and opens the site's `createSessionCookie` → checkout.
+// The session token never reaches this worker.
+//
+// Classic Wix Events tickets and classic Pricing Plans have no ecom checkout: for those the
+// worker names the page by id (`himi.host.memberSitePage`) and the host opens the site's own event or
+// plans page the same way, signed in — where the member picks and pays on the site.
 
 import { dispatch } from "@himalaya/dispatch";
 import { hostSiteFromInput } from "./branded-lite-hosted.js";
@@ -13,6 +17,12 @@ import { hostSiteFromInput } from "./branded-lite-hosted.js";
  *  URL (which carries the member's session token) stays in the host; only the ticket crosses here. */
 export const HOSTED_CHECKOUT_ACTION = "himi.host.memberCheckout";
 export const HOSTED_CHECKOUT_OPEN_ACTION = "himi.host.memberCheckout.open";
+/** Prepares a site PAGE (not an ecom checkout) the same way; opened with [HOSTED_CHECKOUT_OPEN_ACTION]. */
+export const HOSTED_SITE_PAGE_ACTION = "himi.host.memberSitePage";
+
+/** A site page a hosted worker may ask its host for — ids only, never a URL: the host reads the URL
+ *  from Wix itself and decides whether the member may be signed in there. */
+export type HostedSitePage = { page: "event"; eventId: string } | { page: "plans"; planId?: string };
 
 /** Whether this worker runs inside a host that opened a site for it. */
 export function isHostedWorker(): boolean {
@@ -20,14 +30,14 @@ export function isHostedWorker(): boolean {
 }
 
 type HostAnswer = { opened?: unknown; ticket?: unknown; payload?: { opened?: unknown; ticket?: unknown } } | null;
+type HostOpener = (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn">;
 
-/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
- *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
- *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
-export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn"> {
+/** Prepare with [action] [params] → re-read the guard → open by ticket. A host without the verbs, or one
+ *  that refused (Wix named no page, an unsafe URL, no account session), → false, never a throw. */
+function hostOpener(action: string, params: Record<string, string>): HostOpener {
   return async (stillMayCharge) => {
     try {
-      const prepared = await dispatch(HOSTED_CHECKOUT_ACTION, { checkoutId }) as HostAnswer;
+      const prepared = await dispatch(action, params) as HostAnswer;
       const ticket = prepared?.ticket ?? prepared?.payload?.ticket;
       if (typeof ticket !== "string" || !ticket) return false;
       // An unopened ticket simply expires in the host: nothing to cancel.
@@ -40,3 +50,19 @@ export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () =>
     }
   };
 }
+
+/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
+ *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
+ *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
+export function hostedCheckoutOpener(checkoutId: string): HostOpener {
+  return hostOpener(HOSTED_CHECKOUT_ACTION, { checkoutId });
+}
+
+/** The site's own [page] opened by the host, signed in as the lent member where the host deems it safe
+ *  (a visitor otherwise) — the same two steps and answers as [hostedCheckoutOpener]. */
+export function hostedSitePageOpener(page: HostedSitePage): HostOpener {
+  const params: Record<string, string> = page.page === "event"
+    ? { page: "event", eventId: page.eventId }
+    : { page: "plans", ...(page.planId ? { planId: page.planId } : {}) };
+  return hostOpener(HOSTED_SITE_PAGE_ACTION, params);
+}

package/templates/restaurant/tier5-src/himi-events-detail/index.ts

@@ -35,7 +35,10 @@ import {
   type EventRow,
 } from "../_shared/himi-events";
 import { initials } from "../_shared/himi-text.js";
-import { isHostedWorker } from "../_shared/hosted-checkout.js";
+import { hostedSitePageOpener, isHostedWorker } from "../_shared/hosted-checkout.js";
+
+/** A hosted signed-in event-page open is in flight (see openRegistration). */
+let hostedOpenInFlight = false;
 import { stashCopy, copyParam, copyTemplate } from "../_shared/himi-copy.js";
 import { openRichLink } from "../_shared/rich-content-link.js";
 import { richBody } from "../_shared/rich-body.js";
@@ -579,7 +582,8 @@ const svc = defineService<S, {
       // `checkoutReservation` needs a buyer + guest form this screen does not collect, and the
       // redirect session needs a headless OAuth client a hosted app does not have. Skip both —
       // the native chain would also leave a ticket reservation held for nothing — and open the
-      // event's own page, where the member registers on the site.
+      // event's own page, where the member registers on the site: signed in by the host where it can
+      // (`himi.host.memberSitePage`), else as a visitor.
       if (s.registrationKind === "tickets" && s.id && !isHostedWorker()) {
         let reservationId = "";
         try {
@@ -658,6 +662,31 @@ const svc = defineService<S, {
           // fall through to registrationUrl
         }
       }
+      // Hosted: the HOST opens the event's own page signed in as the lent member — ids only; it
+      // reads the page URL from Wix and refuses (a custom domain → a visitor page; no published Events
+      // page → nothing) on its own. Nothing here can change between its prepare and its open (the event
+      // is fixed and the page is where the member chooses and pays), so the guard has nothing to re-read.
+      // A host that refused or failed leaves the visitor page below.
+      if (isHostedWorker() && s.id && (s.registrationKind === "tickets" || s.registrationKind === "rsvp")) {
+        // One signed-in open at a time: the host keeps a single one-time ticket, so a second tap would
+        // replace the first tap's ticket and drop that tap into the signed-OUT visitor page below.
+        if (hostedOpenInFlight) return s;
+        hostedOpenInFlight = true;
+        let opened: boolean | "withdrawn";
+        try {
+          opened = await hostedSitePageOpener({ page: "event", eventId: s.id })(async () => true);
+        } finally {
+          hostedOpenInFlight = false;
+        }
+        if (opened === true) {
+          return derive({
+            ...s,
+            actionMessage: s.registrationKind === "tickets"
+              ? copyParam("event.checkoutOpened", "Complete checkout in the browser to get your tickets.")
+              : "",
+          });
+        }
+      }
       if (!s.registrationUrl) {
         return derive({ ...s, actionMessage: copyParam("event.registrationOnPage", "Registration for this event happens on the event page.") });
       }

package/templates/retail-store/tier5-src/_shared/hosted-checkout.ts

@@ -1,8 +1,12 @@
-// Hosted checkout (#4089 B3). A Branded Lite hosted in a host shell (Spaces)
-// pays as the member the host lent it: Headless `createRedirectSession` does not take a Member
-// instance, so the HOST opens the site's checkout signed in as that member. The worker names only
-// its ecom checkout; the host reads Wix's checkout URL, mints a one-time member session and opens
-// the site's `createSessionCookie` → checkout. The session token never reaches this worker.
+// Hosted checkout. A Branded Lite hosted in a host shell (Spaces) pays as the member the host
+// lent it: Headless `createRedirectSession` does not take a Member instance, so the HOST opens the site's
+// checkout signed in as that member. The worker names only its ecom checkout; the host reads Wix's
+// checkout URL, mints a one-time member session and opens the site's `createSessionCookie` → checkout.
+// The session token never reaches this worker.
+//
+// Classic Wix Events tickets and classic Pricing Plans have no ecom checkout: for those the
+// worker names the page by id (`himi.host.memberSitePage`) and the host opens the site's own event or
+// plans page the same way, signed in — where the member picks and pays on the site.
 
 import { dispatch } from "@himalaya/dispatch";
 import { hostSiteFromInput } from "./branded-lite-hosted.js";
@@ -13,6 +17,12 @@ import { hostSiteFromInput } from "./branded-lite-hosted.js";
  *  URL (which carries the member's session token) stays in the host; only the ticket crosses here. */
 export const HOSTED_CHECKOUT_ACTION = "himi.host.memberCheckout";
 export const HOSTED_CHECKOUT_OPEN_ACTION = "himi.host.memberCheckout.open";
+/** Prepares a site PAGE (not an ecom checkout) the same way; opened with [HOSTED_CHECKOUT_OPEN_ACTION]. */
+export const HOSTED_SITE_PAGE_ACTION = "himi.host.memberSitePage";
+
+/** A site page a hosted worker may ask its host for — ids only, never a URL: the host reads the URL
+ *  from Wix itself and decides whether the member may be signed in there. */
+export type HostedSitePage = { page: "event"; eventId: string } | { page: "plans"; planId?: string };
 
 /** Whether this worker runs inside a host that opened a site for it. */
 export function isHostedWorker(): boolean {
@@ -20,14 +30,14 @@ export function isHostedWorker(): boolean {
 }
 
 type HostAnswer = { opened?: unknown; ticket?: unknown; payload?: { opened?: unknown; ticket?: unknown } } | null;
+type HostOpener = (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn">;
 
-/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
- *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
- *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
-export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () => Promise<boolean>) => Promise<boolean | "withdrawn"> {
+/** Prepare with [action] [params] → re-read the guard → open by ticket. A host without the verbs, or one
+ *  that refused (Wix named no page, an unsafe URL, no account session), → false, never a throw. */
+function hostOpener(action: string, params: Record<string, string>): HostOpener {
   return async (stillMayCharge) => {
     try {
-      const prepared = await dispatch(HOSTED_CHECKOUT_ACTION, { checkoutId }) as HostAnswer;
+      const prepared = await dispatch(action, params) as HostAnswer;
       const ticket = prepared?.ticket ?? prepared?.payload?.ticket;
       if (typeof ticket !== "string" || !ticket) return false;
       // An unopened ticket simply expires in the host: nothing to cancel.
@@ -40,3 +50,19 @@ export function hostedCheckoutOpener(checkoutId: string): (stillMayCharge: () =>
     }
   };
 }
+
+/** `payCashierOrder`'s `openCashier` for a hosted app: the host prepares [checkoutId]'s checkout as the
+ *  lent member, the caller's guard is re-read, and only then does the host open it. Resolves whether it
+ *  opened ("withdrawn" when the guard said no); a host without the verbs (or that refused) → false. */
+export function hostedCheckoutOpener(checkoutId: string): HostOpener {
+  return hostOpener(HOSTED_CHECKOUT_ACTION, { checkoutId });
+}
+
+/** The site's own [page] opened by the host, signed in as the lent member where the host deems it safe
+ *  (a visitor otherwise) — the same two steps and answers as [hostedCheckoutOpener]. */
+export function hostedSitePageOpener(page: HostedSitePage): HostOpener {
+  const params: Record<string, string> = page.page === "event"
+    ? { page: "event", eventId: page.eventId }
+    : { page: "plans", ...(page.planId ? { planId: page.planId } : {}) };
+  return hostOpener(HOSTED_SITE_PAGE_ACTION, params);
+}