@wix/himalaya-cli 0.1489.0 → 0.1491.0

package/dist/cli.mjs

@@ -130176,7 +130176,7 @@ function stableWidgets(widgets) {
   if (!widgets || typeof widgets !== "object" || Array.isArray(widgets)) return widgets;
   return Object.fromEntries(Object.entries(widgets).map(([id, value]) => {
     if (!value || typeof value !== "object" || Array.isArray(value)) return [id, value];
-    const { contentEtag: _regenerated, ...stable } = value;
+    const { contentEtag: _regenerated, family: _listed, ...stable } = value;
     return [id, stable];
   }));
 }
@@ -135146,7 +135146,9 @@ async function bakeWidgets(fetchPath, putWidget, ownBundles) {
     await putWidget(widgetId, json8);
     widgets[widgetId] = {
       contentEtag: snap.contentEtag ?? sha2563(json8),
-      ttlSeconds: snap.refresh?.ttlSeconds ?? 0
+      ttlSeconds: snap.refresh?.ttlSeconds ?? 0,
+      // Listed so a device fetches only the families it draws (RFC 0039 M2); absent in older releases.
+      ...typeof snap.family === "string" ? { family: snap.family } : {}
     };
   }
   return { widgets, failures };
@@ -163610,12 +163612,15 @@ ${releaseId}`;
           headers: { "content-type": JSON_CT3, etag, "cache-control": DOC_CACHE_CONTROL, "x-himalaya-app": app }
         });
       }
+      const widgetSite = path2 === "/v1/widgets" || path2.startsWith("/v1/widget/") ? url.searchParams.get("site") : null;
+      if (widgetSite !== null && !/^[A-Za-z0-9_-]{1,64}$/.test(widgetSite)) return json5(400, { error: "invalid_site" });
+      const widgetScope = widgetSite !== null ? { "x-himalaya-widget-scope": "app" } : {};
       if (path2 === "/v1/widgets") {
         if (!app) return json5(400, { error: "missing_app" });
         const m2 = pin ? await pinnedManifest(app, pin) : await manifest(app);
         if (!m2) return json5(404, { error: pin ? "release_not_found" : "no_release", app });
-        const widgets = Object.entries(m2.widgets ?? {}).map(([widgetId, meta]) => ({ widgetId, contentEtag: meta.contentEtag }));
-        return json5(200, { widgets });
+        const widgets = Object.entries(m2.widgets ?? {}).map(([widgetId, meta]) => ({ widgetId, contentEtag: meta.contentEtag, ...meta.family ? { family: meta.family } : {} }));
+        return json5(200, { widgets }, widgetScope);
       }
       const widgetMatch = /^\/v1\/widget\/([^/]+)$/.exec(path2);
       if (widgetMatch) {
@@ -163629,13 +163634,13 @@ ${releaseId}`;
         const cache = pin ? PINNED_CACHE_CONTROL : `max-age=${meta.ttlSeconds}`;
         const vary = pin ? { vary: "x-himalaya-release" } : {};
         if (request.headers.get("if-none-match") === etag) {
-          return new Response(null, { status: 304, headers: { etag, "cache-control": cache, ...vary } });
+          return new Response(null, { status: 304, headers: { etag, "cache-control": cache, ...vary, ...widgetScope } });
         }
         const body = await store.getWidget(app, widgetId);
         if (!body) return json5(404, { error: "widget_not_found", widgetId });
         return new Response(body, {
           status: 200,
-          headers: { "content-type": JSON_CT3, etag, "cache-control": cache, ...vary, "x-himalaya-app": app }
+          headers: { "content-type": JSON_CT3, etag, "cache-control": cache, ...vary, "x-himalaya-app": app, ...widgetScope }
         });
       }
       return json5(404, { error: "not_found" });

package/guides/widgets.md

@@ -46,13 +46,23 @@ bindings, only **resolved literal values**. Reading the clock is the one allowed
 the last produce (see [refresh](#refresh-taps-and-previews)). A `render` that throws, or returns a
 tree with a binding in it, makes that widget fail to produce.
 
-### There is no live-data path yet
-
-Data your worker fetches **cannot** reach a widget today. `refresh.pushTopic` exists in the type
-definitions, but nothing consumes it yet: setting it does not make the widget update when data
-changes. Plan the widget around what you know when the app is built — a call to action, a
-constant, or a schedule (see [timelines](#content-whose-future-you-know-live-time-and-timelines)) — and let the
-tap take the user into the app, where the live data is.
+### Live data reaches a widget only through the app on the device
+
+The produce above has no credential, so data your worker fetches **cannot** reach a widget through
+`defineWidget`. The one path for live data runs on the device, in the app: the app fetches the
+widget's descriptors, runs their worker **headlessly** with the signed-in session, resolves every
+`$service:` binding to a literal, and publishes the frozen tree itself —
+`WidgetSnapshotSync.publishLocal` on iOS, `WidgetSnapshotSync.publishLocalBlocking` on Android.
+Owner Lite's Today widget works this way (`OwnerLiteHomeWidget`): it refreshes when the app runs or
+the OS grants a background refresh, never on its own. An app that embeds Himalaya apps gets the same
+produce from `HimalayaEmbedSurfaces.publishWidgets` (see
+[embedding → widgets](embedding-sdk.md#home-and-lock-screen-widgets)).
+
+`refresh.pushTopic` exists in the type definitions, but nothing consumes it yet: setting it does not
+make the widget update when data changes. Without a device produce, plan the widget around what you
+know when the app is built — a call to action, a constant, or a schedule (see
+[timelines](#content-whose-future-you-know-live-time-and-timelines)) — and let the tap take the user
+into the app, where the live data is.
 
 ## A widget that stays inside the contract
 
@@ -217,6 +227,9 @@ not, because the car lays out its own rows. It never goes through `defineWidget`
   request, not a schedule.
 - **`deepLink`** is where a tap takes the user. Point it at the screen that shows the live version
   of what the widget summarises.
+- **`GET /v1/widgets?site=<metaSiteId>`** (and `/v1/widget/<id>?site=`) is accepted for a host that
+  shows one app on many sites. The snapshot is still the app's — nothing is produced per site — and
+  the response says so with `x-himalaya-widget-scope: app`.
 - **Preview a widget** while you work: `himi run --watch --content .` serves it at
   `GET /v1/widget/<widget id>`, and `GET /v1/widgets` lists every widget the app produces.
   `himi surfaces --measure-widgets` reports which families your package actually produces.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1489.0",
+  "version": "0.1491.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "7ca79201b3e70513fa54a458c1442bfddacbd2ffccbfab9959d76964"
+  "falconPackageHash": "69ee53fb46bd8285fb455df2eb9a446d954346c0b2f990cfb7e54d09"
 }

package/templates/beauty-salon-owner/tier5-src/_shared/owner-hosted-sites.ts

@@ -0,0 +1,60 @@
+// The businesses an EMBEDDING HOST says the signed-in owner owns — or null when there is no
+// such host.
+//
+// Standalone, an owner screen lists businesses itself (`querySites`, account level) and reads
+// each one with `site.forSite(msid)`, which stamps `wix-site-id` on that call. Embedded, the
+// host owns site selection: its data source signs every call for the business the user picked
+// and drops a worker-sent `wix-site-id`, so a fan-out read ONE business N times. A host that
+// opts in supplies its own list instead (`HimalayaOwnedSitesDataSource` on iOS / Android, the
+// `ownedSites` prop on web) and answers `himi.wix.ownedSites` with it; the embed then routes a
+// `site.forSite(msid)` call to the host's per-site call for any id on that list and refuses
+// every other id. So a worker reads the list here and keeps using `site.forSite` unchanged.
+//
+// A rejection is "not hosted": a standalone shell has no handler for the verb, and an older embed
+// predates it. Callers then do exactly what they did before. A host that opted in but cannot list
+// answers `{ error }` instead, which THROWS here: falling back to `querySites` would read the
+// account through the host's single-site signer and fan out to ids the host then refuses.
+
+import { dispatch } from "@himalaya/dispatch";
+
+export const OWNED_SITES_ACTION = "himi.wix.ownedSites";
+
+export interface HostedSite {
+  /** The business's metaSiteId — what `site.forSite` takes. */
+  id: string;
+  name: string;
+  logoUrl?: string;
+  color?: string;
+}
+
+function text(v: unknown): string {
+  return typeof v === "string" ? v.trim() : "";
+}
+
+/** The host's list, in the host's order; [] is a real answer (an owner with no businesses).
+ *  null when the verb is unanswered or the answer is not a list. Throws the host's `{ error }`. */
+export async function hostOwnedSites(): Promise<HostedSite[] | null> {
+  let value: unknown;
+  try {
+    value = await dispatch(OWNED_SITES_ACTION);
+  } catch {
+    return null;
+  }
+  // Native hosts resolve the payload itself; some web shells wrap it as `{ payload }`.
+  const body = value as { sites?: unknown; error?: unknown; payload?: { sites?: unknown; error?: unknown } } | null;
+  const error = body?.error ?? body?.payload?.error;
+  if (typeof error === "string") throw new Error(error || "The host could not list your businesses");
+  const raw = body?.sites ?? body?.payload?.sites;
+  if (!Array.isArray(raw)) return null;
+  const sites: HostedSite[] = [];
+  for (const entry of raw) {
+    const e = (entry ?? {}) as Record<string, unknown>;
+    const id = text(e.id);
+    if (!id) continue;
+    const site: HostedSite = { id, name: text(e.name) };
+    if (text(e.logoUrl)) site.logoUrl = text(e.logoUrl);
+    if (text(e.color)) site.color = text(e.color);
+    sites.push(site);
+  }
+  return sites;
+}

package/templates/beauty-salon-owner/tier5-src/himi-owner-lite-overview/index.ts

@@ -22,6 +22,11 @@
 // or one whose mint fails, resolves to `null` and renders as "—" beside the others rather
 // than throwing the whole screen into its error state. A rollup that disappears because one
 // of five businesses is unreachable is worse than one that says so in a row.
+//
+// EMBEDDED, THE HOST NAMES THE BUSINESSES. A host that owns site selection (Symphony's Manage
+// Wix) signs each call itself and would drop the per-call `wix-site-id`, so it supplies the
+// owner's sites instead (`hostOwnedSites`) and resolves each `site.forSite(msid)` call against
+// that list. The list replaces rung 1 only; the fan-out below is identical either way.
 
 import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
@@ -31,6 +36,7 @@ import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_share
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { pickSite, pickedSite } from "../_shared/owner-site-pick.js";
+import { hostOwnedSites } from "../_shared/owner-hosted-sites.js";
 
 /** Mirrors the Home dashboard's "needs attention" definition, so a number here means the
  *  same thing it means after the owner drills into that business. */
@@ -176,16 +182,24 @@ async function attentionCount(msid: string): Promise<number | null> {
   }
 }
 
+/** Rung 1: the host's list when embedded, else the account's own (`querySites`). */
+async function listBusinesses(): Promise<Array<{ id: string; name: string }>> {
+  const unnamed = () => copyParam("ownerOverview.unnamedBusiness", "Business");
+  const hosted = await hostOwnedSites();
+  if (hosted) return hosted.map((h) => ({ id: h.id, name: h.name || unnamed() }));
+  const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
+  return (res.sites ?? [])
+    .filter((r: WixSite) => r?.id)
+    .map((r: WixSite) => ({
+      id: r.id || "",
+      name: r.displayName || (r as { name?: string }).name || unnamed(),
+    }));
+}
+
 async function loadRollup(): Promise<OverviewState> {
   if (isOwnerPreviewDemo()) return demoRollup();
   try {
-    const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
-    const businesses = (res.sites ?? [])
-      .filter((r: WixSite) => r?.id)
-      .map((r: WixSite) => ({
-        id: r.id || "",
-        name: r.displayName || (r as { name?: string }).name || copyParam("ownerOverview.unnamedBusiness", "Business"),
-      }));
+    const businesses = await listBusinesses();
     if (businesses.length === 0) return shape({ status: "ready", rows: [] });
 
     // THE FAN-OUT. Concurrent, one business each, active scope untouched.

package/templates/community-club-owner/tier5-src/_shared/owner-hosted-sites.ts

@@ -0,0 +1,60 @@
+// The businesses an EMBEDDING HOST says the signed-in owner owns — or null when there is no
+// such host.
+//
+// Standalone, an owner screen lists businesses itself (`querySites`, account level) and reads
+// each one with `site.forSite(msid)`, which stamps `wix-site-id` on that call. Embedded, the
+// host owns site selection: its data source signs every call for the business the user picked
+// and drops a worker-sent `wix-site-id`, so a fan-out read ONE business N times. A host that
+// opts in supplies its own list instead (`HimalayaOwnedSitesDataSource` on iOS / Android, the
+// `ownedSites` prop on web) and answers `himi.wix.ownedSites` with it; the embed then routes a
+// `site.forSite(msid)` call to the host's per-site call for any id on that list and refuses
+// every other id. So a worker reads the list here and keeps using `site.forSite` unchanged.
+//
+// A rejection is "not hosted": a standalone shell has no handler for the verb, and an older embed
+// predates it. Callers then do exactly what they did before. A host that opted in but cannot list
+// answers `{ error }` instead, which THROWS here: falling back to `querySites` would read the
+// account through the host's single-site signer and fan out to ids the host then refuses.
+
+import { dispatch } from "@himalaya/dispatch";
+
+export const OWNED_SITES_ACTION = "himi.wix.ownedSites";
+
+export interface HostedSite {
+  /** The business's metaSiteId — what `site.forSite` takes. */
+  id: string;
+  name: string;
+  logoUrl?: string;
+  color?: string;
+}
+
+function text(v: unknown): string {
+  return typeof v === "string" ? v.trim() : "";
+}
+
+/** The host's list, in the host's order; [] is a real answer (an owner with no businesses).
+ *  null when the verb is unanswered or the answer is not a list. Throws the host's `{ error }`. */
+export async function hostOwnedSites(): Promise<HostedSite[] | null> {
+  let value: unknown;
+  try {
+    value = await dispatch(OWNED_SITES_ACTION);
+  } catch {
+    return null;
+  }
+  // Native hosts resolve the payload itself; some web shells wrap it as `{ payload }`.
+  const body = value as { sites?: unknown; error?: unknown; payload?: { sites?: unknown; error?: unknown } } | null;
+  const error = body?.error ?? body?.payload?.error;
+  if (typeof error === "string") throw new Error(error || "The host could not list your businesses");
+  const raw = body?.sites ?? body?.payload?.sites;
+  if (!Array.isArray(raw)) return null;
+  const sites: HostedSite[] = [];
+  for (const entry of raw) {
+    const e = (entry ?? {}) as Record<string, unknown>;
+    const id = text(e.id);
+    if (!id) continue;
+    const site: HostedSite = { id, name: text(e.name) };
+    if (text(e.logoUrl)) site.logoUrl = text(e.logoUrl);
+    if (text(e.color)) site.color = text(e.color);
+    sites.push(site);
+  }
+  return sites;
+}

package/templates/community-club-owner/tier5-src/himi-owner-lite-overview/index.ts

@@ -22,6 +22,11 @@
 // or one whose mint fails, resolves to `null` and renders as "—" beside the others rather
 // than throwing the whole screen into its error state. A rollup that disappears because one
 // of five businesses is unreachable is worse than one that says so in a row.
+//
+// EMBEDDED, THE HOST NAMES THE BUSINESSES. A host that owns site selection (Symphony's Manage
+// Wix) signs each call itself and would drop the per-call `wix-site-id`, so it supplies the
+// owner's sites instead (`hostOwnedSites`) and resolves each `site.forSite(msid)` call against
+// that list. The list replaces rung 1 only; the fan-out below is identical either way.
 
 import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
@@ -31,6 +36,7 @@ import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_share
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { pickSite, pickedSite } from "../_shared/owner-site-pick.js";
+import { hostOwnedSites } from "../_shared/owner-hosted-sites.js";
 
 /** Mirrors the Home dashboard's "needs attention" definition, so a number here means the
  *  same thing it means after the owner drills into that business. */
@@ -176,16 +182,24 @@ async function attentionCount(msid: string): Promise<number | null> {
   }
 }
 
+/** Rung 1: the host's list when embedded, else the account's own (`querySites`). */
+async function listBusinesses(): Promise<Array<{ id: string; name: string }>> {
+  const unnamed = () => copyParam("ownerOverview.unnamedBusiness", "Business");
+  const hosted = await hostOwnedSites();
+  if (hosted) return hosted.map((h) => ({ id: h.id, name: h.name || unnamed() }));
+  const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
+  return (res.sites ?? [])
+    .filter((r: WixSite) => r?.id)
+    .map((r: WixSite) => ({
+      id: r.id || "",
+      name: r.displayName || (r as { name?: string }).name || unnamed(),
+    }));
+}
+
 async function loadRollup(): Promise<OverviewState> {
   if (isOwnerPreviewDemo()) return demoRollup();
   try {
-    const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
-    const businesses = (res.sites ?? [])
-      .filter((r: WixSite) => r?.id)
-      .map((r: WixSite) => ({
-        id: r.id || "",
-        name: r.displayName || (r as { name?: string }).name || copyParam("ownerOverview.unnamedBusiness", "Business"),
-      }));
+    const businesses = await listBusinesses();
     if (businesses.length === 0) return shape({ status: "ready", rows: [] });
 
     // THE FAN-OUT. Concurrent, one business each, active scope untouched.

package/templates/events-meetups-owner/tier5-src/_shared/owner-hosted-sites.ts

@@ -0,0 +1,60 @@
+// The businesses an EMBEDDING HOST says the signed-in owner owns — or null when there is no
+// such host.
+//
+// Standalone, an owner screen lists businesses itself (`querySites`, account level) and reads
+// each one with `site.forSite(msid)`, which stamps `wix-site-id` on that call. Embedded, the
+// host owns site selection: its data source signs every call for the business the user picked
+// and drops a worker-sent `wix-site-id`, so a fan-out read ONE business N times. A host that
+// opts in supplies its own list instead (`HimalayaOwnedSitesDataSource` on iOS / Android, the
+// `ownedSites` prop on web) and answers `himi.wix.ownedSites` with it; the embed then routes a
+// `site.forSite(msid)` call to the host's per-site call for any id on that list and refuses
+// every other id. So a worker reads the list here and keeps using `site.forSite` unchanged.
+//
+// A rejection is "not hosted": a standalone shell has no handler for the verb, and an older embed
+// predates it. Callers then do exactly what they did before. A host that opted in but cannot list
+// answers `{ error }` instead, which THROWS here: falling back to `querySites` would read the
+// account through the host's single-site signer and fan out to ids the host then refuses.
+
+import { dispatch } from "@himalaya/dispatch";
+
+export const OWNED_SITES_ACTION = "himi.wix.ownedSites";
+
+export interface HostedSite {
+  /** The business's metaSiteId — what `site.forSite` takes. */
+  id: string;
+  name: string;
+  logoUrl?: string;
+  color?: string;
+}
+
+function text(v: unknown): string {
+  return typeof v === "string" ? v.trim() : "";
+}
+
+/** The host's list, in the host's order; [] is a real answer (an owner with no businesses).
+ *  null when the verb is unanswered or the answer is not a list. Throws the host's `{ error }`. */
+export async function hostOwnedSites(): Promise<HostedSite[] | null> {
+  let value: unknown;
+  try {
+    value = await dispatch(OWNED_SITES_ACTION);
+  } catch {
+    return null;
+  }
+  // Native hosts resolve the payload itself; some web shells wrap it as `{ payload }`.
+  const body = value as { sites?: unknown; error?: unknown; payload?: { sites?: unknown; error?: unknown } } | null;
+  const error = body?.error ?? body?.payload?.error;
+  if (typeof error === "string") throw new Error(error || "The host could not list your businesses");
+  const raw = body?.sites ?? body?.payload?.sites;
+  if (!Array.isArray(raw)) return null;
+  const sites: HostedSite[] = [];
+  for (const entry of raw) {
+    const e = (entry ?? {}) as Record<string, unknown>;
+    const id = text(e.id);
+    if (!id) continue;
+    const site: HostedSite = { id, name: text(e.name) };
+    if (text(e.logoUrl)) site.logoUrl = text(e.logoUrl);
+    if (text(e.color)) site.color = text(e.color);
+    sites.push(site);
+  }
+  return sites;
+}

package/templates/events-meetups-owner/tier5-src/himi-owner-lite-overview/index.ts

@@ -22,6 +22,11 @@
 // or one whose mint fails, resolves to `null` and renders as "—" beside the others rather
 // than throwing the whole screen into its error state. A rollup that disappears because one
 // of five businesses is unreachable is worse than one that says so in a row.
+//
+// EMBEDDED, THE HOST NAMES THE BUSINESSES. A host that owns site selection (Symphony's Manage
+// Wix) signs each call itself and would drop the per-call `wix-site-id`, so it supplies the
+// owner's sites instead (`hostOwnedSites`) and resolves each `site.forSite(msid)` call against
+// that list. The list replaces rung 1 only; the fan-out below is identical either way.
 
 import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
@@ -31,6 +36,7 @@ import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_share
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { pickSite, pickedSite } from "../_shared/owner-site-pick.js";
+import { hostOwnedSites } from "../_shared/owner-hosted-sites.js";
 
 /** Mirrors the Home dashboard's "needs attention" definition, so a number here means the
  *  same thing it means after the owner drills into that business. */
@@ -176,16 +182,24 @@ async function attentionCount(msid: string): Promise<number | null> {
   }
 }
 
+/** Rung 1: the host's list when embedded, else the account's own (`querySites`). */
+async function listBusinesses(): Promise<Array<{ id: string; name: string }>> {
+  const unnamed = () => copyParam("ownerOverview.unnamedBusiness", "Business");
+  const hosted = await hostOwnedSites();
+  if (hosted) return hosted.map((h) => ({ id: h.id, name: h.name || unnamed() }));
+  const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
+  return (res.sites ?? [])
+    .filter((r: WixSite) => r?.id)
+    .map((r: WixSite) => ({
+      id: r.id || "",
+      name: r.displayName || (r as { name?: string }).name || unnamed(),
+    }));
+}
+
 async function loadRollup(): Promise<OverviewState> {
   if (isOwnerPreviewDemo()) return demoRollup();
   try {
-    const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
-    const businesses = (res.sites ?? [])
-      .filter((r: WixSite) => r?.id)
-      .map((r: WixSite) => ({
-        id: r.id || "",
-        name: r.displayName || (r as { name?: string }).name || copyParam("ownerOverview.unnamedBusiness", "Business"),
-      }));
+    const businesses = await listBusinesses();
     if (businesses.length === 0) return shape({ status: "ready", rows: [] });
 
     // THE FAN-OUT. Concurrent, one business each, active scope untouched.

package/templates/gym-fitness-owner/tier5-src/_shared/owner-hosted-sites.ts

@@ -0,0 +1,60 @@
+// The businesses an EMBEDDING HOST says the signed-in owner owns — or null when there is no
+// such host.
+//
+// Standalone, an owner screen lists businesses itself (`querySites`, account level) and reads
+// each one with `site.forSite(msid)`, which stamps `wix-site-id` on that call. Embedded, the
+// host owns site selection: its data source signs every call for the business the user picked
+// and drops a worker-sent `wix-site-id`, so a fan-out read ONE business N times. A host that
+// opts in supplies its own list instead (`HimalayaOwnedSitesDataSource` on iOS / Android, the
+// `ownedSites` prop on web) and answers `himi.wix.ownedSites` with it; the embed then routes a
+// `site.forSite(msid)` call to the host's per-site call for any id on that list and refuses
+// every other id. So a worker reads the list here and keeps using `site.forSite` unchanged.
+//
+// A rejection is "not hosted": a standalone shell has no handler for the verb, and an older embed
+// predates it. Callers then do exactly what they did before. A host that opted in but cannot list
+// answers `{ error }` instead, which THROWS here: falling back to `querySites` would read the
+// account through the host's single-site signer and fan out to ids the host then refuses.
+
+import { dispatch } from "@himalaya/dispatch";
+
+export const OWNED_SITES_ACTION = "himi.wix.ownedSites";
+
+export interface HostedSite {
+  /** The business's metaSiteId — what `site.forSite` takes. */
+  id: string;
+  name: string;
+  logoUrl?: string;
+  color?: string;
+}
+
+function text(v: unknown): string {
+  return typeof v === "string" ? v.trim() : "";
+}
+
+/** The host's list, in the host's order; [] is a real answer (an owner with no businesses).
+ *  null when the verb is unanswered or the answer is not a list. Throws the host's `{ error }`. */
+export async function hostOwnedSites(): Promise<HostedSite[] | null> {
+  let value: unknown;
+  try {
+    value = await dispatch(OWNED_SITES_ACTION);
+  } catch {
+    return null;
+  }
+  // Native hosts resolve the payload itself; some web shells wrap it as `{ payload }`.
+  const body = value as { sites?: unknown; error?: unknown; payload?: { sites?: unknown; error?: unknown } } | null;
+  const error = body?.error ?? body?.payload?.error;
+  if (typeof error === "string") throw new Error(error || "The host could not list your businesses");
+  const raw = body?.sites ?? body?.payload?.sites;
+  if (!Array.isArray(raw)) return null;
+  const sites: HostedSite[] = [];
+  for (const entry of raw) {
+    const e = (entry ?? {}) as Record<string, unknown>;
+    const id = text(e.id);
+    if (!id) continue;
+    const site: HostedSite = { id, name: text(e.name) };
+    if (text(e.logoUrl)) site.logoUrl = text(e.logoUrl);
+    if (text(e.color)) site.color = text(e.color);
+    sites.push(site);
+  }
+  return sites;
+}

package/templates/gym-fitness-owner/tier5-src/himi-owner-lite-overview/index.ts

@@ -22,6 +22,11 @@
 // or one whose mint fails, resolves to `null` and renders as "—" beside the others rather
 // than throwing the whole screen into its error state. A rollup that disappears because one
 // of five businesses is unreachable is worse than one that says so in a row.
+//
+// EMBEDDED, THE HOST NAMES THE BUSINESSES. A host that owns site selection (Symphony's Manage
+// Wix) signs each call itself and would drop the per-call `wix-site-id`, so it supplies the
+// owner's sites instead (`hostOwnedSites`) and resolves each `site.forSite(msid)` call against
+// that list. The list replaces rung 1 only; the fan-out below is identical either way.
 
 import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
@@ -31,6 +36,7 @@ import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_share
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { pickSite, pickedSite } from "../_shared/owner-site-pick.js";
+import { hostOwnedSites } from "../_shared/owner-hosted-sites.js";
 
 /** Mirrors the Home dashboard's "needs attention" definition, so a number here means the
  *  same thing it means after the owner drills into that business. */
@@ -176,16 +182,24 @@ async function attentionCount(msid: string): Promise<number | null> {
   }
 }
 
+/** Rung 1: the host's list when embedded, else the account's own (`querySites`). */
+async function listBusinesses(): Promise<Array<{ id: string; name: string }>> {
+  const unnamed = () => copyParam("ownerOverview.unnamedBusiness", "Business");
+  const hosted = await hostOwnedSites();
+  if (hosted) return hosted.map((h) => ({ id: h.id, name: h.name || unnamed() }));
+  const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
+  return (res.sites ?? [])
+    .filter((r: WixSite) => r?.id)
+    .map((r: WixSite) => ({
+      id: r.id || "",
+      name: r.displayName || (r as { name?: string }).name || unnamed(),
+    }));
+}
+
 async function loadRollup(): Promise<OverviewState> {
   if (isOwnerPreviewDemo()) return demoRollup();
   try {
-    const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
-    const businesses = (res.sites ?? [])
-      .filter((r: WixSite) => r?.id)
-      .map((r: WixSite) => ({
-        id: r.id || "",
-        name: r.displayName || (r as { name?: string }).name || copyParam("ownerOverview.unnamedBusiness", "Business"),
-      }));
+    const businesses = await listBusinesses();
     if (businesses.length === 0) return shape({ status: "ready", rows: [] });
 
     // THE FAN-OUT. Concurrent, one business each, active scope untouched.

package/templates/nonprofit-cause-owner/tier5-src/_shared/owner-hosted-sites.ts

@@ -0,0 +1,60 @@
+// The businesses an EMBEDDING HOST says the signed-in owner owns — or null when there is no
+// such host.
+//
+// Standalone, an owner screen lists businesses itself (`querySites`, account level) and reads
+// each one with `site.forSite(msid)`, which stamps `wix-site-id` on that call. Embedded, the
+// host owns site selection: its data source signs every call for the business the user picked
+// and drops a worker-sent `wix-site-id`, so a fan-out read ONE business N times. A host that
+// opts in supplies its own list instead (`HimalayaOwnedSitesDataSource` on iOS / Android, the
+// `ownedSites` prop on web) and answers `himi.wix.ownedSites` with it; the embed then routes a
+// `site.forSite(msid)` call to the host's per-site call for any id on that list and refuses
+// every other id. So a worker reads the list here and keeps using `site.forSite` unchanged.
+//
+// A rejection is "not hosted": a standalone shell has no handler for the verb, and an older embed
+// predates it. Callers then do exactly what they did before. A host that opted in but cannot list
+// answers `{ error }` instead, which THROWS here: falling back to `querySites` would read the
+// account through the host's single-site signer and fan out to ids the host then refuses.
+
+import { dispatch } from "@himalaya/dispatch";
+
+export const OWNED_SITES_ACTION = "himi.wix.ownedSites";
+
+export interface HostedSite {
+  /** The business's metaSiteId — what `site.forSite` takes. */
+  id: string;
+  name: string;
+  logoUrl?: string;
+  color?: string;
+}
+
+function text(v: unknown): string {
+  return typeof v === "string" ? v.trim() : "";
+}
+
+/** The host's list, in the host's order; [] is a real answer (an owner with no businesses).
+ *  null when the verb is unanswered or the answer is not a list. Throws the host's `{ error }`. */
+export async function hostOwnedSites(): Promise<HostedSite[] | null> {
+  let value: unknown;
+  try {
+    value = await dispatch(OWNED_SITES_ACTION);
+  } catch {
+    return null;
+  }
+  // Native hosts resolve the payload itself; some web shells wrap it as `{ payload }`.
+  const body = value as { sites?: unknown; error?: unknown; payload?: { sites?: unknown; error?: unknown } } | null;
+  const error = body?.error ?? body?.payload?.error;
+  if (typeof error === "string") throw new Error(error || "The host could not list your businesses");
+  const raw = body?.sites ?? body?.payload?.sites;
+  if (!Array.isArray(raw)) return null;
+  const sites: HostedSite[] = [];
+  for (const entry of raw) {
+    const e = (entry ?? {}) as Record<string, unknown>;
+    const id = text(e.id);
+    if (!id) continue;
+    const site: HostedSite = { id, name: text(e.name) };
+    if (text(e.logoUrl)) site.logoUrl = text(e.logoUrl);
+    if (text(e.color)) site.color = text(e.color);
+    sites.push(site);
+  }
+  return sites;
+}