@wix/himalaya-cli 0.1490.0 → 0.1491.0

package/dist/cli.mjs

@@ -22149,7 +22149,6 @@ function resolveIdiom(tokens2, ctx = {}) {
 var IDIOM_CONTEXTS, UNSAFE_KEYS;
 var init_idiom = __esm({
   "../../core/ts/src/idiom.ts"() {
-    "use strict";
     IDIOM_CONTEXTS = {
       ios: { native: ["ios"] },
       android: { native: ["material"] },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1490.0",
+  "version": "0.1491.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "cb54373a9c2a773492e66c5579403c0720caa00367681b4479fbc0e3"
+  "falconPackageHash": "69ee53fb46bd8285fb455df2eb9a446d954346c0b2f990cfb7e54d09"
 }

package/templates/beauty-salon-owner/tier5-src/_shared/owner-hosted-sites.ts

@@ -0,0 +1,60 @@
+// The businesses an EMBEDDING HOST says the signed-in owner owns — or null when there is no
+// such host.
+//
+// Standalone, an owner screen lists businesses itself (`querySites`, account level) and reads
+// each one with `site.forSite(msid)`, which stamps `wix-site-id` on that call. Embedded, the
+// host owns site selection: its data source signs every call for the business the user picked
+// and drops a worker-sent `wix-site-id`, so a fan-out read ONE business N times. A host that
+// opts in supplies its own list instead (`HimalayaOwnedSitesDataSource` on iOS / Android, the
+// `ownedSites` prop on web) and answers `himi.wix.ownedSites` with it; the embed then routes a
+// `site.forSite(msid)` call to the host's per-site call for any id on that list and refuses
+// every other id. So a worker reads the list here and keeps using `site.forSite` unchanged.
+//
+// A rejection is "not hosted": a standalone shell has no handler for the verb, and an older embed
+// predates it. Callers then do exactly what they did before. A host that opted in but cannot list
+// answers `{ error }` instead, which THROWS here: falling back to `querySites` would read the
+// account through the host's single-site signer and fan out to ids the host then refuses.
+
+import { dispatch } from "@himalaya/dispatch";
+
+export const OWNED_SITES_ACTION = "himi.wix.ownedSites";
+
+export interface HostedSite {
+  /** The business's metaSiteId — what `site.forSite` takes. */
+  id: string;
+  name: string;
+  logoUrl?: string;
+  color?: string;
+}
+
+function text(v: unknown): string {
+  return typeof v === "string" ? v.trim() : "";
+}
+
+/** The host's list, in the host's order; [] is a real answer (an owner with no businesses).
+ *  null when the verb is unanswered or the answer is not a list. Throws the host's `{ error }`. */
+export async function hostOwnedSites(): Promise<HostedSite[] | null> {
+  let value: unknown;
+  try {
+    value = await dispatch(OWNED_SITES_ACTION);
+  } catch {
+    return null;
+  }
+  // Native hosts resolve the payload itself; some web shells wrap it as `{ payload }`.
+  const body = value as { sites?: unknown; error?: unknown; payload?: { sites?: unknown; error?: unknown } } | null;
+  const error = body?.error ?? body?.payload?.error;
+  if (typeof error === "string") throw new Error(error || "The host could not list your businesses");
+  const raw = body?.sites ?? body?.payload?.sites;
+  if (!Array.isArray(raw)) return null;
+  const sites: HostedSite[] = [];
+  for (const entry of raw) {
+    const e = (entry ?? {}) as Record<string, unknown>;
+    const id = text(e.id);
+    if (!id) continue;
+    const site: HostedSite = { id, name: text(e.name) };
+    if (text(e.logoUrl)) site.logoUrl = text(e.logoUrl);
+    if (text(e.color)) site.color = text(e.color);
+    sites.push(site);
+  }
+  return sites;
+}

package/templates/beauty-salon-owner/tier5-src/himi-owner-lite-overview/index.ts

@@ -22,6 +22,11 @@
 // or one whose mint fails, resolves to `null` and renders as "—" beside the others rather
 // than throwing the whole screen into its error state. A rollup that disappears because one
 // of five businesses is unreachable is worse than one that says so in a row.
+//
+// EMBEDDED, THE HOST NAMES THE BUSINESSES. A host that owns site selection (Symphony's Manage
+// Wix) signs each call itself and would drop the per-call `wix-site-id`, so it supplies the
+// owner's sites instead (`hostOwnedSites`) and resolves each `site.forSite(msid)` call against
+// that list. The list replaces rung 1 only; the fan-out below is identical either way.
 
 import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
@@ -31,6 +36,7 @@ import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_share
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { pickSite, pickedSite } from "../_shared/owner-site-pick.js";
+import { hostOwnedSites } from "../_shared/owner-hosted-sites.js";
 
 /** Mirrors the Home dashboard's "needs attention" definition, so a number here means the
  *  same thing it means after the owner drills into that business. */
@@ -176,16 +182,24 @@ async function attentionCount(msid: string): Promise<number | null> {
   }
 }
 
+/** Rung 1: the host's list when embedded, else the account's own (`querySites`). */
+async function listBusinesses(): Promise<Array<{ id: string; name: string }>> {
+  const unnamed = () => copyParam("ownerOverview.unnamedBusiness", "Business");
+  const hosted = await hostOwnedSites();
+  if (hosted) return hosted.map((h) => ({ id: h.id, name: h.name || unnamed() }));
+  const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
+  return (res.sites ?? [])
+    .filter((r: WixSite) => r?.id)
+    .map((r: WixSite) => ({
+      id: r.id || "",
+      name: r.displayName || (r as { name?: string }).name || unnamed(),
+    }));
+}
+
 async function loadRollup(): Promise<OverviewState> {
   if (isOwnerPreviewDemo()) return demoRollup();
   try {
-    const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
-    const businesses = (res.sites ?? [])
-      .filter((r: WixSite) => r?.id)
-      .map((r: WixSite) => ({
-        id: r.id || "",
-        name: r.displayName || (r as { name?: string }).name || copyParam("ownerOverview.unnamedBusiness", "Business"),
-      }));
+    const businesses = await listBusinesses();
     if (businesses.length === 0) return shape({ status: "ready", rows: [] });
 
     // THE FAN-OUT. Concurrent, one business each, active scope untouched.

package/templates/community-club-owner/tier5-src/_shared/owner-hosted-sites.ts

@@ -0,0 +1,60 @@
+// The businesses an EMBEDDING HOST says the signed-in owner owns — or null when there is no
+// such host.
+//
+// Standalone, an owner screen lists businesses itself (`querySites`, account level) and reads
+// each one with `site.forSite(msid)`, which stamps `wix-site-id` on that call. Embedded, the
+// host owns site selection: its data source signs every call for the business the user picked
+// and drops a worker-sent `wix-site-id`, so a fan-out read ONE business N times. A host that
+// opts in supplies its own list instead (`HimalayaOwnedSitesDataSource` on iOS / Android, the
+// `ownedSites` prop on web) and answers `himi.wix.ownedSites` with it; the embed then routes a
+// `site.forSite(msid)` call to the host's per-site call for any id on that list and refuses
+// every other id. So a worker reads the list here and keeps using `site.forSite` unchanged.
+//
+// A rejection is "not hosted": a standalone shell has no handler for the verb, and an older embed
+// predates it. Callers then do exactly what they did before. A host that opted in but cannot list
+// answers `{ error }` instead, which THROWS here: falling back to `querySites` would read the
+// account through the host's single-site signer and fan out to ids the host then refuses.
+
+import { dispatch } from "@himalaya/dispatch";
+
+export const OWNED_SITES_ACTION = "himi.wix.ownedSites";
+
+export interface HostedSite {
+  /** The business's metaSiteId — what `site.forSite` takes. */
+  id: string;
+  name: string;
+  logoUrl?: string;
+  color?: string;
+}
+
+function text(v: unknown): string {
+  return typeof v === "string" ? v.trim() : "";
+}
+
+/** The host's list, in the host's order; [] is a real answer (an owner with no businesses).
+ *  null when the verb is unanswered or the answer is not a list. Throws the host's `{ error }`. */
+export async function hostOwnedSites(): Promise<HostedSite[] | null> {
+  let value: unknown;
+  try {
+    value = await dispatch(OWNED_SITES_ACTION);
+  } catch {
+    return null;
+  }
+  // Native hosts resolve the payload itself; some web shells wrap it as `{ payload }`.
+  const body = value as { sites?: unknown; error?: unknown; payload?: { sites?: unknown; error?: unknown } } | null;
+  const error = body?.error ?? body?.payload?.error;
+  if (typeof error === "string") throw new Error(error || "The host could not list your businesses");
+  const raw = body?.sites ?? body?.payload?.sites;
+  if (!Array.isArray(raw)) return null;
+  const sites: HostedSite[] = [];
+  for (const entry of raw) {
+    const e = (entry ?? {}) as Record<string, unknown>;
+    const id = text(e.id);
+    if (!id) continue;
+    const site: HostedSite = { id, name: text(e.name) };
+    if (text(e.logoUrl)) site.logoUrl = text(e.logoUrl);
+    if (text(e.color)) site.color = text(e.color);
+    sites.push(site);
+  }
+  return sites;
+}

package/templates/community-club-owner/tier5-src/himi-owner-lite-overview/index.ts

@@ -22,6 +22,11 @@
 // or one whose mint fails, resolves to `null` and renders as "—" beside the others rather
 // than throwing the whole screen into its error state. A rollup that disappears because one
 // of five businesses is unreachable is worse than one that says so in a row.
+//
+// EMBEDDED, THE HOST NAMES THE BUSINESSES. A host that owns site selection (Symphony's Manage
+// Wix) signs each call itself and would drop the per-call `wix-site-id`, so it supplies the
+// owner's sites instead (`hostOwnedSites`) and resolves each `site.forSite(msid)` call against
+// that list. The list replaces rung 1 only; the fan-out below is identical either way.
 
 import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
@@ -31,6 +36,7 @@ import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_share
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { pickSite, pickedSite } from "../_shared/owner-site-pick.js";
+import { hostOwnedSites } from "../_shared/owner-hosted-sites.js";
 
 /** Mirrors the Home dashboard's "needs attention" definition, so a number here means the
  *  same thing it means after the owner drills into that business. */
@@ -176,16 +182,24 @@ async function attentionCount(msid: string): Promise<number | null> {
   }
 }
 
+/** Rung 1: the host's list when embedded, else the account's own (`querySites`). */
+async function listBusinesses(): Promise<Array<{ id: string; name: string }>> {
+  const unnamed = () => copyParam("ownerOverview.unnamedBusiness", "Business");
+  const hosted = await hostOwnedSites();
+  if (hosted) return hosted.map((h) => ({ id: h.id, name: h.name || unnamed() }));
+  const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
+  return (res.sites ?? [])
+    .filter((r: WixSite) => r?.id)
+    .map((r: WixSite) => ({
+      id: r.id || "",
+      name: r.displayName || (r as { name?: string }).name || unnamed(),
+    }));
+}
+
 async function loadRollup(): Promise<OverviewState> {
   if (isOwnerPreviewDemo()) return demoRollup();
   try {
-    const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
-    const businesses = (res.sites ?? [])
-      .filter((r: WixSite) => r?.id)
-      .map((r: WixSite) => ({
-        id: r.id || "",
-        name: r.displayName || (r as { name?: string }).name || copyParam("ownerOverview.unnamedBusiness", "Business"),
-      }));
+    const businesses = await listBusinesses();
     if (businesses.length === 0) return shape({ status: "ready", rows: [] });
 
     // THE FAN-OUT. Concurrent, one business each, active scope untouched.

package/templates/events-meetups-owner/tier5-src/_shared/owner-hosted-sites.ts

@@ -0,0 +1,60 @@
+// The businesses an EMBEDDING HOST says the signed-in owner owns — or null when there is no
+// such host.
+//
+// Standalone, an owner screen lists businesses itself (`querySites`, account level) and reads
+// each one with `site.forSite(msid)`, which stamps `wix-site-id` on that call. Embedded, the
+// host owns site selection: its data source signs every call for the business the user picked
+// and drops a worker-sent `wix-site-id`, so a fan-out read ONE business N times. A host that
+// opts in supplies its own list instead (`HimalayaOwnedSitesDataSource` on iOS / Android, the
+// `ownedSites` prop on web) and answers `himi.wix.ownedSites` with it; the embed then routes a
+// `site.forSite(msid)` call to the host's per-site call for any id on that list and refuses
+// every other id. So a worker reads the list here and keeps using `site.forSite` unchanged.
+//
+// A rejection is "not hosted": a standalone shell has no handler for the verb, and an older embed
+// predates it. Callers then do exactly what they did before. A host that opted in but cannot list
+// answers `{ error }` instead, which THROWS here: falling back to `querySites` would read the
+// account through the host's single-site signer and fan out to ids the host then refuses.
+
+import { dispatch } from "@himalaya/dispatch";
+
+export const OWNED_SITES_ACTION = "himi.wix.ownedSites";
+
+export interface HostedSite {
+  /** The business's metaSiteId — what `site.forSite` takes. */
+  id: string;
+  name: string;
+  logoUrl?: string;
+  color?: string;
+}
+
+function text(v: unknown): string {
+  return typeof v === "string" ? v.trim() : "";
+}
+
+/** The host's list, in the host's order; [] is a real answer (an owner with no businesses).
+ *  null when the verb is unanswered or the answer is not a list. Throws the host's `{ error }`. */
+export async function hostOwnedSites(): Promise<HostedSite[] | null> {
+  let value: unknown;
+  try {
+    value = await dispatch(OWNED_SITES_ACTION);
+  } catch {
+    return null;
+  }
+  // Native hosts resolve the payload itself; some web shells wrap it as `{ payload }`.
+  const body = value as { sites?: unknown; error?: unknown; payload?: { sites?: unknown; error?: unknown } } | null;
+  const error = body?.error ?? body?.payload?.error;
+  if (typeof error === "string") throw new Error(error || "The host could not list your businesses");
+  const raw = body?.sites ?? body?.payload?.sites;
+  if (!Array.isArray(raw)) return null;
+  const sites: HostedSite[] = [];
+  for (const entry of raw) {
+    const e = (entry ?? {}) as Record<string, unknown>;
+    const id = text(e.id);
+    if (!id) continue;
+    const site: HostedSite = { id, name: text(e.name) };
+    if (text(e.logoUrl)) site.logoUrl = text(e.logoUrl);
+    if (text(e.color)) site.color = text(e.color);
+    sites.push(site);
+  }
+  return sites;
+}

package/templates/events-meetups-owner/tier5-src/himi-owner-lite-overview/index.ts

@@ -22,6 +22,11 @@
 // or one whose mint fails, resolves to `null` and renders as "—" beside the others rather
 // than throwing the whole screen into its error state. A rollup that disappears because one
 // of five businesses is unreachable is worse than one that says so in a row.
+//
+// EMBEDDED, THE HOST NAMES THE BUSINESSES. A host that owns site selection (Symphony's Manage
+// Wix) signs each call itself and would drop the per-call `wix-site-id`, so it supplies the
+// owner's sites instead (`hostOwnedSites`) and resolves each `site.forSite(msid)` call against
+// that list. The list replaces rung 1 only; the fan-out below is identical either way.
 
 import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
@@ -31,6 +36,7 @@ import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_share
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { pickSite, pickedSite } from "../_shared/owner-site-pick.js";
+import { hostOwnedSites } from "../_shared/owner-hosted-sites.js";
 
 /** Mirrors the Home dashboard's "needs attention" definition, so a number here means the
  *  same thing it means after the owner drills into that business. */
@@ -176,16 +182,24 @@ async function attentionCount(msid: string): Promise<number | null> {
   }
 }
 
+/** Rung 1: the host's list when embedded, else the account's own (`querySites`). */
+async function listBusinesses(): Promise<Array<{ id: string; name: string }>> {
+  const unnamed = () => copyParam("ownerOverview.unnamedBusiness", "Business");
+  const hosted = await hostOwnedSites();
+  if (hosted) return hosted.map((h) => ({ id: h.id, name: h.name || unnamed() }));
+  const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
+  return (res.sites ?? [])
+    .filter((r: WixSite) => r?.id)
+    .map((r: WixSite) => ({
+      id: r.id || "",
+      name: r.displayName || (r as { name?: string }).name || unnamed(),
+    }));
+}
+
 async function loadRollup(): Promise<OverviewState> {
   if (isOwnerPreviewDemo()) return demoRollup();
   try {
-    const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
-    const businesses = (res.sites ?? [])
-      .filter((r: WixSite) => r?.id)
-      .map((r: WixSite) => ({
-        id: r.id || "",
-        name: r.displayName || (r as { name?: string }).name || copyParam("ownerOverview.unnamedBusiness", "Business"),
-      }));
+    const businesses = await listBusinesses();
     if (businesses.length === 0) return shape({ status: "ready", rows: [] });
 
     // THE FAN-OUT. Concurrent, one business each, active scope untouched.

package/templates/gym-fitness-owner/tier5-src/_shared/owner-hosted-sites.ts

@@ -0,0 +1,60 @@
+// The businesses an EMBEDDING HOST says the signed-in owner owns — or null when there is no
+// such host.
+//
+// Standalone, an owner screen lists businesses itself (`querySites`, account level) and reads
+// each one with `site.forSite(msid)`, which stamps `wix-site-id` on that call. Embedded, the
+// host owns site selection: its data source signs every call for the business the user picked
+// and drops a worker-sent `wix-site-id`, so a fan-out read ONE business N times. A host that
+// opts in supplies its own list instead (`HimalayaOwnedSitesDataSource` on iOS / Android, the
+// `ownedSites` prop on web) and answers `himi.wix.ownedSites` with it; the embed then routes a
+// `site.forSite(msid)` call to the host's per-site call for any id on that list and refuses
+// every other id. So a worker reads the list here and keeps using `site.forSite` unchanged.
+//
+// A rejection is "not hosted": a standalone shell has no handler for the verb, and an older embed
+// predates it. Callers then do exactly what they did before. A host that opted in but cannot list
+// answers `{ error }` instead, which THROWS here: falling back to `querySites` would read the
+// account through the host's single-site signer and fan out to ids the host then refuses.
+
+import { dispatch } from "@himalaya/dispatch";
+
+export const OWNED_SITES_ACTION = "himi.wix.ownedSites";
+
+export interface HostedSite {
+  /** The business's metaSiteId — what `site.forSite` takes. */
+  id: string;
+  name: string;
+  logoUrl?: string;
+  color?: string;
+}
+
+function text(v: unknown): string {
+  return typeof v === "string" ? v.trim() : "";
+}
+
+/** The host's list, in the host's order; [] is a real answer (an owner with no businesses).
+ *  null when the verb is unanswered or the answer is not a list. Throws the host's `{ error }`. */
+export async function hostOwnedSites(): Promise<HostedSite[] | null> {
+  let value: unknown;
+  try {
+    value = await dispatch(OWNED_SITES_ACTION);
+  } catch {
+    return null;
+  }
+  // Native hosts resolve the payload itself; some web shells wrap it as `{ payload }`.
+  const body = value as { sites?: unknown; error?: unknown; payload?: { sites?: unknown; error?: unknown } } | null;
+  const error = body?.error ?? body?.payload?.error;
+  if (typeof error === "string") throw new Error(error || "The host could not list your businesses");
+  const raw = body?.sites ?? body?.payload?.sites;
+  if (!Array.isArray(raw)) return null;
+  const sites: HostedSite[] = [];
+  for (const entry of raw) {
+    const e = (entry ?? {}) as Record<string, unknown>;
+    const id = text(e.id);
+    if (!id) continue;
+    const site: HostedSite = { id, name: text(e.name) };
+    if (text(e.logoUrl)) site.logoUrl = text(e.logoUrl);
+    if (text(e.color)) site.color = text(e.color);
+    sites.push(site);
+  }
+  return sites;
+}

package/templates/gym-fitness-owner/tier5-src/himi-owner-lite-overview/index.ts

@@ -22,6 +22,11 @@
 // or one whose mint fails, resolves to `null` and renders as "—" beside the others rather
 // than throwing the whole screen into its error state. A rollup that disappears because one
 // of five businesses is unreachable is worse than one that says so in a row.
+//
+// EMBEDDED, THE HOST NAMES THE BUSINESSES. A host that owns site selection (Symphony's Manage
+// Wix) signs each call itself and would drop the per-call `wix-site-id`, so it supplies the
+// owner's sites instead (`hostOwnedSites`) and resolves each `site.forSite(msid)` call against
+// that list. The list replaces rung 1 only; the fan-out below is identical either way.
 
 import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
@@ -31,6 +36,7 @@ import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_share
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { pickSite, pickedSite } from "../_shared/owner-site-pick.js";
+import { hostOwnedSites } from "../_shared/owner-hosted-sites.js";
 
 /** Mirrors the Home dashboard's "needs attention" definition, so a number here means the
  *  same thing it means after the owner drills into that business. */
@@ -176,16 +182,24 @@ async function attentionCount(msid: string): Promise<number | null> {
   }
 }
 
+/** Rung 1: the host's list when embedded, else the account's own (`querySites`). */
+async function listBusinesses(): Promise<Array<{ id: string; name: string }>> {
+  const unnamed = () => copyParam("ownerOverview.unnamedBusiness", "Business");
+  const hosted = await hostOwnedSites();
+  if (hosted) return hosted.map((h) => ({ id: h.id, name: h.name || unnamed() }));
+  const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
+  return (res.sites ?? [])
+    .filter((r: WixSite) => r?.id)
+    .map((r: WixSite) => ({
+      id: r.id || "",
+      name: r.displayName || (r as { name?: string }).name || unnamed(),
+    }));
+}
+
 async function loadRollup(): Promise<OverviewState> {
   if (isOwnerPreviewDemo()) return demoRollup();
   try {
-    const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
-    const businesses = (res.sites ?? [])
-      .filter((r: WixSite) => r?.id)
-      .map((r: WixSite) => ({
-        id: r.id || "",
-        name: r.displayName || (r as { name?: string }).name || copyParam("ownerOverview.unnamedBusiness", "Business"),
-      }));
+    const businesses = await listBusinesses();
     if (businesses.length === 0) return shape({ status: "ready", rows: [] });
 
     // THE FAN-OUT. Concurrent, one business each, active scope untouched.

package/templates/nonprofit-cause-owner/tier5-src/_shared/owner-hosted-sites.ts

@@ -0,0 +1,60 @@
+// The businesses an EMBEDDING HOST says the signed-in owner owns — or null when there is no
+// such host.
+//
+// Standalone, an owner screen lists businesses itself (`querySites`, account level) and reads
+// each one with `site.forSite(msid)`, which stamps `wix-site-id` on that call. Embedded, the
+// host owns site selection: its data source signs every call for the business the user picked
+// and drops a worker-sent `wix-site-id`, so a fan-out read ONE business N times. A host that
+// opts in supplies its own list instead (`HimalayaOwnedSitesDataSource` on iOS / Android, the
+// `ownedSites` prop on web) and answers `himi.wix.ownedSites` with it; the embed then routes a
+// `site.forSite(msid)` call to the host's per-site call for any id on that list and refuses
+// every other id. So a worker reads the list here and keeps using `site.forSite` unchanged.
+//
+// A rejection is "not hosted": a standalone shell has no handler for the verb, and an older embed
+// predates it. Callers then do exactly what they did before. A host that opted in but cannot list
+// answers `{ error }` instead, which THROWS here: falling back to `querySites` would read the
+// account through the host's single-site signer and fan out to ids the host then refuses.
+
+import { dispatch } from "@himalaya/dispatch";
+
+export const OWNED_SITES_ACTION = "himi.wix.ownedSites";
+
+export interface HostedSite {
+  /** The business's metaSiteId — what `site.forSite` takes. */
+  id: string;
+  name: string;
+  logoUrl?: string;
+  color?: string;
+}
+
+function text(v: unknown): string {
+  return typeof v === "string" ? v.trim() : "";
+}
+
+/** The host's list, in the host's order; [] is a real answer (an owner with no businesses).
+ *  null when the verb is unanswered or the answer is not a list. Throws the host's `{ error }`. */
+export async function hostOwnedSites(): Promise<HostedSite[] | null> {
+  let value: unknown;
+  try {
+    value = await dispatch(OWNED_SITES_ACTION);
+  } catch {
+    return null;
+  }
+  // Native hosts resolve the payload itself; some web shells wrap it as `{ payload }`.
+  const body = value as { sites?: unknown; error?: unknown; payload?: { sites?: unknown; error?: unknown } } | null;
+  const error = body?.error ?? body?.payload?.error;
+  if (typeof error === "string") throw new Error(error || "The host could not list your businesses");
+  const raw = body?.sites ?? body?.payload?.sites;
+  if (!Array.isArray(raw)) return null;
+  const sites: HostedSite[] = [];
+  for (const entry of raw) {
+    const e = (entry ?? {}) as Record<string, unknown>;
+    const id = text(e.id);
+    if (!id) continue;
+    const site: HostedSite = { id, name: text(e.name) };
+    if (text(e.logoUrl)) site.logoUrl = text(e.logoUrl);
+    if (text(e.color)) site.color = text(e.color);
+    sites.push(site);
+  }
+  return sites;
+}

package/templates/nonprofit-cause-owner/tier5-src/himi-owner-lite-overview/index.ts

@@ -22,6 +22,11 @@
 // or one whose mint fails, resolves to `null` and renders as "—" beside the others rather
 // than throwing the whole screen into its error state. A rollup that disappears because one
 // of five businesses is unreachable is worse than one that says so in a row.
+//
+// EMBEDDED, THE HOST NAMES THE BUSINESSES. A host that owns site selection (Symphony's Manage
+// Wix) signs each call itself and would drop the per-call `wix-site-id`, so it supplies the
+// owner's sites instead (`hostOwnedSites`) and resolves each `site.forSite(msid)` call against
+// that list. The list replaces rung 1 only; the fan-out below is identical either way.
 
 import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
@@ -31,6 +36,7 @@ import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_share
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { pickSite, pickedSite } from "../_shared/owner-site-pick.js";
+import { hostOwnedSites } from "../_shared/owner-hosted-sites.js";
 
 /** Mirrors the Home dashboard's "needs attention" definition, so a number here means the
  *  same thing it means after the owner drills into that business. */
@@ -176,16 +182,24 @@ async function attentionCount(msid: string): Promise<number | null> {
   }
 }
 
+/** Rung 1: the host's list when embedded, else the account's own (`querySites`). */
+async function listBusinesses(): Promise<Array<{ id: string; name: string }>> {
+  const unnamed = () => copyParam("ownerOverview.unnamedBusiness", "Business");
+  const hosted = await hostOwnedSites();
+  if (hosted) return hosted.map((h) => ({ id: h.id, name: h.name || unnamed() }));
+  const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
+  return (res.sites ?? [])
+    .filter((r: WixSite) => r?.id)
+    .map((r: WixSite) => ({
+      id: r.id || "",
+      name: r.displayName || (r as { name?: string }).name || unnamed(),
+    }));
+}
+
 async function loadRollup(): Promise<OverviewState> {
   if (isOwnerPreviewDemo()) return demoRollup();
   try {
-    const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
-    const businesses = (res.sites ?? [])
-      .filter((r: WixSite) => r?.id)
-      .map((r: WixSite) => ({
-        id: r.id || "",
-        name: r.displayName || (r as { name?: string }).name || copyParam("ownerOverview.unnamedBusiness", "Business"),
-      }));
+    const businesses = await listBusinesses();
     if (businesses.length === 0) return shape({ status: "ready", rows: [] });
 
     // THE FAN-OUT. Concurrent, one business each, active scope untouched.

package/templates/owner-lite/tier5-src/_shared/owner-hosted-sites.ts

@@ -0,0 +1,60 @@
+// The businesses an EMBEDDING HOST says the signed-in owner owns — or null when there is no
+// such host.
+//
+// Standalone, an owner screen lists businesses itself (`querySites`, account level) and reads
+// each one with `site.forSite(msid)`, which stamps `wix-site-id` on that call. Embedded, the
+// host owns site selection: its data source signs every call for the business the user picked
+// and drops a worker-sent `wix-site-id`, so a fan-out read ONE business N times. A host that
+// opts in supplies its own list instead (`HimalayaOwnedSitesDataSource` on iOS / Android, the
+// `ownedSites` prop on web) and answers `himi.wix.ownedSites` with it; the embed then routes a
+// `site.forSite(msid)` call to the host's per-site call for any id on that list and refuses
+// every other id. So a worker reads the list here and keeps using `site.forSite` unchanged.
+//
+// A rejection is "not hosted": a standalone shell has no handler for the verb, and an older embed
+// predates it. Callers then do exactly what they did before. A host that opted in but cannot list
+// answers `{ error }` instead, which THROWS here: falling back to `querySites` would read the
+// account through the host's single-site signer and fan out to ids the host then refuses.
+
+import { dispatch } from "@himalaya/dispatch";
+
+export const OWNED_SITES_ACTION = "himi.wix.ownedSites";
+
+export interface HostedSite {
+  /** The business's metaSiteId — what `site.forSite` takes. */
+  id: string;
+  name: string;
+  logoUrl?: string;
+  color?: string;
+}
+
+function text(v: unknown): string {
+  return typeof v === "string" ? v.trim() : "";
+}
+
+/** The host's list, in the host's order; [] is a real answer (an owner with no businesses).
+ *  null when the verb is unanswered or the answer is not a list. Throws the host's `{ error }`. */
+export async function hostOwnedSites(): Promise<HostedSite[] | null> {
+  let value: unknown;
+  try {
+    value = await dispatch(OWNED_SITES_ACTION);
+  } catch {
+    return null;
+  }
+  // Native hosts resolve the payload itself; some web shells wrap it as `{ payload }`.
+  const body = value as { sites?: unknown; error?: unknown; payload?: { sites?: unknown; error?: unknown } } | null;
+  const error = body?.error ?? body?.payload?.error;
+  if (typeof error === "string") throw new Error(error || "The host could not list your businesses");
+  const raw = body?.sites ?? body?.payload?.sites;
+  if (!Array.isArray(raw)) return null;
+  const sites: HostedSite[] = [];
+  for (const entry of raw) {
+    const e = (entry ?? {}) as Record<string, unknown>;
+    const id = text(e.id);
+    if (!id) continue;
+    const site: HostedSite = { id, name: text(e.name) };
+    if (text(e.logoUrl)) site.logoUrl = text(e.logoUrl);
+    if (text(e.color)) site.color = text(e.color);
+    sites.push(site);
+  }
+  return sites;
+}

package/templates/owner-lite/tier5-src/himi-owner-lite-overview/index.ts

@@ -22,6 +22,11 @@
 // or one whose mint fails, resolves to `null` and renders as "—" beside the others rather
 // than throwing the whole screen into its error state. A rollup that disappears because one
 // of five businesses is unreachable is worse than one that says so in a row.
+//
+// EMBEDDED, THE HOST NAMES THE BUSINESSES. A host that owns site selection (Symphony's Manage
+// Wix) signs each call itself and would drop the per-call `wix-site-id`, so it supplies the
+// owner's sites instead (`hostOwnedSites`) and resolves each `site.forSite(msid)` call against
+// that list. The list replaces rung 1 only; the fan-out below is identical either way.
 
 import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
@@ -31,6 +36,7 @@ import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_share
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { pickSite, pickedSite } from "../_shared/owner-site-pick.js";
+import { hostOwnedSites } from "../_shared/owner-hosted-sites.js";
 
 /** Mirrors the Home dashboard's "needs attention" definition, so a number here means the
  *  same thing it means after the owner drills into that business. */
@@ -176,16 +182,24 @@ async function attentionCount(msid: string): Promise<number | null> {
   }
 }
 
+/** Rung 1: the host's list when embedded, else the account's own (`querySites`). */
+async function listBusinesses(): Promise<Array<{ id: string; name: string }>> {
+  const unnamed = () => copyParam("ownerOverview.unnamedBusiness", "Business");
+  const hosted = await hostOwnedSites();
+  if (hosted) return hosted.map((h) => ({ id: h.id, name: h.name || unnamed() }));
+  const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
+  return (res.sites ?? [])
+    .filter((r: WixSite) => r?.id)
+    .map((r: WixSite) => ({
+      id: r.id || "",
+      name: r.displayName || (r as { name?: string }).name || unnamed(),
+    }));
+}
+
 async function loadRollup(): Promise<OverviewState> {
   if (isOwnerPreviewDemo()) return demoRollup();
   try {
-    const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
-    const businesses = (res.sites ?? [])
-      .filter((r: WixSite) => r?.id)
-      .map((r: WixSite) => ({
-        id: r.id || "",
-        name: r.displayName || (r as { name?: string }).name || copyParam("ownerOverview.unnamedBusiness", "Business"),
-      }));
+    const businesses = await listBusinesses();
     if (businesses.length === 0) return shape({ status: "ready", rows: [] });
 
     // THE FAN-OUT. Concurrent, one business each, active scope untouched.

package/templates/podcast-creator-owner/tier5-src/_shared/owner-hosted-sites.ts

@@ -0,0 +1,60 @@
+// The businesses an EMBEDDING HOST says the signed-in owner owns — or null when there is no
+// such host.
+//
+// Standalone, an owner screen lists businesses itself (`querySites`, account level) and reads
+// each one with `site.forSite(msid)`, which stamps `wix-site-id` on that call. Embedded, the
+// host owns site selection: its data source signs every call for the business the user picked
+// and drops a worker-sent `wix-site-id`, so a fan-out read ONE business N times. A host that
+// opts in supplies its own list instead (`HimalayaOwnedSitesDataSource` on iOS / Android, the
+// `ownedSites` prop on web) and answers `himi.wix.ownedSites` with it; the embed then routes a
+// `site.forSite(msid)` call to the host's per-site call for any id on that list and refuses
+// every other id. So a worker reads the list here and keeps using `site.forSite` unchanged.
+//
+// A rejection is "not hosted": a standalone shell has no handler for the verb, and an older embed
+// predates it. Callers then do exactly what they did before. A host that opted in but cannot list
+// answers `{ error }` instead, which THROWS here: falling back to `querySites` would read the
+// account through the host's single-site signer and fan out to ids the host then refuses.
+
+import { dispatch } from "@himalaya/dispatch";
+
+export const OWNED_SITES_ACTION = "himi.wix.ownedSites";
+
+export interface HostedSite {
+  /** The business's metaSiteId — what `site.forSite` takes. */
+  id: string;
+  name: string;
+  logoUrl?: string;
+  color?: string;
+}
+
+function text(v: unknown): string {
+  return typeof v === "string" ? v.trim() : "";
+}
+
+/** The host's list, in the host's order; [] is a real answer (an owner with no businesses).
+ *  null when the verb is unanswered or the answer is not a list. Throws the host's `{ error }`. */
+export async function hostOwnedSites(): Promise<HostedSite[] | null> {
+  let value: unknown;
+  try {
+    value = await dispatch(OWNED_SITES_ACTION);
+  } catch {
+    return null;
+  }
+  // Native hosts resolve the payload itself; some web shells wrap it as `{ payload }`.
+  const body = value as { sites?: unknown; error?: unknown; payload?: { sites?: unknown; error?: unknown } } | null;
+  const error = body?.error ?? body?.payload?.error;
+  if (typeof error === "string") throw new Error(error || "The host could not list your businesses");
+  const raw = body?.sites ?? body?.payload?.sites;
+  if (!Array.isArray(raw)) return null;
+  const sites: HostedSite[] = [];
+  for (const entry of raw) {
+    const e = (entry ?? {}) as Record<string, unknown>;
+    const id = text(e.id);
+    if (!id) continue;
+    const site: HostedSite = { id, name: text(e.name) };
+    if (text(e.logoUrl)) site.logoUrl = text(e.logoUrl);
+    if (text(e.color)) site.color = text(e.color);
+    sites.push(site);
+  }
+  return sites;
+}

package/templates/podcast-creator-owner/tier5-src/himi-owner-lite-overview/index.ts

@@ -22,6 +22,11 @@
 // or one whose mint fails, resolves to `null` and renders as "—" beside the others rather
 // than throwing the whole screen into its error state. A rollup that disappears because one
 // of five businesses is unreachable is worse than one that says so in a row.
+//
+// EMBEDDED, THE HOST NAMES THE BUSINESSES. A host that owns site selection (Symphony's Manage
+// Wix) signs each call itself and would drop the per-call `wix-site-id`, so it supplies the
+// owner's sites instead (`hostOwnedSites`) and resolves each `site.forSite(msid)` call against
+// that list. The list replaces rung 1 only; the fan-out below is identical either way.
 
 import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
@@ -31,6 +36,7 @@ import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_share
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { pickSite, pickedSite } from "../_shared/owner-site-pick.js";
+import { hostOwnedSites } from "../_shared/owner-hosted-sites.js";
 
 /** Mirrors the Home dashboard's "needs attention" definition, so a number here means the
  *  same thing it means after the owner drills into that business. */
@@ -176,16 +182,24 @@ async function attentionCount(msid: string): Promise<number | null> {
   }
 }
 
+/** Rung 1: the host's list when embedded, else the account's own (`querySites`). */
+async function listBusinesses(): Promise<Array<{ id: string; name: string }>> {
+  const unnamed = () => copyParam("ownerOverview.unnamedBusiness", "Business");
+  const hosted = await hostOwnedSites();
+  if (hosted) return hosted.map((h) => ({ id: h.id, name: h.name || unnamed() }));
+  const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
+  return (res.sites ?? [])
+    .filter((r: WixSite) => r?.id)
+    .map((r: WixSite) => ({
+      id: r.id || "",
+      name: r.displayName || (r as { name?: string }).name || unnamed(),
+    }));
+}
+
 async function loadRollup(): Promise<OverviewState> {
   if (isOwnerPreviewDemo()) return demoRollup();
   try {
-    const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
-    const businesses = (res.sites ?? [])
-      .filter((r: WixSite) => r?.id)
-      .map((r: WixSite) => ({
-        id: r.id || "",
-        name: r.displayName || (r as { name?: string }).name || copyParam("ownerOverview.unnamedBusiness", "Business"),
-      }));
+    const businesses = await listBusinesses();
     if (businesses.length === 0) return shape({ status: "ready", rows: [] });
 
     // THE FAN-OUT. Concurrent, one business each, active scope untouched.

package/templates/portfolio-creative-owner/tier5-src/_shared/owner-hosted-sites.ts

@@ -0,0 +1,60 @@
+// The businesses an EMBEDDING HOST says the signed-in owner owns — or null when there is no
+// such host.
+//
+// Standalone, an owner screen lists businesses itself (`querySites`, account level) and reads
+// each one with `site.forSite(msid)`, which stamps `wix-site-id` on that call. Embedded, the
+// host owns site selection: its data source signs every call for the business the user picked
+// and drops a worker-sent `wix-site-id`, so a fan-out read ONE business N times. A host that
+// opts in supplies its own list instead (`HimalayaOwnedSitesDataSource` on iOS / Android, the
+// `ownedSites` prop on web) and answers `himi.wix.ownedSites` with it; the embed then routes a
+// `site.forSite(msid)` call to the host's per-site call for any id on that list and refuses
+// every other id. So a worker reads the list here and keeps using `site.forSite` unchanged.
+//
+// A rejection is "not hosted": a standalone shell has no handler for the verb, and an older embed
+// predates it. Callers then do exactly what they did before. A host that opted in but cannot list
+// answers `{ error }` instead, which THROWS here: falling back to `querySites` would read the
+// account through the host's single-site signer and fan out to ids the host then refuses.
+
+import { dispatch } from "@himalaya/dispatch";
+
+export const OWNED_SITES_ACTION = "himi.wix.ownedSites";
+
+export interface HostedSite {
+  /** The business's metaSiteId — what `site.forSite` takes. */
+  id: string;
+  name: string;
+  logoUrl?: string;
+  color?: string;
+}
+
+function text(v: unknown): string {
+  return typeof v === "string" ? v.trim() : "";
+}
+
+/** The host's list, in the host's order; [] is a real answer (an owner with no businesses).
+ *  null when the verb is unanswered or the answer is not a list. Throws the host's `{ error }`. */
+export async function hostOwnedSites(): Promise<HostedSite[] | null> {
+  let value: unknown;
+  try {
+    value = await dispatch(OWNED_SITES_ACTION);
+  } catch {
+    return null;
+  }
+  // Native hosts resolve the payload itself; some web shells wrap it as `{ payload }`.
+  const body = value as { sites?: unknown; error?: unknown; payload?: { sites?: unknown; error?: unknown } } | null;
+  const error = body?.error ?? body?.payload?.error;
+  if (typeof error === "string") throw new Error(error || "The host could not list your businesses");
+  const raw = body?.sites ?? body?.payload?.sites;
+  if (!Array.isArray(raw)) return null;
+  const sites: HostedSite[] = [];
+  for (const entry of raw) {
+    const e = (entry ?? {}) as Record<string, unknown>;
+    const id = text(e.id);
+    if (!id) continue;
+    const site: HostedSite = { id, name: text(e.name) };
+    if (text(e.logoUrl)) site.logoUrl = text(e.logoUrl);
+    if (text(e.color)) site.color = text(e.color);
+    sites.push(site);
+  }
+  return sites;
+}

package/templates/portfolio-creative-owner/tier5-src/himi-owner-lite-overview/index.ts

@@ -22,6 +22,11 @@
 // or one whose mint fails, resolves to `null` and renders as "—" beside the others rather
 // than throwing the whole screen into its error state. A rollup that disappears because one
 // of five businesses is unreachable is worse than one that says so in a row.
+//
+// EMBEDDED, THE HOST NAMES THE BUSINESSES. A host that owns site selection (Symphony's Manage
+// Wix) signs each call itself and would drop the per-call `wix-site-id`, so it supplies the
+// owner's sites instead (`hostOwnedSites`) and resolves each `site.forSite(msid)` call against
+// that list. The list replaces rung 1 only; the fan-out below is identical either way.
 
 import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
@@ -31,6 +36,7 @@ import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_share
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { pickSite, pickedSite } from "../_shared/owner-site-pick.js";
+import { hostOwnedSites } from "../_shared/owner-hosted-sites.js";
 
 /** Mirrors the Home dashboard's "needs attention" definition, so a number here means the
  *  same thing it means after the owner drills into that business. */
@@ -176,16 +182,24 @@ async function attentionCount(msid: string): Promise<number | null> {
   }
 }
 
+/** Rung 1: the host's list when embedded, else the account's own (`querySites`). */
+async function listBusinesses(): Promise<Array<{ id: string; name: string }>> {
+  const unnamed = () => copyParam("ownerOverview.unnamedBusiness", "Business");
+  const hosted = await hostOwnedSites();
+  if (hosted) return hosted.map((h) => ({ id: h.id, name: h.name || unnamed() }));
+  const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
+  return (res.sites ?? [])
+    .filter((r: WixSite) => r?.id)
+    .map((r: WixSite) => ({
+      id: r.id || "",
+      name: r.displayName || (r as { name?: string }).name || unnamed(),
+    }));
+}
+
 async function loadRollup(): Promise<OverviewState> {
   if (isOwnerPreviewDemo()) return demoRollup();
   try {
-    const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
-    const businesses = (res.sites ?? [])
-      .filter((r: WixSite) => r?.id)
-      .map((r: WixSite) => ({
-        id: r.id || "",
-        name: r.displayName || (r as { name?: string }).name || copyParam("ownerOverview.unnamedBusiness", "Business"),
-      }));
+    const businesses = await listBusinesses();
     if (businesses.length === 0) return shape({ status: "ready", rows: [] });
 
     // THE FAN-OUT. Concurrent, one business each, active scope untouched.

package/templates/restaurant-owner/tier5-src/_shared/owner-hosted-sites.ts

@@ -0,0 +1,60 @@
+// The businesses an EMBEDDING HOST says the signed-in owner owns — or null when there is no
+// such host.
+//
+// Standalone, an owner screen lists businesses itself (`querySites`, account level) and reads
+// each one with `site.forSite(msid)`, which stamps `wix-site-id` on that call. Embedded, the
+// host owns site selection: its data source signs every call for the business the user picked
+// and drops a worker-sent `wix-site-id`, so a fan-out read ONE business N times. A host that
+// opts in supplies its own list instead (`HimalayaOwnedSitesDataSource` on iOS / Android, the
+// `ownedSites` prop on web) and answers `himi.wix.ownedSites` with it; the embed then routes a
+// `site.forSite(msid)` call to the host's per-site call for any id on that list and refuses
+// every other id. So a worker reads the list here and keeps using `site.forSite` unchanged.
+//
+// A rejection is "not hosted": a standalone shell has no handler for the verb, and an older embed
+// predates it. Callers then do exactly what they did before. A host that opted in but cannot list
+// answers `{ error }` instead, which THROWS here: falling back to `querySites` would read the
+// account through the host's single-site signer and fan out to ids the host then refuses.
+
+import { dispatch } from "@himalaya/dispatch";
+
+export const OWNED_SITES_ACTION = "himi.wix.ownedSites";
+
+export interface HostedSite {
+  /** The business's metaSiteId — what `site.forSite` takes. */
+  id: string;
+  name: string;
+  logoUrl?: string;
+  color?: string;
+}
+
+function text(v: unknown): string {
+  return typeof v === "string" ? v.trim() : "";
+}
+
+/** The host's list, in the host's order; [] is a real answer (an owner with no businesses).
+ *  null when the verb is unanswered or the answer is not a list. Throws the host's `{ error }`. */
+export async function hostOwnedSites(): Promise<HostedSite[] | null> {
+  let value: unknown;
+  try {
+    value = await dispatch(OWNED_SITES_ACTION);
+  } catch {
+    return null;
+  }
+  // Native hosts resolve the payload itself; some web shells wrap it as `{ payload }`.
+  const body = value as { sites?: unknown; error?: unknown; payload?: { sites?: unknown; error?: unknown } } | null;
+  const error = body?.error ?? body?.payload?.error;
+  if (typeof error === "string") throw new Error(error || "The host could not list your businesses");
+  const raw = body?.sites ?? body?.payload?.sites;
+  if (!Array.isArray(raw)) return null;
+  const sites: HostedSite[] = [];
+  for (const entry of raw) {
+    const e = (entry ?? {}) as Record<string, unknown>;
+    const id = text(e.id);
+    if (!id) continue;
+    const site: HostedSite = { id, name: text(e.name) };
+    if (text(e.logoUrl)) site.logoUrl = text(e.logoUrl);
+    if (text(e.color)) site.color = text(e.color);
+    sites.push(site);
+  }
+  return sites;
+}

package/templates/restaurant-owner/tier5-src/himi-owner-lite-overview/index.ts

@@ -22,6 +22,11 @@
 // or one whose mint fails, resolves to `null` and renders as "—" beside the others rather
 // than throwing the whole screen into its error state. A rollup that disappears because one
 // of five businesses is unreachable is worse than one that says so in a row.
+//
+// EMBEDDED, THE HOST NAMES THE BUSINESSES. A host that owns site selection (Symphony's Manage
+// Wix) signs each call itself and would drop the per-call `wix-site-id`, so it supplies the
+// owner's sites instead (`hostOwnedSites`) and resolves each `site.forSite(msid)` call against
+// that list. The list replaces rung 1 only; the fan-out below is identical either way.
 
 import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
@@ -31,6 +36,7 @@ import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_share
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { pickSite, pickedSite } from "../_shared/owner-site-pick.js";
+import { hostOwnedSites } from "../_shared/owner-hosted-sites.js";
 
 /** Mirrors the Home dashboard's "needs attention" definition, so a number here means the
  *  same thing it means after the owner drills into that business. */
@@ -176,16 +182,24 @@ async function attentionCount(msid: string): Promise<number | null> {
   }
 }
 
+/** Rung 1: the host's list when embedded, else the account's own (`querySites`). */
+async function listBusinesses(): Promise<Array<{ id: string; name: string }>> {
+  const unnamed = () => copyParam("ownerOverview.unnamedBusiness", "Business");
+  const hosted = await hostOwnedSites();
+  if (hosted) return hosted.map((h) => ({ id: h.id, name: h.name || unnamed() }));
+  const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
+  return (res.sites ?? [])
+    .filter((r: WixSite) => r?.id)
+    .map((r: WixSite) => ({
+      id: r.id || "",
+      name: r.displayName || (r as { name?: string }).name || unnamed(),
+    }));
+}
+
 async function loadRollup(): Promise<OverviewState> {
   if (isOwnerPreviewDemo()) return demoRollup();
   try {
-    const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
-    const businesses = (res.sites ?? [])
-      .filter((r: WixSite) => r?.id)
-      .map((r: WixSite) => ({
-        id: r.id || "",
-        name: r.displayName || (r as { name?: string }).name || copyParam("ownerOverview.unnamedBusiness", "Business"),
-      }));
+    const businesses = await listBusinesses();
     if (businesses.length === 0) return shape({ status: "ready", rows: [] });
 
     // THE FAN-OUT. Concurrent, one business each, active scope untouched.

package/templates/retail-store-owner/tier5-src/_shared/owner-hosted-sites.ts

@@ -0,0 +1,60 @@
+// The businesses an EMBEDDING HOST says the signed-in owner owns — or null when there is no
+// such host.
+//
+// Standalone, an owner screen lists businesses itself (`querySites`, account level) and reads
+// each one with `site.forSite(msid)`, which stamps `wix-site-id` on that call. Embedded, the
+// host owns site selection: its data source signs every call for the business the user picked
+// and drops a worker-sent `wix-site-id`, so a fan-out read ONE business N times. A host that
+// opts in supplies its own list instead (`HimalayaOwnedSitesDataSource` on iOS / Android, the
+// `ownedSites` prop on web) and answers `himi.wix.ownedSites` with it; the embed then routes a
+// `site.forSite(msid)` call to the host's per-site call for any id on that list and refuses
+// every other id. So a worker reads the list here and keeps using `site.forSite` unchanged.
+//
+// A rejection is "not hosted": a standalone shell has no handler for the verb, and an older embed
+// predates it. Callers then do exactly what they did before. A host that opted in but cannot list
+// answers `{ error }` instead, which THROWS here: falling back to `querySites` would read the
+// account through the host's single-site signer and fan out to ids the host then refuses.
+
+import { dispatch } from "@himalaya/dispatch";
+
+export const OWNED_SITES_ACTION = "himi.wix.ownedSites";
+
+export interface HostedSite {
+  /** The business's metaSiteId — what `site.forSite` takes. */
+  id: string;
+  name: string;
+  logoUrl?: string;
+  color?: string;
+}
+
+function text(v: unknown): string {
+  return typeof v === "string" ? v.trim() : "";
+}
+
+/** The host's list, in the host's order; [] is a real answer (an owner with no businesses).
+ *  null when the verb is unanswered or the answer is not a list. Throws the host's `{ error }`. */
+export async function hostOwnedSites(): Promise<HostedSite[] | null> {
+  let value: unknown;
+  try {
+    value = await dispatch(OWNED_SITES_ACTION);
+  } catch {
+    return null;
+  }
+  // Native hosts resolve the payload itself; some web shells wrap it as `{ payload }`.
+  const body = value as { sites?: unknown; error?: unknown; payload?: { sites?: unknown; error?: unknown } } | null;
+  const error = body?.error ?? body?.payload?.error;
+  if (typeof error === "string") throw new Error(error || "The host could not list your businesses");
+  const raw = body?.sites ?? body?.payload?.sites;
+  if (!Array.isArray(raw)) return null;
+  const sites: HostedSite[] = [];
+  for (const entry of raw) {
+    const e = (entry ?? {}) as Record<string, unknown>;
+    const id = text(e.id);
+    if (!id) continue;
+    const site: HostedSite = { id, name: text(e.name) };
+    if (text(e.logoUrl)) site.logoUrl = text(e.logoUrl);
+    if (text(e.color)) site.color = text(e.color);
+    sites.push(site);
+  }
+  return sites;
+}

package/templates/retail-store-owner/tier5-src/himi-owner-lite-overview/index.ts

@@ -22,6 +22,11 @@
 // or one whose mint fails, resolves to `null` and renders as "—" beside the others rather
 // than throwing the whole screen into its error state. A rollup that disappears because one
 // of five businesses is unreachable is worse than one that says so in a row.
+//
+// EMBEDDED, THE HOST NAMES THE BUSINESSES. A host that owns site selection (Symphony's Manage
+// Wix) signs each call itself and would drop the per-call `wix-site-id`, so it supplies the
+// owner's sites instead (`hostOwnedSites`) and resolves each `site.forSite(msid)` call against
+// that list. The list replaces rung 1 only; the fan-out below is identical either way.
 
 import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
@@ -31,6 +36,7 @@ import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_share
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { pickSite, pickedSite } from "../_shared/owner-site-pick.js";
+import { hostOwnedSites } from "../_shared/owner-hosted-sites.js";
 
 /** Mirrors the Home dashboard's "needs attention" definition, so a number here means the
  *  same thing it means after the owner drills into that business. */
@@ -176,16 +182,24 @@ async function attentionCount(msid: string): Promise<number | null> {
   }
 }
 
+/** Rung 1: the host's list when embedded, else the account's own (`querySites`). */
+async function listBusinesses(): Promise<Array<{ id: string; name: string }>> {
+  const unnamed = () => copyParam("ownerOverview.unnamedBusiness", "Business");
+  const hosted = await hostOwnedSites();
+  if (hosted) return hosted.map((h) => ({ id: h.id, name: h.name || unnamed() }));
+  const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
+  return (res.sites ?? [])
+    .filter((r: WixSite) => r?.id)
+    .map((r: WixSite) => ({
+      id: r.id || "",
+      name: r.displayName || (r as { name?: string }).name || unnamed(),
+    }));
+}
+
 async function loadRollup(): Promise<OverviewState> {
   if (isOwnerPreviewDemo()) return demoRollup();
   try {
-    const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
-    const businesses = (res.sites ?? [])
-      .filter((r: WixSite) => r?.id)
-      .map((r: WixSite) => ({
-        id: r.id || "",
-        name: r.displayName || (r as { name?: string }).name || copyParam("ownerOverview.unnamedBusiness", "Business"),
-      }));
+    const businesses = await listBusinesses();
     if (businesses.length === 0) return shape({ status: "ready", rows: [] });
 
     // THE FAN-OUT. Concurrent, one business each, active scope untouched.

package/templates/yoga-studio-owner/tier5-src/_shared/owner-hosted-sites.ts

@@ -0,0 +1,60 @@
+// The businesses an EMBEDDING HOST says the signed-in owner owns — or null when there is no
+// such host.
+//
+// Standalone, an owner screen lists businesses itself (`querySites`, account level) and reads
+// each one with `site.forSite(msid)`, which stamps `wix-site-id` on that call. Embedded, the
+// host owns site selection: its data source signs every call for the business the user picked
+// and drops a worker-sent `wix-site-id`, so a fan-out read ONE business N times. A host that
+// opts in supplies its own list instead (`HimalayaOwnedSitesDataSource` on iOS / Android, the
+// `ownedSites` prop on web) and answers `himi.wix.ownedSites` with it; the embed then routes a
+// `site.forSite(msid)` call to the host's per-site call for any id on that list and refuses
+// every other id. So a worker reads the list here and keeps using `site.forSite` unchanged.
+//
+// A rejection is "not hosted": a standalone shell has no handler for the verb, and an older embed
+// predates it. Callers then do exactly what they did before. A host that opted in but cannot list
+// answers `{ error }` instead, which THROWS here: falling back to `querySites` would read the
+// account through the host's single-site signer and fan out to ids the host then refuses.
+
+import { dispatch } from "@himalaya/dispatch";
+
+export const OWNED_SITES_ACTION = "himi.wix.ownedSites";
+
+export interface HostedSite {
+  /** The business's metaSiteId — what `site.forSite` takes. */
+  id: string;
+  name: string;
+  logoUrl?: string;
+  color?: string;
+}
+
+function text(v: unknown): string {
+  return typeof v === "string" ? v.trim() : "";
+}
+
+/** The host's list, in the host's order; [] is a real answer (an owner with no businesses).
+ *  null when the verb is unanswered or the answer is not a list. Throws the host's `{ error }`. */
+export async function hostOwnedSites(): Promise<HostedSite[] | null> {
+  let value: unknown;
+  try {
+    value = await dispatch(OWNED_SITES_ACTION);
+  } catch {
+    return null;
+  }
+  // Native hosts resolve the payload itself; some web shells wrap it as `{ payload }`.
+  const body = value as { sites?: unknown; error?: unknown; payload?: { sites?: unknown; error?: unknown } } | null;
+  const error = body?.error ?? body?.payload?.error;
+  if (typeof error === "string") throw new Error(error || "The host could not list your businesses");
+  const raw = body?.sites ?? body?.payload?.sites;
+  if (!Array.isArray(raw)) return null;
+  const sites: HostedSite[] = [];
+  for (const entry of raw) {
+    const e = (entry ?? {}) as Record<string, unknown>;
+    const id = text(e.id);
+    if (!id) continue;
+    const site: HostedSite = { id, name: text(e.name) };
+    if (text(e.logoUrl)) site.logoUrl = text(e.logoUrl);
+    if (text(e.color)) site.color = text(e.color);
+    sites.push(site);
+  }
+  return sites;
+}

package/templates/yoga-studio-owner/tier5-src/himi-owner-lite-overview/index.ts

@@ -22,6 +22,11 @@
 // or one whose mint fails, resolves to `null` and renders as "—" beside the others rather
 // than throwing the whole screen into its error state. A rollup that disappears because one
 // of five businesses is unreachable is worse than one that says so in a row.
+//
+// EMBEDDED, THE HOST NAMES THE BUSINESSES. A host that owns site selection (Symphony's Manage
+// Wix) signs each call itself and would drop the per-call `wix-site-id`, so it supplies the
+// owner's sites instead (`hostOwnedSites`) and resolves each `site.forSite(msid)` call against
+// that list. The list replaces rung 1 only; the fan-out below is identical either way.
 
 import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
@@ -31,6 +36,7 @@ import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_share
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { pickSite, pickedSite } from "../_shared/owner-site-pick.js";
+import { hostOwnedSites } from "../_shared/owner-hosted-sites.js";
 
 /** Mirrors the Home dashboard's "needs attention" definition, so a number here means the
  *  same thing it means after the owner drills into that business. */
@@ -176,16 +182,24 @@ async function attentionCount(msid: string): Promise<number | null> {
   }
 }
 
+/** Rung 1: the host's list when embedded, else the account's own (`querySites`). */
+async function listBusinesses(): Promise<Array<{ id: string; name: string }>> {
+  const unnamed = () => copyParam("ownerOverview.unnamedBusiness", "Business");
+  const hosted = await hostOwnedSites();
+  if (hosted) return hosted.map((h) => ({ id: h.id, name: h.name || unnamed() }));
+  const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
+  return (res.sites ?? [])
+    .filter((r: WixSite) => r?.id)
+    .map((r: WixSite) => ({
+      id: r.id || "",
+      name: r.displayName || (r as { name?: string }).name || unnamed(),
+    }));
+}
+
 async function loadRollup(): Promise<OverviewState> {
   if (isOwnerPreviewDemo()) return demoRollup();
   try {
-    const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
-    const businesses = (res.sites ?? [])
-      .filter((r: WixSite) => r?.id)
-      .map((r: WixSite) => ({
-        id: r.id || "",
-        name: r.displayName || (r as { name?: string }).name || copyParam("ownerOverview.unnamedBusiness", "Business"),
-      }));
+    const businesses = await listBusinesses();
     if (businesses.length === 0) return shape({ status: "ready", rows: [] });
 
     // THE FAN-OUT. Concurrent, one business each, active scope untouched.