@wix/himalaya-cli 0.1490.0 → 0.1492.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/sdk/iap/src/wix-payments-contract.d.ts

@@ -113,7 +113,7 @@ export interface WixIapPayment {
     refundedDate?: string;
 }
 export type WixIapOperation = "startPayment" | "startItemPayment" | "completePayment" | "getPayment";
-export type StartPaymentErrorCode = "NOT_PENDING" | "WRONG_PAYMENT_METHOD" | "NOT_ORDER_BUYER" | "UNSUPPORTED_ORDER" | "PRODUCT_NOT_AVAILABLE" | "ALREADY_OWNED";
+export type StartPaymentErrorCode = "NOT_PENDING" | "WRONG_PAYMENT_METHOD" | "NOT_ORDER_BUYER" | "UNSUPPORTED_ORDER" | "PRODUCT_NOT_AVAILABLE" | "ALREADY_OWNED" | "APP_NOT_CONFIGURED" | "SUBSCRIPTION_NOT_IN_APP" | "ALREADY_SUBSCRIBED";
 export type StartItemPaymentErrorCode = "PRODUCT_NOT_AVAILABLE" | "ALREADY_OWNED" | "ITEM_NOT_AVAILABLE" | "SITE_NOT_ACCEPTING_PAYMENTS" | "UNSUPPORTED_ORDER";
 export type CompletePaymentErrorCode = "INVALID_PURCHASE" | "OWNED_BY_ANOTHER_CUSTOMER" | "PURCHASE_REVOKED" | "NOT_PURCHASED" | "ZERO_PRICE" | "NO_MATCHING_PAYMENT" | "PAYMENT_NOT_PENDING" | "APP_NOT_CONFIGURED";
 export type GetPaymentErrorCode = "NOT_FOUND";

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/iap-checkout.mjs

@@ -1019,7 +1019,7 @@ function wixApiGlobal() {
 
 // ../../core/sdk/iap/src/wix-payments-wire.ts
 function startPaymentCall(scope, wixTransactionId) {
-  return post(scope, "/payments/start", { appId: scope.binding.purchasesAppId, wixTransactionId });
+  return post(scope, "/payments/start", { appleBundleId: scope.binding.bundleId, wixTransactionId });
 }
 function startItemPaymentCall(scope, item) {
   return post(scope, "/payments/start-item", { appId: scope.binding.purchasesAppId, item: { catalogItemId: item.catalogItemId, catalogAppId: item.catalogAppId } });
@@ -1031,7 +1031,7 @@ function catalogItemOf(raw) {
   return valid ? { catalogItemId, catalogAppId } : null;
 }
 function completePaymentCall(scope, signedTransaction) {
-  return post(scope, "/payments/complete", { appId: scope.binding.purchasesAppId, apple: { signedTransaction } });
+  return post(scope, "/payments/complete", { appleBundleId: scope.binding.bundleId, apple: { signedTransaction } });
 }
 function paymentCall(scope, paymentId) {
   return get2(scope, `/payments/${encodeURIComponent(paymentId)}`);
@@ -1313,7 +1313,10 @@ var START_PAYMENT_CODES = [
   "NOT_ORDER_BUYER",
   "UNSUPPORTED_ORDER",
   "PRODUCT_NOT_AVAILABLE",
-  "ALREADY_OWNED"
+  "ALREADY_OWNED",
+  "APP_NOT_CONFIGURED",
+  "SUBSCRIPTION_NOT_IN_APP",
+  "ALREADY_SUBSCRIBED"
 ];
 var START_ITEM_PAYMENT_CODES = [
   "PRODUCT_NOT_AVAILABLE",
@@ -1922,6 +1925,9 @@ function createWixOrderBackend(deps) {
   }
   async function startRefusal(sale, ref, failure3) {
     if (failure3.kind !== "application") return failureStop(failure3);
+    if (failure3.code === "SUBSCRIPTION_NOT_IN_APP" || failure3.code === "ALREADY_SUBSCRIBED") {
+      return stopWith("rejected", "paymentRefused");
+    }
     if (failure3.code === "ALREADY_OWNED") return alreadyPaid(sale, ref);
     if (failure3.code === "NOT_PENDING" || failure3.code === "NOT_ORDER_BUYER") forget(sale, sale.catalogRef);
     return stopWith("rejected", failure3.code === "NOT_PENDING" ? "orderClosed" : "paymentRefused");

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/iap.mjs

@@ -1028,7 +1028,7 @@ function wixApiGlobal() {
 
 // ../../core/sdk/iap/src/wix-payments-wire.ts
 function startPaymentCall(scope, wixTransactionId) {
-  return post(scope, "/payments/start", { appId: scope.binding.purchasesAppId, wixTransactionId });
+  return post(scope, "/payments/start", { appleBundleId: scope.binding.bundleId, wixTransactionId });
 }
 function startItemPaymentCall(scope, item) {
   return post(scope, "/payments/start-item", { appId: scope.binding.purchasesAppId, item: { catalogItemId: item.catalogItemId, catalogAppId: item.catalogAppId } });
@@ -1040,7 +1040,7 @@ function catalogItemOf(raw) {
   return valid ? { catalogItemId, catalogAppId } : null;
 }
 function completePaymentCall(scope, signedTransaction) {
-  return post(scope, "/payments/complete", { appId: scope.binding.purchasesAppId, apple: { signedTransaction } });
+  return post(scope, "/payments/complete", { appleBundleId: scope.binding.bundleId, apple: { signedTransaction } });
 }
 function paymentCall(scope, paymentId) {
   return get(scope, `/payments/${encodeURIComponent(paymentId)}`);
@@ -1322,7 +1322,10 @@ var START_PAYMENT_CODES = [
   "NOT_ORDER_BUYER",
   "UNSUPPORTED_ORDER",
   "PRODUCT_NOT_AVAILABLE",
-  "ALREADY_OWNED"
+  "ALREADY_OWNED",
+  "APP_NOT_CONFIGURED",
+  "SUBSCRIPTION_NOT_IN_APP",
+  "ALREADY_SUBSCRIBED"
 ];
 var START_ITEM_PAYMENT_CODES = [
   "PRODUCT_NOT_AVAILABLE",

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/screens.mjs

@@ -1585,7 +1585,7 @@ function wixApiGlobal() {
 
 // ../../core/sdk/iap/src/wix-payments-wire.ts
 function startPaymentCall(scope, wixTransactionId) {
-  return post(scope, "/payments/start", { appId: scope.binding.purchasesAppId, wixTransactionId });
+  return post(scope, "/payments/start", { appleBundleId: scope.binding.bundleId, wixTransactionId });
 }
 function startItemPaymentCall(scope, item) {
   return post(scope, "/payments/start-item", { appId: scope.binding.purchasesAppId, item: { catalogItemId: item.catalogItemId, catalogAppId: item.catalogAppId } });
@@ -1597,7 +1597,7 @@ function catalogItemOf(raw) {
   return valid ? { catalogItemId, catalogAppId } : null;
 }
 function completePaymentCall(scope, signedTransaction) {
-  return post(scope, "/payments/complete", { appId: scope.binding.purchasesAppId, apple: { signedTransaction } });
+  return post(scope, "/payments/complete", { appleBundleId: scope.binding.bundleId, apple: { signedTransaction } });
 }
 function paymentCall(scope, paymentId) {
   return get2(scope, `/payments/${encodeURIComponent(paymentId)}`);
@@ -1879,7 +1879,10 @@ var START_PAYMENT_CODES = [
   "NOT_ORDER_BUYER",
   "UNSUPPORTED_ORDER",
   "PRODUCT_NOT_AVAILABLE",
-  "ALREADY_OWNED"
+  "ALREADY_OWNED",
+  "APP_NOT_CONFIGURED",
+  "SUBSCRIPTION_NOT_IN_APP",
+  "ALREADY_SUBSCRIBED"
 ];
 var START_ITEM_PAYMENT_CODES = [
   "PRODUCT_NOT_AVAILABLE",
@@ -2482,6 +2485,9 @@ function createWixOrderBackend(deps) {
   }
   async function startRefusal(sale, ref, failure3) {
     if (failure3.kind !== "application") return failureStop(failure3);
+    if (failure3.code === "SUBSCRIPTION_NOT_IN_APP" || failure3.code === "ALREADY_SUBSCRIBED") {
+      return stopWith("rejected", "paymentRefused");
+    }
     if (failure3.code === "ALREADY_OWNED") return alreadyPaid(sale, ref);
     if (failure3.code === "NOT_PENDING" || failure3.code === "NOT_ORDER_BUYER") forget(sale, sale.catalogRef);
     return stopWith("rejected", failure3.code === "NOT_PENDING" ? "orderClosed" : "paymentRefused");

package/dist/cli.mjs

@@ -22149,7 +22149,6 @@ function resolveIdiom(tokens2, ctx = {}) {
 var IDIOM_CONTEXTS, UNSAFE_KEYS;
 var init_idiom = __esm({
   "../../core/ts/src/idiom.ts"() {
-    "use strict";
     IDIOM_CONTEXTS = {
       ios: { native: ["ios"] },
       android: { native: ["material"] },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1490.0",
+  "version": "0.1492.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "cb54373a9c2a773492e66c5579403c0720caa00367681b4479fbc0e3"
+  "falconPackageHash": "7aba2d162be36ebf4054e60bba00ab84930e4a00bf727faafad1fe83"
 }

package/templates/beauty-salon-owner/tier5-src/_shared/owner-hosted-sites.ts

@@ -0,0 +1,60 @@
+// The businesses an EMBEDDING HOST says the signed-in owner owns — or null when there is no
+// such host.
+//
+// Standalone, an owner screen lists businesses itself (`querySites`, account level) and reads
+// each one with `site.forSite(msid)`, which stamps `wix-site-id` on that call. Embedded, the
+// host owns site selection: its data source signs every call for the business the user picked
+// and drops a worker-sent `wix-site-id`, so a fan-out read ONE business N times. A host that
+// opts in supplies its own list instead (`HimalayaOwnedSitesDataSource` on iOS / Android, the
+// `ownedSites` prop on web) and answers `himi.wix.ownedSites` with it; the embed then routes a
+// `site.forSite(msid)` call to the host's per-site call for any id on that list and refuses
+// every other id. So a worker reads the list here and keeps using `site.forSite` unchanged.
+//
+// A rejection is "not hosted": a standalone shell has no handler for the verb, and an older embed
+// predates it. Callers then do exactly what they did before. A host that opted in but cannot list
+// answers `{ error }` instead, which THROWS here: falling back to `querySites` would read the
+// account through the host's single-site signer and fan out to ids the host then refuses.
+
+import { dispatch } from "@himalaya/dispatch";
+
+export const OWNED_SITES_ACTION = "himi.wix.ownedSites";
+
+export interface HostedSite {
+  /** The business's metaSiteId — what `site.forSite` takes. */
+  id: string;
+  name: string;
+  logoUrl?: string;
+  color?: string;
+}
+
+function text(v: unknown): string {
+  return typeof v === "string" ? v.trim() : "";
+}
+
+/** The host's list, in the host's order; [] is a real answer (an owner with no businesses).
+ *  null when the verb is unanswered or the answer is not a list. Throws the host's `{ error }`. */
+export async function hostOwnedSites(): Promise<HostedSite[] | null> {
+  let value: unknown;
+  try {
+    value = await dispatch(OWNED_SITES_ACTION);
+  } catch {
+    return null;
+  }
+  // Native hosts resolve the payload itself; some web shells wrap it as `{ payload }`.
+  const body = value as { sites?: unknown; error?: unknown; payload?: { sites?: unknown; error?: unknown } } | null;
+  const error = body?.error ?? body?.payload?.error;
+  if (typeof error === "string") throw new Error(error || "The host could not list your businesses");
+  const raw = body?.sites ?? body?.payload?.sites;
+  if (!Array.isArray(raw)) return null;
+  const sites: HostedSite[] = [];
+  for (const entry of raw) {
+    const e = (entry ?? {}) as Record<string, unknown>;
+    const id = text(e.id);
+    if (!id) continue;
+    const site: HostedSite = { id, name: text(e.name) };
+    if (text(e.logoUrl)) site.logoUrl = text(e.logoUrl);
+    if (text(e.color)) site.color = text(e.color);
+    sites.push(site);
+  }
+  return sites;
+}

package/templates/beauty-salon-owner/tier5-src/himi-owner-lite-overview/index.ts

@@ -22,6 +22,11 @@
 // or one whose mint fails, resolves to `null` and renders as "—" beside the others rather
 // than throwing the whole screen into its error state. A rollup that disappears because one
 // of five businesses is unreachable is worse than one that says so in a row.
+//
+// EMBEDDED, THE HOST NAMES THE BUSINESSES. A host that owns site selection (Symphony's Manage
+// Wix) signs each call itself and would drop the per-call `wix-site-id`, so it supplies the
+// owner's sites instead (`hostOwnedSites`) and resolves each `site.forSite(msid)` call against
+// that list. The list replaces rung 1 only; the fan-out below is identical either way.
 
 import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
@@ -31,6 +36,7 @@ import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_share
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { pickSite, pickedSite } from "../_shared/owner-site-pick.js";
+import { hostOwnedSites } from "../_shared/owner-hosted-sites.js";
 
 /** Mirrors the Home dashboard's "needs attention" definition, so a number here means the
  *  same thing it means after the owner drills into that business. */
@@ -176,16 +182,24 @@ async function attentionCount(msid: string): Promise<number | null> {
   }
 }
 
+/** Rung 1: the host's list when embedded, else the account's own (`querySites`). */
+async function listBusinesses(): Promise<Array<{ id: string; name: string }>> {
+  const unnamed = () => copyParam("ownerOverview.unnamedBusiness", "Business");
+  const hosted = await hostOwnedSites();
+  if (hosted) return hosted.map((h) => ({ id: h.id, name: h.name || unnamed() }));
+  const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
+  return (res.sites ?? [])
+    .filter((r: WixSite) => r?.id)
+    .map((r: WixSite) => ({
+      id: r.id || "",
+      name: r.displayName || (r as { name?: string }).name || unnamed(),
+    }));
+}
+
 async function loadRollup(): Promise<OverviewState> {
   if (isOwnerPreviewDemo()) return demoRollup();
   try {
-    const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
-    const businesses = (res.sites ?? [])
-      .filter((r: WixSite) => r?.id)
-      .map((r: WixSite) => ({
-        id: r.id || "",
-        name: r.displayName || (r as { name?: string }).name || copyParam("ownerOverview.unnamedBusiness", "Business"),
-      }));
+    const businesses = await listBusinesses();
     if (businesses.length === 0) return shape({ status: "ready", rows: [] });
 
     // THE FAN-OUT. Concurrent, one business each, active scope untouched.

package/templates/community-club-owner/tier5-src/_shared/owner-hosted-sites.ts

@@ -0,0 +1,60 @@
+// The businesses an EMBEDDING HOST says the signed-in owner owns — or null when there is no
+// such host.
+//
+// Standalone, an owner screen lists businesses itself (`querySites`, account level) and reads
+// each one with `site.forSite(msid)`, which stamps `wix-site-id` on that call. Embedded, the
+// host owns site selection: its data source signs every call for the business the user picked
+// and drops a worker-sent `wix-site-id`, so a fan-out read ONE business N times. A host that
+// opts in supplies its own list instead (`HimalayaOwnedSitesDataSource` on iOS / Android, the
+// `ownedSites` prop on web) and answers `himi.wix.ownedSites` with it; the embed then routes a
+// `site.forSite(msid)` call to the host's per-site call for any id on that list and refuses
+// every other id. So a worker reads the list here and keeps using `site.forSite` unchanged.
+//
+// A rejection is "not hosted": a standalone shell has no handler for the verb, and an older embed
+// predates it. Callers then do exactly what they did before. A host that opted in but cannot list
+// answers `{ error }` instead, which THROWS here: falling back to `querySites` would read the
+// account through the host's single-site signer and fan out to ids the host then refuses.
+
+import { dispatch } from "@himalaya/dispatch";
+
+export const OWNED_SITES_ACTION = "himi.wix.ownedSites";
+
+export interface HostedSite {
+  /** The business's metaSiteId — what `site.forSite` takes. */
+  id: string;
+  name: string;
+  logoUrl?: string;
+  color?: string;
+}
+
+function text(v: unknown): string {
+  return typeof v === "string" ? v.trim() : "";
+}
+
+/** The host's list, in the host's order; [] is a real answer (an owner with no businesses).
+ *  null when the verb is unanswered or the answer is not a list. Throws the host's `{ error }`. */
+export async function hostOwnedSites(): Promise<HostedSite[] | null> {
+  let value: unknown;
+  try {
+    value = await dispatch(OWNED_SITES_ACTION);
+  } catch {
+    return null;
+  }
+  // Native hosts resolve the payload itself; some web shells wrap it as `{ payload }`.
+  const body = value as { sites?: unknown; error?: unknown; payload?: { sites?: unknown; error?: unknown } } | null;
+  const error = body?.error ?? body?.payload?.error;
+  if (typeof error === "string") throw new Error(error || "The host could not list your businesses");
+  const raw = body?.sites ?? body?.payload?.sites;
+  if (!Array.isArray(raw)) return null;
+  const sites: HostedSite[] = [];
+  for (const entry of raw) {
+    const e = (entry ?? {}) as Record<string, unknown>;
+    const id = text(e.id);
+    if (!id) continue;
+    const site: HostedSite = { id, name: text(e.name) };
+    if (text(e.logoUrl)) site.logoUrl = text(e.logoUrl);
+    if (text(e.color)) site.color = text(e.color);
+    sites.push(site);
+  }
+  return sites;
+}

package/templates/community-club-owner/tier5-src/himi-owner-lite-overview/index.ts

@@ -22,6 +22,11 @@
 // or one whose mint fails, resolves to `null` and renders as "—" beside the others rather
 // than throwing the whole screen into its error state. A rollup that disappears because one
 // of five businesses is unreachable is worse than one that says so in a row.
+//
+// EMBEDDED, THE HOST NAMES THE BUSINESSES. A host that owns site selection (Symphony's Manage
+// Wix) signs each call itself and would drop the per-call `wix-site-id`, so it supplies the
+// owner's sites instead (`hostOwnedSites`) and resolves each `site.forSite(msid)` call against
+// that list. The list replaces rung 1 only; the fan-out below is identical either way.
 
 import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
@@ -31,6 +36,7 @@ import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_share
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { pickSite, pickedSite } from "../_shared/owner-site-pick.js";
+import { hostOwnedSites } from "../_shared/owner-hosted-sites.js";
 
 /** Mirrors the Home dashboard's "needs attention" definition, so a number here means the
  *  same thing it means after the owner drills into that business. */
@@ -176,16 +182,24 @@ async function attentionCount(msid: string): Promise<number | null> {
   }
 }
 
+/** Rung 1: the host's list when embedded, else the account's own (`querySites`). */
+async function listBusinesses(): Promise<Array<{ id: string; name: string }>> {
+  const unnamed = () => copyParam("ownerOverview.unnamedBusiness", "Business");
+  const hosted = await hostOwnedSites();
+  if (hosted) return hosted.map((h) => ({ id: h.id, name: h.name || unnamed() }));
+  const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
+  return (res.sites ?? [])
+    .filter((r: WixSite) => r?.id)
+    .map((r: WixSite) => ({
+      id: r.id || "",
+      name: r.displayName || (r as { name?: string }).name || unnamed(),
+    }));
+}
+
 async function loadRollup(): Promise<OverviewState> {
   if (isOwnerPreviewDemo()) return demoRollup();
   try {
-    const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
-    const businesses = (res.sites ?? [])
-      .filter((r: WixSite) => r?.id)
-      .map((r: WixSite) => ({
-        id: r.id || "",
-        name: r.displayName || (r as { name?: string }).name || copyParam("ownerOverview.unnamedBusiness", "Business"),
-      }));
+    const businesses = await listBusinesses();
     if (businesses.length === 0) return shape({ status: "ready", rows: [] });
 
     // THE FAN-OUT. Concurrent, one business each, active scope untouched.

package/templates/events-meetups-owner/tier5-src/_shared/owner-hosted-sites.ts

@@ -0,0 +1,60 @@
+// The businesses an EMBEDDING HOST says the signed-in owner owns — or null when there is no
+// such host.
+//
+// Standalone, an owner screen lists businesses itself (`querySites`, account level) and reads
+// each one with `site.forSite(msid)`, which stamps `wix-site-id` on that call. Embedded, the
+// host owns site selection: its data source signs every call for the business the user picked
+// and drops a worker-sent `wix-site-id`, so a fan-out read ONE business N times. A host that
+// opts in supplies its own list instead (`HimalayaOwnedSitesDataSource` on iOS / Android, the
+// `ownedSites` prop on web) and answers `himi.wix.ownedSites` with it; the embed then routes a
+// `site.forSite(msid)` call to the host's per-site call for any id on that list and refuses
+// every other id. So a worker reads the list here and keeps using `site.forSite` unchanged.
+//
+// A rejection is "not hosted": a standalone shell has no handler for the verb, and an older embed
+// predates it. Callers then do exactly what they did before. A host that opted in but cannot list
+// answers `{ error }` instead, which THROWS here: falling back to `querySites` would read the
+// account through the host's single-site signer and fan out to ids the host then refuses.
+
+import { dispatch } from "@himalaya/dispatch";
+
+export const OWNED_SITES_ACTION = "himi.wix.ownedSites";
+
+export interface HostedSite {
+  /** The business's metaSiteId — what `site.forSite` takes. */
+  id: string;
+  name: string;
+  logoUrl?: string;
+  color?: string;
+}
+
+function text(v: unknown): string {
+  return typeof v === "string" ? v.trim() : "";
+}
+
+/** The host's list, in the host's order; [] is a real answer (an owner with no businesses).
+ *  null when the verb is unanswered or the answer is not a list. Throws the host's `{ error }`. */
+export async function hostOwnedSites(): Promise<HostedSite[] | null> {
+  let value: unknown;
+  try {
+    value = await dispatch(OWNED_SITES_ACTION);
+  } catch {
+    return null;
+  }
+  // Native hosts resolve the payload itself; some web shells wrap it as `{ payload }`.
+  const body = value as { sites?: unknown; error?: unknown; payload?: { sites?: unknown; error?: unknown } } | null;
+  const error = body?.error ?? body?.payload?.error;
+  if (typeof error === "string") throw new Error(error || "The host could not list your businesses");
+  const raw = body?.sites ?? body?.payload?.sites;
+  if (!Array.isArray(raw)) return null;
+  const sites: HostedSite[] = [];
+  for (const entry of raw) {
+    const e = (entry ?? {}) as Record<string, unknown>;
+    const id = text(e.id);
+    if (!id) continue;
+    const site: HostedSite = { id, name: text(e.name) };
+    if (text(e.logoUrl)) site.logoUrl = text(e.logoUrl);
+    if (text(e.color)) site.color = text(e.color);
+    sites.push(site);
+  }
+  return sites;
+}

package/templates/events-meetups-owner/tier5-src/himi-owner-lite-overview/index.ts

@@ -22,6 +22,11 @@
 // or one whose mint fails, resolves to `null` and renders as "—" beside the others rather
 // than throwing the whole screen into its error state. A rollup that disappears because one
 // of five businesses is unreachable is worse than one that says so in a row.
+//
+// EMBEDDED, THE HOST NAMES THE BUSINESSES. A host that owns site selection (Symphony's Manage
+// Wix) signs each call itself and would drop the per-call `wix-site-id`, so it supplies the
+// owner's sites instead (`hostOwnedSites`) and resolves each `site.forSite(msid)` call against
+// that list. The list replaces rung 1 only; the fan-out below is identical either way.
 
 import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
@@ -31,6 +36,7 @@ import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_share
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { pickSite, pickedSite } from "../_shared/owner-site-pick.js";
+import { hostOwnedSites } from "../_shared/owner-hosted-sites.js";
 
 /** Mirrors the Home dashboard's "needs attention" definition, so a number here means the
  *  same thing it means after the owner drills into that business. */
@@ -176,16 +182,24 @@ async function attentionCount(msid: string): Promise<number | null> {
   }
 }
 
+/** Rung 1: the host's list when embedded, else the account's own (`querySites`). */
+async function listBusinesses(): Promise<Array<{ id: string; name: string }>> {
+  const unnamed = () => copyParam("ownerOverview.unnamedBusiness", "Business");
+  const hosted = await hostOwnedSites();
+  if (hosted) return hosted.map((h) => ({ id: h.id, name: h.name || unnamed() }));
+  const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
+  return (res.sites ?? [])
+    .filter((r: WixSite) => r?.id)
+    .map((r: WixSite) => ({
+      id: r.id || "",
+      name: r.displayName || (r as { name?: string }).name || unnamed(),
+    }));
+}
+
 async function loadRollup(): Promise<OverviewState> {
   if (isOwnerPreviewDemo()) return demoRollup();
   try {
-    const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
-    const businesses = (res.sites ?? [])
-      .filter((r: WixSite) => r?.id)
-      .map((r: WixSite) => ({
-        id: r.id || "",
-        name: r.displayName || (r as { name?: string }).name || copyParam("ownerOverview.unnamedBusiness", "Business"),
-      }));
+    const businesses = await listBusinesses();
     if (businesses.length === 0) return shape({ status: "ready", rows: [] });
 
     // THE FAN-OUT. Concurrent, one business each, active scope untouched.

package/templates/gym-fitness-owner/tier5-src/_shared/owner-hosted-sites.ts

@@ -0,0 +1,60 @@
+// The businesses an EMBEDDING HOST says the signed-in owner owns — or null when there is no
+// such host.
+//
+// Standalone, an owner screen lists businesses itself (`querySites`, account level) and reads
+// each one with `site.forSite(msid)`, which stamps `wix-site-id` on that call. Embedded, the
+// host owns site selection: its data source signs every call for the business the user picked
+// and drops a worker-sent `wix-site-id`, so a fan-out read ONE business N times. A host that
+// opts in supplies its own list instead (`HimalayaOwnedSitesDataSource` on iOS / Android, the
+// `ownedSites` prop on web) and answers `himi.wix.ownedSites` with it; the embed then routes a
+// `site.forSite(msid)` call to the host's per-site call for any id on that list and refuses
+// every other id. So a worker reads the list here and keeps using `site.forSite` unchanged.
+//
+// A rejection is "not hosted": a standalone shell has no handler for the verb, and an older embed
+// predates it. Callers then do exactly what they did before. A host that opted in but cannot list
+// answers `{ error }` instead, which THROWS here: falling back to `querySites` would read the
+// account through the host's single-site signer and fan out to ids the host then refuses.
+
+import { dispatch } from "@himalaya/dispatch";
+
+export const OWNED_SITES_ACTION = "himi.wix.ownedSites";
+
+export interface HostedSite {
+  /** The business's metaSiteId — what `site.forSite` takes. */
+  id: string;
+  name: string;
+  logoUrl?: string;
+  color?: string;
+}
+
+function text(v: unknown): string {
+  return typeof v === "string" ? v.trim() : "";
+}
+
+/** The host's list, in the host's order; [] is a real answer (an owner with no businesses).
+ *  null when the verb is unanswered or the answer is not a list. Throws the host's `{ error }`. */
+export async function hostOwnedSites(): Promise<HostedSite[] | null> {
+  let value: unknown;
+  try {
+    value = await dispatch(OWNED_SITES_ACTION);
+  } catch {
+    return null;
+  }
+  // Native hosts resolve the payload itself; some web shells wrap it as `{ payload }`.
+  const body = value as { sites?: unknown; error?: unknown; payload?: { sites?: unknown; error?: unknown } } | null;
+  const error = body?.error ?? body?.payload?.error;
+  if (typeof error === "string") throw new Error(error || "The host could not list your businesses");
+  const raw = body?.sites ?? body?.payload?.sites;
+  if (!Array.isArray(raw)) return null;
+  const sites: HostedSite[] = [];
+  for (const entry of raw) {
+    const e = (entry ?? {}) as Record<string, unknown>;
+    const id = text(e.id);
+    if (!id) continue;
+    const site: HostedSite = { id, name: text(e.name) };
+    if (text(e.logoUrl)) site.logoUrl = text(e.logoUrl);
+    if (text(e.color)) site.color = text(e.color);
+    sites.push(site);
+  }
+  return sites;
+}

package/templates/gym-fitness-owner/tier5-src/himi-owner-lite-overview/index.ts

@@ -22,6 +22,11 @@
 // or one whose mint fails, resolves to `null` and renders as "—" beside the others rather
 // than throwing the whole screen into its error state. A rollup that disappears because one
 // of five businesses is unreachable is worse than one that says so in a row.
+//
+// EMBEDDED, THE HOST NAMES THE BUSINESSES. A host that owns site selection (Symphony's Manage
+// Wix) signs each call itself and would drop the per-call `wix-site-id`, so it supplies the
+// owner's sites instead (`hostOwnedSites`) and resolves each `site.forSite(msid)` call against
+// that list. The list replaces rung 1 only; the fan-out below is identical either way.
 
 import { defineService } from "@himalaya/state";
 import { querySites, type WixSite } from "@himalaya/wix-site-list";
@@ -31,6 +36,7 @@ import { ownerLoadError, isOwnerPreviewDemo, ownerDemoFallback } from "../_share
 import { DEMO_SITES, DEMO_NOTE } from "../_shared/owner-preview-demo.js";
 import { stashCopy, copyParam } from "../_shared/himi-copy.js";
 import { pickSite, pickedSite } from "../_shared/owner-site-pick.js";
+import { hostOwnedSites } from "../_shared/owner-hosted-sites.js";
 
 /** Mirrors the Home dashboard's "needs attention" definition, so a number here means the
  *  same thing it means after the owner drills into that business. */
@@ -176,16 +182,24 @@ async function attentionCount(msid: string): Promise<number | null> {
   }
 }
 
+/** Rung 1: the host's list when embedded, else the account's own (`querySites`). */
+async function listBusinesses(): Promise<Array<{ id: string; name: string }>> {
+  const unnamed = () => copyParam("ownerOverview.unnamedBusiness", "Business");
+  const hosted = await hostOwnedSites();
+  if (hosted) return hosted.map((h) => ({ id: h.id, name: h.name || unnamed() }));
+  const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
+  return (res.sites ?? [])
+    .filter((r: WixSite) => r?.id)
+    .map((r: WixSite) => ({
+      id: r.id || "",
+      name: r.displayName || (r as { name?: string }).name || unnamed(),
+    }));
+}
+
 async function loadRollup(): Promise<OverviewState> {
   if (isOwnerPreviewDemo()) return demoRollup();
   try {
-    const res = await querySites({ query: { cursorPaging: { limit: 50 } } });
-    const businesses = (res.sites ?? [])
-      .filter((r: WixSite) => r?.id)
-      .map((r: WixSite) => ({
-        id: r.id || "",
-        name: r.displayName || (r as { name?: string }).name || copyParam("ownerOverview.unnamedBusiness", "Business"),
-      }));
+    const businesses = await listBusinesses();
     if (businesses.length === 0) return shape({ status: "ready", rows: [] });
 
     // THE FAN-OUT. Concurrent, one business each, active scope untouched.