@wix/himalaya-cli 0.1572.0 → 0.1574.0

package/templates/portfolio-creative-owner/dev/index.ts

@@ -86711,15 +86711,31 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
 
 // Live seed-id enumeration: a published release serves only EXACT screens, so
 // `himi push` bakes each templated detail route's CURRENT catalog ids as exact
-// screens via `seedIds`. Anonymous visitor rung against this app's own clientId;
-// best-effort (offline build → no baked details, preview still live-resolves).
+// screens via `seedIds`. Anonymous visitor rung against this app's own clientId — or,
+// for an app bound through the One App visitor identity (`visitorSource: "one-app"`,
+// no client), that site's One App visitor instance. Best-effort (offline build → no
+// baked details, preview still live-resolves).
+async function liveSeedToken(WIX: string): Promise<string | undefined> {
+  const auth = (config as { auth?: { config?: { clientId?: string; visitorSource?: string; metaSiteId?: string } } }).auth?.config;
+  // A One App binding boots as the site's One App visitor, so the seed reads as that visitor too —
+  // even beside a member-login clientId, and never repointed by a stray local WIX_CLIENT_ID.
+  const oneApp = auth?.visitorSource === "one-app";
+  const clientId = oneApp ? "" : process.env.WIX_CLIENT_ID ?? auth?.clientId ?? "";
+  if (clientId && !clientId.startsWith("YOUR_")) {
+    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
+    return ((await mint.json()) as { access_token?: string }).access_token;
+  }
+  const msid = oneApp ? auth?.metaSiteId ?? "" : "";
+  if (!/^[0-9a-fA-F-]{10,64}$/.test(msid)) return undefined;
+  const mint = await fetch(`https://apps.wix.com/_api/one-app-session-web/v3/businesses/${msid}/signed-instance?signed_instance_type=Visitor`, { headers: { Accept: "application/json" }, redirect: "error" });
+  const visitor = (await mint.json()) as { signedInstance?: string; signedInstanceType?: string };
+  return visitor.signedInstanceType === "Visitor" ? visitor.signedInstance : undefined;
+}
+
 async function liveSeedIds(spec: LiveSeed): Promise<string[]> {
   try {
     const WIX = "https://www.wixapis.com";
-    const clientId = process.env.WIX_CLIENT_ID ?? (config as { auth?: { config?: { clientId?: string } } }).auth?.config?.clientId ?? "";
-    if (!clientId || clientId.startsWith("YOUR_")) return [];
-    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
-    const token = ((await mint.json()) as { access_token?: string }).access_token;
+    const token = await liveSeedToken(WIX);
     if (!token) return [];
     const res = await fetch(WIX + spec.path, { method: "POST", headers: { Authorization: token, "Content-Type": "application/json" }, body: JSON.stringify(spec.body) });
     const json = (await res.json()) as Record<string, unknown>;

package/templates/restaurant/dev/index.ts

@@ -26773,15 +26773,31 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
 
 // Live seed-id enumeration: a published release serves only EXACT screens, so
 // `himi push` bakes each templated detail route's CURRENT catalog ids as exact
-// screens via `seedIds`. Anonymous visitor rung against this app's own clientId;
-// best-effort (offline build → no baked details, preview still live-resolves).
+// screens via `seedIds`. Anonymous visitor rung against this app's own clientId — or,
+// for an app bound through the One App visitor identity (`visitorSource: "one-app"`,
+// no client), that site's One App visitor instance. Best-effort (offline build → no
+// baked details, preview still live-resolves).
+async function liveSeedToken(WIX: string): Promise<string | undefined> {
+  const auth = (config as { auth?: { config?: { clientId?: string; visitorSource?: string; metaSiteId?: string } } }).auth?.config;
+  // A One App binding boots as the site's One App visitor, so the seed reads as that visitor too —
+  // even beside a member-login clientId, and never repointed by a stray local WIX_CLIENT_ID.
+  const oneApp = auth?.visitorSource === "one-app";
+  const clientId = oneApp ? "" : process.env.WIX_CLIENT_ID ?? auth?.clientId ?? "";
+  if (clientId && !clientId.startsWith("YOUR_")) {
+    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
+    return ((await mint.json()) as { access_token?: string }).access_token;
+  }
+  const msid = oneApp ? auth?.metaSiteId ?? "" : "";
+  if (!/^[0-9a-fA-F-]{10,64}$/.test(msid)) return undefined;
+  const mint = await fetch(`https://apps.wix.com/_api/one-app-session-web/v3/businesses/${msid}/signed-instance?signed_instance_type=Visitor`, { headers: { Accept: "application/json" }, redirect: "error" });
+  const visitor = (await mint.json()) as { signedInstance?: string; signedInstanceType?: string };
+  return visitor.signedInstanceType === "Visitor" ? visitor.signedInstance : undefined;
+}
+
 async function liveSeedIds(spec: LiveSeed): Promise<string[]> {
   try {
     const WIX = "https://www.wixapis.com";
-    const clientId = process.env.WIX_CLIENT_ID ?? (config as { auth?: { config?: { clientId?: string } } }).auth?.config?.clientId ?? "";
-    if (!clientId || clientId.startsWith("YOUR_")) return [];
-    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
-    const token = ((await mint.json()) as { access_token?: string }).access_token;
+    const token = await liveSeedToken(WIX);
     if (!token) return [];
     const res = await fetch(WIX + spec.path, { method: "POST", headers: { Authorization: token, "Content-Type": "application/json" }, body: JSON.stringify(spec.body) });
     const json = (await res.json()) as Record<string, unknown>;

package/templates/restaurant/tier5-src/_shared/iap-worker.ts

@@ -4,6 +4,7 @@
 // SDK; this only supplies the copy and the hydration reset.
 import { hostSessionFromGlobal, type IapPriceCopy } from "@himalaya/iap";
 import type { IapCommerce, IapPurchaseCopy, IapRestoreResult } from "@himalaya/iap-checkout";
+import { paymentSetupMessage } from "./payment-setup.js";
 import { copyParam, copyTemplate } from "./himi-copy.js";
 
 /** Price labels from the screen's copy pack (`<prefix>.priceLoadingText`, …). */
@@ -25,6 +26,7 @@ export function iapPurchaseCopy(prefix: string): IapPurchaseCopy {
     awaitingApproval: copyParam(`${prefix}.purchaseAwaitingApprovalText`, "Waiting for approval"),
     unavailable: copyParam(`${prefix}.purchaseTemporarilyUnavailableText`, "Purchasing is temporarily unavailable."),
     signInRequired: copyParam(`${prefix}.purchaseSignInText`, "Sign in to buy."),
+    sitePaymentUnavailable: paymentSetupMessage(prefix),
     retry: copyParam(`${prefix}.purchaseRetryText`, "Something went wrong. Try again."),
     priceChanged: copyParam(`${prefix}.purchasePriceChangedText`, "The price changed. Check it and try again."),
     support: copyParam(`${prefix}.purchaseSupportText`, "We couldn't finish this purchase. Contact support."),

package/templates/restaurant/tier5-src/_shared/payment-setup.ts

@@ -0,0 +1,6 @@
+import { copyParam } from "./himi-copy.js";
+
+/** No provider or country guess: Wix only established that online payment is unavailable. */
+export function paymentSetupMessage(prefix: string): string {
+  return copyParam(`${prefix}.paymentSetupUnavailable`, "This site is not accepting online payments. Go back or contact the business for other payment options.");
+}

package/templates/restaurant/tier5-src/himi-events-detail/index.ts

@@ -1,3 +1,4 @@
+import { paymentSetupMessage } from "../_shared/payment-setup.js";
 // Tier-5 bundle: himi-events — event detail.
 import { calendarDay, formatClock, formatCurrency, formatWeekdayDateTime, formatWeekdayMonthDay, formatTimeZoneLabel } from "../_shared/engine-intl.js";
 import { defineService as registerService } from "@himalaya/state";
@@ -18,7 +19,7 @@ import {
   type WixEvent,
 } from "@himalaya/wix-events";
 import { session as wixPlatformSession } from "@himalaya/wix-platform";
-import { payCashierOrder } from "@himalaya/checkout";
+import { isPaymentSetupFailure, payCashierOrder } from "@himalaya/checkout";
 import { get, upsert, type DbEntity } from "@himalaya/local-db";
 import {
   currentInputId,
@@ -986,16 +987,18 @@ const svc: ReturnType<typeof defineService<S, DetailActions>> = defineService<S,
               if (pay.kind === "paid") result = { ...s, ticketSheetOpen: false, snackbarMessage: detailCopy("event.ticketIssued", "You're in — your ticket is confirmed.") };
               else if (pay.kind === "handoff") result = { ...s, ticketSheetOpen: false, snackbarMessage: detailCopy("event.checkoutOpened", "Complete checkout in the browser to get your tickets.") };
               else if (pay.kind === "cancelled") result = { ...s, snackbarMessage: detailCopy("event.ticketCancelled", "Payment cancelled — no ticket was issued.") };
+              else if (isPaymentSetupFailure(pay)) result = { ...s, snackbarMessage: paymentSetupMessage("event") };
               else throw new Error("Payment could not be completed");
             }
           }
         }
-      } catch {
+      } catch (error) {
+        if (isPaymentSetupFailure(error)) result = { ...s, snackbarMessage: paymentSetupMessage("event") };
         try {
           // A public event page is not pinned to this selection or price. Only
           // continue in hosted checkout when a reservation already holds it.
           const params = reservationId ? { reservationId } : undefined;
-          if (params) {
+          if (params && !result) {
             const redirect = await createRedirectSession({ eventsCheckout: params });
             const url = redirect.redirectSession?.fullUrl;
             if (url) {
@@ -1003,7 +1006,9 @@ const svc: ReturnType<typeof defineService<S, DetailActions>> = defineService<S,
               result = { ...s, ticketSheetOpen: false, snackbarMessage: opened.opened ? detailCopy("event.checkoutOpened", "Complete checkout in the browser to get your tickets.") : detailCopy("event.registrationOpenFailed", "Could not open the registration page.") };
             }
           }
-        } catch { /* report below */ }
+        } catch (error) {
+          if (isPaymentSetupFailure(error)) result = { ...s, snackbarMessage: paymentSetupMessage("event") };
+        }
         if (!result) result = { ...s, snackbarMessage: detailCopy("event.purchaseUnavailable", "Purchasing is temporarily unavailable.") };
       } finally { ticketCheckoutInFlight = false; }
       return derive(result!);

package/templates/restaurant-owner/dev/index.ts

@@ -90719,15 +90719,31 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
 
 // Live seed-id enumeration: a published release serves only EXACT screens, so
 // `himi push` bakes each templated detail route's CURRENT catalog ids as exact
-// screens via `seedIds`. Anonymous visitor rung against this app's own clientId;
-// best-effort (offline build → no baked details, preview still live-resolves).
+// screens via `seedIds`. Anonymous visitor rung against this app's own clientId — or,
+// for an app bound through the One App visitor identity (`visitorSource: "one-app"`,
+// no client), that site's One App visitor instance. Best-effort (offline build → no
+// baked details, preview still live-resolves).
+async function liveSeedToken(WIX: string): Promise<string | undefined> {
+  const auth = (config as { auth?: { config?: { clientId?: string; visitorSource?: string; metaSiteId?: string } } }).auth?.config;
+  // A One App binding boots as the site's One App visitor, so the seed reads as that visitor too —
+  // even beside a member-login clientId, and never repointed by a stray local WIX_CLIENT_ID.
+  const oneApp = auth?.visitorSource === "one-app";
+  const clientId = oneApp ? "" : process.env.WIX_CLIENT_ID ?? auth?.clientId ?? "";
+  if (clientId && !clientId.startsWith("YOUR_")) {
+    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
+    return ((await mint.json()) as { access_token?: string }).access_token;
+  }
+  const msid = oneApp ? auth?.metaSiteId ?? "" : "";
+  if (!/^[0-9a-fA-F-]{10,64}$/.test(msid)) return undefined;
+  const mint = await fetch(`https://apps.wix.com/_api/one-app-session-web/v3/businesses/${msid}/signed-instance?signed_instance_type=Visitor`, { headers: { Accept: "application/json" }, redirect: "error" });
+  const visitor = (await mint.json()) as { signedInstance?: string; signedInstanceType?: string };
+  return visitor.signedInstanceType === "Visitor" ? visitor.signedInstance : undefined;
+}
+
 async function liveSeedIds(spec: LiveSeed): Promise<string[]> {
   try {
     const WIX = "https://www.wixapis.com";
-    const clientId = process.env.WIX_CLIENT_ID ?? (config as { auth?: { config?: { clientId?: string } } }).auth?.config?.clientId ?? "";
-    if (!clientId || clientId.startsWith("YOUR_")) return [];
-    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
-    const token = ((await mint.json()) as { access_token?: string }).access_token;
+    const token = await liveSeedToken(WIX);
     if (!token) return [];
     const res = await fetch(WIX + spec.path, { method: "POST", headers: { Authorization: token, "Content-Type": "application/json" }, body: JSON.stringify(spec.body) });
     const json = (await res.json()) as Record<string, unknown>;

package/templates/retail-store/dev/index.ts

@@ -25622,15 +25622,31 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
 
 // Live seed-id enumeration: a published release serves only EXACT screens, so
 // `himi push` bakes each templated detail route's CURRENT catalog ids as exact
-// screens via `seedIds`. Anonymous visitor rung against this app's own clientId;
-// best-effort (offline build → no baked details, preview still live-resolves).
+// screens via `seedIds`. Anonymous visitor rung against this app's own clientId — or,
+// for an app bound through the One App visitor identity (`visitorSource: "one-app"`,
+// no client), that site's One App visitor instance. Best-effort (offline build → no
+// baked details, preview still live-resolves).
+async function liveSeedToken(WIX: string): Promise<string | undefined> {
+  const auth = (config as { auth?: { config?: { clientId?: string; visitorSource?: string; metaSiteId?: string } } }).auth?.config;
+  // A One App binding boots as the site's One App visitor, so the seed reads as that visitor too —
+  // even beside a member-login clientId, and never repointed by a stray local WIX_CLIENT_ID.
+  const oneApp = auth?.visitorSource === "one-app";
+  const clientId = oneApp ? "" : process.env.WIX_CLIENT_ID ?? auth?.clientId ?? "";
+  if (clientId && !clientId.startsWith("YOUR_")) {
+    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
+    return ((await mint.json()) as { access_token?: string }).access_token;
+  }
+  const msid = oneApp ? auth?.metaSiteId ?? "" : "";
+  if (!/^[0-9a-fA-F-]{10,64}$/.test(msid)) return undefined;
+  const mint = await fetch(`https://apps.wix.com/_api/one-app-session-web/v3/businesses/${msid}/signed-instance?signed_instance_type=Visitor`, { headers: { Accept: "application/json" }, redirect: "error" });
+  const visitor = (await mint.json()) as { signedInstance?: string; signedInstanceType?: string };
+  return visitor.signedInstanceType === "Visitor" ? visitor.signedInstance : undefined;
+}
+
 async function liveSeedIds(spec: LiveSeed): Promise<string[]> {
   try {
     const WIX = "https://www.wixapis.com";
-    const clientId = process.env.WIX_CLIENT_ID ?? (config as { auth?: { config?: { clientId?: string } } }).auth?.config?.clientId ?? "";
-    if (!clientId || clientId.startsWith("YOUR_")) return [];
-    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
-    const token = ((await mint.json()) as { access_token?: string }).access_token;
+    const token = await liveSeedToken(WIX);
     if (!token) return [];
     const res = await fetch(WIX + spec.path, { method: "POST", headers: { Authorization: token, "Content-Type": "application/json" }, body: JSON.stringify(spec.body) });
     const json = (await res.json()) as Record<string, unknown>;

package/templates/retail-store/tier5-src/_shared/iap-worker.ts

@@ -4,6 +4,7 @@
 // SDK; this only supplies the copy and the hydration reset.
 import { hostSessionFromGlobal, type IapPriceCopy } from "@himalaya/iap";
 import type { IapCommerce, IapPurchaseCopy, IapRestoreResult } from "@himalaya/iap-checkout";
+import { paymentSetupMessage } from "./payment-setup.js";
 import { copyParam, copyTemplate } from "./himi-copy.js";
 
 /** Price labels from the screen's copy pack (`<prefix>.priceLoadingText`, …). */
@@ -25,6 +26,7 @@ export function iapPurchaseCopy(prefix: string): IapPurchaseCopy {
     awaitingApproval: copyParam(`${prefix}.purchaseAwaitingApprovalText`, "Waiting for approval"),
     unavailable: copyParam(`${prefix}.purchaseTemporarilyUnavailableText`, "Purchasing is temporarily unavailable."),
     signInRequired: copyParam(`${prefix}.purchaseSignInText`, "Sign in to buy."),
+    sitePaymentUnavailable: paymentSetupMessage(prefix),
     retry: copyParam(`${prefix}.purchaseRetryText`, "Something went wrong. Try again."),
     priceChanged: copyParam(`${prefix}.purchasePriceChangedText`, "The price changed. Check it and try again."),
     support: copyParam(`${prefix}.purchaseSupportText`, "We couldn't finish this purchase. Contact support."),

package/templates/retail-store/tier5-src/_shared/payment-setup.ts

@@ -0,0 +1,6 @@
+import { copyParam } from "./himi-copy.js";
+
+/** No provider or country guess: Wix only established that online payment is unavailable. */
+export function paymentSetupMessage(prefix: string): string {
+  return copyParam(`${prefix}.paymentSetupUnavailable`, "This site is not accepting online payments. Go back or contact the business for other payment options.");
+}

package/templates/retail-store/tier5-src/himi-branded-lite-cart/index.ts

@@ -1,3 +1,4 @@
+import { paymentSetupMessage } from "../_shared/payment-setup.js";
 import { withOnlineWrites } from "../_shared/online-actions.js";
 import { defineService as registerState } from "@himalaya/state";
 import { getStoreProduct } from "../_shared/himi-store.js";
@@ -7,7 +8,7 @@ import { withIapPresentation } from "../_shared/iap-presentation.js";
 import { type IapCommerce, classifyCart } from "@himalaya/iap-checkout";
 import { addCouponToCurrentCart, calculateCurrentCart, createCheckoutFromCurrentCart, getCurrentCart, removeCouponFromCurrentCart, removeLineItemsFromCurrentCart, updateLineItemsQuantity, type WixCartDetail, type WixCartLineItemDetail } from "@himalaya/wix-ecom";
 import { createRedirectSession } from "@himalaya/wix-redirects";
-import { payCashierOrder } from "@himalaya/checkout";
+import { isPaymentSetupFailure, payCashierOrder } from "@himalaya/checkout";
 import { hostedCheckoutOpener, isHostedWorker } from "../_shared/hosted-checkout.js";
 import { formatCurrency } from "../_shared/engine-intl.js";
 
@@ -574,8 +575,10 @@ const svc = defineService<State, {
           // only confirmed once it lands, so the cart must survive a bail-out.
           return derive({ ...state, checkoutHint: copyParam("cart.checkoutOpenedMessage", "Checkout opened.") });
         }
+        if (isPaymentSetupFailure(pay)) return derive({ ...state, checkoutHint: paymentSetupMessage("cart") });
         return derive({ ...state, checkoutHint: copyParam("cart.checkoutFailedMessage", "Checkout could not start.") });
-      } catch {
+      } catch (error) {
+        if (isPaymentSetupFailure(error)) return derive({ ...state, checkoutHint: paymentSetupMessage("cart") });
         return derive({ ...state, checkoutHint: copyParam("cart.checkoutFailedMessage", "Checkout could not start.") });
       }
     },

package/templates/retail-store-owner/dev/index.ts

@@ -80984,15 +80984,31 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
 
 // Live seed-id enumeration: a published release serves only EXACT screens, so
 // `himi push` bakes each templated detail route's CURRENT catalog ids as exact
-// screens via `seedIds`. Anonymous visitor rung against this app's own clientId;
-// best-effort (offline build → no baked details, preview still live-resolves).
+// screens via `seedIds`. Anonymous visitor rung against this app's own clientId — or,
+// for an app bound through the One App visitor identity (`visitorSource: "one-app"`,
+// no client), that site's One App visitor instance. Best-effort (offline build → no
+// baked details, preview still live-resolves).
+async function liveSeedToken(WIX: string): Promise<string | undefined> {
+  const auth = (config as { auth?: { config?: { clientId?: string; visitorSource?: string; metaSiteId?: string } } }).auth?.config;
+  // A One App binding boots as the site's One App visitor, so the seed reads as that visitor too —
+  // even beside a member-login clientId, and never repointed by a stray local WIX_CLIENT_ID.
+  const oneApp = auth?.visitorSource === "one-app";
+  const clientId = oneApp ? "" : process.env.WIX_CLIENT_ID ?? auth?.clientId ?? "";
+  if (clientId && !clientId.startsWith("YOUR_")) {
+    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
+    return ((await mint.json()) as { access_token?: string }).access_token;
+  }
+  const msid = oneApp ? auth?.metaSiteId ?? "" : "";
+  if (!/^[0-9a-fA-F-]{10,64}$/.test(msid)) return undefined;
+  const mint = await fetch(`https://apps.wix.com/_api/one-app-session-web/v3/businesses/${msid}/signed-instance?signed_instance_type=Visitor`, { headers: { Accept: "application/json" }, redirect: "error" });
+  const visitor = (await mint.json()) as { signedInstance?: string; signedInstanceType?: string };
+  return visitor.signedInstanceType === "Visitor" ? visitor.signedInstance : undefined;
+}
+
 async function liveSeedIds(spec: LiveSeed): Promise<string[]> {
   try {
     const WIX = "https://www.wixapis.com";
-    const clientId = process.env.WIX_CLIENT_ID ?? (config as { auth?: { config?: { clientId?: string } } }).auth?.config?.clientId ?? "";
-    if (!clientId || clientId.startsWith("YOUR_")) return [];
-    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
-    const token = ((await mint.json()) as { access_token?: string }).access_token;
+    const token = await liveSeedToken(WIX);
     if (!token) return [];
     const res = await fetch(WIX + spec.path, { method: "POST", headers: { Authorization: token, "Content-Type": "application/json" }, body: JSON.stringify(spec.body) });
     const json = (await res.json()) as Record<string, unknown>;

package/templates/surface-showcase/dev/index.ts

@@ -626,15 +626,31 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
 
 // Live seed-id enumeration: a published release serves only EXACT screens, so
 // `himi push` bakes each templated detail route's CURRENT catalog ids as exact
-// screens via `seedIds`. Anonymous visitor rung against this app's own clientId;
-// best-effort (offline build → no baked details, preview still live-resolves).
+// screens via `seedIds`. Anonymous visitor rung against this app's own clientId — or,
+// for an app bound through the One App visitor identity (`visitorSource: "one-app"`,
+// no client), that site's One App visitor instance. Best-effort (offline build → no
+// baked details, preview still live-resolves).
+async function liveSeedToken(WIX: string): Promise<string | undefined> {
+  const auth = (config as { auth?: { config?: { clientId?: string; visitorSource?: string; metaSiteId?: string } } }).auth?.config;
+  // A One App binding boots as the site's One App visitor, so the seed reads as that visitor too —
+  // even beside a member-login clientId, and never repointed by a stray local WIX_CLIENT_ID.
+  const oneApp = auth?.visitorSource === "one-app";
+  const clientId = oneApp ? "" : process.env.WIX_CLIENT_ID ?? auth?.clientId ?? "";
+  if (clientId && !clientId.startsWith("YOUR_")) {
+    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
+    return ((await mint.json()) as { access_token?: string }).access_token;
+  }
+  const msid = oneApp ? auth?.metaSiteId ?? "" : "";
+  if (!/^[0-9a-fA-F-]{10,64}$/.test(msid)) return undefined;
+  const mint = await fetch(`https://apps.wix.com/_api/one-app-session-web/v3/businesses/${msid}/signed-instance?signed_instance_type=Visitor`, { headers: { Accept: "application/json" }, redirect: "error" });
+  const visitor = (await mint.json()) as { signedInstance?: string; signedInstanceType?: string };
+  return visitor.signedInstanceType === "Visitor" ? visitor.signedInstance : undefined;
+}
+
 async function liveSeedIds(spec: LiveSeed): Promise<string[]> {
   try {
     const WIX = "https://www.wixapis.com";
-    const clientId = process.env.WIX_CLIENT_ID ?? (config as { auth?: { config?: { clientId?: string } } }).auth?.config?.clientId ?? "";
-    if (!clientId || clientId.startsWith("YOUR_")) return [];
-    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
-    const token = ((await mint.json()) as { access_token?: string }).access_token;
+    const token = await liveSeedToken(WIX);
     if (!token) return [];
     const res = await fetch(WIX + spec.path, { method: "POST", headers: { Authorization: token, "Content-Type": "application/json" }, body: JSON.stringify(spec.body) });
     const json = (await res.json()) as Record<string, unknown>;

package/templates/yoga-studio/dev/index.ts

@@ -37400,15 +37400,31 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
 
 // Live seed-id enumeration: a published release serves only EXACT screens, so
 // `himi push` bakes each templated detail route's CURRENT catalog ids as exact
-// screens via `seedIds`. Anonymous visitor rung against this app's own clientId;
-// best-effort (offline build → no baked details, preview still live-resolves).
+// screens via `seedIds`. Anonymous visitor rung against this app's own clientId — or,
+// for an app bound through the One App visitor identity (`visitorSource: "one-app"`,
+// no client), that site's One App visitor instance. Best-effort (offline build → no
+// baked details, preview still live-resolves).
+async function liveSeedToken(WIX: string): Promise<string | undefined> {
+  const auth = (config as { auth?: { config?: { clientId?: string; visitorSource?: string; metaSiteId?: string } } }).auth?.config;
+  // A One App binding boots as the site's One App visitor, so the seed reads as that visitor too —
+  // even beside a member-login clientId, and never repointed by a stray local WIX_CLIENT_ID.
+  const oneApp = auth?.visitorSource === "one-app";
+  const clientId = oneApp ? "" : process.env.WIX_CLIENT_ID ?? auth?.clientId ?? "";
+  if (clientId && !clientId.startsWith("YOUR_")) {
+    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
+    return ((await mint.json()) as { access_token?: string }).access_token;
+  }
+  const msid = oneApp ? auth?.metaSiteId ?? "" : "";
+  if (!/^[0-9a-fA-F-]{10,64}$/.test(msid)) return undefined;
+  const mint = await fetch(`https://apps.wix.com/_api/one-app-session-web/v3/businesses/${msid}/signed-instance?signed_instance_type=Visitor`, { headers: { Accept: "application/json" }, redirect: "error" });
+  const visitor = (await mint.json()) as { signedInstance?: string; signedInstanceType?: string };
+  return visitor.signedInstanceType === "Visitor" ? visitor.signedInstance : undefined;
+}
+
 async function liveSeedIds(spec: LiveSeed): Promise<string[]> {
   try {
     const WIX = "https://www.wixapis.com";
-    const clientId = process.env.WIX_CLIENT_ID ?? (config as { auth?: { config?: { clientId?: string } } }).auth?.config?.clientId ?? "";
-    if (!clientId || clientId.startsWith("YOUR_")) return [];
-    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
-    const token = ((await mint.json()) as { access_token?: string }).access_token;
+    const token = await liveSeedToken(WIX);
     if (!token) return [];
     const res = await fetch(WIX + spec.path, { method: "POST", headers: { Authorization: token, "Content-Type": "application/json" }, body: JSON.stringify(spec.body) });
     const json = (await res.json()) as Record<string, unknown>;

package/templates/yoga-studio/tier5-src/_shared/iap-worker.ts

@@ -4,6 +4,7 @@
 // SDK; this only supplies the copy and the hydration reset.
 import { hostSessionFromGlobal, type IapPriceCopy } from "@himalaya/iap";
 import type { IapCommerce, IapPurchaseCopy, IapRestoreResult } from "@himalaya/iap-checkout";
+import { paymentSetupMessage } from "./payment-setup.js";
 import { copyParam, copyTemplate } from "./himi-copy.js";
 
 /** Price labels from the screen's copy pack (`<prefix>.priceLoadingText`, …). */
@@ -25,6 +26,7 @@ export function iapPurchaseCopy(prefix: string): IapPurchaseCopy {
     awaitingApproval: copyParam(`${prefix}.purchaseAwaitingApprovalText`, "Waiting for approval"),
     unavailable: copyParam(`${prefix}.purchaseTemporarilyUnavailableText`, "Purchasing is temporarily unavailable."),
     signInRequired: copyParam(`${prefix}.purchaseSignInText`, "Sign in to buy."),
+    sitePaymentUnavailable: paymentSetupMessage(prefix),
     retry: copyParam(`${prefix}.purchaseRetryText`, "Something went wrong. Try again."),
     priceChanged: copyParam(`${prefix}.purchasePriceChangedText`, "The price changed. Check it and try again."),
     support: copyParam(`${prefix}.purchaseSupportText`, "We couldn't finish this purchase. Contact support."),

package/templates/yoga-studio/tier5-src/_shared/payment-setup.ts

@@ -0,0 +1,6 @@
+import { copyParam } from "./himi-copy.js";
+
+/** No provider or country guess: Wix only established that online payment is unavailable. */
+export function paymentSetupMessage(prefix: string): string {
+  return copyParam(`${prefix}.paymentSetupUnavailable`, "This site is not accepting online payments. Go back or contact the business for other payment options.");
+}

package/templates/yoga-studio/tier5-src/himi-booking-time/index.ts

@@ -1,3 +1,4 @@
+import { paymentSetupMessage } from "../_shared/payment-setup.js";
 import { withOnlineWrites, offlineWritesEnabled } from "../_shared/online-actions.js";
 // Tier-5 bundle: himi-booking — availability and member booking.
 import { defineService as registerService, navigate } from "@himalaya/state";
@@ -9,7 +10,7 @@ import { dispatch } from "@himalaya/dispatch";
 import { bookSchedule, bookSlot, getService, queryServiceAvailability, registerToWaitlist, type WixBookingSlotFull, type WixSelectedPaymentOption, type WixService } from "@himalaya/wix-bookings";
 import { createCheckout, createOrder } from "@himalaya/wix-ecom";
 import { createRedirectSession, type WixSlot } from "@himalaya/wix-redirects";
-import { payCashierOrder } from "@himalaya/checkout";
+import { isPaymentSetupFailure, payCashierOrder } from "@himalaya/checkout";
 import { hostedCheckoutOpener, isHostedWorker } from "../_shared/hosted-checkout.js";
 import { session as wixPlatformSession } from "@himalaya/wix-platform";
 import { displayName, getMyData, type WixMyData } from "@himalaya/wix-users";
@@ -1587,10 +1588,12 @@ async function bookSelectedIn(s: S): Promise<S> {
           ? copyParam("time.coursePaymentCancelled", "Payment cancelled — your course booking wasn't confirmed. Try again.")
           : copyParam("time.paymentCancelled", "Payment cancelled — your booking wasn't confirmed. Pick a time to try again.") });
       }
+      if (isPaymentSetupFailure(pay)) return derive({ ...s, bookingInFlight: false, message: paymentSetupMessage("time") });
       return derive({ ...s, bookingInFlight: false, message: s.isCourse
         ? copyParam("time.coursePaymentFailed", "Payment couldn't be completed. Try again.")
         : copyParam("time.paymentFailed", "Payment couldn't be completed. Pick another time or try again.") });
-    } catch {
+    } catch (error) {
+      if (isPaymentSetupFailure(error)) return derive({ ...s, bookingInFlight: false, message: paymentSetupMessage("time") });
       return derive({ ...s, bookingInFlight: false, message: s.isCourse
         ? copyParam("time.courseCheckoutFailed", "Checkout could not start. Try again.")
         : copyParam("time.checkoutFailed", "Checkout could not start. Pick another time or try again.") });

package/templates/yoga-studio/tier5-src/himi-branded-lite-plans/index.ts

@@ -1,3 +1,4 @@
+import { paymentSetupMessage } from "../_shared/payment-setup.js";
 import { offlineWriteMessage, offlineWritesEnabled, withOnlineWrites } from "../_shared/online-actions.js";
 import { connectivity } from "@himalaya/state";
 import { defineService as registerService } from "../_shared/collection-service.js";
@@ -6,7 +7,7 @@ import { createRedirectSession } from "@himalaya/wix-redirects";
 import { open as openUrl } from "@himalaya/open-url";
 import { session as wixPlatformSession } from "@himalaya/wix-platform";
 import { copyParam, copyTemplate, stashCopy } from "../_shared/himi-copy.js";
-import { activePlanIds, entitlement, payCashierOrder } from "@himalaya/checkout";
+import { activePlanIds, entitlement, isPaymentSetupFailure, payCashierOrder } from "@himalaya/checkout";
 import { hostSessionFromGlobal, iapPriceFields, type IapCatalogItem } from "@himalaya/iap";
 import { createIapCommerce, pricingPlanOrders } from "@himalaya/iap-checkout";
 import { iapPriceCopy, iapPurchaseCopy, resetUnhydratedKeysOnOlderRuntime } from "../_shared/iap-worker.js";
@@ -290,7 +291,9 @@ async function regularJoinMessage(row: PlanRow, reference: { kind: string; id: s
     if (pay.kind === "cancelled") {
       return copyParam("plans.joinCancelledMessage", "Payment cancelled — you haven't joined.");
     }
-  } catch {
+    if (isPaymentSetupFailure(pay)) return paymentSetupMessage("plans");
+  } catch (error) {
+    if (isPaymentSetupFailure(error)) return paymentSetupMessage("plans");
   }
   return copyTemplate("plans.joinOnSiteMessage", "Memberships are purchased on the website — visit the site to join {name}.", { name: row.name });
 }

package/templates/yoga-studio/tier5-src/himi-branded-lite-program/index.ts

@@ -1,3 +1,4 @@
+import { paymentSetupMessage } from "../_shared/payment-setup.js";
 import { dispatch } from "@himalaya/dispatch";
 import { memberAccess, assertMemberAccess } from "../_shared/member-access.js";
 import { offlineWriteMessage, withOnlineWrites } from "../_shared/online-actions.js";
@@ -42,7 +43,7 @@ import { getMyMember } from "@himalaya/wix-members";
 import { session as wixPlatformSession } from "@himalaya/wix-platform";
 import { cleanTitle, initials } from "../_shared/himi-text.js";
 import { copyParam, copyTemplate, stashCopy } from "../_shared/himi-copy.js";
-import { payCashierOrder } from "@himalaya/checkout";
+import { isPaymentSetupFailure, payCashierOrder } from "@himalaya/checkout";
 import { formatCurrency } from "../_shared/engine-intl.js";
 import { iapPriceFields, onlineProgramItem, type IapCatalogItem, type IapPollDirective, type IapPriceFields } from "@himalaya/iap";
 import { createIapCommerce, onlineProgramOrders, type IapPurchaseFields } from "@himalaya/iap-checkout";
@@ -251,9 +252,11 @@ async function enrollmentMessage(id: string, name: string, guards: CommerceGuard
       : copyTemplate("program.joinedMessage", "You're enrolled in {name}.", { name });
     if (pay.kind === "handoff") return "";
     if (pay.kind === "cancelled") return copyParam("program.joinCancelledMessage", "Payment cancelled — you haven't enrolled.");
-  } catch {
+    if (isPaymentSetupFailure(pay)) return paymentSetupMessage("program");
+  } catch (error) {
     if (!connectivity().online) return offlineWriteMessage;
     if (preparationWithdrawn) return blocked();
+    if (isPaymentSetupFailure(error)) return paymentSetupMessage("program");
     // fall through to the site-directing message
   }
   return copyTemplate("program.joinOnSiteMessage", "Enrolment happens on the website — visit the site to join {name}.", { name });

package/templates/yoga-studio/tier5-src/himi-events-detail/index.ts

@@ -1,3 +1,4 @@
+import { paymentSetupMessage } from "../_shared/payment-setup.js";
 // Tier-5 bundle: himi-events — event detail.
 import { calendarDay, formatClock, formatCurrency, formatWeekdayDateTime, formatWeekdayMonthDay, formatTimeZoneLabel } from "../_shared/engine-intl.js";
 import { defineService as registerService } from "@himalaya/state";
@@ -18,7 +19,7 @@ import {
   type WixEvent,
 } from "@himalaya/wix-events";
 import { session as wixPlatformSession } from "@himalaya/wix-platform";
-import { payCashierOrder } from "@himalaya/checkout";
+import { isPaymentSetupFailure, payCashierOrder } from "@himalaya/checkout";
 import { get, upsert, type DbEntity } from "@himalaya/local-db";
 import {
   currentInputId,
@@ -986,16 +987,18 @@ const svc: ReturnType<typeof defineService<S, DetailActions>> = defineService<S,
               if (pay.kind === "paid") result = { ...s, ticketSheetOpen: false, snackbarMessage: detailCopy("event.ticketIssued", "You're in — your ticket is confirmed.") };
               else if (pay.kind === "handoff") result = { ...s, ticketSheetOpen: false, snackbarMessage: detailCopy("event.checkoutOpened", "Complete checkout in the browser to get your tickets.") };
               else if (pay.kind === "cancelled") result = { ...s, snackbarMessage: detailCopy("event.ticketCancelled", "Payment cancelled — no ticket was issued.") };
+              else if (isPaymentSetupFailure(pay)) result = { ...s, snackbarMessage: paymentSetupMessage("event") };
               else throw new Error("Payment could not be completed");
             }
           }
         }
-      } catch {
+      } catch (error) {
+        if (isPaymentSetupFailure(error)) result = { ...s, snackbarMessage: paymentSetupMessage("event") };
         try {
           // A public event page is not pinned to this selection or price. Only
           // continue in hosted checkout when a reservation already holds it.
           const params = reservationId ? { reservationId } : undefined;
-          if (params) {
+          if (params && !result) {
             const redirect = await createRedirectSession({ eventsCheckout: params });
             const url = redirect.redirectSession?.fullUrl;
             if (url) {
@@ -1003,7 +1006,9 @@ const svc: ReturnType<typeof defineService<S, DetailActions>> = defineService<S,
               result = { ...s, ticketSheetOpen: false, snackbarMessage: opened.opened ? detailCopy("event.checkoutOpened", "Complete checkout in the browser to get your tickets.") : detailCopy("event.registrationOpenFailed", "Could not open the registration page.") };
             }
           }
-        } catch { /* report below */ }
+        } catch (error) {
+          if (isPaymentSetupFailure(error)) result = { ...s, snackbarMessage: paymentSetupMessage("event") };
+        }
         if (!result) result = { ...s, snackbarMessage: detailCopy("event.purchaseUnavailable", "Purchasing is temporarily unavailable.") };
       } finally { ticketCheckoutInFlight = false; }
       return derive(result!);

package/templates/yoga-studio-owner/dev/index.ts

@@ -82114,15 +82114,31 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
 
 // Live seed-id enumeration: a published release serves only EXACT screens, so
 // `himi push` bakes each templated detail route's CURRENT catalog ids as exact
-// screens via `seedIds`. Anonymous visitor rung against this app's own clientId;
-// best-effort (offline build → no baked details, preview still live-resolves).
+// screens via `seedIds`. Anonymous visitor rung against this app's own clientId — or,
+// for an app bound through the One App visitor identity (`visitorSource: "one-app"`,
+// no client), that site's One App visitor instance. Best-effort (offline build → no
+// baked details, preview still live-resolves).
+async function liveSeedToken(WIX: string): Promise<string | undefined> {
+  const auth = (config as { auth?: { config?: { clientId?: string; visitorSource?: string; metaSiteId?: string } } }).auth?.config;
+  // A One App binding boots as the site's One App visitor, so the seed reads as that visitor too —
+  // even beside a member-login clientId, and never repointed by a stray local WIX_CLIENT_ID.
+  const oneApp = auth?.visitorSource === "one-app";
+  const clientId = oneApp ? "" : process.env.WIX_CLIENT_ID ?? auth?.clientId ?? "";
+  if (clientId && !clientId.startsWith("YOUR_")) {
+    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
+    return ((await mint.json()) as { access_token?: string }).access_token;
+  }
+  const msid = oneApp ? auth?.metaSiteId ?? "" : "";
+  if (!/^[0-9a-fA-F-]{10,64}$/.test(msid)) return undefined;
+  const mint = await fetch(`https://apps.wix.com/_api/one-app-session-web/v3/businesses/${msid}/signed-instance?signed_instance_type=Visitor`, { headers: { Accept: "application/json" }, redirect: "error" });
+  const visitor = (await mint.json()) as { signedInstance?: string; signedInstanceType?: string };
+  return visitor.signedInstanceType === "Visitor" ? visitor.signedInstance : undefined;
+}
+
 async function liveSeedIds(spec: LiveSeed): Promise<string[]> {
   try {
     const WIX = "https://www.wixapis.com";
-    const clientId = process.env.WIX_CLIENT_ID ?? (config as { auth?: { config?: { clientId?: string } } }).auth?.config?.clientId ?? "";
-    if (!clientId || clientId.startsWith("YOUR_")) return [];
-    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
-    const token = ((await mint.json()) as { access_token?: string }).access_token;
+    const token = await liveSeedToken(WIX);
     if (!token) return [];
     const res = await fetch(WIX + spec.path, { method: "POST", headers: { Authorization: token, "Content-Type": "application/json" }, body: JSON.stringify(spec.body) });
     const json = (await res.json()) as Record<string, unknown>;