@wix/himalaya-cli 0.1573.0 → 0.1574.0

package/templates/portfolio-creative/dev/index.ts

@@ -36114,15 +36114,31 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
 
 // Live seed-id enumeration: a published release serves only EXACT screens, so
 // `himi push` bakes each templated detail route's CURRENT catalog ids as exact
-// screens via `seedIds`. Anonymous visitor rung against this app's own clientId;
-// best-effort (offline build → no baked details, preview still live-resolves).
+// screens via `seedIds`. Anonymous visitor rung against this app's own clientId — or,
+// for an app bound through the One App visitor identity (`visitorSource: "one-app"`,
+// no client), that site's One App visitor instance. Best-effort (offline build → no
+// baked details, preview still live-resolves).
+async function liveSeedToken(WIX: string): Promise<string | undefined> {
+  const auth = (config as { auth?: { config?: { clientId?: string; visitorSource?: string; metaSiteId?: string } } }).auth?.config;
+  // A One App binding boots as the site's One App visitor, so the seed reads as that visitor too —
+  // even beside a member-login clientId, and never repointed by a stray local WIX_CLIENT_ID.
+  const oneApp = auth?.visitorSource === "one-app";
+  const clientId = oneApp ? "" : process.env.WIX_CLIENT_ID ?? auth?.clientId ?? "";
+  if (clientId && !clientId.startsWith("YOUR_")) {
+    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
+    return ((await mint.json()) as { access_token?: string }).access_token;
+  }
+  const msid = oneApp ? auth?.metaSiteId ?? "" : "";
+  if (!/^[0-9a-fA-F-]{10,64}$/.test(msid)) return undefined;
+  const mint = await fetch(`https://apps.wix.com/_api/one-app-session-web/v3/businesses/${msid}/signed-instance?signed_instance_type=Visitor`, { headers: { Accept: "application/json" }, redirect: "error" });
+  const visitor = (await mint.json()) as { signedInstance?: string; signedInstanceType?: string };
+  return visitor.signedInstanceType === "Visitor" ? visitor.signedInstance : undefined;
+}
+
 async function liveSeedIds(spec: LiveSeed): Promise<string[]> {
   try {
     const WIX = "https://www.wixapis.com";
-    const clientId = process.env.WIX_CLIENT_ID ?? (config as { auth?: { config?: { clientId?: string } } }).auth?.config?.clientId ?? "";
-    if (!clientId || clientId.startsWith("YOUR_")) return [];
-    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
-    const token = ((await mint.json()) as { access_token?: string }).access_token;
+    const token = await liveSeedToken(WIX);
     if (!token) return [];
     const res = await fetch(WIX + spec.path, { method: "POST", headers: { Authorization: token, "Content-Type": "application/json" }, body: JSON.stringify(spec.body) });
     const json = (await res.json()) as Record<string, unknown>;

package/templates/portfolio-creative-owner/dev/index.ts

@@ -86711,15 +86711,31 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
 
 // Live seed-id enumeration: a published release serves only EXACT screens, so
 // `himi push` bakes each templated detail route's CURRENT catalog ids as exact
-// screens via `seedIds`. Anonymous visitor rung against this app's own clientId;
-// best-effort (offline build → no baked details, preview still live-resolves).
+// screens via `seedIds`. Anonymous visitor rung against this app's own clientId — or,
+// for an app bound through the One App visitor identity (`visitorSource: "one-app"`,
+// no client), that site's One App visitor instance. Best-effort (offline build → no
+// baked details, preview still live-resolves).
+async function liveSeedToken(WIX: string): Promise<string | undefined> {
+  const auth = (config as { auth?: { config?: { clientId?: string; visitorSource?: string; metaSiteId?: string } } }).auth?.config;
+  // A One App binding boots as the site's One App visitor, so the seed reads as that visitor too —
+  // even beside a member-login clientId, and never repointed by a stray local WIX_CLIENT_ID.
+  const oneApp = auth?.visitorSource === "one-app";
+  const clientId = oneApp ? "" : process.env.WIX_CLIENT_ID ?? auth?.clientId ?? "";
+  if (clientId && !clientId.startsWith("YOUR_")) {
+    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
+    return ((await mint.json()) as { access_token?: string }).access_token;
+  }
+  const msid = oneApp ? auth?.metaSiteId ?? "" : "";
+  if (!/^[0-9a-fA-F-]{10,64}$/.test(msid)) return undefined;
+  const mint = await fetch(`https://apps.wix.com/_api/one-app-session-web/v3/businesses/${msid}/signed-instance?signed_instance_type=Visitor`, { headers: { Accept: "application/json" }, redirect: "error" });
+  const visitor = (await mint.json()) as { signedInstance?: string; signedInstanceType?: string };
+  return visitor.signedInstanceType === "Visitor" ? visitor.signedInstance : undefined;
+}
+
 async function liveSeedIds(spec: LiveSeed): Promise<string[]> {
   try {
     const WIX = "https://www.wixapis.com";
-    const clientId = process.env.WIX_CLIENT_ID ?? (config as { auth?: { config?: { clientId?: string } } }).auth?.config?.clientId ?? "";
-    if (!clientId || clientId.startsWith("YOUR_")) return [];
-    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
-    const token = ((await mint.json()) as { access_token?: string }).access_token;
+    const token = await liveSeedToken(WIX);
     if (!token) return [];
     const res = await fetch(WIX + spec.path, { method: "POST", headers: { Authorization: token, "Content-Type": "application/json" }, body: JSON.stringify(spec.body) });
     const json = (await res.json()) as Record<string, unknown>;

package/templates/restaurant/dev/index.ts

@@ -26773,15 +26773,31 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
 
 // Live seed-id enumeration: a published release serves only EXACT screens, so
 // `himi push` bakes each templated detail route's CURRENT catalog ids as exact
-// screens via `seedIds`. Anonymous visitor rung against this app's own clientId;
-// best-effort (offline build → no baked details, preview still live-resolves).
+// screens via `seedIds`. Anonymous visitor rung against this app's own clientId — or,
+// for an app bound through the One App visitor identity (`visitorSource: "one-app"`,
+// no client), that site's One App visitor instance. Best-effort (offline build → no
+// baked details, preview still live-resolves).
+async function liveSeedToken(WIX: string): Promise<string | undefined> {
+  const auth = (config as { auth?: { config?: { clientId?: string; visitorSource?: string; metaSiteId?: string } } }).auth?.config;
+  // A One App binding boots as the site's One App visitor, so the seed reads as that visitor too —
+  // even beside a member-login clientId, and never repointed by a stray local WIX_CLIENT_ID.
+  const oneApp = auth?.visitorSource === "one-app";
+  const clientId = oneApp ? "" : process.env.WIX_CLIENT_ID ?? auth?.clientId ?? "";
+  if (clientId && !clientId.startsWith("YOUR_")) {
+    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
+    return ((await mint.json()) as { access_token?: string }).access_token;
+  }
+  const msid = oneApp ? auth?.metaSiteId ?? "" : "";
+  if (!/^[0-9a-fA-F-]{10,64}$/.test(msid)) return undefined;
+  const mint = await fetch(`https://apps.wix.com/_api/one-app-session-web/v3/businesses/${msid}/signed-instance?signed_instance_type=Visitor`, { headers: { Accept: "application/json" }, redirect: "error" });
+  const visitor = (await mint.json()) as { signedInstance?: string; signedInstanceType?: string };
+  return visitor.signedInstanceType === "Visitor" ? visitor.signedInstance : undefined;
+}
+
 async function liveSeedIds(spec: LiveSeed): Promise<string[]> {
   try {
     const WIX = "https://www.wixapis.com";
-    const clientId = process.env.WIX_CLIENT_ID ?? (config as { auth?: { config?: { clientId?: string } } }).auth?.config?.clientId ?? "";
-    if (!clientId || clientId.startsWith("YOUR_")) return [];
-    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
-    const token = ((await mint.json()) as { access_token?: string }).access_token;
+    const token = await liveSeedToken(WIX);
     if (!token) return [];
     const res = await fetch(WIX + spec.path, { method: "POST", headers: { Authorization: token, "Content-Type": "application/json" }, body: JSON.stringify(spec.body) });
     const json = (await res.json()) as Record<string, unknown>;

package/templates/restaurant-owner/dev/index.ts

@@ -90719,15 +90719,31 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
 
 // Live seed-id enumeration: a published release serves only EXACT screens, so
 // `himi push` bakes each templated detail route's CURRENT catalog ids as exact
-// screens via `seedIds`. Anonymous visitor rung against this app's own clientId;
-// best-effort (offline build → no baked details, preview still live-resolves).
+// screens via `seedIds`. Anonymous visitor rung against this app's own clientId — or,
+// for an app bound through the One App visitor identity (`visitorSource: "one-app"`,
+// no client), that site's One App visitor instance. Best-effort (offline build → no
+// baked details, preview still live-resolves).
+async function liveSeedToken(WIX: string): Promise<string | undefined> {
+  const auth = (config as { auth?: { config?: { clientId?: string; visitorSource?: string; metaSiteId?: string } } }).auth?.config;
+  // A One App binding boots as the site's One App visitor, so the seed reads as that visitor too —
+  // even beside a member-login clientId, and never repointed by a stray local WIX_CLIENT_ID.
+  const oneApp = auth?.visitorSource === "one-app";
+  const clientId = oneApp ? "" : process.env.WIX_CLIENT_ID ?? auth?.clientId ?? "";
+  if (clientId && !clientId.startsWith("YOUR_")) {
+    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
+    return ((await mint.json()) as { access_token?: string }).access_token;
+  }
+  const msid = oneApp ? auth?.metaSiteId ?? "" : "";
+  if (!/^[0-9a-fA-F-]{10,64}$/.test(msid)) return undefined;
+  const mint = await fetch(`https://apps.wix.com/_api/one-app-session-web/v3/businesses/${msid}/signed-instance?signed_instance_type=Visitor`, { headers: { Accept: "application/json" }, redirect: "error" });
+  const visitor = (await mint.json()) as { signedInstance?: string; signedInstanceType?: string };
+  return visitor.signedInstanceType === "Visitor" ? visitor.signedInstance : undefined;
+}
+
 async function liveSeedIds(spec: LiveSeed): Promise<string[]> {
   try {
     const WIX = "https://www.wixapis.com";
-    const clientId = process.env.WIX_CLIENT_ID ?? (config as { auth?: { config?: { clientId?: string } } }).auth?.config?.clientId ?? "";
-    if (!clientId || clientId.startsWith("YOUR_")) return [];
-    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
-    const token = ((await mint.json()) as { access_token?: string }).access_token;
+    const token = await liveSeedToken(WIX);
     if (!token) return [];
     const res = await fetch(WIX + spec.path, { method: "POST", headers: { Authorization: token, "Content-Type": "application/json" }, body: JSON.stringify(spec.body) });
     const json = (await res.json()) as Record<string, unknown>;

package/templates/retail-store/dev/index.ts

@@ -25622,15 +25622,31 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
 
 // Live seed-id enumeration: a published release serves only EXACT screens, so
 // `himi push` bakes each templated detail route's CURRENT catalog ids as exact
-// screens via `seedIds`. Anonymous visitor rung against this app's own clientId;
-// best-effort (offline build → no baked details, preview still live-resolves).
+// screens via `seedIds`. Anonymous visitor rung against this app's own clientId — or,
+// for an app bound through the One App visitor identity (`visitorSource: "one-app"`,
+// no client), that site's One App visitor instance. Best-effort (offline build → no
+// baked details, preview still live-resolves).
+async function liveSeedToken(WIX: string): Promise<string | undefined> {
+  const auth = (config as { auth?: { config?: { clientId?: string; visitorSource?: string; metaSiteId?: string } } }).auth?.config;
+  // A One App binding boots as the site's One App visitor, so the seed reads as that visitor too —
+  // even beside a member-login clientId, and never repointed by a stray local WIX_CLIENT_ID.
+  const oneApp = auth?.visitorSource === "one-app";
+  const clientId = oneApp ? "" : process.env.WIX_CLIENT_ID ?? auth?.clientId ?? "";
+  if (clientId && !clientId.startsWith("YOUR_")) {
+    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
+    return ((await mint.json()) as { access_token?: string }).access_token;
+  }
+  const msid = oneApp ? auth?.metaSiteId ?? "" : "";
+  if (!/^[0-9a-fA-F-]{10,64}$/.test(msid)) return undefined;
+  const mint = await fetch(`https://apps.wix.com/_api/one-app-session-web/v3/businesses/${msid}/signed-instance?signed_instance_type=Visitor`, { headers: { Accept: "application/json" }, redirect: "error" });
+  const visitor = (await mint.json()) as { signedInstance?: string; signedInstanceType?: string };
+  return visitor.signedInstanceType === "Visitor" ? visitor.signedInstance : undefined;
+}
+
 async function liveSeedIds(spec: LiveSeed): Promise<string[]> {
   try {
     const WIX = "https://www.wixapis.com";
-    const clientId = process.env.WIX_CLIENT_ID ?? (config as { auth?: { config?: { clientId?: string } } }).auth?.config?.clientId ?? "";
-    if (!clientId || clientId.startsWith("YOUR_")) return [];
-    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
-    const token = ((await mint.json()) as { access_token?: string }).access_token;
+    const token = await liveSeedToken(WIX);
     if (!token) return [];
     const res = await fetch(WIX + spec.path, { method: "POST", headers: { Authorization: token, "Content-Type": "application/json" }, body: JSON.stringify(spec.body) });
     const json = (await res.json()) as Record<string, unknown>;

package/templates/retail-store-owner/dev/index.ts

@@ -80984,15 +80984,31 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
 
 // Live seed-id enumeration: a published release serves only EXACT screens, so
 // `himi push` bakes each templated detail route's CURRENT catalog ids as exact
-// screens via `seedIds`. Anonymous visitor rung against this app's own clientId;
-// best-effort (offline build → no baked details, preview still live-resolves).
+// screens via `seedIds`. Anonymous visitor rung against this app's own clientId — or,
+// for an app bound through the One App visitor identity (`visitorSource: "one-app"`,
+// no client), that site's One App visitor instance. Best-effort (offline build → no
+// baked details, preview still live-resolves).
+async function liveSeedToken(WIX: string): Promise<string | undefined> {
+  const auth = (config as { auth?: { config?: { clientId?: string; visitorSource?: string; metaSiteId?: string } } }).auth?.config;
+  // A One App binding boots as the site's One App visitor, so the seed reads as that visitor too —
+  // even beside a member-login clientId, and never repointed by a stray local WIX_CLIENT_ID.
+  const oneApp = auth?.visitorSource === "one-app";
+  const clientId = oneApp ? "" : process.env.WIX_CLIENT_ID ?? auth?.clientId ?? "";
+  if (clientId && !clientId.startsWith("YOUR_")) {
+    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
+    return ((await mint.json()) as { access_token?: string }).access_token;
+  }
+  const msid = oneApp ? auth?.metaSiteId ?? "" : "";
+  if (!/^[0-9a-fA-F-]{10,64}$/.test(msid)) return undefined;
+  const mint = await fetch(`https://apps.wix.com/_api/one-app-session-web/v3/businesses/${msid}/signed-instance?signed_instance_type=Visitor`, { headers: { Accept: "application/json" }, redirect: "error" });
+  const visitor = (await mint.json()) as { signedInstance?: string; signedInstanceType?: string };
+  return visitor.signedInstanceType === "Visitor" ? visitor.signedInstance : undefined;
+}
+
 async function liveSeedIds(spec: LiveSeed): Promise<string[]> {
   try {
     const WIX = "https://www.wixapis.com";
-    const clientId = process.env.WIX_CLIENT_ID ?? (config as { auth?: { config?: { clientId?: string } } }).auth?.config?.clientId ?? "";
-    if (!clientId || clientId.startsWith("YOUR_")) return [];
-    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
-    const token = ((await mint.json()) as { access_token?: string }).access_token;
+    const token = await liveSeedToken(WIX);
     if (!token) return [];
     const res = await fetch(WIX + spec.path, { method: "POST", headers: { Authorization: token, "Content-Type": "application/json" }, body: JSON.stringify(spec.body) });
     const json = (await res.json()) as Record<string, unknown>;

package/templates/surface-showcase/dev/index.ts

@@ -626,15 +626,31 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
 
 // Live seed-id enumeration: a published release serves only EXACT screens, so
 // `himi push` bakes each templated detail route's CURRENT catalog ids as exact
-// screens via `seedIds`. Anonymous visitor rung against this app's own clientId;
-// best-effort (offline build → no baked details, preview still live-resolves).
+// screens via `seedIds`. Anonymous visitor rung against this app's own clientId — or,
+// for an app bound through the One App visitor identity (`visitorSource: "one-app"`,
+// no client), that site's One App visitor instance. Best-effort (offline build → no
+// baked details, preview still live-resolves).
+async function liveSeedToken(WIX: string): Promise<string | undefined> {
+  const auth = (config as { auth?: { config?: { clientId?: string; visitorSource?: string; metaSiteId?: string } } }).auth?.config;
+  // A One App binding boots as the site's One App visitor, so the seed reads as that visitor too —
+  // even beside a member-login clientId, and never repointed by a stray local WIX_CLIENT_ID.
+  const oneApp = auth?.visitorSource === "one-app";
+  const clientId = oneApp ? "" : process.env.WIX_CLIENT_ID ?? auth?.clientId ?? "";
+  if (clientId && !clientId.startsWith("YOUR_")) {
+    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
+    return ((await mint.json()) as { access_token?: string }).access_token;
+  }
+  const msid = oneApp ? auth?.metaSiteId ?? "" : "";
+  if (!/^[0-9a-fA-F-]{10,64}$/.test(msid)) return undefined;
+  const mint = await fetch(`https://apps.wix.com/_api/one-app-session-web/v3/businesses/${msid}/signed-instance?signed_instance_type=Visitor`, { headers: { Accept: "application/json" }, redirect: "error" });
+  const visitor = (await mint.json()) as { signedInstance?: string; signedInstanceType?: string };
+  return visitor.signedInstanceType === "Visitor" ? visitor.signedInstance : undefined;
+}
+
 async function liveSeedIds(spec: LiveSeed): Promise<string[]> {
   try {
     const WIX = "https://www.wixapis.com";
-    const clientId = process.env.WIX_CLIENT_ID ?? (config as { auth?: { config?: { clientId?: string } } }).auth?.config?.clientId ?? "";
-    if (!clientId || clientId.startsWith("YOUR_")) return [];
-    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
-    const token = ((await mint.json()) as { access_token?: string }).access_token;
+    const token = await liveSeedToken(WIX);
     if (!token) return [];
     const res = await fetch(WIX + spec.path, { method: "POST", headers: { Authorization: token, "Content-Type": "application/json" }, body: JSON.stringify(spec.body) });
     const json = (await res.json()) as Record<string, unknown>;

package/templates/yoga-studio/dev/index.ts

@@ -37400,15 +37400,31 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
 
 // Live seed-id enumeration: a published release serves only EXACT screens, so
 // `himi push` bakes each templated detail route's CURRENT catalog ids as exact
-// screens via `seedIds`. Anonymous visitor rung against this app's own clientId;
-// best-effort (offline build → no baked details, preview still live-resolves).
+// screens via `seedIds`. Anonymous visitor rung against this app's own clientId — or,
+// for an app bound through the One App visitor identity (`visitorSource: "one-app"`,
+// no client), that site's One App visitor instance. Best-effort (offline build → no
+// baked details, preview still live-resolves).
+async function liveSeedToken(WIX: string): Promise<string | undefined> {
+  const auth = (config as { auth?: { config?: { clientId?: string; visitorSource?: string; metaSiteId?: string } } }).auth?.config;
+  // A One App binding boots as the site's One App visitor, so the seed reads as that visitor too —
+  // even beside a member-login clientId, and never repointed by a stray local WIX_CLIENT_ID.
+  const oneApp = auth?.visitorSource === "one-app";
+  const clientId = oneApp ? "" : process.env.WIX_CLIENT_ID ?? auth?.clientId ?? "";
+  if (clientId && !clientId.startsWith("YOUR_")) {
+    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
+    return ((await mint.json()) as { access_token?: string }).access_token;
+  }
+  const msid = oneApp ? auth?.metaSiteId ?? "" : "";
+  if (!/^[0-9a-fA-F-]{10,64}$/.test(msid)) return undefined;
+  const mint = await fetch(`https://apps.wix.com/_api/one-app-session-web/v3/businesses/${msid}/signed-instance?signed_instance_type=Visitor`, { headers: { Accept: "application/json" }, redirect: "error" });
+  const visitor = (await mint.json()) as { signedInstance?: string; signedInstanceType?: string };
+  return visitor.signedInstanceType === "Visitor" ? visitor.signedInstance : undefined;
+}
+
 async function liveSeedIds(spec: LiveSeed): Promise<string[]> {
   try {
     const WIX = "https://www.wixapis.com";
-    const clientId = process.env.WIX_CLIENT_ID ?? (config as { auth?: { config?: { clientId?: string } } }).auth?.config?.clientId ?? "";
-    if (!clientId || clientId.startsWith("YOUR_")) return [];
-    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
-    const token = ((await mint.json()) as { access_token?: string }).access_token;
+    const token = await liveSeedToken(WIX);
     if (!token) return [];
     const res = await fetch(WIX + spec.path, { method: "POST", headers: { Authorization: token, "Content-Type": "application/json" }, body: JSON.stringify(spec.body) });
     const json = (await res.json()) as Record<string, unknown>;

package/templates/yoga-studio-owner/dev/index.ts

@@ -82114,15 +82114,31 @@ const TEMPLATED: { pattern: string; display: string; liveSeed?: LiveSeed; static
 
 // Live seed-id enumeration: a published release serves only EXACT screens, so
 // `himi push` bakes each templated detail route's CURRENT catalog ids as exact
-// screens via `seedIds`. Anonymous visitor rung against this app's own clientId;
-// best-effort (offline build → no baked details, preview still live-resolves).
+// screens via `seedIds`. Anonymous visitor rung against this app's own clientId — or,
+// for an app bound through the One App visitor identity (`visitorSource: "one-app"`,
+// no client), that site's One App visitor instance. Best-effort (offline build → no
+// baked details, preview still live-resolves).
+async function liveSeedToken(WIX: string): Promise<string | undefined> {
+  const auth = (config as { auth?: { config?: { clientId?: string; visitorSource?: string; metaSiteId?: string } } }).auth?.config;
+  // A One App binding boots as the site's One App visitor, so the seed reads as that visitor too —
+  // even beside a member-login clientId, and never repointed by a stray local WIX_CLIENT_ID.
+  const oneApp = auth?.visitorSource === "one-app";
+  const clientId = oneApp ? "" : process.env.WIX_CLIENT_ID ?? auth?.clientId ?? "";
+  if (clientId && !clientId.startsWith("YOUR_")) {
+    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
+    return ((await mint.json()) as { access_token?: string }).access_token;
+  }
+  const msid = oneApp ? auth?.metaSiteId ?? "" : "";
+  if (!/^[0-9a-fA-F-]{10,64}$/.test(msid)) return undefined;
+  const mint = await fetch(`https://apps.wix.com/_api/one-app-session-web/v3/businesses/${msid}/signed-instance?signed_instance_type=Visitor`, { headers: { Accept: "application/json" }, redirect: "error" });
+  const visitor = (await mint.json()) as { signedInstance?: string; signedInstanceType?: string };
+  return visitor.signedInstanceType === "Visitor" ? visitor.signedInstance : undefined;
+}
+
 async function liveSeedIds(spec: LiveSeed): Promise<string[]> {
   try {
     const WIX = "https://www.wixapis.com";
-    const clientId = process.env.WIX_CLIENT_ID ?? (config as { auth?: { config?: { clientId?: string } } }).auth?.config?.clientId ?? "";
-    if (!clientId || clientId.startsWith("YOUR_")) return [];
-    const mint = await fetch(WIX + "/oauth2/token", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ clientId, grantType: "anonymous" }) });
-    const token = ((await mint.json()) as { access_token?: string }).access_token;
+    const token = await liveSeedToken(WIX);
     if (!token) return [];
     const res = await fetch(WIX + spec.path, { method: "POST", headers: { Authorization: token, "Content-Type": "application/json" }, body: JSON.stringify(spec.body) });
     const json = (await res.json()) as Record<string, unknown>;