@wix/himalaya-cli 0.1397.0 → 0.1399.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/serve-runtime/src/wix-bridge.d.ts

@@ -259,4 +259,34 @@ export declare function memberInstanceRefusal(e: unknown): {
         reason?: string;
     };
 };
+export declare const MEMBER_SESSION_URL = "https://manage.wix.com/_api/users-members/v1/user-member-connections/member-session";
+/** Wix will not issue a member session on this site to this account: it holds no role there (a site it only
+ *  JOINED refuses it — a plain member needs an IAM-scoped OAuth app). The host opens the page as a visitor. */
+export declare class MemberSessionRefused extends Error {
+    readonly metaSiteId: string;
+    readonly reason: string;
+    readonly code = "MemberSessionRefused";
+    constructor(metaSiteId: string, reason: string);
+}
+/** A one-time site-member session token for [metaSiteId], minted from the account [sessionCookie] (already
+ *  narrowed to `forwardableWixSessionCookies`). Throws `AccountSessionExpired` (a 401 on either step),
+ *  `MemberSessionRefused` (403/404), or `SiteInstanceUnavailable` (anything transient). Never follows a
+ *  redirect, never caches. */
+export declare function mintMemberSessionToken(sessionCookie: string, metaSiteId: string, fetchImpl?: typeof fetch, timeoutMs?: number): Promise<string>;
+/** The bridge's answer for a member-session failure, in the `{ error }` shape every bridge refusal has. */
+export declare function memberSessionRefusal(e: unknown): {
+    status: number;
+    body: {
+        error: string;
+    };
+};
+/** `https://wix.app/mobile.apps/<shortId>`, or null for anything that is not an id. */
+export declare function inviteShortLinkUrl(shortId: string): string | null;
+/** A URL a short link's redirects name the invite in: `https://wix.app/invite/<site>/<invite>` or a wix.com
+ *  `…/place-invites/invite-lp/<invite>` page (native `SpacesLinks.isInviteLanding`). */
+export declare function isInviteLanding(url: URL): boolean;
+export declare const INVITE_MAX_HOPS = 8;
+/** Follow [shortId]'s short link to its invite landing; null when it lands nowhere an invite is named. No
+ *  cookies, no credentials; each hop bounded by [timeoutMs]. */
+export declare function resolveInviteShortLink(shortId: string, fetchImpl?: typeof fetch, timeoutMs?: number): Promise<string | null>;
 export {};

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/icon-catalog.generated.d.ts

@@ -28,7 +28,7 @@ export declare const ICON_CATALOG: Readonly<Record<string, IconCatalogEntry>>;
 /** normalized (lowercased, separators stripped) → canonical key, aliases included. */
 export declare const ICON_NORMALIZED_INDEX: Readonly<Record<string, string>>;
 /** Every authorable name, aliases included. `_unknown` is deliberately absent. */
-export declare const ICON_NAMES: readonly ["ai", "arrow_down", "arrow_left", "arrow_right", "arrow_up", "back", "bag", "bag_fill", "barcode", "bell", "bell_fill", "bell_off", "bell_slash", "book", "bookmark", "bookmark_fill", "boxes", "branch", "calendar", "camera", "cart", "cart_fill", "chart", "chat", "check", "checklist", "checkmark", "chevron_down", "chevron_left", "chevron_right", "chevron_up", "circle", "circle_fill", "clock", "close", "cookie", "copy", "dashboard", "doc", "document", "download", "edit", "ellipsis", "error", "expand", "external_link", "filter", "folder", "forward", "fullscreen", "gear", "globe", "grid", "grid_fill", "grip", "heart", "heart_fill", "help", "home", "home_fill", "house", "image", "inbox", "info", "layers", "link", "list", "location", "lock", "logout", "mail", "map", "menu", "message", "mic", "mic_fill", "microphone", "microphone_fill", "minus", "moon", "more", "more_vertical", "music", "newspaper", "newspaper_fill", "next", "pause", "pencil", "people", "person", "person_fill", "phone", "photo", "pin", "play", "play_circle", "play_circle_fill", "plus", "plus_circle", "plus_circle_fill", "prev", "question", "refresh", "repeat", "rss", "search", "send", "send_arrow", "settings", "settings_fill", "share", "shuffle", "skip_back", "skip_forward", "skip_next", "skip_previous", "star", "star_fill", "stop", "success", "tag", "ticket", "ticket_fill", "trash", "tray", "undo", "user", "visible", "volume", "warning", "wifi", "xmark"];
+export declare const ICON_NAMES: readonly ["ai", "arrow_down", "arrow_left", "arrow_right", "arrow_up", "back", "bag", "bag_fill", "barcode", "bell", "bell_fill", "bell_off", "bell_slash", "book", "bookmark", "bookmark_fill", "boxes", "branch", "calendar", "camera", "cart", "cart_fill", "chart", "chat", "check", "checklist", "checkmark", "chevron_down", "chevron_left", "chevron_right", "chevron_up", "circle", "circle_fill", "clock", "close", "concealed", "cookie", "copy", "dashboard", "doc", "document", "download", "edit", "ellipsis", "error", "expand", "external_link", "eye", "eye_slash", "filter", "folder", "forward", "fullscreen", "gear", "gift", "globe", "grid", "grid_fill", "grip", "heart", "heart_fill", "help", "home", "home_fill", "house", "image", "inbox", "info", "layers", "link", "list", "location", "lock", "logout", "mail", "map", "menu", "message", "mic", "mic_fill", "microphone", "microphone_fill", "minus", "moon", "more", "more_vertical", "music", "newspaper", "newspaper_fill", "next", "paper_plane", "pause", "pencil", "people", "person", "person_fill", "phone", "photo", "pin", "play", "play_circle", "play_circle_fill", "plus", "plus_circle", "plus_circle_fill", "prev", "question", "refresh", "repeat", "rss", "search", "send", "send_arrow", "settings", "settings_fill", "share", "shuffle", "skip_back", "skip_forward", "skip_next", "skip_previous", "star", "star_fill", "stop", "success", "tag", "ticket", "ticket_fill", "trash", "tray", "undo", "user", "visible", "volume", "warning", "wifi", "xmark"];
 export type IconName = (typeof ICON_NAMES)[number];
 /** Resolve any authored string to a row, falling back to `_unknown`. Never returns undefined. */
 export declare function resolveIcon(name: string): IconCatalogEntry;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/schema.d.ts

@@ -805,6 +805,8 @@ export interface TextFieldProps {
     /** LITERAL error string for a server-rendered screen with no worker to bind.
      *  Lower precedence than `errorPath`, higher than the rules. */
     errorText?: string;
+    /** Opt-in accessible show/hide button. Only applies to secure fields; initially masked. */
+    visibilityToggle?: boolean;
 }
 export interface ToggleProps {
     label?: string;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/validation.d.ts

@@ -121,6 +121,7 @@ export declare function shouldRevealError(args: {
     touched: boolean;
     focused: boolean;
     submitAttempted: boolean;
+    feedbackShown?: boolean;
 }): boolean;
 export declare const validators: {
     readonly email: (v: string) => boolean;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/flows/auth/src/copy.generated.d.ts

@@ -0,0 +1,109 @@
+declare const _default: {
+    readonly "auth.gate.title": "Welcome";
+    readonly "auth.gate.subtitle": "Sign in to continue";
+    readonly "auth.gate.signIn": "Sign In";
+    readonly "auth.gate.createAccount": "Create account";
+    readonly "auth.gate.resetPassword": "Reset password";
+    readonly "auth.gate.verifyTitle": "Verify it's you";
+    readonly "auth.gate.sendResetLink": "Send reset link";
+    readonly "auth.gate.verify": "Verify";
+    readonly "auth.gate.continue": "Continue";
+    readonly "auth.gate.forgotPassword": "Forgot password?";
+    readonly "auth.gate.backToSignIn": "Back to sign in";
+    readonly "auth.gate.continueWith": "Continue with {provider}";
+    readonly "auth.gate.sendCodeVia": "Send code via";
+    readonly "auth.gate.resendCode": "Didn't get it? Resend code";
+    readonly "auth.gate.field.code": "Verification code";
+    readonly "auth.gate.field.email": "Email";
+    readonly "auth.gate.field.name": "Name";
+    readonly "auth.gate.field.password": "Password";
+    readonly "auth.gate.field.captcha": "reCAPTCHA token (account only)";
+    readonly "auth.gate.password.show": "Show password";
+    readonly "auth.gate.password.hide": "Hide password";
+    readonly "auth.gate.notice.codeResent": "A new code was sent.";
+    readonly "auth.gate.notice.codeSentVia": "Code sent via {method}.";
+    readonly "auth.gate.notice.resetSent": "If that email is registered, a reset link is on its way.";
+    readonly "auth.biometric.unlockWith": "Unlock with {method}";
+    readonly "auth.biometric.orPassword": "or sign in with your password";
+    readonly "auth.biometric.label.faceId": "Face ID";
+    readonly "auth.biometric.label.touchId": "Touch ID";
+    readonly "auth.biometric.label.faceUnlock": "Face Unlock";
+    readonly "auth.biometric.label.fingerprint": "Fingerprint";
+    readonly "auth.biometric.label.generic": "biometrics";
+    readonly "auth.biometric.prompt.usePassword": "Use password";
+    readonly "auth.biometric.error.unavailable": "Biometric unlock isn't available on this device.";
+    readonly "auth.biometric.error.cancelled": "Biometric unlock was cancelled.";
+    readonly "auth.biometric.error.notEnrolled": "No Face ID / Touch ID is enrolled.";
+    readonly "auth.biometric.error.failed": "Biometric unlock failed.";
+    readonly "auth.biometric.error.invalidated": "Biometrics changed; sign in again.";
+    readonly "auth.biometric.prompt.unlock": "Unlock your account";
+    readonly "auth.biometric.prompt.disable": "Confirm to turn off biometric unlock";
+    readonly "auth.biometric.enrollTitle": "Unlock with {method}?";
+    readonly "auth.biometric.enrollMessage": "Use {method} instead of your password the next time you open the app.";
+    readonly "auth.biometric.enrollAccept": "Use {method}";
+    readonly "auth.biometric.enrollDecline": "Not now";
+    readonly "auth.error.invalidCredentials": "Wrong email or password.";
+    readonly "auth.error.accountNotFound": "We couldn't find an account for that email.";
+    readonly "auth.error.emailInUse": "That email is already registered.";
+    readonly "auth.error.verificationRequired": "Additional verification is required.";
+    readonly "auth.error.verifyEmail": "Check your email to verify your account, then sign in.";
+    readonly "auth.error.incorrectCode": "Incorrect code.";
+    readonly "auth.error.network": "Network error.";
+    readonly "auth.error.visitorToken": "Could not obtain a visitor token.";
+    readonly "auth.error.noSessionToken": "Login succeeded but no session token.";
+    readonly "auth.error.authSession": "Could not create an auth session.";
+    readonly "auth.error.signInIncomplete": "Sign-in did not complete.";
+    readonly "auth.error.tokenExchange": "Token exchange failed.";
+    readonly "auth.error.noRedirect": "No auth redirect.";
+    readonly "auth.error.registrationFailed": "Registration failed ({code}).";
+    readonly "auth.error.twoFactorRequired": "Two-factor verification required.";
+    readonly "auth.error.noPendingVerification": "No pending verification.";
+    readonly "auth.error.verificationCancelled": "Verification cancelled.";
+    readonly "auth.error.biometricSignInFirst": "Sign in before enabling biometric unlock.";
+    readonly "auth.error.noSessionToProtect": "No session to protect.";
+    readonly "auth.error.biometricEnableFailed": "Couldn't enable biometric unlock.";
+    readonly "auth.error.biometricUnlockFailed": "Couldn't unlock. Sign in with your password.";
+    readonly "auth.error.biometricsUnavailable": "Biometrics unavailable.";
+    readonly "auth.error.noBiometricsEnrolled": "No biometrics enrolled.";
+    readonly "auth.error.biometricNotEnabled": "Biometric unlock not enabled.";
+    readonly "auth.error.unsupported": "Unsupported.";
+    readonly "auth.error.methodUnavailable": "This sign-in method isn't available.";
+    readonly "auth.error.verificationRequiredRetry": "Additional verification is required. Please try again.";
+    readonly "auth.error.networkRetry": "Network error. Please try again.";
+    readonly "auth.error.signInCancelled": "Sign-in was cancelled.";
+    readonly "auth.error.genericRetry": "Something went wrong. Please try again.";
+    readonly "auth.error.biometricLocked": "Locked: unlock with biometrics first.";
+    readonly "auth.error.googleNoPresenter": "No presenter for Google sign-in.";
+    readonly "auth.error.googleNoToken": "Google sign-in returned no id_token.";
+    readonly "auth.error.appleNoToken": "Apple sign-in returned no token.";
+    readonly "auth.error.memberSettingsUnreadable": "Could not read the site's member settings.";
+    readonly "auth.error.memberSettingsMalformed": "Member settings response was not a JSON object.";
+    readonly "auth.biometric.error.noCipher": "No cipher.";
+    readonly "auth.error.unlockOvertaken": "Unlock overtaken by a sign-in or sign-out.";
+    readonly "auth.gate.code.show": "Show code";
+    readonly "auth.gate.code.hide": "Hide code";
+    readonly "auth.feedback.invalid_input": "Check the highlighted fields and try again.";
+    readonly "auth.feedback.invalid_credentials": "The email or password is incorrect. Check your details or reset your password.";
+    readonly "auth.feedback.registration_failed": "We could not create an account. Check your details, or try signing in or resetting your password.";
+    readonly "auth.feedback.invalid_code": "That code is invalid or has expired. Check the code or request a new one.";
+    readonly "auth.feedback.expired_code": "That code has expired. Request a new code and try again.";
+    readonly "auth.feedback.totp": "That code did not work. Enter the current code from your authenticator app.";
+    readonly "auth.feedback.network": "We could not connect. Check your connection and try again.";
+    readonly "auth.feedback.rate_limited": "Too many attempts. Wait a few minutes and try again.";
+    readonly "auth.feedback.unavailable": "This action is not available here. Use a supported sign-in method or open the app.";
+    readonly "auth.feedback.cancelled": "Sign-in was cancelled. Try again when you are ready.";
+    readonly "auth.feedback.verification_required": "Complete verification to continue, then try again.";
+    readonly "auth.feedback.unknown": "We could not complete this action. Please try again.";
+    readonly "auth.validation.emailRequired": "Enter your email address.";
+    readonly "auth.validation.emailInvalid": "Enter a valid email address.";
+    readonly "auth.validation.passwordMinimum": "Use at least 8 characters for your new password.";
+    readonly "auth.validation.passwordRequired": "Enter your password.";
+    readonly "auth.validation.codeRequired": "Enter your verification code.";
+    readonly "auth.validation.nameRequired": "Enter your name.";
+    readonly "auth.feedback.busy": "Please wait…";
+    readonly "auth.gate.verify.title": "Verify your email";
+    readonly "auth.gate.verify.body": "Enter the confirmation code sent to your email to finish signing in.";
+    readonly "auth.gate.cancel": "Cancel";
+    readonly "auth.gate.codePlaceholder": "Confirmation code";
+};
+export default _default;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/flows/auth/src/feedback.d.ts

@@ -0,0 +1,15 @@
+export type AuthFailureCode = "invalid_input" | "invalid_credentials" | "registration_failed" | "invalid_code" | "expired_code" | "network" | "rate_limited" | "unavailable" | "cancelled" | "verification_required" | "unknown";
+export type AuthOperation = "signIn" | "register" | "reset" | "verify";
+export declare function authMessage(key: string, translate?: (key: string) => string | undefined): string;
+/** Only structured failure identities cross into UI copy. Never echo server/error text. */
+export declare function authFailure(raw: unknown, operation?: AuthOperation, translate?: (key: string) => string | undefined): {
+    code: AuthFailureCode;
+    reason: string;
+};
+/** Shared predicates; credentials are never normalized like an email. */
+export declare function identityErrors(input: {
+    email?: string;
+    password?: string;
+    code?: string;
+    name?: string;
+}, operation: AuthOperation, requireName?: boolean): Record<string, string>;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/flows/auth/src/index.d.ts

@@ -1,3 +1,5 @@
+import { type AuthFailureCode } from "./feedback.js";
+export * from "./feedback.js";
 /** Action-id prefix the host registered the Wix auth actions under. Matches
  *  `WixConsumerAuthActions.register(actionIdPrefix:)` — default `himi.wix`. */
 export declare const DEFAULT_AUTH_PREFIX = "himi.wix";
@@ -12,6 +14,7 @@ export type AuthResult = {
 } | {
     ok: false;
     reason: string;
+    code?: AuthFailureCode;
 };
 /** Who the session belongs to right now. `signedIn` is false for a visitor. */
 export interface AuthState {

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/flows/screens/src/index.d.ts

@@ -1,4 +1,48 @@
 import { entitlement } from "@wix/himalaya/checkout";
+type Node = Record<string, any>;
+/** An action shown by `detailedHeader`. */
+export interface DetailedHeaderAction {
+    label: string;
+    action: Node;
+    style?: "primary" | "secondary" | "plain";
+}
+/** Options for the shared One App-style detailed header composition. */
+export interface DetailedHeaderOptions {
+    /** Prefix for stable SDUI node IDs. Use a unique value for each header. */
+    id?: string;
+    /** Page nodes that scroll beneath the hero and detail card. */
+    content?: Node[];
+    /** Cover image selected by the migration from the source cover list. */
+    imageUrl?: string;
+    title: string;
+    subtitle?: string;
+    logoUrl?: string;
+    locationLabel?: string;
+    locationAction?: DetailedHeaderAction;
+    memberCaption?: string;
+    memberAvatars?: Array<{
+        imageUrl?: string;
+        initials?: string;
+    }>;
+    /** Live member rows from a service. This takes precedence over `memberAvatars`. */
+    memberAvatarsPath?: string;
+    inviteAction?: DetailedHeaderAction;
+    primaryAction?: DetailedHeaderAction;
+    aboutAction?: DetailedHeaderAction;
+    /** Keep the hero at one height when the source header is not collapsible. */
+    collapsible?: boolean;
+    expandedHeight?: number;
+    collapsedHeight?: number;
+}
+/**
+ * Build the shared Detailed header used by One App migrations.
+ *
+ * The header uses Himalaya's cross-platform `CollapsingHeader` and standard
+ * components for the detail card, logo, member strip, and actions. A migration
+ * calls this builder instead of copying header layout into each app. Himalaya's
+ * hero accepts one image, so pass the first source cover image here.
+ */
+export declare function detailedHeader(opts: DetailedHeaderOptions): Node;
 export interface ScreenEnvelope {
     screenId: string;
     renderer: string;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/auth.mjs

@@ -1,3 +1,290 @@
+// ../../core/ts/src/validation.ts
+var EMAIL_RE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/;
+var URL_HOST_RE = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(:[0-9]+)?$/;
+var INTEGER_RE = /^[+-]?[0-9]+$/;
+var NUMBER_RE = /^[+-]?([0-9]+(\.[0-9]+)?|\.[0-9]+)$/;
+function isEmail(value) {
+  if (!EMAIL_RE.test(value)) return false;
+  if (value.includes("..")) return false;
+  const local = value.slice(0, value.indexOf("@"));
+  return !local.startsWith(".") && !local.endsWith(".");
+}
+function isPhone(value) {
+  let s = "";
+  for (const ch of value) {
+    if (" -().\xA0	".includes(ch)) continue;
+    s += ch;
+  }
+  if (s.startsWith("+")) s = s.slice(1);
+  if (s.length < 7 || s.length > 15) return false;
+  for (const ch of s) if (ch < "0" || ch > "9") return false;
+  return true;
+}
+function isUrl(value) {
+  if (/\s/.test(value)) return false;
+  let rest = value;
+  const lower = value.toLowerCase();
+  if (lower.startsWith("http://")) rest = value.slice(7);
+  else if (lower.startsWith("https://")) rest = value.slice(8);
+  else if (value.includes("://")) return false;
+  if (rest.length === 0) return false;
+  let end = rest.length;
+  for (let i = 0; i < rest.length; i++) {
+    const c = rest[i];
+    if (c === "/" || c === "?" || c === "#") {
+      end = i;
+      break;
+    }
+  }
+  const hostPort = rest.slice(0, end);
+  if (!URL_HOST_RE.test(hostPort)) return false;
+  const host = hostPort.split(":")[0];
+  if (host === "localhost") return true;
+  const dot = host.lastIndexOf(".");
+  if (dot < 1) return false;
+  const tld = host.slice(dot + 1);
+  if (tld.length < 2) return false;
+  for (const ch of tld) {
+    const isAlpha = ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z";
+    if (!isAlpha) return false;
+  }
+  return true;
+}
+function parseNumeric(value) {
+  if (!NUMBER_RE.test(value)) return null;
+  const n = Number(value);
+  return Number.isFinite(n) ? n : null;
+}
+function matchesType(type, value) {
+  switch (type) {
+    case "email":
+      return isEmail(value);
+    case "phone":
+      return isPhone(value);
+    case "url":
+      return isUrl(value);
+    case "number":
+      return NUMBER_RE.test(value);
+    case "integer":
+      return INTEGER_RE.test(value);
+    // Additive decoding: an unknown type is NOT a failure. A renderer that has
+    // not shipped a new type yet must let the value through rather than block a
+    // form it cannot understand — the server still re-validates on submit.
+    default:
+      return true;
+  }
+}
+function validate(rule, rawValue) {
+  if (!rule) return null;
+  const value = rawValue ?? "";
+  if (value.length === 0) {
+    return rule.required === true ? { rule: "required" } : null;
+  }
+  if (rule.type && !matchesType(rule.type, value)) {
+    return { rule: "type", type: rule.type };
+  }
+  if (rule.regex) {
+    let ok;
+    try {
+      ok = new RegExp(`^(?:${rule.regex})$`).test(value);
+    } catch {
+      ok = true;
+    }
+    if (!ok) return { rule: "regex" };
+  }
+  if (typeof rule.minLength === "number" && rule.minLength > 0 && value.length < rule.minLength) {
+    return { rule: "minLength", limit: rule.minLength };
+  }
+  if (typeof rule.maxLength === "number" && rule.maxLength > 0 && value.length > rule.maxLength) {
+    return { rule: "maxLength", limit: rule.maxLength };
+  }
+  if (typeof rule.minValue === "number" || typeof rule.maxValue === "number") {
+    const n = parseNumeric(value);
+    if (n !== null) {
+      if (typeof rule.minValue === "number" && n < rule.minValue) {
+        return { rule: "minValue", limit: rule.minValue };
+      }
+      if (typeof rule.maxValue === "number" && n > rule.maxValue) {
+        return { rule: "maxValue", limit: rule.maxValue };
+      }
+    }
+  }
+  return null;
+}
+
+// ../../stdlib/flows/auth/src/copy.generated.ts
+var copy_generated_default = {
+  "auth.gate.title": "Welcome",
+  "auth.gate.subtitle": "Sign in to continue",
+  "auth.gate.signIn": "Sign In",
+  "auth.gate.createAccount": "Create account",
+  "auth.gate.resetPassword": "Reset password",
+  "auth.gate.verifyTitle": "Verify it's you",
+  "auth.gate.sendResetLink": "Send reset link",
+  "auth.gate.verify": "Verify",
+  "auth.gate.continue": "Continue",
+  "auth.gate.forgotPassword": "Forgot password?",
+  "auth.gate.backToSignIn": "Back to sign in",
+  "auth.gate.continueWith": "Continue with {provider}",
+  "auth.gate.sendCodeVia": "Send code via",
+  "auth.gate.resendCode": "Didn't get it? Resend code",
+  "auth.gate.field.code": "Verification code",
+  "auth.gate.field.email": "Email",
+  "auth.gate.field.name": "Name",
+  "auth.gate.field.password": "Password",
+  "auth.gate.field.captcha": "reCAPTCHA token (account only)",
+  "auth.gate.password.show": "Show password",
+  "auth.gate.password.hide": "Hide password",
+  "auth.gate.notice.codeResent": "A new code was sent.",
+  "auth.gate.notice.codeSentVia": "Code sent via {method}.",
+  "auth.gate.notice.resetSent": "If that email is registered, a reset link is on its way.",
+  "auth.biometric.unlockWith": "Unlock with {method}",
+  "auth.biometric.orPassword": "or sign in with your password",
+  "auth.biometric.label.faceId": "Face ID",
+  "auth.biometric.label.touchId": "Touch ID",
+  "auth.biometric.label.faceUnlock": "Face Unlock",
+  "auth.biometric.label.fingerprint": "Fingerprint",
+  "auth.biometric.label.generic": "biometrics",
+  "auth.biometric.prompt.usePassword": "Use password",
+  "auth.biometric.error.unavailable": "Biometric unlock isn't available on this device.",
+  "auth.biometric.error.cancelled": "Biometric unlock was cancelled.",
+  "auth.biometric.error.notEnrolled": "No Face ID / Touch ID is enrolled.",
+  "auth.biometric.error.failed": "Biometric unlock failed.",
+  "auth.biometric.error.invalidated": "Biometrics changed; sign in again.",
+  "auth.biometric.prompt.unlock": "Unlock your account",
+  "auth.biometric.prompt.disable": "Confirm to turn off biometric unlock",
+  "auth.biometric.enrollTitle": "Unlock with {method}?",
+  "auth.biometric.enrollMessage": "Use {method} instead of your password the next time you open the app.",
+  "auth.biometric.enrollAccept": "Use {method}",
+  "auth.biometric.enrollDecline": "Not now",
+  "auth.error.invalidCredentials": "Wrong email or password.",
+  "auth.error.accountNotFound": "We couldn't find an account for that email.",
+  "auth.error.emailInUse": "That email is already registered.",
+  "auth.error.verificationRequired": "Additional verification is required.",
+  "auth.error.verifyEmail": "Check your email to verify your account, then sign in.",
+  "auth.error.incorrectCode": "Incorrect code.",
+  "auth.error.network": "Network error.",
+  "auth.error.visitorToken": "Could not obtain a visitor token.",
+  "auth.error.noSessionToken": "Login succeeded but no session token.",
+  "auth.error.authSession": "Could not create an auth session.",
+  "auth.error.signInIncomplete": "Sign-in did not complete.",
+  "auth.error.tokenExchange": "Token exchange failed.",
+  "auth.error.noRedirect": "No auth redirect.",
+  "auth.error.registrationFailed": "Registration failed ({code}).",
+  "auth.error.twoFactorRequired": "Two-factor verification required.",
+  "auth.error.noPendingVerification": "No pending verification.",
+  "auth.error.verificationCancelled": "Verification cancelled.",
+  "auth.error.biometricSignInFirst": "Sign in before enabling biometric unlock.",
+  "auth.error.noSessionToProtect": "No session to protect.",
+  "auth.error.biometricEnableFailed": "Couldn't enable biometric unlock.",
+  "auth.error.biometricUnlockFailed": "Couldn't unlock. Sign in with your password.",
+  "auth.error.biometricsUnavailable": "Biometrics unavailable.",
+  "auth.error.noBiometricsEnrolled": "No biometrics enrolled.",
+  "auth.error.biometricNotEnabled": "Biometric unlock not enabled.",
+  "auth.error.unsupported": "Unsupported.",
+  "auth.error.methodUnavailable": "This sign-in method isn't available.",
+  "auth.error.verificationRequiredRetry": "Additional verification is required. Please try again.",
+  "auth.error.networkRetry": "Network error. Please try again.",
+  "auth.error.signInCancelled": "Sign-in was cancelled.",
+  "auth.error.genericRetry": "Something went wrong. Please try again.",
+  "auth.error.biometricLocked": "Locked: unlock with biometrics first.",
+  "auth.error.googleNoPresenter": "No presenter for Google sign-in.",
+  "auth.error.googleNoToken": "Google sign-in returned no id_token.",
+  "auth.error.appleNoToken": "Apple sign-in returned no token.",
+  "auth.error.memberSettingsUnreadable": "Could not read the site's member settings.",
+  "auth.error.memberSettingsMalformed": "Member settings response was not a JSON object.",
+  "auth.biometric.error.noCipher": "No cipher.",
+  "auth.error.unlockOvertaken": "Unlock overtaken by a sign-in or sign-out.",
+  "auth.gate.code.show": "Show code",
+  "auth.gate.code.hide": "Hide code",
+  "auth.feedback.invalid_input": "Check the highlighted fields and try again.",
+  "auth.feedback.invalid_credentials": "The email or password is incorrect. Check your details or reset your password.",
+  "auth.feedback.registration_failed": "We could not create an account. Check your details, or try signing in or resetting your password.",
+  "auth.feedback.invalid_code": "That code is invalid or has expired. Check the code or request a new one.",
+  "auth.feedback.expired_code": "That code has expired. Request a new code and try again.",
+  "auth.feedback.totp": "That code did not work. Enter the current code from your authenticator app.",
+  "auth.feedback.network": "We could not connect. Check your connection and try again.",
+  "auth.feedback.rate_limited": "Too many attempts. Wait a few minutes and try again.",
+  "auth.feedback.unavailable": "This action is not available here. Use a supported sign-in method or open the app.",
+  "auth.feedback.cancelled": "Sign-in was cancelled. Try again when you are ready.",
+  "auth.feedback.verification_required": "Complete verification to continue, then try again.",
+  "auth.feedback.unknown": "We could not complete this action. Please try again.",
+  "auth.validation.emailRequired": "Enter your email address.",
+  "auth.validation.emailInvalid": "Enter a valid email address.",
+  "auth.validation.passwordMinimum": "Use at least 8 characters for your new password.",
+  "auth.validation.passwordRequired": "Enter your password.",
+  "auth.validation.codeRequired": "Enter your verification code.",
+  "auth.validation.nameRequired": "Enter your name.",
+  "auth.feedback.busy": "Please wait\u2026",
+  "auth.gate.verify.title": "Verify your email",
+  "auth.gate.verify.body": "Enter the confirmation code sent to your email to finish signing in.",
+  "auth.gate.cancel": "Cancel",
+  "auth.gate.codePlaceholder": "Confirmation code"
+};
+
+// ../../stdlib/flows/auth/src/feedback.ts
+var failureKeys = {
+  invalid_input: "auth.feedback.invalid_input",
+  invalid_credentials: "auth.feedback.invalid_credentials",
+  registration_failed: "auth.feedback.registration_failed",
+  invalid_code: "auth.feedback.invalid_code",
+  expired_code: "auth.feedback.expired_code",
+  network: "auth.feedback.network",
+  rate_limited: "auth.feedback.rate_limited",
+  unavailable: "auth.feedback.unavailable",
+  cancelled: "auth.feedback.cancelled",
+  verification_required: "auth.feedback.verification_required",
+  unknown: "auth.feedback.unknown"
+};
+var codes = new Set(Object.keys(failureKeys));
+var aliases = {
+  invalidCredentials: "invalid_credentials",
+  emailInUse: "registration_failed",
+  unsupported: "unavailable",
+  recaptchaRequired: "verification_required",
+  needsTwoFactor: "verification_required",
+  INVALID_CREDENTIALS: "invalid_credentials",
+  EMAIL_IN_USE: "registration_failed",
+  UNSUPPORTED: "unavailable",
+  NETWORK: "network",
+  CANCELLED: "cancelled",
+  RECAPTCHA_REQUIRED: "verification_required",
+  INVALID_CODE: "invalid_code",
+  EXPIRED_CODE: "expired_code",
+  TOO_MANY_REQUESTS: "rate_limited"
+};
+function authMessage(key, translate) {
+  const translated = translate?.(key);
+  return translated && translated !== key ? translated : copy_generated_default[key] ?? copy_generated_default["auth.feedback.unknown"];
+}
+function authFailure(raw, operation = "signIn", translate) {
+  const value = raw && typeof raw === "object" ? raw : {};
+  const payload = value.payload && typeof value.payload === "object" ? value.payload : value;
+  const named = payload.code ?? value.code ?? value.kind;
+  const status = value.statusCode ?? value.status;
+  let code = codes.has(named) ? named : aliases[named] ?? "unknown";
+  if (status === 429) code = "rate_limited";
+  else if ([404, 405, 501].includes(status)) code = "unavailable";
+  else if ([401, 403].includes(status) && operation === "signIn") code = "invalid_credentials";
+  else if (status === 0 || status >= 500 || value.name === "TypeError" || value.name === "TimeoutError") code = "network";
+  if (operation === "verify" && code === "invalid_credentials") code = "invalid_code";
+  if (operation === "register" && code === "invalid_credentials") code = "registration_failed";
+  return { code, reason: authMessage(failureKeys[code], translate) };
+}
+function identityErrors(input, operation, requireName = false) {
+  const errors = {};
+  if (operation === "verify") {
+    if (!input.code?.trim()) errors.code = "auth.validation.codeRequired";
+    return errors;
+  }
+  const email = input.email?.trim() ?? "";
+  if (!email) errors.email = "auth.validation.emailRequired";
+  else if (validate({ type: "email" }, email)) errors.email = "auth.validation.emailInvalid";
+  if ((operation === "signIn" || operation === "register") && !input.password?.length) errors.password = "auth.validation.passwordRequired";
+  if (operation === "register" && requireName && !input.name?.trim()) errors.name = "auth.validation.nameRequired";
+  return errors;
+}
+
 // ../../stdlib/flows/auth/src/index.ts
 async function dispatch(handlerId, params) {
   const fn = globalThis.himalaya?.dispatch;
@@ -12,12 +299,6 @@ function emailOf(raw) {
   const email = direct?.email ?? wrapped?.payload?.email;
   return typeof email === "string" ? email : "";
 }
-function reasonOf(raw, fallback) {
-  const direct = raw;
-  const wrapped = raw;
-  const err = direct?.error ?? wrapped?.payload?.error;
-  return typeof err === "string" && err ? err : fallback;
-}
 function reportedOk(raw) {
   const status = raw?.status;
   if (typeof status !== "string") return true;
@@ -41,9 +322,9 @@ async function attempt(action, params, failureText, opts) {
   try {
     raw = await dispatch(id(opts, action), params);
   } catch (e) {
-    return { ok: false, reason: e?.message || failureText };
+    return { ok: false, ...authFailure(e, action === "registerDirect" ? "register" : "signIn") };
   }
-  if (!reportedOk(raw)) return { ok: false, reason: reasonOf(raw, failureText) };
+  if (!reportedOk(raw) || raw?.error || raw?.payload?.error) return { ok: false, ...authFailure(raw, action === "registerDirect" ? "register" : "signIn") };
   const state = await authState(opts);
   if (!state.signedIn) {
     return { ok: false, reason: failureText };
@@ -51,12 +332,12 @@ async function attempt(action, params, failureText, opts) {
   return { ok: true, email: state.email };
 }
 function signInDirect(email, password, opts) {
-  if (!email || !password) {
-    return Promise.resolve({ ok: false, reason: "Enter your email and password." });
+  if (Object.keys(identityErrors({ email: email.trim(), password }, "signIn")).length) {
+    return Promise.resolve({ ok: false, code: "invalid_input", reason: authMessage("auth.feedback.invalid_input") });
   }
   return attempt(
     "signInDirect",
-    { email, password },
+    { email: email.trim(), password },
     "Sign-in did not complete. Please try again.",
     opts
   );
@@ -65,13 +346,13 @@ function signIn(opts) {
   return attempt("signIn", {}, "Sign-in did not complete. Please try again.", opts);
 }
 function registerMember(email, password, profile, opts) {
-  if (!email || !password) {
-    return Promise.resolve({ ok: false, reason: "Enter your email and password." });
+  if (Object.keys(identityErrors({ email: email.trim(), password }, "register")).length) {
+    return Promise.resolve({ ok: false, code: "invalid_input", reason: authMessage("auth.feedback.invalid_input") });
   }
   return attempt(
     "registerDirect",
     {
-      email,
+      email: email.trim(),
       password,
       ...profile?.firstName ? { firstName: profile.firstName } : {},
       ...profile?.lastName ? { lastName: profile.lastName } : {}
@@ -81,15 +362,17 @@ function registerMember(email, password, profile, opts) {
   );
 }
 async function resetPassword(email, opts) {
-  if (!email) return { ok: false, reason: "Enter your email." };
+  const errors = identityErrors({ email }, "reset");
+  if (errors.email) return { ok: false, code: "invalid_input", reason: authMessage(errors.email) };
+  email = email.trim();
   try {
     const raw = await dispatch(id(opts, "resetPassword"), { email });
-    if (!reportedOk(raw)) {
-      return { ok: false, reason: reasonOf(raw, "We could not send the reset email.") };
+    if (!reportedOk(raw) || raw?.error || raw?.payload?.error) {
+      return { ok: false, ...authFailure(raw, "reset") };
     }
     return { ok: true, email };
   } catch (e) {
-    return { ok: false, reason: e?.message || "We could not send the reset email." };
+    return { ok: false, ...authFailure(e, "reset") };
   }
 }
 async function signOut(opts) {
@@ -101,7 +384,10 @@ async function signOut(opts) {
 }
 export {
   DEFAULT_AUTH_PREFIX,
+  authFailure,
+  authMessage,
   authState,
+  identityErrors,
   registerMember,
   resetPassword,
   signIn,