@wix/himalaya-cli 0.1399.0 → 0.1401.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/sdk/sdk-types/src/capabilities.generated.d.ts

@@ -39,9 +39,10 @@ export declare const CAPABILITY_REGISTRY: {
     readonly theme: readonly ["applyOverlay", "clearOverlay", "surfaces"];
     readonly ui: readonly ["alert", "snackbar"];
     readonly wix_cashier: readonly ["isAvailable", "proceedToPayment"];
+    readonly wix_chat: readonly ["getRealtimeStatus", "subscribeRealtime", "unsubscribeRealtime"];
 };
 /** A capability id backed by an @himalaya/* SDK binding. */
-export type SdkCapability = "app_info" | "audio_record" | "base44" | "biometrics" | "browser_auth" | "calendar" | "calls" | "camera" | "clipboard" | "contacts" | "file_picker" | "files" | "godot" | "haptic" | "health" | "himi_apps" | "iap" | "keyboard" | "live_activity" | "local_database" | "location" | "media_playback" | "motion" | "on_device_ai" | "open_url" | "pdf" | "photos" | "presigned_upload" | "push" | "release_control" | "secure_storage" | "share" | "speaker_diarization" | "speech" | "system_intents" | "tasks" | "theme" | "ui" | "wix_cashier";
+export type SdkCapability = "app_info" | "audio_record" | "base44" | "biometrics" | "browser_auth" | "calendar" | "calls" | "camera" | "clipboard" | "contacts" | "file_picker" | "files" | "godot" | "haptic" | "health" | "himi_apps" | "iap" | "keyboard" | "live_activity" | "local_database" | "location" | "media_playback" | "motion" | "on_device_ai" | "open_url" | "pdf" | "photos" | "presigned_upload" | "push" | "release_control" | "secure_storage" | "share" | "speaker_diarization" | "speech" | "system_intents" | "tasks" | "theme" | "ui" | "wix_cashier" | "wix_chat";
 /** All `capability.<id>.<verb>` action ids, flattened (the worker-bridge wire vocabulary). */
 export declare const CAPABILITY_ACTION_IDS: readonly string[];
 /** Capability id → the @himalaya/* package(s) a worker imports to reach it — every dispatch

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/sdk/webview-page/src/capabilities.generated.d.ts

@@ -37,6 +37,7 @@ import type * as TasksSdk from "@wix/himalaya/tasks";
 import type * as ThemeSdk from "@wix/himalaya/theme";
 import type * as UiSdk from "@wix/himalaya/ui";
 import type * as WixCashierSdk from "@wix/himalaya/wix-cashier";
+import type * as WixChatSdk from "@wix/himalaya/wix-chat";
 type PageModule<T> = {
     readonly [P in keyof T as T[P] extends (...args: any[]) => any ? P : T[P] extends readonly unknown[] ? never : T[P] extends object ? keyof PageModule<T[P]> extends never ? never : P : never]: T[P] extends (...args: infer A) => infer R ? (...args: A) => R : T[P] extends readonly unknown[] ? never : T[P] extends object ? PageModule<T[P]> : never;
 };
@@ -83,6 +84,7 @@ export interface HimalayaPageCapabilities {
     readonly "theme": PageModule<typeof ThemeSdk>;
     readonly "ui": PageModule<typeof UiSdk>;
     readonly "wix_cashier": PageModule<typeof WixCashierSdk>;
+    readonly "wix_chat": PageModule<typeof WixChatSdk>;
 }
 export type HimalayaPageSdk = HimalayaPageCapabilities & {
     readonly version: 1;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/sdk/wix-chat/src/index.d.ts

@@ -0,0 +1,33 @@
+export type RealtimeState = "connected" | "connecting" | "reconnecting" | "disconnected" | "error" | "unavailable";
+export type RealtimeReason = "chat_setup_scope_unavailable" | "runtime_unavailable" | "invalid_setup_response" | "firebase_auth_failed" | "firebase_connection_failed" | "invalid_event" | "event_overflow";
+export interface RealtimeStatus {
+    state: RealtimeState;
+    reason?: RealtimeReason;
+}
+export interface RealtimeSubscription extends RealtimeStatus {
+    subscriptionId: string;
+}
+export interface RealtimeEventEnvelope {
+    /** A normalized Wix Chat server event from Firebase. */
+    event: Record<string, unknown>;
+    /** Firebase server timestamp sampled when the subscription was established. */
+    connectionEstablishedTimestamp: number;
+}
+/** Subscribe this worker to Wix Chat realtime events. Reducers receive one
+ *  {@link RealtimeEventEnvelope}; status reducers receive {@link RealtimeStatus}.
+ *  A new subscription replaces the worker's prior subscription, and worker disposal
+ *  always closes the host stream. The returned identifier is opaque and worker-local. */
+export declare function subscribeRealtime(opts: {
+    onEvent: string;
+    onStatus?: string;
+}): Promise<RealtimeSubscription>;
+/** Stop this worker's subscription. Returns `ok: false` for an unknown or stale ID. */
+export declare function unsubscribeRealtime(opts: {
+    subscriptionId: string;
+}): Promise<{
+    ok: boolean;
+}>;
+/** Read the latest host connection status for a worker-local subscription ID. */
+export declare function getRealtimeStatus(opts: {
+    subscriptionId: string;
+}): Promise<RealtimeStatus>;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/define-app.d.ts

@@ -515,6 +515,13 @@ export interface NotificationCategoryAction {
     /** When true the action opens a text input (reply-style). */
     input?: boolean;
     inputPlaceholder?: string;
+    /** When true a press on a LOCKED device asks for unlock (Face ID / passcode / PIN)
+     *  before it reaches `observerAction` — set it on any action that writes (accept,
+     *  decline, delete). iOS `UNNotificationActionOptions.authenticationRequired`;
+     *  Android `setAuthenticationRequired` (API 31+). Android 8–11 (API 26–30) has no
+     *  per-action gate, so it fails CLOSED there: the flagged button is omitted, while the
+     *  notification and its tap-to-open stay. */
+    authenticationRequired?: boolean;
 }
 /** A notification category — a named set of action buttons. */
 export interface NotificationCategory {
@@ -747,7 +754,7 @@ export interface OrientationEnvelope {
 export declare const DEFAULT_ORIENTATION_ENVELOPE: Required<OrientationEnvelope>;
 /** Fill in the absent families. Total, so callers never branch on `undefined`. */
 export declare function resolveOrientationEnvelope(env?: OrientationEnvelope): Required<OrientationEnvelope>;
-export type Capability = "camera" | "barcode_scanner" | "biometrics" | "secure_storage" | "share" | "push" | "file_picker" | "files" | "open_url" | "pdf" | "clipboard" | "theme" | "photos" | "presigned_upload" | "ui" | "calendar" | "contacts" | "tasks" | "audio_record" | "audio_record_background" | "calls" | "location" | "location_background" | "motion" | "health" | "media_playback" | "webview" | "browser_auth" | "haptic" | "himi_apps" | "iap" | "keyboard" | "wix_cashier" | "live_activity" | "local_database" | "speech" | "speaker_diarization" | "system_intents" | "on_device_ai" | "app_info" | "release_control" | "godot" | "base44" | "animation";
+export type Capability = "camera" | "barcode_scanner" | "biometrics" | "secure_storage" | "share" | "push" | "file_picker" | "files" | "open_url" | "pdf" | "clipboard" | "theme" | "photos" | "presigned_upload" | "ui" | "calendar" | "contacts" | "tasks" | "audio_record" | "audio_record_background" | "calls" | "location" | "location_background" | "motion" | "health" | "media_playback" | "webview" | "browser_auth" | "haptic" | "himi_apps" | "iap" | "keyboard" | "wix_cashier" | "wix_chat" | "live_activity" | "local_database" | "speech" | "speaker_diarization" | "system_intents" | "on_device_ai" | "app_info" | "release_control" | "godot" | "base44" | "animation";
 /** `defineApp({ wixIap })` — the purchases-service app a build binds this app to. */
 export interface WixIapConfig {
     /** The purchases service's app UUID, registered on the app's own auth site. Not a secret. */

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/auth-providers/wix/src/auth-modalities.d.ts

@@ -7,6 +7,8 @@ export declare function classifyAuthErrorCode(code: number): {
 export type PushApprovalState = "approved" | "pending" | "denied" | "expired";
 export interface AuthModalitiesConfig {
     baseURL?: string;
+    /** Host of the Verification v1 API the push-approval poll reads (#4309). */
+    verificationBaseURL?: string;
     fetchImpl?: typeof fetch;
     now?: () => number;
     sleep?: (ms: number) => Promise<void>;
@@ -14,6 +16,7 @@ export interface AuthModalitiesConfig {
 }
 export declare class WixAuthModalities {
     private readonly baseURL;
+    private readonly verificationBaseURL;
     private readonly fetchImpl;
     private readonly sleep;
     private readonly devMode;
@@ -26,8 +29,16 @@ export declare class WixAuthModalities {
     /** Complete a magic-link login from the token in the opened link. */
     verifyMagicLink(token: string): Promise<WixAccountSession>;
     /** Push-based 2FA: poll for the user's approval on their trusted device. Loops
-     *  until approved/denied/expired or `maxPolls` is hit. */
-    pollPushApproval(twoFAToken: string, opts?: {
+     *  until approved/denied/expired or `maxPolls` is hit (default 60 × 5s = 5 minutes).
+     *
+     *  #4309 — the wire Wix's own native client uses (mobile-native-core LegacyTwoFactor), and
+     *  the one the native WixNativeAuthEngine polls: Verification v1 GetChallenge,
+     *  `GET manage.wix.com/_api/verification-web/v1/challenges/get-challenge?verificationId=…`,
+     *  keyed by the 2FA payload's `verificationId` (digits; `NativeAuthError.verificationId` on the
+     *  needsTwoFactor challenge — not its `twoFAToken`). After "approved" the caller completes
+     *  the login with ONE `/auth/m/verifycodeandlogin` carrying an empty code. The old
+     *  `/auth/m/push2fa/status` route was never Wix's. */
+    pollPushApproval(verificationId: string, opts?: {
         intervalMs?: number;
         maxPolls?: number;
     }): Promise<PushApprovalState>;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/auth-providers/wix/src/index.d.ts

@@ -91,8 +91,18 @@ export interface WixNativeAuthConfig {
     /** App URL scheme registered in the client's allowed redirect URIs — used by
      *  the (no-UI) sessionToken → member-token PKCE exchange. */
     redirectUri?: string;
-    /** Federated providers to surface on the form. */
+    /** Federated providers to surface on the form. The app shows only the ones that can run on
+     *  the platform (#4309): Apple on iOS, Google once its module is linked and `google` names a
+     *  client id. */
     social?: SocialAuthProvider[];
+    /** Google OAuth client ids for "Continue with Google" (#4309). iOS registers `iosClientId`
+     *  (with its reversed-id URL scheme in Info.plist); Android asks Credential Manager for a token
+     *  for `serverClientId`, the WEB client Wix's `/oneapp/social/sign-in/google` accepts. Absent →
+     *  the Google button is hidden on that platform. Baked into auth.json. */
+    google?: {
+        iosClientId?: string;
+        serverClientId?: string;
+    };
     /** Override the Wix API host (staging). Default: https://www.wixapis.com. */
     apiBase?: string;
     /** PerimeterX automation token — one-app `x-px-access-token` captcha bypass for

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/auth-providers/wix/src/native-engine.d.ts

@@ -27,9 +27,15 @@ export declare class NativeAuthError extends Error {
     readonly twoFAMethod?: string;
     /** Every enabled 2FA method (drives the picker when >1). */
     readonly twoFAMethods?: string[];
+    /** #4309 — the push challenge's id (digits), when the payload carried one: what
+     *  `WixAuthModalities.pollPushApproval` polls. */
+    readonly verificationId?: string;
     constructor(kind: NativeAuthErrorKind, message: string, twoFAToken?: string, twoFAMethod?: string, 
     /** Every enabled 2FA method (drives the picker when >1). */
-    twoFAMethods?: string[]);
+    twoFAMethods?: string[], 
+    /** #4309 — the push challenge's id (digits), when the payload carried one: what
+     *  `WixAuthModalities.pollPushApproval` polls. */
+    verificationId?: string);
 }
 export interface WixNativeAuthEngineConfig {
     baseURL?: string;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/flows/auth/src/copy.generated.d.ts

@@ -14,6 +14,8 @@ declare const _default: {
     readonly "auth.gate.sendCodeVia": "Send code via";
     readonly "auth.gate.resendCode": "Didn't get it? Resend code";
     readonly "auth.gate.field.code": "Verification code";
+    readonly "auth.gate.pushWaiting": "Approve the sign-in on your other device.";
+    readonly "auth.gate.pushResend": "Send a new request";
     readonly "auth.gate.field.email": "Email";
     readonly "auth.gate.field.name": "Name";
     readonly "auth.gate.field.password": "Password";
@@ -58,6 +60,9 @@ declare const _default: {
     readonly "auth.error.registrationFailed": "Registration failed ({code}).";
     readonly "auth.error.twoFactorRequired": "Two-factor verification required.";
     readonly "auth.error.noPendingVerification": "No pending verification.";
+    readonly "auth.error.pushDeclined": "The sign-in was declined on your other device.";
+    readonly "auth.error.pushExpired": "The approval request expired. Send a new one or choose another method.";
+    readonly "auth.error.pushUnavailable": "Push approval isn't available. Choose another method.";
     readonly "auth.error.verificationCancelled": "Verification cancelled.";
     readonly "auth.error.biometricSignInFirst": "Sign in before enabling biometric unlock.";
     readonly "auth.error.noSessionToProtect": "No session to protect.";

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/wix-sdk/members-v1/src/index.d.ts

@@ -67,11 +67,77 @@ export interface WixQueryMembersResponse {
 export interface WixGetMemberResponse {
     member: WixMember;
 }
+export interface WixGetMyMemberResponse {
+    member: WixMember;
+}
+export interface WixUpdateMemberRequest {
+    member: Partial<WixMember>;
+}
+export interface WixUpdateMemberResponse {
+    member: WixMember;
+}
+export interface WixDeleteMemberPhonesResponse {
+    member?: WixMember;
+}
+export interface WixListCurrentMemberBlockingRequest {
+    cursorPaging?: {
+        limit?: number;
+        cursor?: string;
+    };
+}
+export interface WixListCurrentMemberBlockingResponse {
+    blockedMemberIds?: string[];
+    pagingMetadata?: {
+        cursors?: {
+            next?: string;
+            prev?: string;
+        };
+        count?: number;
+        total?: number;
+        tooManyToCount?: boolean;
+    };
+}
 /** List site members — POST /members/v1/members/query. Pass `{ query: { paging: { limit, offset? } } }`
  *  (offset paging). Do not pass `cursorPaging` — that is a different Wix envelope and is not on this type. */
 export declare function queryMembers(req?: WixQueryMembersRequest): Promise<WixQueryMembersResponse>;
 /** Fetch a single member by id — GET /members/v1/members/{id}?fieldsets=FULL. */
 export declare function getMember(id: string): Promise<WixGetMemberResponse>;
+/** Fetch the currently authenticated member — member-scoped, unlike the owner roster query.
+ * @scope member — requires the signed-in site-member identity; an anonymous visitor cannot read this record.
+ */
+export declare function getMyMember(req?: {
+    fieldsets?: string[];
+}): Promise<WixGetMyMemberResponse>;
+/** Update a member record. Callers that serve members must pass the authenticated member's id.
+ * @scope member — the id must identify the signed-in member; mismatches are rejected by Wix authorization.
+ */
+export declare function updateMember(id: string, req: WixUpdateMemberRequest): Promise<WixUpdateMemberResponse>;
+/** Change the signed-in member's own public profile slug.
+ * @scope member — requires a signed-in site member; the operation applies only to that member's slug.
+ */
+export declare function updateMySlug(req: {
+    slug: string;
+}): Promise<WixUpdateMemberResponse>;
+/** List IDs blocked by the authenticated member — member-owned social blocks, not site moderation.
+ * @scope member — requires a signed-in site member; an empty list means the member has no blocked members.
+ */
+export declare function listCurrentMemberBlocking(req?: WixListCurrentMemberBlockingRequest): Promise<WixListCurrentMemberBlockingResponse>;
+/** Remove one member from the authenticated member's own block list.
+ * @scope member — requires a signed-in site member; Wix applies the change to that member's block list.
+ */
+export declare function unblockCurrentMember(memberId: string): Promise<Record<string, never>>;
+/** Delete every stored contact phone from a member's own profile. The API has no per-phone delete.
+ * @scope member — id must be the signed-in member; this endpoint clears all phone numbers on that profile.
+ */
+export declare function deleteMemberPhones(id: string): Promise<WixDeleteMemberPhonesResponse>;
+/** Leave the Wix Members Area community. Wix changes the member to PRIVATE.
+ * @scope member — requires a signed-in member; this removes that member from the public Members Area community.
+ */
+export declare function leaveCommunity(): Promise<WixUpdateMemberResponse>;
+/** Join the Wix Members Area community. Wix changes the member to PUBLIC.
+ * @scope member — requires a signed-in member; this makes that member's Members Area profile public.
+ */
+export declare function joinCommunity(): Promise<WixUpdateMemberResponse>;
 /** Approve a member — POST /members/v1/members/{id}/approve. Reactivates BOTH a
  * PENDING member and a BLOCKED one (verified live: approve on a blocked member →
  * 200, status APPROVED). There is NO separate `/unblock` endpoint — it 404s; the

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/wix-sdk/site-media/src/index.d.ts

@@ -25,4 +25,12 @@ export interface GenerateUploadUrlResponse {
  *  POST /site-media/v1/files/generate-upload-url → { uploadUrl, … }.
  *  Caller PUTs the bytes to `uploadUrl`, then uses the returned file id. */
 export declare function generateUploadUrl(mimeType: string, fileName: string, parentFolderId?: string): Promise<GenerateUploadUrlResponse>;
+/** Ask a site-owned Velo HTTP function for a member-authorized photo upload URL.
+ * The backend function must independently bind the request to its authenticated
+ * member and return `{ uploadUrl }`; this helper does not add credentials or
+ * bypass the host's current Wix identity.
+ * @scope member — requires a signed-in member and a configured site function that verifies the current member;
+ * the returned URL is for upload only and does not itself update the member profile.
+ */
+export declare function generateMemberPhotoUploadUrl(functionName: string, mimeType: string, fileName: string): Promise<GenerateUploadUrlResponse>;
 export { wixCall };

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/audio-record.mjs

@@ -53,7 +53,8 @@ var CAPABILITY_REGISTRY = {
   "tasks": ["backend", "create", "getPermissionStatus", "list", "remove", "requestPermission", "setCompleted"],
   "theme": ["applyOverlay", "clearOverlay", "surfaces"],
   "ui": ["alert", "snackbar"],
-  "wix_cashier": ["isAvailable", "proceedToPayment"]
+  "wix_cashier": ["isAvailable", "proceedToPayment"],
+  "wix_chat": ["getRealtimeStatus", "subscribeRealtime", "unsubscribeRealtime"]
 };
 var CAPABILITY_ACTION_IDS = Object.freeze(
   Object.entries(CAPABILITY_REGISTRY).flatMap(([id, verbs]) => verbs.map((v) => `capability.${id}.${v}`))

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/auth.mjs

@@ -129,6 +129,8 @@ var copy_generated_default = {
   "auth.gate.sendCodeVia": "Send code via",
   "auth.gate.resendCode": "Didn't get it? Resend code",
   "auth.gate.field.code": "Verification code",
+  "auth.gate.pushWaiting": "Approve the sign-in on your other device.",
+  "auth.gate.pushResend": "Send a new request",
   "auth.gate.field.email": "Email",
   "auth.gate.field.name": "Name",
   "auth.gate.field.password": "Password",
@@ -173,6 +175,9 @@ var copy_generated_default = {
   "auth.error.registrationFailed": "Registration failed ({code}).",
   "auth.error.twoFactorRequired": "Two-factor verification required.",
   "auth.error.noPendingVerification": "No pending verification.",
+  "auth.error.pushDeclined": "The sign-in was declined on your other device.",
+  "auth.error.pushExpired": "The approval request expired. Send a new one or choose another method.",
+  "auth.error.pushUnavailable": "Push approval isn't available. Choose another method.",
   "auth.error.verificationCancelled": "Verification cancelled.",
   "auth.error.biometricSignInFirst": "Sign in before enabling biometric unlock.",
   "auth.error.noSessionToProtect": "No session to protect.",

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/calendar.mjs

@@ -53,7 +53,8 @@ var CAPABILITY_REGISTRY = {
   "tasks": ["backend", "create", "getPermissionStatus", "list", "remove", "requestPermission", "setCompleted"],
   "theme": ["applyOverlay", "clearOverlay", "surfaces"],
   "ui": ["alert", "snackbar"],
-  "wix_cashier": ["isAvailable", "proceedToPayment"]
+  "wix_cashier": ["isAvailable", "proceedToPayment"],
+  "wix_chat": ["getRealtimeStatus", "subscribeRealtime", "unsubscribeRealtime"]
 };
 var CAPABILITY_ACTION_IDS = Object.freeze(
   Object.entries(CAPABILITY_REGISTRY).flatMap(([id, verbs]) => verbs.map((v) => `capability.${id}.${v}`))

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/calls.mjs

@@ -53,7 +53,8 @@ var CAPABILITY_REGISTRY = {
   "tasks": ["backend", "create", "getPermissionStatus", "list", "remove", "requestPermission", "setCompleted"],
   "theme": ["applyOverlay", "clearOverlay", "surfaces"],
   "ui": ["alert", "snackbar"],
-  "wix_cashier": ["isAvailable", "proceedToPayment"]
+  "wix_cashier": ["isAvailable", "proceedToPayment"],
+  "wix_chat": ["getRealtimeStatus", "subscribeRealtime", "unsubscribeRealtime"]
 };
 var CAPABILITY_ACTION_IDS = Object.freeze(
   Object.entries(CAPABILITY_REGISTRY).flatMap(([id, verbs]) => verbs.map((v) => `capability.${id}.${v}`))

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/contacts.mjs

@@ -53,7 +53,8 @@ var CAPABILITY_REGISTRY = {
   "tasks": ["backend", "create", "getPermissionStatus", "list", "remove", "requestPermission", "setCompleted"],
   "theme": ["applyOverlay", "clearOverlay", "surfaces"],
   "ui": ["alert", "snackbar"],
-  "wix_cashier": ["isAvailable", "proceedToPayment"]
+  "wix_cashier": ["isAvailable", "proceedToPayment"],
+  "wix_chat": ["getRealtimeStatus", "subscribeRealtime", "unsubscribeRealtime"]
 };
 var CAPABILITY_ACTION_IDS = Object.freeze(
   Object.entries(CAPABILITY_REGISTRY).flatMap(([id, verbs]) => verbs.map((v) => `capability.${id}.${v}`))

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/location.mjs

@@ -53,7 +53,8 @@ var CAPABILITY_REGISTRY = {
   "tasks": ["backend", "create", "getPermissionStatus", "list", "remove", "requestPermission", "setCompleted"],
   "theme": ["applyOverlay", "clearOverlay", "surfaces"],
   "ui": ["alert", "snackbar"],
-  "wix_cashier": ["isAvailable", "proceedToPayment"]
+  "wix_cashier": ["isAvailable", "proceedToPayment"],
+  "wix_chat": ["getRealtimeStatus", "subscribeRealtime", "unsubscribeRealtime"]
 };
 var CAPABILITY_ACTION_IDS = Object.freeze(
   Object.entries(CAPABILITY_REGISTRY).flatMap(([id, verbs]) => verbs.map((v) => `capability.${id}.${v}`))

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/motion.mjs

@@ -53,7 +53,8 @@ var CAPABILITY_REGISTRY = {
   "tasks": ["backend", "create", "getPermissionStatus", "list", "remove", "requestPermission", "setCompleted"],
   "theme": ["applyOverlay", "clearOverlay", "surfaces"],
   "ui": ["alert", "snackbar"],
-  "wix_cashier": ["isAvailable", "proceedToPayment"]
+  "wix_cashier": ["isAvailable", "proceedToPayment"],
+  "wix_chat": ["getRealtimeStatus", "subscribeRealtime", "unsubscribeRealtime"]
 };
 var CAPABILITY_ACTION_IDS = Object.freeze(
   Object.entries(CAPABILITY_REGISTRY).flatMap(([id, verbs]) => verbs.map((v) => `capability.${id}.${v}`))

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/photos.mjs

@@ -53,7 +53,8 @@ var CAPABILITY_REGISTRY = {
   "tasks": ["backend", "create", "getPermissionStatus", "list", "remove", "requestPermission", "setCompleted"],
   "theme": ["applyOverlay", "clearOverlay", "surfaces"],
   "ui": ["alert", "snackbar"],
-  "wix_cashier": ["isAvailable", "proceedToPayment"]
+  "wix_cashier": ["isAvailable", "proceedToPayment"],
+  "wix_chat": ["getRealtimeStatus", "subscribeRealtime", "unsubscribeRealtime"]
 };
 var CAPABILITY_ACTION_IDS = Object.freeze(
   Object.entries(CAPABILITY_REGISTRY).flatMap(([id, verbs]) => verbs.map((v) => `capability.${id}.${v}`))

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/screens.mjs

@@ -140,6 +140,8 @@ var copy_generated_default = {
   "auth.gate.sendCodeVia": "Send code via",
   "auth.gate.resendCode": "Didn't get it? Resend code",
   "auth.gate.field.code": "Verification code",
+  "auth.gate.pushWaiting": "Approve the sign-in on your other device.",
+  "auth.gate.pushResend": "Send a new request",
   "auth.gate.field.email": "Email",
   "auth.gate.field.name": "Name",
   "auth.gate.field.password": "Password",
@@ -184,6 +186,9 @@ var copy_generated_default = {
   "auth.error.registrationFailed": "Registration failed ({code}).",
   "auth.error.twoFactorRequired": "Two-factor verification required.",
   "auth.error.noPendingVerification": "No pending verification.",
+  "auth.error.pushDeclined": "The sign-in was declined on your other device.",
+  "auth.error.pushExpired": "The approval request expired. Send a new one or choose another method.",
+  "auth.error.pushUnavailable": "Push approval isn't available. Choose another method.",
   "auth.error.verificationCancelled": "Verification cancelled.",
   "auth.error.biometricSignInFirst": "Sign in before enabling biometric unlock.",
   "auth.error.noSessionToProtect": "No session to protect.",

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/sdk-types.mjs

@@ -38,7 +38,8 @@ var CAPABILITY_REGISTRY = {
   "tasks": ["backend", "create", "getPermissionStatus", "list", "remove", "requestPermission", "setCompleted"],
   "theme": ["applyOverlay", "clearOverlay", "surfaces"],
   "ui": ["alert", "snackbar"],
-  "wix_cashier": ["isAvailable", "proceedToPayment"]
+  "wix_cashier": ["isAvailable", "proceedToPayment"],
+  "wix_chat": ["getRealtimeStatus", "subscribeRealtime", "unsubscribeRealtime"]
 };
 var CAPABILITY_ACTION_IDS = Object.freeze(
   Object.entries(CAPABILITY_REGISTRY).flatMap(([id, verbs]) => verbs.map((v) => `capability.${id}.${v}`))

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/tasks.mjs

@@ -53,7 +53,8 @@ var CAPABILITY_REGISTRY = {
   "tasks": ["backend", "create", "getPermissionStatus", "list", "remove", "requestPermission", "setCompleted"],
   "theme": ["applyOverlay", "clearOverlay", "surfaces"],
   "ui": ["alert", "snackbar"],
-  "wix_cashier": ["isAvailable", "proceedToPayment"]
+  "wix_cashier": ["isAvailable", "proceedToPayment"],
+  "wix_chat": ["getRealtimeStatus", "subscribeRealtime", "unsubscribeRealtime"]
 };
 var CAPABILITY_ACTION_IDS = Object.freeze(
   Object.entries(CAPABILITY_REGISTRY).flatMap(([id, verbs]) => verbs.map((v) => `capability.${id}.${v}`))

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-auth/worker.mjs

@@ -167,12 +167,13 @@ var DeviceAuthClient = class {
 
 // ../../stdlib/auth-providers/wix/src/native-engine.ts
 var NativeAuthError = class extends Error {
-  constructor(kind, message, twoFAToken, twoFAMethod, twoFAMethods) {
+  constructor(kind, message, twoFAToken, twoFAMethod, twoFAMethods, verificationId) {
     super(message);
     this.kind = kind;
     this.twoFAToken = twoFAToken;
     this.twoFAMethod = twoFAMethod;
     this.twoFAMethods = twoFAMethods;
+    this.verificationId = verificationId;
     this.name = "NativeAuthError";
   }
 };
@@ -270,12 +271,15 @@ var WixNativeAuthEngine = class {
     if (payload.twoFAToken && json.success !== true) {
       const current = payload.currentTwoFAMethod ?? "sms";
       const methods = payload.enabledTwoFAMethods ?? [current];
+      const id = payload.verificationId;
+      const verificationId = (typeof id === "string" || typeof id === "number") && /^\d+$/.test(String(id)) ? String(id) : void 0;
       throw new NativeAuthError(
         "needsTwoFactor",
         "Two-factor verification required.",
         payload.twoFAToken,
         current,
-        methods
+        methods,
+        verificationId
       );
     }
     if (json.success !== true || !payload.guid) {
@@ -472,10 +476,12 @@ function classifyAuthErrorCode(code) {
 var WixAuthModalities = class {
   constructor(config = {}) {
     __publicField(this, "baseURL");
+    __publicField(this, "verificationBaseURL");
     __publicField(this, "fetchImpl");
     __publicField(this, "sleep");
     __publicField(this, "devMode");
     this.baseURL = config.baseURL ?? "https://users.wix.com";
+    this.verificationBaseURL = config.verificationBaseURL ?? "https://manage.wix.com";
     this.fetchImpl = config.fetchImpl ?? globalThis.fetch;
     this.sleep = config.sleep ?? engineSleep("WixAuthModalities");
     this.devMode = config.devMode ?? false;
@@ -500,25 +506,60 @@ var WixAuthModalities = class {
     return { userId: p.guid ?? "", email: p.email ?? "", accessToken: access, refreshToken: p.wixSession2 ?? "" };
   }
   /** Push-based 2FA: poll for the user's approval on their trusted device. Loops
-   *  until approved/denied/expired or `maxPolls` is hit. */
-  async pollPushApproval(twoFAToken, opts = {}) {
-    const interval = opts.intervalMs ?? 3e3;
-    const maxPolls = opts.maxPolls ?? 20;
+   *  until approved/denied/expired or `maxPolls` is hit (default 60 × 5s = 5 minutes).
+   *
+   *  #4309 — the wire Wix's own native client uses (mobile-native-core LegacyTwoFactor), and
+   *  the one the native WixNativeAuthEngine polls: Verification v1 GetChallenge,
+   *  `GET manage.wix.com/_api/verification-web/v1/challenges/get-challenge?verificationId=…`,
+   *  keyed by the 2FA payload's `verificationId` (digits; `NativeAuthError.verificationId` on the
+   *  needsTwoFactor challenge — not its `twoFAToken`). After "approved" the caller completes
+   *  the login with ONE `/auth/m/verifycodeandlogin` carrying an empty code. The old
+   *  `/auth/m/push2fa/status` route was never Wix's. */
+  async pollPushApproval(verificationId, opts = {}) {
+    const interval = opts.intervalMs ?? 5e3;
+    const maxPolls = opts.maxPolls ?? 60;
+    if (!this.devMode && !/^\d+$/.test(verificationId)) {
+      throw new NativeAuthError("unknown", "Push approval isn't available. Choose another method.");
+    }
     for (let i = 0; i < maxPolls; i++) {
-      const state = await this.pushStatusOnce(twoFAToken, i);
+      const state = await this.pushStatusOnce(verificationId, i);
       if (state !== "pending") return state;
       await this.sleep(interval);
     }
     return "expired";
   }
-  async pushStatusOnce(twoFAToken, poll) {
+  async pushStatusOnce(verificationId, poll) {
     if (this.devMode) {
-      if (twoFAToken === "deny") return "denied";
+      if (verificationId === "deny") return "denied";
       return poll >= 1 ? "approved" : "pending";
     }
-    const j = await this.post("/auth/m/push2fa/status", { twoFAToken });
-    const s = j.status ?? "pending";
-    return ["approved", "pending", "denied", "expired"].includes(s) ? s : "pending";
+    let res;
+    try {
+      res = await this.fetchImpl(
+        `${this.verificationBaseURL}/_api/verification-web/v1/challenges/get-challenge?verificationId=${verificationId}`,
+        { method: "GET", headers: { Accept: "application/json" } }
+      );
+    } catch {
+      return "pending";
+    }
+    if (res.status === 404) return "expired";
+    if (!res.ok) return "pending";
+    let j = {};
+    try {
+      j = JSON.parse(await res.text());
+    } catch {
+      return "pending";
+    }
+    switch (j.challenge?.approvalChallenge?.status) {
+      case "APPROVED":
+        return "approved";
+      case "DECLINED":
+        return "denied";
+      case "EXPIRED":
+        return "expired";
+      default:
+        return "pending";
+    }
   }
   /** Device-login: approve a login started on another device (confirm-on-device). */
   async confirmDeviceLogin(userCode, authToken) {
@@ -718,6 +759,15 @@ var WIX_SENSITIVE_KEYS = [
   "setcookie",
   // captcha / passwords
   "password",
+  "currentpassword",
+  "newpassword",
+  "confirmpassword",
+  "oldpassword",
+  // T5 account-settings state uses passwordCurrent/passwordNew/passwordConfirm;
+  // redact those camel-case state keys too if state snapshots reach the gateway.
+  "passwordcurrent",
+  "passwordnew",
+  "passwordconfirm",
   "recaptcha",
   "recaptcharesponsefield",
   "pxaccesstoken"