@wix/himalaya-cli 0.1400.0 → 0.1402.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/auth-providers/wix/src/auth-modalities.d.ts

@@ -7,6 +7,8 @@ export declare function classifyAuthErrorCode(code: number): {
 export type PushApprovalState = "approved" | "pending" | "denied" | "expired";
 export interface AuthModalitiesConfig {
     baseURL?: string;
+    /** Host of the Verification v1 API the push-approval poll reads (#4309). */
+    verificationBaseURL?: string;
     fetchImpl?: typeof fetch;
     now?: () => number;
     sleep?: (ms: number) => Promise<void>;
@@ -14,6 +16,7 @@ export interface AuthModalitiesConfig {
 }
 export declare class WixAuthModalities {
     private readonly baseURL;
+    private readonly verificationBaseURL;
     private readonly fetchImpl;
     private readonly sleep;
     private readonly devMode;
@@ -26,8 +29,16 @@ export declare class WixAuthModalities {
     /** Complete a magic-link login from the token in the opened link. */
     verifyMagicLink(token: string): Promise<WixAccountSession>;
     /** Push-based 2FA: poll for the user's approval on their trusted device. Loops
-     *  until approved/denied/expired or `maxPolls` is hit. */
-    pollPushApproval(twoFAToken: string, opts?: {
+     *  until approved/denied/expired or `maxPolls` is hit (default 60 × 5s = 5 minutes).
+     *
+     *  #4309 — the wire Wix's own native client uses (mobile-native-core LegacyTwoFactor), and
+     *  the one the native WixNativeAuthEngine polls: Verification v1 GetChallenge,
+     *  `GET manage.wix.com/_api/verification-web/v1/challenges/get-challenge?verificationId=…`,
+     *  keyed by the 2FA payload's `verificationId` (digits; `NativeAuthError.verificationId` on the
+     *  needsTwoFactor challenge — not its `twoFAToken`). After "approved" the caller completes
+     *  the login with ONE `/auth/m/verifycodeandlogin` carrying an empty code. The old
+     *  `/auth/m/push2fa/status` route was never Wix's. */
+    pollPushApproval(verificationId: string, opts?: {
         intervalMs?: number;
         maxPolls?: number;
     }): Promise<PushApprovalState>;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/auth-providers/wix/src/index.d.ts

@@ -91,8 +91,18 @@ export interface WixNativeAuthConfig {
     /** App URL scheme registered in the client's allowed redirect URIs — used by
      *  the (no-UI) sessionToken → member-token PKCE exchange. */
     redirectUri?: string;
-    /** Federated providers to surface on the form. */
+    /** Federated providers to surface on the form. The app shows only the ones that can run on
+     *  the platform (#4309): Apple on iOS, Google once its module is linked and `google` names a
+     *  client id. */
     social?: SocialAuthProvider[];
+    /** Google OAuth client ids for "Continue with Google" (#4309). iOS registers `iosClientId`
+     *  (with its reversed-id URL scheme in Info.plist); Android asks Credential Manager for a token
+     *  for `serverClientId`, the WEB client Wix's `/oneapp/social/sign-in/google` accepts. Absent →
+     *  the Google button is hidden on that platform. Baked into auth.json. */
+    google?: {
+        iosClientId?: string;
+        serverClientId?: string;
+    };
     /** Override the Wix API host (staging). Default: https://www.wixapis.com. */
     apiBase?: string;
     /** PerimeterX automation token — one-app `x-px-access-token` captcha bypass for

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/auth-providers/wix/src/native-engine.d.ts

@@ -27,9 +27,15 @@ export declare class NativeAuthError extends Error {
     readonly twoFAMethod?: string;
     /** Every enabled 2FA method (drives the picker when >1). */
     readonly twoFAMethods?: string[];
+    /** #4309 — the push challenge's id (digits), when the payload carried one: what
+     *  `WixAuthModalities.pollPushApproval` polls. */
+    readonly verificationId?: string;
     constructor(kind: NativeAuthErrorKind, message: string, twoFAToken?: string, twoFAMethod?: string, 
     /** Every enabled 2FA method (drives the picker when >1). */
-    twoFAMethods?: string[]);
+    twoFAMethods?: string[], 
+    /** #4309 — the push challenge's id (digits), when the payload carried one: what
+     *  `WixAuthModalities.pollPushApproval` polls. */
+    verificationId?: string);
 }
 export interface WixNativeAuthEngineConfig {
     baseURL?: string;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/flows/auth/src/copy.generated.d.ts

@@ -14,6 +14,8 @@ declare const _default: {
     readonly "auth.gate.sendCodeVia": "Send code via";
     readonly "auth.gate.resendCode": "Didn't get it? Resend code";
     readonly "auth.gate.field.code": "Verification code";
+    readonly "auth.gate.pushWaiting": "Approve the sign-in on your other device.";
+    readonly "auth.gate.pushResend": "Send a new request";
     readonly "auth.gate.field.email": "Email";
     readonly "auth.gate.field.name": "Name";
     readonly "auth.gate.field.password": "Password";
@@ -58,6 +60,9 @@ declare const _default: {
     readonly "auth.error.registrationFailed": "Registration failed ({code}).";
     readonly "auth.error.twoFactorRequired": "Two-factor verification required.";
     readonly "auth.error.noPendingVerification": "No pending verification.";
+    readonly "auth.error.pushDeclined": "The sign-in was declined on your other device.";
+    readonly "auth.error.pushExpired": "The approval request expired. Send a new one or choose another method.";
+    readonly "auth.error.pushUnavailable": "Push approval isn't available. Choose another method.";
     readonly "auth.error.verificationCancelled": "Verification cancelled.";
     readonly "auth.error.biometricSignInFirst": "Sign in before enabling biometric unlock.";
     readonly "auth.error.noSessionToProtect": "No session to protect.";

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/auth.mjs

@@ -129,6 +129,8 @@ var copy_generated_default = {
   "auth.gate.sendCodeVia": "Send code via",
   "auth.gate.resendCode": "Didn't get it? Resend code",
   "auth.gate.field.code": "Verification code",
+  "auth.gate.pushWaiting": "Approve the sign-in on your other device.",
+  "auth.gate.pushResend": "Send a new request",
   "auth.gate.field.email": "Email",
   "auth.gate.field.name": "Name",
   "auth.gate.field.password": "Password",
@@ -173,6 +175,9 @@ var copy_generated_default = {
   "auth.error.registrationFailed": "Registration failed ({code}).",
   "auth.error.twoFactorRequired": "Two-factor verification required.",
   "auth.error.noPendingVerification": "No pending verification.",
+  "auth.error.pushDeclined": "The sign-in was declined on your other device.",
+  "auth.error.pushExpired": "The approval request expired. Send a new one or choose another method.",
+  "auth.error.pushUnavailable": "Push approval isn't available. Choose another method.",
   "auth.error.verificationCancelled": "Verification cancelled.",
   "auth.error.biometricSignInFirst": "Sign in before enabling biometric unlock.",
   "auth.error.noSessionToProtect": "No session to protect.",

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/screens.mjs

@@ -140,6 +140,8 @@ var copy_generated_default = {
   "auth.gate.sendCodeVia": "Send code via",
   "auth.gate.resendCode": "Didn't get it? Resend code",
   "auth.gate.field.code": "Verification code",
+  "auth.gate.pushWaiting": "Approve the sign-in on your other device.",
+  "auth.gate.pushResend": "Send a new request",
   "auth.gate.field.email": "Email",
   "auth.gate.field.name": "Name",
   "auth.gate.field.password": "Password",
@@ -184,6 +186,9 @@ var copy_generated_default = {
   "auth.error.registrationFailed": "Registration failed ({code}).",
   "auth.error.twoFactorRequired": "Two-factor verification required.",
   "auth.error.noPendingVerification": "No pending verification.",
+  "auth.error.pushDeclined": "The sign-in was declined on your other device.",
+  "auth.error.pushExpired": "The approval request expired. Send a new one or choose another method.",
+  "auth.error.pushUnavailable": "Push approval isn't available. Choose another method.",
   "auth.error.verificationCancelled": "Verification cancelled.",
   "auth.error.biometricSignInFirst": "Sign in before enabling biometric unlock.",
   "auth.error.noSessionToProtect": "No session to protect.",

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-auth/worker.mjs

@@ -167,12 +167,13 @@ var DeviceAuthClient = class {
 
 // ../../stdlib/auth-providers/wix/src/native-engine.ts
 var NativeAuthError = class extends Error {
-  constructor(kind, message, twoFAToken, twoFAMethod, twoFAMethods) {
+  constructor(kind, message, twoFAToken, twoFAMethod, twoFAMethods, verificationId) {
     super(message);
     this.kind = kind;
     this.twoFAToken = twoFAToken;
     this.twoFAMethod = twoFAMethod;
     this.twoFAMethods = twoFAMethods;
+    this.verificationId = verificationId;
     this.name = "NativeAuthError";
   }
 };
@@ -270,12 +271,15 @@ var WixNativeAuthEngine = class {
     if (payload.twoFAToken && json.success !== true) {
       const current = payload.currentTwoFAMethod ?? "sms";
       const methods = payload.enabledTwoFAMethods ?? [current];
+      const id = payload.verificationId;
+      const verificationId = (typeof id === "string" || typeof id === "number") && /^\d+$/.test(String(id)) ? String(id) : void 0;
       throw new NativeAuthError(
         "needsTwoFactor",
         "Two-factor verification required.",
         payload.twoFAToken,
         current,
-        methods
+        methods,
+        verificationId
       );
     }
     if (json.success !== true || !payload.guid) {
@@ -472,10 +476,12 @@ function classifyAuthErrorCode(code) {
 var WixAuthModalities = class {
   constructor(config = {}) {
     __publicField(this, "baseURL");
+    __publicField(this, "verificationBaseURL");
     __publicField(this, "fetchImpl");
     __publicField(this, "sleep");
     __publicField(this, "devMode");
     this.baseURL = config.baseURL ?? "https://users.wix.com";
+    this.verificationBaseURL = config.verificationBaseURL ?? "https://manage.wix.com";
     this.fetchImpl = config.fetchImpl ?? globalThis.fetch;
     this.sleep = config.sleep ?? engineSleep("WixAuthModalities");
     this.devMode = config.devMode ?? false;
@@ -500,25 +506,60 @@ var WixAuthModalities = class {
     return { userId: p.guid ?? "", email: p.email ?? "", accessToken: access, refreshToken: p.wixSession2 ?? "" };
   }
   /** Push-based 2FA: poll for the user's approval on their trusted device. Loops
-   *  until approved/denied/expired or `maxPolls` is hit. */
-  async pollPushApproval(twoFAToken, opts = {}) {
-    const interval = opts.intervalMs ?? 3e3;
-    const maxPolls = opts.maxPolls ?? 20;
+   *  until approved/denied/expired or `maxPolls` is hit (default 60 × 5s = 5 minutes).
+   *
+   *  #4309 — the wire Wix's own native client uses (mobile-native-core LegacyTwoFactor), and
+   *  the one the native WixNativeAuthEngine polls: Verification v1 GetChallenge,
+   *  `GET manage.wix.com/_api/verification-web/v1/challenges/get-challenge?verificationId=…`,
+   *  keyed by the 2FA payload's `verificationId` (digits; `NativeAuthError.verificationId` on the
+   *  needsTwoFactor challenge — not its `twoFAToken`). After "approved" the caller completes
+   *  the login with ONE `/auth/m/verifycodeandlogin` carrying an empty code. The old
+   *  `/auth/m/push2fa/status` route was never Wix's. */
+  async pollPushApproval(verificationId, opts = {}) {
+    const interval = opts.intervalMs ?? 5e3;
+    const maxPolls = opts.maxPolls ?? 60;
+    if (!this.devMode && !/^\d+$/.test(verificationId)) {
+      throw new NativeAuthError("unknown", "Push approval isn't available. Choose another method.");
+    }
     for (let i = 0; i < maxPolls; i++) {
-      const state = await this.pushStatusOnce(twoFAToken, i);
+      const state = await this.pushStatusOnce(verificationId, i);
       if (state !== "pending") return state;
       await this.sleep(interval);
     }
     return "expired";
   }
-  async pushStatusOnce(twoFAToken, poll) {
+  async pushStatusOnce(verificationId, poll) {
     if (this.devMode) {
-      if (twoFAToken === "deny") return "denied";
+      if (verificationId === "deny") return "denied";
       return poll >= 1 ? "approved" : "pending";
     }
-    const j = await this.post("/auth/m/push2fa/status", { twoFAToken });
-    const s = j.status ?? "pending";
-    return ["approved", "pending", "denied", "expired"].includes(s) ? s : "pending";
+    let res;
+    try {
+      res = await this.fetchImpl(
+        `${this.verificationBaseURL}/_api/verification-web/v1/challenges/get-challenge?verificationId=${verificationId}`,
+        { method: "GET", headers: { Accept: "application/json" } }
+      );
+    } catch {
+      return "pending";
+    }
+    if (res.status === 404) return "expired";
+    if (!res.ok) return "pending";
+    let j = {};
+    try {
+      j = JSON.parse(await res.text());
+    } catch {
+      return "pending";
+    }
+    switch (j.challenge?.approvalChallenge?.status) {
+      case "APPROVED":
+        return "approved";
+      case "DECLINED":
+        return "denied";
+      case "EXPIRED":
+        return "expired";
+      default:
+        return "pending";
+    }
   }
   /** Device-login: approve a login started on another device (confirm-on-device). */
   async confirmDeviceLogin(userCode, authToken) {

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-auth.mjs

@@ -35,12 +35,13 @@ function dualDomainAuthorizeUrls(clientIds, redirectUri, opts = {}, endpoint = O
 
 // ../../stdlib/auth-providers/wix/src/native-engine.ts
 var NativeAuthError = class extends Error {
-  constructor(kind, message, twoFAToken, twoFAMethod, twoFAMethods) {
+  constructor(kind, message, twoFAToken, twoFAMethod, twoFAMethods, verificationId) {
     super(message);
     this.kind = kind;
     this.twoFAToken = twoFAToken;
     this.twoFAMethod = twoFAMethod;
     this.twoFAMethods = twoFAMethods;
+    this.verificationId = verificationId;
     this.name = "NativeAuthError";
   }
 };
@@ -138,12 +139,15 @@ var WixNativeAuthEngine = class {
     if (payload.twoFAToken && json.success !== true) {
       const current = payload.currentTwoFAMethod ?? "sms";
       const methods = payload.enabledTwoFAMethods ?? [current];
+      const id = payload.verificationId;
+      const verificationId = (typeof id === "string" || typeof id === "number") && /^\d+$/.test(String(id)) ? String(id) : void 0;
       throw new NativeAuthError(
         "needsTwoFactor",
         "Two-factor verification required.",
         payload.twoFAToken,
         current,
-        methods
+        methods,
+        verificationId
       );
     }
     if (json.success !== true || !payload.guid) {
@@ -914,10 +918,12 @@ function classifyAuthErrorCode(code) {
 var WixAuthModalities = class {
   constructor(config = {}) {
     __publicField(this, "baseURL");
+    __publicField(this, "verificationBaseURL");
     __publicField(this, "fetchImpl");
     __publicField(this, "sleep");
     __publicField(this, "devMode");
     this.baseURL = config.baseURL ?? "https://users.wix.com";
+    this.verificationBaseURL = config.verificationBaseURL ?? "https://manage.wix.com";
     this.fetchImpl = config.fetchImpl ?? globalThis.fetch;
     this.sleep = config.sleep ?? engineSleep("WixAuthModalities");
     this.devMode = config.devMode ?? false;
@@ -942,25 +948,60 @@ var WixAuthModalities = class {
     return { userId: p.guid ?? "", email: p.email ?? "", accessToken: access, refreshToken: p.wixSession2 ?? "" };
   }
   /** Push-based 2FA: poll for the user's approval on their trusted device. Loops
-   *  until approved/denied/expired or `maxPolls` is hit. */
-  async pollPushApproval(twoFAToken, opts = {}) {
-    const interval = opts.intervalMs ?? 3e3;
-    const maxPolls = opts.maxPolls ?? 20;
+   *  until approved/denied/expired or `maxPolls` is hit (default 60 × 5s = 5 minutes).
+   *
+   *  #4309 — the wire Wix's own native client uses (mobile-native-core LegacyTwoFactor), and
+   *  the one the native WixNativeAuthEngine polls: Verification v1 GetChallenge,
+   *  `GET manage.wix.com/_api/verification-web/v1/challenges/get-challenge?verificationId=…`,
+   *  keyed by the 2FA payload's `verificationId` (digits; `NativeAuthError.verificationId` on the
+   *  needsTwoFactor challenge — not its `twoFAToken`). After "approved" the caller completes
+   *  the login with ONE `/auth/m/verifycodeandlogin` carrying an empty code. The old
+   *  `/auth/m/push2fa/status` route was never Wix's. */
+  async pollPushApproval(verificationId, opts = {}) {
+    const interval = opts.intervalMs ?? 5e3;
+    const maxPolls = opts.maxPolls ?? 60;
+    if (!this.devMode && !/^\d+$/.test(verificationId)) {
+      throw new NativeAuthError("unknown", "Push approval isn't available. Choose another method.");
+    }
     for (let i = 0; i < maxPolls; i++) {
-      const state = await this.pushStatusOnce(twoFAToken, i);
+      const state = await this.pushStatusOnce(verificationId, i);
       if (state !== "pending") return state;
       await this.sleep(interval);
     }
     return "expired";
   }
-  async pushStatusOnce(twoFAToken, poll) {
+  async pushStatusOnce(verificationId, poll) {
     if (this.devMode) {
-      if (twoFAToken === "deny") return "denied";
+      if (verificationId === "deny") return "denied";
       return poll >= 1 ? "approved" : "pending";
     }
-    const j = await this.post("/auth/m/push2fa/status", { twoFAToken });
-    const s = j.status ?? "pending";
-    return ["approved", "pending", "denied", "expired"].includes(s) ? s : "pending";
+    let res;
+    try {
+      res = await this.fetchImpl(
+        `${this.verificationBaseURL}/_api/verification-web/v1/challenges/get-challenge?verificationId=${verificationId}`,
+        { method: "GET", headers: { Accept: "application/json" } }
+      );
+    } catch {
+      return "pending";
+    }
+    if (res.status === 404) return "expired";
+    if (!res.ok) return "pending";
+    let j = {};
+    try {
+      j = JSON.parse(await res.text());
+    } catch {
+      return "pending";
+    }
+    switch (j.challenge?.approvalChallenge?.status) {
+      case "APPROVED":
+        return "approved";
+      case "DECLINED":
+        return "denied";
+      case "EXPIRED":
+        return "expired";
+      default:
+        return "pending";
+    }
   }
   /** Device-login: approve a login started on another device (confirm-on-device). */
   async confirmDeviceLogin(userCode, authToken) {
@@ -1194,6 +1235,12 @@ function WixAuthProvider(config) {
     authorizationEndpoint: config.authorizationEndpoint
   });
 }
+function googleClientIds(google) {
+  const out = {};
+  if (google?.iosClientId) out.iosClientId = google.iosClientId;
+  if (google?.serverClientId) out.serverClientId = google.serverClientId;
+  return Object.keys(out).length ? out : void 0;
+}
 function WixNativeAuthProvider(config) {
   if (config.mode !== "owner" && config.mode !== "consumer" && config.mode !== "account") {
     throw new Error('WixNativeAuthProvider: mode must be "owner", "consumer" or "account".');
@@ -1205,6 +1252,7 @@ function WixNativeAuthProvider(config) {
       ...config.clientId ? { clientId: config.clientId } : {},
       ...config.redirectUri ? { redirectUri: config.redirectUri } : {},
       ...config.social ? { social: config.social } : {},
+      ...googleClientIds(config.google) ? { google: googleClientIds(config.google) } : {},
       ...config.apiBase ? { apiBase: config.apiBase } : {},
       ...config.pxToken ? { pxToken: config.pxToken } : {},
       ...config.petriOverrides ? { petriOverrides: config.petriOverrides } : {},

package/dist/cli.mjs

@@ -158566,30 +158566,30 @@ var init_preview_assets_generated = __esm({
   "../../packages/serve/src/preview-assets.generated.ts"() {
     init_preview_assets_format();
     PREVIEW_ASSET_MANIFEST = [
-      { key: "assets/DashboardHost-FLftzjWd.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 2916, sha256: "39805a9d3c89305c4278f5db6273d7c76e2981b0fbd94786eb1b748eabac0e70" },
-      { key: "assets/DevDrawer-DD3C4HP5.js", contentType: "application/javascript; charset=utf-8", offset: 2924, length: 16744, sha256: "30d69a01add3dffe0d15526242ea86ff4ff3b0747c7678ccdd01dd822e25e767" },
-      { key: "assets/IdiomCompare-Cark4OXd.js", contentType: "application/javascript; charset=utf-8", offset: 19668, length: 1892, sha256: "240b67407e3a48924a5357a91add67cf5e574ac1c1164595696db3ad2dd2a699" },
-      { key: "assets/SchemeCompare-Ccf4p2yo.js", contentType: "application/javascript; charset=utf-8", offset: 21560, length: 1819, sha256: "6a586fe602ffc1ad1ddbb35d90e30e59dc47861bc069f2483abc45b9ded888b3" },
-      { key: "assets/index-DoXQRJ-S.js", contentType: "application/javascript; charset=utf-8", offset: 23379, length: 1347260, sha256: "a122d6ef8d532041e5f36d9f0ed94b859fbb905c425a1010f277128d2618f8c6" },
-      { key: "assets/pdf-zTIxws1x.js", contentType: "application/javascript; charset=utf-8", offset: 1370639, length: 488199, sha256: "bd05a192eb4c5ac641c5359a382d7a9691009dfa097ffe2e726f6d527eb4b6da" },
-      { key: "assets/pdf.worker.min-BQa_JDET.js", contentType: "application/javascript; charset=utf-8", offset: 1858838, length: 73, sha256: "41bcfda4f3c8c0a81c785ea87c69afc8e7d0ed8c333324aee94c273d881bb6aa" },
-      { key: "assets/pdf.worker.min-BmVo14Nb.mjs", contentType: "application/javascript; charset=utf-8", offset: 1858911, length: 1317034, sha256: "a33cfe728c584fdba4fcc1fd54bcdc2f9f2f13889ddbb5b2bd1d0f8cbe49b84e" },
-      { key: "assets/pdfDocument-BPP_18kR.js", contentType: "application/javascript; charset=utf-8", offset: 3175945, length: 2868, sha256: "e792c73e1455cd83ef6107b705143992cc3f75202459afc9abeffdcfc05bd645" },
-      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 3178813, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
-      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 3183423, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
-      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 3672007, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
-      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 3762931, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
-      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 3853915, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
-      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 3944895, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
-      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 4035767, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
-      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 4126747, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
-      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 4235383, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
-      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 4344467, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
-      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 4453515, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
-      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 4561215, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
-      { key: "himi-sw.js", contentType: "application/javascript; charset=utf-8", offset: 4649323, length: 6748, sha256: "4a92459977d7cefa1a6a7e020c3a63509737f083b3f2773557c1a5771665811a" },
-      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 4656071, length: 4947, sha256: "cd7207aa03a0f339467bee350b16dfbca4fe181909c8f7049b44e6fb8dc3040b" },
-      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 4661018, length: 17768, sha256: "a47dec8623a0f58def7d8785ee74d08483626e75d07c9328bfc9ecb2172c2e0d" }
+      { key: "assets/DashboardHost-6DvWku4i.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 2916, sha256: "46e3ab97803e805b234fb086ed27eba4cfc5e930e0b9e8812119ffac987a93b6" },
+      { key: "assets/DevDrawer-G_2i4pRi.js", contentType: "application/javascript; charset=utf-8", offset: 2924, length: 16744, sha256: "c0f9e787c8d568c6b137a2f3263678d73fb2594aa5ed0bf4ccc114abe0c3b144" },
+      { key: "assets/IdiomCompare-h8in8vjb.js", contentType: "application/javascript; charset=utf-8", offset: 19668, length: 1892, sha256: "d6a486564253b0e69d9c072534b5fc0b14fd6ee0fa2b96533779c052f374001c" },
+      { key: "assets/SchemeCompare-3x7S1joY.js", contentType: "application/javascript; charset=utf-8", offset: 21560, length: 1819, sha256: "8a1dbd7789ed364054e51bdbe6ee059b9a0ed7c14d93c7943a259d025e59e685" },
+      { key: "assets/index-Dk8Fbe24.js", contentType: "application/javascript; charset=utf-8", offset: 23379, length: 1347630, sha256: "c32d9c00c974f661644e7dab457e04320bebcd6048fd3289723b2994f4e3fa6a" },
+      { key: "assets/pdf-DO5DPR9X.js", contentType: "application/javascript; charset=utf-8", offset: 1371009, length: 488199, sha256: "f82b99f57e8f1bb281f7047ed3294751a27517f488bf55457ba05dc51b468ea1" },
+      { key: "assets/pdf.worker.min-BQa_JDET.js", contentType: "application/javascript; charset=utf-8", offset: 1859208, length: 73, sha256: "41bcfda4f3c8c0a81c785ea87c69afc8e7d0ed8c333324aee94c273d881bb6aa" },
+      { key: "assets/pdf.worker.min-BmVo14Nb.mjs", contentType: "application/javascript; charset=utf-8", offset: 1859281, length: 1317034, sha256: "a33cfe728c584fdba4fcc1fd54bcdc2f9f2f13889ddbb5b2bd1d0f8cbe49b84e" },
+      { key: "assets/pdfDocument-CnBMTr3b.js", contentType: "application/javascript; charset=utf-8", offset: 3176315, length: 2868, sha256: "496494bdb4b29138dc9a588dfe2795abda60a5911f2f84a68dbcdd604097024e" },
+      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 3179183, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
+      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 3183793, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
+      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 3672377, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
+      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 3763301, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
+      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 3854285, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
+      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 3945265, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
+      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 4036137, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
+      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 4127117, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
+      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 4235753, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
+      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 4344837, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
+      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 4453885, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
+      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 4561585, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
+      { key: "himi-sw.js", contentType: "application/javascript; charset=utf-8", offset: 4649693, length: 6748, sha256: "4a92459977d7cefa1a6a7e020c3a63509737f083b3f2773557c1a5771665811a" },
+      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 4656441, length: 4947, sha256: "8a3e407eac0cc5028b16d9b6baa12018a35f017e25164e830471a643313d690b" },
+      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 4661388, length: 17768, sha256: "a47dec8623a0f58def7d8785ee74d08483626e75d07c9328bfc9ecb2172c2e0d" }
     ];
   }
 });

package/guides/wix-login-integration.md

@@ -112,6 +112,48 @@ browser-direct to wixapis instead). See `core/web-host/src/App.tsx`. There is no
 > **rejects with `sign_in_unavailable`** unless the `__webwix` bridge already holds a member. Catch that and
 > show a real error state — it is the difference between "sign-in isn't available here" and a dead button.
 
+## Social sign-in (Google, Apple) and push-approval 2FA
+
+`social: ["google", "apple"]` on `WixNativeAuthProvider` lists the buttons the app *may* show. The
+native gate shows only the ones that can actually run on that platform, so a button never fails with
+"This sign-in method isn't available":
+
+| Provider | iOS | Android |
+|---|---|---|
+| Apple | always (Sign in with Apple, needs the entitlement) | never (no native path) |
+| Google | when `HimalayaWixAuthGoogle` is linked **and** an iOS client id is configured | when `:himalaya-wix-auth-google` is linked **and** a server client id is configured |
+
+Enable Google in four steps:
+
+1. Configure the client ids (from a Google Cloud project whose tokens Wix's
+   `/oneapp/social/sign-in/google` accepts):
+   ```ts
+   WixNativeAuthProvider({ mode: "owner", social: ["google", "apple"],
+     google: { iosClientId: "<ios>.apps.googleusercontent.com", serverClientId: "<web>.apps.googleusercontent.com" } })
+   ```
+   An id left out hides Google on that platform: `iosClientId` for iOS, `serverClientId` (the WEB
+   client) for Android.
+2. **iOS** — add the `HimalayaWixAuthGoogle` package to the app (it pulls GoogleSignIn-iOS), add the
+   reversed iOS client id as a URL scheme (`CFBundleURLTypes`), and call
+   `HimalayaWixAuthGoogle.register(clientId:serverClientId:)` at boot, before the gate's provider list
+   is built.
+3. **Android** — include `:himalaya-wix-auth-google` (androidx.credentials + Google identity) and call
+   `CredentialManagerGoogleAdapter.register(context, serverClientId)` at boot.
+4. Filter the baked `social` list before handing it to the gate:
+   `SocialSignInCoordinator.shared.availableProviders(requested, devMode:)` (iOS) /
+   `SocialSignInAdapters.available(requested, devMode)` (Android). The dev seam (`devMode`) shows every
+   provider and answers with a dev credential.
+
+Only a real cancel reads as "cancelled"; a misconfigured client id surfaces Google's own message.
+
+**Push-approval 2FA (owner/account).** When a Wix account's second factor is push approval, the gate
+shows "Approve the sign-in on your other device." instead of a code field and waits on its own: the
+provider polls Wix's Verification API with the challenge's `verificationId` (every 5s, at most 5
+minutes) and, once approved, completes the login with an empty code. Declined and expired requests show
+their own message; the primary button sends a new request, and the method picker switches to a code
+factor at any time. Dev seam accounts: `2fa-push@himalaya.dev` (approves) and
+`2fa-push-deny@himalaya.dev` (declines), password `Passw0rd!`.
+
 ## Fail-closed (`required: true`)
 
 If a required-auth app can't build its provider (unknown `providerId`, missing config key), boot sets a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1400.0",
+  "version": "0.1402.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "16227ece9e0317f714176f3eecc0ae2774dc54d2f87df990070d3d72"
+  "falconPackageHash": "52ee343f360b7adc92355c0a381f833835c5bbe5dfe40716324c1ad5"
 }