@wix/himalaya-cli 0.1478.0 → 0.1479.0

package/dist/cli.mjs

@@ -10053,7 +10053,6 @@ function webViewOriginAllowed(url, origins) {
 }
 var init_webview_origin = __esm({
   "../../core/ts/src/webview-origin.ts"() {
-    "use strict";
   }
 });
 
@@ -162376,16 +162375,24 @@ ${releaseId}`;
         }
         const exchangeClient = wixClientIdOf(utf8Decode(exchangeCfg.bytes));
         if ("error" in exchangeClient) return json5(501, { error: `member_exchange_${exchangeClient.error}` }, noStore);
+        let rawBody;
+        try {
+          rawBody = await request.text();
+        } catch {
+          return json5(400, { error: "body_unreadable" }, noStore);
+        }
+        if (!rawBody) return json5(400, { error: "empty_body" }, noStore);
         let exchangeBody;
         try {
-          exchangeBody = await request.json();
+          exchangeBody = JSON.parse(rawBody);
         } catch {
-          return json5(400, { error: "bad_request" }, noStore);
+          return json5(400, { error: "invalid_json" }, noStore);
         }
-        if (!exchangeBody || typeof exchangeBody !== "object") return json5(400, { error: "bad_request" }, noStore);
+        if (!exchangeBody || typeof exchangeBody !== "object" || Array.isArray(exchangeBody)) return json5(400, { error: "invalid_body" }, noStore);
         const exchanged = await exchangeMemberSession({ clientId: exchangeClient.clientId, sessionToken: exchangeBody.sessionToken }, webwixFetch);
         if (exchanged.ok) return json5(200, { accessToken: exchanged.accessToken, expiresAt: exchanged.expiresAt }, noStore);
-        return json5(exchanged.code === "bad_request" ? 400 : 502, { error: exchanged.code, ...exchanged.status !== void 0 ? { status: exchanged.status } : {} }, noStore);
+        if (exchanged.code === "bad_request") return json5(400, { error: "invalid_session_token" }, noStore);
+        return json5(502, { error: exchanged.code, ...exchanged.status !== void 0 ? { status: exchanged.status } : {} }, noStore);
       }
       if (request.method === "POST" && path2 === "/v1/__webwix/call") {
         const served = { rung: "none" };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1478.0",
+  "version": "0.1479.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "9df3ab790eedc5502b485d550de7a6fda56709041ca3aa3c46412c91"
+  "falconPackageHash": "fb248ed127f089ebaa1bc984e5388a4732b97e826a7524a503aafbc1"
 }