@wix/himalaya-cli 0.870.0 → 0.872.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/dev-server/src/wix-gateway.d.ts

@@ -9,6 +9,7 @@ export interface WixGatewayState {
     seq: number;
     ruleSeq: number;
 }
+export declare const SECRET_BODY_KEYS: Set<string>;
 /** Scrub secrets from a request/response body before it is stored/streamed to the
  *  admin inspector. JSON bodies are redacted structurally by key; other bodies
  *  get form/bearer token scrubbing. Never throws. */

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/auth-providers/wix/src/device-auth.d.ts

@@ -18,6 +18,13 @@ export interface DeviceAuthResult {
     tokens?: DeviceAuthTokens;
     error?: string;
 }
+/** A device-authorization request that failed before a QR could be shown. Typed
+ *  so the caller can render it, rather than the raw `SyntaxError` an HTML gateway
+ *  page used to produce out of `res.json()`. */
+export declare class DeviceAuthError extends Error {
+    readonly status?: number;
+    constructor(message: string, status?: number);
+}
 export interface DeviceAuthConfig {
     clientId: string;
     baseURL?: string;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/auth-providers/wix/src/index.d.ts

@@ -7,7 +7,7 @@ export { REDACTED, WIX_SENSITIVE_KEYS, isSensitiveKey, normalizeKey, redactHeade
 export { SessionIDService, InMemorySessionIDStore, bsiShouldRotate, localDayIndex, BSI_ROTATE_INTERVAL_MS, type SessionIDRecord, type SessionIDStore, } from "./session-id.js";
 export { policyFor as wixRequestPolicy, isFirstPartyWixHost, isSignedUploadTarget, type MobileRequestKind, type RequestPolicy, } from "./request-policy.js";
 export { METASITE_HEADER, SIGNED_INSTANCE_EXP_HEADER, AUTH_PROXY_PREFIX, authProxyHeaders, authProxyPseudoInstance, isAuthProxyInstance, authProxyBusinessId, parseSignedInstanceExp, isSignedInstanceExpired, } from "./auth-proxy.js";
-export { DeviceAuthClient, parseDeviceQr, type DeviceAuthorization, type DeviceAuthTokens, type DeviceAuthResult, type DeviceAuthConfig, type DeviceAuthTerminal, } from "./device-auth.js";
+export { DeviceAuthClient, DeviceAuthError, parseDeviceQr, type DeviceAuthorization, type DeviceAuthTokens, type DeviceAuthResult, type DeviceAuthConfig, type DeviceAuthTerminal, } from "./device-auth.js";
 export { buildRegistrationOptions, buildAuthenticationOptions, authenticatorDataCounter, assertSignCountAdvanced, PasskeyCloneError, type RegistrationOptions, type AuthenticationOptions, } from "./passkey-ceremony.js";
 export { WixAuthModalities, classifyAuthErrorCode, type PushApprovalState, type AuthModalitiesConfig, } from "./auth-modalities.js";
 export { shouldEscalateCaptcha, captchaResponseFields, CaptchaEscalation, CAPTCHA_ESCALATION_CODES, type CaptchaTier, } from "./captcha-escalation.js";

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/auth-providers/wix/src/passkey-server.d.ts

@@ -3,6 +3,12 @@ export interface StoredCredential {
     credentialId: string;
     publicKeySpki: string;
     alg: number;
+    /** The authenticator's signature counter, for clone detection (WebAuthn §7.2
+     *  step 17). `verifyAuthentication` does NOT read or advance this — step 17 is
+     *  `assertSignCountAdvanced` in `passkey-ceremony.ts`, which the host calls with
+     *  `authenticatorDataCounter(authenticatorData)` and then PERSISTS the returned
+     *  value. It is split out because only the host owns the store; do not read a
+     *  non-zero value here as proof the check ran. */
     signCount: number;
 }
 export interface ClientData {
@@ -33,6 +39,16 @@ export interface AuthenticationInput {
     stored: StoredCredential;
     expectedChallenge: string;
     expectedOrigin: string;
+    /** The relying-party id this assertion must be bound to — the SAME value the
+     *  page passed as `rpId` in `buildAuthenticationOptions` (a registrable domain
+     *  suffix of the origin, e.g. `"localhost"` or `"wix.com"`).
+     *
+     *  REQUIRED, not optional, and deliberately so: a security check the caller can
+     *  forget is a security check that is off in production. WebAuthn §7.2 step 15
+     *  is the only thing binding an assertion to its relying party, and without it
+     *  `expectedOrigin` alone leaves nothing checking what the *authenticator*
+     *  signed over. */
+    expectedRpId: string;
 }
 /** Verify an assertion against a stored credential. Throws PasskeyError on any
  *  mismatch / bad signature; returns true on success. */

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/auth-providers/wix/src/redaction.d.ts

@@ -7,6 +7,26 @@ export declare const WIX_SENSITIVE_KEYS: readonly string[];
 export declare function normalizeKey(key: string): string;
 /** Whether a header/field/cookie name names a Wix secret. */
 export declare function isSensitiveKey(key: string): boolean;
+/** Whether a `name=` token seen in a FREE-TEXT body (form-encoded, query string,
+ *  raw dump) names a Wix secret.
+ *
+ *  Looser than `isSensitiveKey` on purpose, in exactly two ways, because a
+ *  free-text scrubber sees names the structural paths never do:
+ *
+ *  1. **Internal separators.** The vocabulary is stored separator-stripped
+ *     (`accesstoken`), so a literal alternation built from it can never match the
+ *     snake_case OAuth spellings `access_token` / `refresh_token` / `id_token`
+ *     — which is precisely the shape an OAuth form body uses. We therefore split
+ *     the name on separators and normalize before comparing.
+ *  2. **Prefix/suffix tolerance.** A name whose leading segments are a secret
+ *     name counts (`accessTokenV2`, `x-access-token`), matching the loose
+ *     `\b<key>[-_]?[a-z0-9]*=` shape this replaced. Over-redaction is the safe
+ *     direction for a log scrubber; under-redaction is a leak.
+ *
+ *  Checking every segment-suffix (not just the whole name) reproduces the old
+ *  `\b` anchoring: `x-access-token` matches on its `access-token` tail, while
+ *  `myaccesstoken` — which has no word boundary before the secret — does not. */
+export declare function isSensitiveFreeTextName(name: string): boolean;
 /** Redact a header map (values only; keys preserved). Case-insensitive. */
 export declare function redactHeaders(headers: Record<string, string | string[] | undefined>): Record<string, string>;
 /** Redact a `Cookie:` / `Set-Cookie:` header string, keeping cookie names but

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/auth-providers/wix/src/signed-instance-resolver.d.ts

@@ -57,6 +57,9 @@ export declare class SignedInstanceResolver {
     /** Resolve the signed instance for `businessId`, using (and populating) the
      *  caches. Concurrent calls for the same key share a single fetch. */
     resolve(businessId: string, signedInstanceType?: SignedInstanceType, forceRefresh?: boolean): Promise<string | undefined>;
+    /** Whether `task` is still the in-flight fetch registered for `key` — false once
+     *  `remove`/`reset` has evicted it, or a later resolve has replaced it. */
+    private isCurrent;
     /** Evict everything for a business (e.g. on leaving / switching it). */
     remove(businessId: string): void;
     /** Wipe all caches (e.g. on sign-out). */

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-auth/server.mjs

@@ -3,7 +3,7 @@ var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { en
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 
 // ../../stdlib/auth-providers/wix/src/passkey-server.ts
-import { createHash, createPublicKey, verify as cryptoVerify, randomBytes } from "node:crypto";
+import { createHash, createPublicKey, verify as cryptoVerify, randomBytes, timingSafeEqual } from "node:crypto";
 function newChallenge() {
   return randomBytes(32).toString("base64url");
 }
@@ -34,11 +34,17 @@ function verifyRegistration(input) {
     signCount: 0
   };
 }
+var FLAG_USER_PRESENT = 1;
 function verifyAuthentication(input) {
   const client = parseClientData(input.clientDataJSON);
   assertCeremony(client, "webauthn.get", input.expectedChallenge, input.expectedOrigin);
   const authData = Buffer.from(input.authenticatorData, "base64url");
   if (authData.length < 37) throw new PasskeyError("authenticatorData too short");
+  const expectedRpIdHash = createHash("sha256").update(input.expectedRpId).digest();
+  if (!timingSafeEqual(authData.subarray(0, 32), expectedRpIdHash)) {
+    throw new PasskeyError("rpIdHash mismatch");
+  }
+  if ((authData[32] & FLAG_USER_PRESENT) === 0) throw new PasskeyError("user not present");
   const clientHash = createHash("sha256").update(Buffer.from(input.clientDataJSON, "base64url")).digest();
   const signedData = Buffer.concat([authData, clientHash]);
   let key;
@@ -53,7 +59,7 @@ function verifyAuthentication(input) {
 }
 
 // ../../stdlib/auth-providers/wix/src/jot-deeplink.ts
-import { createHmac, timingSafeEqual } from "node:crypto";
+import { createHmac, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 var JOT_DLA_HOST = "invite.mobileappinvite.com";
 function signJotPayload(payload, secret) {
   return createHmac("sha256", secret).update(payload).digest("base64url");
@@ -62,7 +68,7 @@ function verifyJotSignature(payload, signature, secret) {
   const expected = signJotPayload(payload, secret);
   const a = Buffer.from(signature);
   const b = Buffer.from(expected);
-  return a.length === b.length && timingSafeEqual(a, b);
+  return a.length === b.length && timingSafeEqual2(a, b);
 }
 function parseUniversalLink(url, appId) {
   let u;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-auth/worker.mjs

@@ -4,6 +4,21 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
 
 // ../../stdlib/auth-providers/wix/src/device-auth.ts
 var DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+var DeviceAuthError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "DeviceAuthError";
+  }
+};
+async function readJsonSafely(res) {
+  try {
+    const value = await res.json();
+    return value && typeof value === "object" ? { json: value, parsed: true } : { json: {}, parsed: false };
+  } catch {
+    return { json: {}, parsed: false };
+  }
+}
 function parseDeviceQr(scanned) {
   const s = scanned.trim();
   if (!s) return {};
@@ -52,7 +67,13 @@ var DeviceAuthClient = class {
       headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
       body: `client_id=${encodeURIComponent(this.clientId)}&scope=${encodeURIComponent(scope)}`
     });
-    const j = await res.json();
+    const { json: j } = await readJsonSafely(res);
+    if (!res.ok || !j.device_code) {
+      throw new DeviceAuthError(
+        j.error_description ?? j.error ?? `Could not start device sign-in (HTTP ${res.status}).`,
+        res.status
+      );
+    }
     return {
       deviceCode: j.device_code,
       userCode: j.user_code,
@@ -65,15 +86,21 @@ var DeviceAuthClient = class {
   /** One poll step against the token endpoint. */
   async pollOnce(auth) {
     if (this.devMode) return { terminal: { state: "authorized", tokens: { accessToken: "dev-device-token" } } };
-    const res = await this.fetchImpl(`${this.baseURL}/oauth2/token`, {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
-      body: `grant_type=${encodeURIComponent(DEVICE_GRANT)}&device_code=${encodeURIComponent(auth.deviceCode)}&client_id=${encodeURIComponent(this.clientId)}`
-    });
-    const j = await res.json();
+    let res;
+    try {
+      res = await this.fetchImpl(`${this.baseURL}/oauth2/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
+        body: `grant_type=${encodeURIComponent(DEVICE_GRANT)}&device_code=${encodeURIComponent(auth.deviceCode)}&client_id=${encodeURIComponent(this.clientId)}`
+      });
+    } catch {
+      return {};
+    }
+    const { json: j, parsed } = await readJsonSafely(res);
     if (j.access_token) {
       return { terminal: { state: "authorized", tokens: { accessToken: j.access_token, refreshToken: j.refresh_token } } };
     }
+    if (!parsed) return {};
     switch (j.error) {
       case "authorization_pending":
         return {};
@@ -83,8 +110,11 @@ var DeviceAuthClient = class {
         return { terminal: { state: "denied", error: "The sign-in request was denied." } };
       case "expired_token":
         return { terminal: { state: "expired", error: "The code expired. Try again." } };
+      // `message` is read too so Wix's own error envelope, which carries no
+      // `error`, still reaches the user with its actual reason rather than the
+      // generic fallback.
       default:
-        return { terminal: { state: "error", error: j.error_description ?? j.error ?? "Device authorization failed." } };
+        return { terminal: { state: "error", error: j.error_description ?? j.error ?? j.message ?? "Device authorization failed." } };
     }
   }
   /** Run the full poll loop until a terminal state or the code expires. Honors
@@ -152,7 +182,15 @@ var WixNativeAuthEngine = class {
     } catch (e) {
       throw new NativeAuthError("network", e.message);
     }
-    const json = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      throw new NativeAuthError("network", `Account status lookup failed (HTTP ${res.status}).`);
+    }
+    let json;
+    try {
+      json = await res.json();
+    } catch {
+      throw new NativeAuthError("network", "Account status response was not readable JSON.");
+    }
     const status = json?.payload?.userAuthStatus ?? json?.userAuthStatus ?? {};
     if (!status.userId) return "newUser";
     return status.hasPassword ? "existingPassword" : "passwordless";
@@ -671,6 +709,14 @@ function normalizeKey(key) {
 function isSensitiveKey(key) {
   return SENSITIVE.has(normalizeKey(key));
 }
+function isSensitiveFreeTextName(name) {
+  const segments = name.split(/[^A-Za-z0-9]+/).filter(Boolean);
+  for (let i = 0; i < segments.length; i++) {
+    const tail = normalizeKey(segments.slice(i).join(""));
+    for (const k of WIX_SENSITIVE_KEYS) if (tail.startsWith(k)) return true;
+  }
+  return false;
+}
 function redactHeaders(headers) {
   const out = {};
   for (const [k, v] of Object.entries(headers)) {
@@ -699,10 +745,9 @@ function redactJson(value) {
   }
   return value;
 }
-var FORM_TOKEN_RE = new RegExp(
-  `\\b(${WIX_SENSITIVE_KEYS.map((k) => k.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})([-_]?[a-z0-9]*)?=([^&;\\s]+)`,
-  "gi"
-);
+var FORM_ASSIGNMENT_RE = /([A-Za-z0-9][A-Za-z0-9_.-]*)=([^&;\s]+)/g;
+var JSON_FIELD_RE = /"([^"\\]+)"(\s*:\s*)"((?:\\.|[^"\\])*)"/g;
+var JSON_FIELD_UNTERMINATED_RE = /"([^"\\]+)"(\s*:\s*)"(?:\\.|[^"\\])*$/;
 var BEARER_RE = /\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi;
 function redactBody(body, maxLen = 4096) {
   if (!body) return body ?? "";
@@ -720,7 +765,7 @@ function redactBody(body, maxLen = 4096) {
   return out.length > maxLen ? out.slice(0, maxLen) + "\u2026(truncated)" : out;
 }
 function scrubText(s) {
-  return s.replace(FORM_TOKEN_RE, (_m, name) => `${name}=${REDACTED}`).replace(BEARER_RE, (_m, scheme) => `${scheme} ${REDACTED}`);
+  return s.replace(FORM_ASSIGNMENT_RE, (m, name) => isSensitiveFreeTextName(name) ? `${name}=${REDACTED}` : m).replace(JSON_FIELD_RE, (m, name, sep) => isSensitiveFreeTextName(name) ? `"${name}"${sep}"${REDACTED}"` : m).replace(JSON_FIELD_UNTERMINATED_RE, (m, name, sep) => isSensitiveFreeTextName(name) ? `"${name}"${sep}"${REDACTED}` : m).replace(BEARER_RE, (_m, scheme) => `${scheme} ${REDACTED}`);
 }
 
 // ../../stdlib/auth-providers/wix/src/request-policy.ts
@@ -915,24 +960,32 @@ var SignedInstanceResolver = class {
     this.pending.set(key, task);
     try {
       const record = await task;
-      if (record) {
+      if (record && this.isCurrent(key, task)) {
         this.memoryCache.set(key, record);
         if (!this.isExpired(record)) this.storage.save(businessId, signedInstanceType, record);
       }
       return record?.signedInstance;
     } catch (error) {
       const sie = error instanceof SignedInstanceError ? error : new SignedInstanceError("Signed-instance fetch failed", "fetchFailed", error);
-      this.failureCache.set(key, { error: sie, expiry: this.now() + this.failureCacheTtlMs });
+      if (this.isCurrent(key, task)) {
+        this.failureCache.set(key, { error: sie, expiry: this.now() + this.failureCacheTtlMs });
+      }
       this.report(sie);
       throw sie;
     } finally {
-      this.pending.delete(key);
+      if (this.isCurrent(key, task)) this.pending.delete(key);
     }
   }
+  /** Whether `task` is still the in-flight fetch registered for `key` — false once
+   *  `remove`/`reset` has evicted it, or a later resolve has replaced it. */
+  isCurrent(key, task) {
+    return this.pending.get(key) === task;
+  }
   /** Evict everything for a business (e.g. on leaving / switching it). */
   remove(businessId) {
     for (const k of [...this.memoryCache.keys()]) if (k.startsWith(`${businessId}:`)) this.memoryCache.delete(k);
     for (const k of [...this.failureCache.keys()]) if (k.startsWith(`${businessId}:`)) this.failureCache.delete(k);
+    for (const k of [...this.pending.keys()]) if (k.startsWith(`${businessId}:`)) this.pending.delete(k);
     this.storage.deleteBusiness(businessId);
   }
   /** Wipe all caches (e.g. on sign-out). */
@@ -958,6 +1011,7 @@ export {
   CAPTCHA_ESCALATION_CODES,
   CaptchaEscalation,
   DeviceAuthClient,
+  DeviceAuthError,
   InMemorySessionIDStore,
   InMemorySignedInstanceStorage,
   METASITE_HEADER,
@@ -988,6 +1042,7 @@ export {
   dualDomainAuthorizeUrls,
   isAuthProxyInstance,
   isFirstPartyWixHost,
+  isSensitiveFreeTextName,
   isSensitiveKey,
   isSignedInstanceExpired,
   isSignedUploadTarget,

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-auth.mjs

@@ -70,7 +70,15 @@ var WixNativeAuthEngine = class {
     } catch (e) {
       throw new NativeAuthError("network", e.message);
     }
-    const json = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      throw new NativeAuthError("network", `Account status lookup failed (HTTP ${res.status}).`);
+    }
+    let json;
+    try {
+      json = await res.json();
+    } catch {
+      throw new NativeAuthError("network", "Account status response was not readable JSON.");
+    }
     const status = json?.payload?.userAuthStatus ?? json?.userAuthStatus ?? {};
     if (!status.userId) return "newUser";
     return status.hasPassword ? "existingPassword" : "passwordless";
@@ -402,24 +410,32 @@ var SignedInstanceResolver = class {
     this.pending.set(key, task);
     try {
       const record = await task;
-      if (record) {
+      if (record && this.isCurrent(key, task)) {
         this.memoryCache.set(key, record);
         if (!this.isExpired(record)) this.storage.save(businessId, signedInstanceType, record);
       }
       return record?.signedInstance;
     } catch (error) {
       const sie = error instanceof SignedInstanceError ? error : new SignedInstanceError("Signed-instance fetch failed", "fetchFailed", error);
-      this.failureCache.set(key, { error: sie, expiry: this.now() + this.failureCacheTtlMs });
+      if (this.isCurrent(key, task)) {
+        this.failureCache.set(key, { error: sie, expiry: this.now() + this.failureCacheTtlMs });
+      }
       this.report(sie);
       throw sie;
     } finally {
-      this.pending.delete(key);
+      if (this.isCurrent(key, task)) this.pending.delete(key);
     }
   }
+  /** Whether `task` is still the in-flight fetch registered for `key` — false once
+   *  `remove`/`reset` has evicted it, or a later resolve has replaced it. */
+  isCurrent(key, task) {
+    return this.pending.get(key) === task;
+  }
   /** Evict everything for a business (e.g. on leaving / switching it). */
   remove(businessId) {
     for (const k of [...this.memoryCache.keys()]) if (k.startsWith(`${businessId}:`)) this.memoryCache.delete(k);
     for (const k of [...this.failureCache.keys()]) if (k.startsWith(`${businessId}:`)) this.failureCache.delete(k);
+    for (const k of [...this.pending.keys()]) if (k.startsWith(`${businessId}:`)) this.pending.delete(k);
     this.storage.deleteBusiness(businessId);
   }
   /** Wipe all caches (e.g. on sign-out). */
@@ -477,6 +493,14 @@ function normalizeKey(key) {
 function isSensitiveKey(key) {
   return SENSITIVE.has(normalizeKey(key));
 }
+function isSensitiveFreeTextName(name) {
+  const segments = name.split(/[^A-Za-z0-9]+/).filter(Boolean);
+  for (let i = 0; i < segments.length; i++) {
+    const tail = normalizeKey(segments.slice(i).join(""));
+    for (const k of WIX_SENSITIVE_KEYS) if (tail.startsWith(k)) return true;
+  }
+  return false;
+}
 function redactHeaders(headers) {
   const out = {};
   for (const [k, v] of Object.entries(headers)) {
@@ -505,10 +529,9 @@ function redactJson(value) {
   }
   return value;
 }
-var FORM_TOKEN_RE = new RegExp(
-  `\\b(${WIX_SENSITIVE_KEYS.map((k) => k.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})([-_]?[a-z0-9]*)?=([^&;\\s]+)`,
-  "gi"
-);
+var FORM_ASSIGNMENT_RE = /([A-Za-z0-9][A-Za-z0-9_.-]*)=([^&;\s]+)/g;
+var JSON_FIELD_RE = /"([^"\\]+)"(\s*:\s*)"((?:\\.|[^"\\])*)"/g;
+var JSON_FIELD_UNTERMINATED_RE = /"([^"\\]+)"(\s*:\s*)"(?:\\.|[^"\\])*$/;
 var BEARER_RE = /\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi;
 function redactBody(body, maxLen = 4096) {
   if (!body) return body ?? "";
@@ -526,7 +549,7 @@ function redactBody(body, maxLen = 4096) {
   return out.length > maxLen ? out.slice(0, maxLen) + "\u2026(truncated)" : out;
 }
 function scrubText(s) {
-  return s.replace(FORM_TOKEN_RE, (_m, name) => `${name}=${REDACTED}`).replace(BEARER_RE, (_m, scheme) => `${scheme} ${REDACTED}`);
+  return s.replace(FORM_ASSIGNMENT_RE, (m, name) => isSensitiveFreeTextName(name) ? `${name}=${REDACTED}` : m).replace(JSON_FIELD_RE, (m, name, sep) => isSensitiveFreeTextName(name) ? `"${name}"${sep}"${REDACTED}"` : m).replace(JSON_FIELD_UNTERMINATED_RE, (m, name, sep) => isSensitiveFreeTextName(name) ? `"${name}"${sep}"${REDACTED}` : m).replace(BEARER_RE, (_m, scheme) => `${scheme} ${REDACTED}`);
 }
 
 // ../../stdlib/auth-providers/wix/src/session-id.ts
@@ -661,6 +684,21 @@ function pickHeader(headers, name) {
 
 // ../../stdlib/auth-providers/wix/src/device-auth.ts
 var DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+var DeviceAuthError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "DeviceAuthError";
+  }
+};
+async function readJsonSafely(res) {
+  try {
+    const value = await res.json();
+    return value && typeof value === "object" ? { json: value, parsed: true } : { json: {}, parsed: false };
+  } catch {
+    return { json: {}, parsed: false };
+  }
+}
 function parseDeviceQr(scanned) {
   const s = scanned.trim();
   if (!s) return {};
@@ -709,7 +747,13 @@ var DeviceAuthClient = class {
       headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
       body: `client_id=${encodeURIComponent(this.clientId)}&scope=${encodeURIComponent(scope)}`
     });
-    const j = await res.json();
+    const { json: j } = await readJsonSafely(res);
+    if (!res.ok || !j.device_code) {
+      throw new DeviceAuthError(
+        j.error_description ?? j.error ?? `Could not start device sign-in (HTTP ${res.status}).`,
+        res.status
+      );
+    }
     return {
       deviceCode: j.device_code,
       userCode: j.user_code,
@@ -722,15 +766,21 @@ var DeviceAuthClient = class {
   /** One poll step against the token endpoint. */
   async pollOnce(auth) {
     if (this.devMode) return { terminal: { state: "authorized", tokens: { accessToken: "dev-device-token" } } };
-    const res = await this.fetchImpl(`${this.baseURL}/oauth2/token`, {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
-      body: `grant_type=${encodeURIComponent(DEVICE_GRANT)}&device_code=${encodeURIComponent(auth.deviceCode)}&client_id=${encodeURIComponent(this.clientId)}`
-    });
-    const j = await res.json();
+    let res;
+    try {
+      res = await this.fetchImpl(`${this.baseURL}/oauth2/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
+        body: `grant_type=${encodeURIComponent(DEVICE_GRANT)}&device_code=${encodeURIComponent(auth.deviceCode)}&client_id=${encodeURIComponent(this.clientId)}`
+      });
+    } catch {
+      return {};
+    }
+    const { json: j, parsed } = await readJsonSafely(res);
     if (j.access_token) {
       return { terminal: { state: "authorized", tokens: { accessToken: j.access_token, refreshToken: j.refresh_token } } };
     }
+    if (!parsed) return {};
     switch (j.error) {
       case "authorization_pending":
         return {};
@@ -740,8 +790,11 @@ var DeviceAuthClient = class {
         return { terminal: { state: "denied", error: "The sign-in request was denied." } };
       case "expired_token":
         return { terminal: { state: "expired", error: "The code expired. Try again." } };
+      // `message` is read too so Wix's own error envelope, which carries no
+      // `error`, still reaches the user with its actual reason rather than the
+      // generic fallback.
       default:
-        return { terminal: { state: "error", error: j.error_description ?? j.error ?? "Device authorization failed." } };
+        return { terminal: { state: "error", error: j.error_description ?? j.error ?? j.message ?? "Device authorization failed." } };
     }
   }
   /** Run the full poll loop until a terminal state or the code expires. Honors
@@ -1113,6 +1166,7 @@ export {
   CLIENT_SITE_KEY_OPTIONS,
   CaptchaEscalation,
   DeviceAuthClient,
+  DeviceAuthError,
   InMemorySessionIDStore,
   InMemorySignedInstanceStorage,
   MEMBER_SITE_SETTINGS_URL,