@wix/agent-skills 1.16.0 → 1.16.1

package/skills/wix-app/scripts/scan-a11y-eslint.cjs

@@ -0,0 +1,201 @@
+#!/usr/bin/env node
+'use strict';
+
+// oxlint-disable no-console preserve-caught-error
+
+const path = require('path');
+const { createRequire } = require('module');
+
+const ROOT = process.cwd();
+const LOCAL_REQUIRE = createRequire(__filename);
+const ROOT_REQUIRE = createRequire(path.join(ROOT, 'package.json'));
+const { ESLint } = loadModule('eslint');
+const jsxA11y = loadModule('eslint-plugin-jsx-a11y');
+const tsParser = loadModule('@typescript-eslint/parser');
+
+const RULE_CONFIG = {
+  'jsx-a11y/alt-text': 'error',
+  'jsx-a11y/anchor-has-content': 'error',
+  'jsx-a11y/anchor-is-valid': 'error',
+  'jsx-a11y/aria-activedescendant-has-tabindex': 'error',
+  'jsx-a11y/aria-props': 'error',
+  'jsx-a11y/aria-proptypes': 'error',
+  'jsx-a11y/aria-role': 'error',
+  'jsx-a11y/aria-unsupported-elements': 'error',
+  'jsx-a11y/click-events-have-key-events': 'error',
+  'jsx-a11y/heading-has-content': 'error',
+  'jsx-a11y/iframe-has-title': 'error',
+  'jsx-a11y/img-redundant-alt': 'error',
+  'jsx-a11y/interactive-supports-focus': 'error',
+  'jsx-a11y/label-has-associated-control': 'error',
+  'jsx-a11y/media-has-caption': 'error',
+  'jsx-a11y/mouse-events-have-key-events': 'error',
+  'jsx-a11y/no-access-key': 'error',
+  'jsx-a11y/no-aria-hidden-on-focusable': 'error',
+  'jsx-a11y/no-autofocus': 'error',
+  'jsx-a11y/no-distracting-elements': 'error',
+  'jsx-a11y/no-interactive-element-to-noninteractive-role': 'error',
+  'jsx-a11y/no-noninteractive-element-interactions': 'error',
+  'jsx-a11y/no-noninteractive-element-to-interactive-role': 'error',
+  'jsx-a11y/no-noninteractive-tabindex': 'error',
+  'jsx-a11y/no-redundant-roles': 'error',
+  'jsx-a11y/no-static-element-interactions': 'error',
+  'jsx-a11y/prefer-tag-over-role': 'error',
+  'jsx-a11y/role-has-required-aria-props': 'error',
+  'jsx-a11y/role-supports-aria-props': 'error',
+  'jsx-a11y/scope': 'error',
+  'jsx-a11y/tabindex-no-positive': 'error',
+};
+
+function toRelative(filePath) {
+  return path.relative(ROOT, filePath) || filePath;
+}
+
+function severityLabel(severity) {
+  if (severity === 2) return 'error';
+  if (severity === 1) return 'warning';
+  return 'off';
+}
+
+function loadModule(name) {
+  try {
+    return LOCAL_REQUIRE(name);
+  } catch (localError) {
+    try {
+      return ROOT_REQUIRE(name);
+    } catch (rootError) {
+      throw new Error(
+        `Missing dependency "${name}". Local resolution failed: ${localError.message}. Root resolution failed: ${rootError.message}`,
+      );
+    }
+  }
+}
+
+function createEslint() {
+  try {
+    return new ESLint({
+      overrideConfigFile: true,
+      overrideConfig: [
+        {
+          files: ['**/*.{tsx,jsx,ts,js}'],
+          languageOptions: {
+            parser: tsParser,
+            parserOptions: {
+              ecmaFeatures: { jsx: true },
+              ecmaVersion: 2022,
+              sourceType: 'module',
+            },
+          },
+          plugins: {
+            'jsx-a11y': jsxA11y,
+          },
+          rules: RULE_CONFIG,
+        },
+      ],
+    });
+  } catch (flatConfigError) {
+    try {
+      return new ESLint({
+        useEslintrc: false,
+        overrideConfig: {
+          parser: '@typescript-eslint/parser',
+          plugins: ['jsx-a11y'],
+          parserOptions: {
+            ecmaFeatures: { jsx: true },
+            ecmaVersion: 2022,
+            sourceType: 'module',
+          },
+          rules: RULE_CONFIG,
+        },
+        extensions: ['.tsx', '.jsx', '.ts', '.js'],
+      });
+    } catch (legacyConfigError) {
+      throw new Error(
+        `Failed to initialize ESLint. Flat config error: ${flatConfigError.message}. Legacy config error: ${legacyConfigError.message}`,
+      );
+    }
+  }
+}
+
+async function main() {
+  const files = process.argv.slice(2);
+  if (files.length === 0) {
+    console.log(
+      JSON.stringify(
+        {
+          error: 'No files specified.',
+          usage: 'node <SKILL_ROOT>/scripts/scan-a11y-eslint.cjs <file1> [file2] ...',
+        },
+        null,
+        2,
+      ),
+    );
+    process.exit(1);
+  }
+
+  const absoluteFiles = files.map((f) => path.resolve(f));
+
+  const eslint = createEslint();
+
+  const results = await eslint.lintFiles(absoluteFiles);
+
+  const findings = [];
+  const parseErrors = [];
+
+  for (const result of results) {
+    const relFile = toRelative(result.filePath);
+
+    for (const msg of result.messages) {
+      if (msg.fatal) {
+        parseErrors.push({
+          file: relFile,
+          line: msg.line,
+          column: msg.column,
+          message: msg.message,
+        });
+        continue;
+      }
+
+      if (!msg.ruleId || !msg.ruleId.startsWith('jsx-a11y/')) continue;
+
+      findings.push({
+        file: relFile,
+        line: msg.line,
+        column: msg.column,
+        endLine: msg.endLine ?? null,
+        endColumn: msg.endColumn ?? null,
+        rule: msg.ruleId,
+        severity: severityLabel(msg.severity),
+        message: msg.message,
+      });
+    }
+  }
+
+  const ruleBreakdown = {};
+  for (const f of findings) {
+    ruleBreakdown[f.rule] = (ruleBreakdown[f.rule] || 0) + 1;
+  }
+
+  const output = {
+    meta: {
+      filesScanned: files.length,
+      engine: 'eslint + eslint-plugin-jsx-a11y',
+      rulesEnabled: Object.keys(RULE_CONFIG).length,
+      parseErrors,
+    },
+    findings,
+    summary: {
+      totalFindings: findings.length,
+      filesWithFindings: new Set(findings.map((f) => f.file)).size,
+      cleanFiles: files.length - new Set(findings.map((f) => f.file)).size,
+      ruleBreakdown,
+    },
+  };
+
+  console.log(JSON.stringify(output, null, 2));
+}
+
+main().catch((err) => {
+  console.error(JSON.stringify({ error: err.message }, null, 2));
+  process.exit(1);
+});

package/skills/wix-headless/references/CAPABILITIES.md

@@ -37,10 +37,23 @@ The verticals the skill operates end-to-end today: **stores · blog · cms · fo
 - **Required site features:** an index/list view of the collection; a detail page per item. (Visitor reads are public; visitor writes go through a form.) **(Opt-in, with members)** when the brief asks for per-user-private data ("my saved items", a personal list) or member-only content **and** members login is in the run, a collection can instead be **member-scoped** — each member sees/edits only their own rows, or any logged-in member reads shared member-only content. Added only on that intent, never by default; see the members cross-cutting entry and `setup-cms.md`.
 - **Implementation checklist:** show each item's main fields with clear labels; link the list to each item's detail page; show a sensible empty state when there are no items yet.
 
-### forms — capture leads
-- **Intent:** contact / lead / signup / waitlist / "let people reach me" / generic custom data capture / nothing dynamic named. **Not for RSVP** — confirming attendance to an event or occasion (a wedding, party, or gathering) is the **events** vertical, which has a built-in RSVP registration form; route there even when it's a single occasion with no tickets. Use `forms` only when no event is involved.
+### forms — any visitor-fillable form
+- **Intent:** contact / enquiry / lead / signup / waitlist / application / feedback / survey /
+  questionnaire / quote request / intake or registration form / "let people reach me" / generic custom
+  data capture — plus the **floor** when nothing dynamic is named. Lead capture is the most common
+  case, **not the boundary**: any form a visitor fills in and submits is this vertical, and whether
+  the submission also becomes a CRM contact is an optional per-field mapping.
+- **Not forms — an RSVP is `events`:** confirming attendance to an event or occasion (a wedding,
+  party, or gathering) is the **events** vertical, which ships a built-in RSVP registration form —
+  route there even for a single occasion with no tickets.
+- **Not forms — a per-service booking form is `bookings`:** the form attached to a bookable service
+  belongs to **bookings**. Use `forms` only when neither an event nor a bookable service is
+  involved.
 - **Required site features:** a visible form; a confirmation after submitting; basic field validation.
-- **Implementation checklist:** render every field with a clear label; mark which fields are required; a clear submit button; show a thank-you / success state after sending; show a friendly message if the submit fails.
+  A site may have **more than one** form, each with its own purpose and field set.
+- **Implementation checklist:** render every field with a clear label; mark which fields are required;
+  a clear submit button; show a thank-you / success state after sending; show a friendly message if
+  the submit fails.
 
 ### events — events and registration
 - **Intent:** event / ticket / RSVP / registration / attendees / "confirm attendance" / a wedding, party, or gathering people respond to. **Covers RSVP to a single occasion** (one wedding, one party) — not only multi-event listings, and not only ticketed events. An invitation with an RSVP is this vertical, not `forms`.

package/skills/wix-headless/references/SDK_HANDOFF.md

@@ -58,7 +58,7 @@ The host binds to **schema**, not to a frozen list of content IDs. **Content is
 
 Carry only the **structural** carve-outs the coding step genuinely reads — the collection/form *names and keys* you must know to query and bind, which do **not** change when an owner adds a row:
 - **cms:** `collectionId` + field keys per collection
-- **forms:** **`formId` only.** The field set, order, labels, `required`, validation format, and dropdown options are **read live from the form schema at render time** (visitor token, no elevate — `how-to-code-forms.md`), so the handoff no longer carries per-field `target` keys. Reading the schema live is the source of truth: it closes the seed↔site drift by construction (a field the owner adds/removes/relabels in the dashboard reflects on the site with no code change) and is the more v2-aligned "host resolves everything else live" shape. (For a bespoke, design-led form where dashboard-editability isn't the value prop, the host may still hardcode inputs from the known `target`s — `how-to-code-forms.md` covers that mode — but the default and the carry is `formId` only.)
+- **forms:** `formId` + each form's field `target` keys (the submission keys the frontend binds `name` = target). Field set, labels, options, and validation (`required`, format, length/pattern) are read live from the schema (`how-to-code-forms.md`).
 
 Everything else the host resolves live from the queries in §3. (Static platform constants — Stores/Bookings app IDs, the Blog appDefId — and the public `clientId` are needed too, but they're identical for every site, not seed output; they're in §2/§3.)
 

package/skills/wix-headless/references/SEED.md

@@ -34,7 +34,7 @@ Each entry states only the entities, where their count/content comes from, the p
 - **stores** — *A product catalog.* Recipe: **`setup-online-store.md`**. `intent.stores.productCount` products whose names/prices fit `brand`. If `intent.stores.categoriesNamed` is non-empty, create exactly those categories and assign products into them; **if empty, create none** (skill policy — overrides any docs default). **Variant cardinality — keep it small by default:** unless `intent.stores` calls for specific options, give each product **at most one option with ≤3 choices** (so ≤3 variants/product); many products legitimately have **no** options (a single variant). Seeding cost scales with the variant Cartesian product and the field count per variant, so don't manufacture options the brief doesn't need — but **honor a larger/explicit option set when intent names one** (this default is a floor, not a cap). Text-only by default (images only when `imagery` is on — §1, §4). **Keep (seed-time only):** `categoryIds[]` to assign products into their categories; **nothing goes to the handoff** — the frontend lists products and categories **live** (`queryProducts` / `searchProducts` / `queryCategories`), so owner-added products/categories appear with no code change.
 - **blog** — *Initial posts.* Recipe: **`setup-blog.md`**. `intent.blog.postCount` posts on `intent.blog.topics` (or brand-derived topics). Text-only (no covers). **Keep:** nothing for the handoff — posts are discovered **live** (`queryPosts`, `[...slug]` routes). Track created post ids only transiently (to confirm success / assign categories).
 - **cms** — *Content collections.* Recipe: **`setup-cms.md`**. One collection per `intent.cms.collections` entry; `itemCount` items each, content from `brand`. Collections are **public-read** (visitor reads on the frontend) by default. **(Opt-in, members only)** if the brief calls for per-user-private or member-only data **and** members login is in the run, seed that collection **member-scoped** instead (per-user or member-only — see `setup-cms.md`); a per-user collection is seeded **empty** (members populate it), since admin-seeded rows are owned by the admin. **Keep (→ handoff):** `collectionIds{<name>}` + each collection's **field keys** — this is *structural* (the frontend must know the collection name and its fields to query and bind; it doesn't change when an owner adds a row). `itemIds{<name>:[]}` only transiently, for wiring multi-references during seeding.
-- **forms** — *Lead-capture forms.* Recipe: **`setup-forms.md`**. One form per `intent.forms.forms` entry; fields from the entry; `purpose` names the form. **Keep (→ handoff):** `formIds[]` + each form's field **`target`** keys — *structural* (the frontend sets input `name` = target to submit).
+- **forms** — *Visitor-fillable forms.* Recipe: **`setup-forms.md`**. One form per `intent.forms.forms` entry; fields from the entry, `purpose` names the form. **Keep (→ handoff):** `formIds[]` + each form's field **`target`** keys — *structural* (the frontend binds each input's `name` = target to submit; targets are **immutable**, so they don't go stale when an owner relabels a field).
 - **events** — *A ticketed or RSVP occasion, or upcoming events.* Recipe: **`setup-events.md`**. Each event is **either `TICKETING`** (paid — it has ticket tiers) **or `RSVP`** (free — the registration form is built-in, so don't seed form fields) per intent. For an **RSVP occasion** (a wedding, party, gathering): one RSVP event with the occasion's real details (title, a **future** date/time, location). For a **ticketed** event: the event plus its ticket tiers (default a single `"General Admission"` tier if none named). For a **listing** site: `intent.events.eventCount` events with brand-appropriate titles and **future** start dates (a default location/timezone is fine). Text-only. **Keep:** nothing for the handoff — events and tiers are discovered **live** (`queryEvents`, `getEventBySlug`, `queryAvailableTickets`); track `eventIds`/`ticketDefinitionIds` only transiently.
 - **bookings** — *Bookable services.* Recipe: **`setup-bookings.md`**. `intent.bookings.serviceCount` services (name + short description fitting `brand`, a simple duration and price); keep the schedule minimal. **Keep:** `serviceIds[]` as **seed-time state** (pricing-plans' coverage step keys on them, below); nothing for the handoff — services are discovered **live** (`queryServices`).
 - **pricing-plans** — *Membership tiers.* Recipe: **`setup-pricing-plans.md`**. `intent.pricing-plans.planCount` recurring plans (name, price, a monthly billing cycle) fitting `brand`. **When bookings is also in this run and the intent is a membership that covers services** (a studio/gym/class pass), also **attach the covered bookings services to the plan** — seed the bookings services first, since coverage keys on their service ids (see the recipe). **Keep:** the bookings coverage only transiently, to wire it during seeding; nothing for the handoff — plans are discovered **live** (`queryPlans`) and plan→service coverage is read **live** at checkout, never from a frozen map (see `how-to-code-pricing-plans.md`).