@wix/agent-skills 1.19.0 → 1.19.2

package/skills/wix-manage/references/seo/manage-google-search-console.md

@@ -0,0 +1,272 @@
+---
+name: "Manage Google Search Console for a Wix Site"
+description: "Connect a Wix site to Google Search Console and drive its setup through the public GSC Connection and Site Readiness APIs: check connection and readiness, start the Google authorization, verify ownership, add the property, submit the sitemap, request indexing, read search performance, run URL inspection, recover a stale connection, or disconnect. The site owner authorizes in their own browser via a single-use connect URL."
+---
+
+# Manage Google Search Console for a Wix Site
+
+The **GSC Connection API** links a Google account to the site. The **GSC Site
+Readiness API** acts through that account: verifies ownership, adds the Search
+Console property, submits the sitemap, requests indexing, reads search performance
+and URL inspection. Both select the site from the caller's authorization context
+and take no site ID. Use the site already selected in the environment. If none is
+selected, list the available sites. Select the only site automatically; if several
+are available, ask the user to choose by name before making site-specific calls.
+Never invent a site ID or ask the user to type one.
+
+All endpoints are under `https://www.wixapis.com`: Connection calls under
+`/gsc/connection/v1`, everything else under `/gsc/v1`.
+
+## Start every task with two reads
+
+Both are side-effect free. Do them before describing the site's state.
+
+```
+GET https://www.wixapis.com/gsc/connection/v1/connection
+```
+
+```json
+{ "connection": { "status": "VALID", "connectedEmailMasking": "m*******@gmail.com", "ownedByCaller": true } }
+```
+
+```
+GET https://www.wixapis.com/gsc/v1/site-readiness
+```
+
+```json
+{ "siteReadiness": { "status": "NOT_READY", "blockingReason": "SITE_OWNER_NOT_VERIFIED" } }
+```
+
+Read them together:
+
+| `connection.status` | `siteReadiness` | Meaning | Next |
+|---|---|---|---|
+| `NOT_CONNECTED` | `NOT_READY` / `SITE_OWNER_NOT_VERIFIED` | No Google account linked | Connect (below) |
+| `PENDING` | any | An authorization attempt is open | Ask the user to finish it in their browser, do not start another |
+| `VALID` | `READY` | Connected and verified | Property steps if the user wants them |
+| `VALID` | `NOT_READY` / `SITE_OWNER_NOT_VERIFIED` | Connected, not verified | Verify Site |
+| `INVALID` | `NOT_READY` / `TOKEN_INVALID` | Credentials rejected by Google | Reconnect |
+| `VALID` | `NOT_READY` / `DOMAIN_MISSING` | No connected domain | User connects a domain first |
+
+`blockingReason` is `UNKNOWN_BLOCKING_REASON` when the status is `READY`; not an
+error. Treat an unrecognized reason as "not ready, no known next action".
+
+`READY` covers connection and verification only. Whether the property was added,
+the sitemap submitted, or indexing requested comes from **List Events**.
+
+## `VALID` can be stale, and `MISSING_TOKEN` means reconnect
+
+`INVALID` is only written when a real call to Google is rejected, so a site nobody
+has queried since its credentials broke keeps reporting `VALID`. The tell arrives
+on the first Google-facing call:
+
+```json
+{ "message": "FAILED_PRECONDITION: Missing Token", "details": { "applicationError": { "code": "MISSING_TOKEN" } } }
+```
+
+The reference describes `MISSING_TOKEN` as "no Google account is connected"; it
+also fires when the stored credentials are gone while Get Connection still said
+`VALID`. Either way: the Google account must be reconnected. Do not retry, and do
+not tell the user the site is connected.
+
+## Connect a Google account
+
+Get Connect URL is `GET`, but it **writes**: every call starts a new single-use
+authorization attempt (two-hour expiry) and Get Connection reports `PENDING` while
+it is open. Use Get Connection to check connection status. Call Get Connect URL
+when starting a connection or reconnection attempt; while the user completes that
+attempt, use Get Connection for status checks. Request a new URL when a new attempt
+is needed, such as after expiry. On an already-connected site it is allowed: the
+same Google account refreshes the credentials, a different one replaces the
+connection. Say which before you do it.
+
+1. Read Get Connection. If `VALID`, stop unless the user wants to reconnect.
+2. Call [Get Connect URL](https://dev.wix.com/docs/api-reference/business-management/seo/google-search-console/connection-v1/get-connect-url). The request takes no parameters or body.
+
+   ```
+   GET https://www.wixapis.com/gsc/connection/v1/connect-url
+   ```
+
+   ```json
+   { "connectUrl": "https://accounts.google.com/o/oauth2/v2/auth?client_id=407408718192.apps.googleusercontent.com&redirect_uri=https%3A%2F%2Fwww.wixapis.com%2Fgsc%2Fconnection%2Fv1%2Fconnect-callback&response_type=code&scope=openid%20email%20https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fwebmasters&state=EXAMPLE_STATE" }
+   ```
+
+   The response above is illustrative. Wix generates the authorization URL,
+   including its OAuth query parameters. Give the user the exact returned
+   `connectUrl`; do not construct, modify, or reuse the example URL.
+
+3. Give the URL to the user and ask them to tell you when they have finished. Wix
+   completes the exchange server-side; there is no code to send back.
+4. When the user says they are done, read Get Connection once and confirm `VALID`.
+   Do not poll while waiting. If it is still `PENDING`, the user has not finished;
+   if the attempt expired (two hours), request a fresh URL only after they agree.
+
+## Writes need a published, indexable site with a connected domain
+
+Get Connect URL, Verify Site, Add Site, and Submit Sitemap fail with
+`FAILED_PRECONDITION` until the site is published, has a connected (premium)
+domain, and allows indexing. The code names the first failing check:
+
+```json
+{ "message": "FAILED_PRECONDITION: The site has no connected domain. Connect a domain before connecting the site to Google Search Console",
+  "details": { "applicationError": { "code": "DOMAIN_NOT_CONNECTED" } } }
+```
+
+Codes: `SITE_NOT_PUBLISHED`, `DOMAIN_NOT_CONNECTED`, `SITE_NOT_INDEXABLE`. A free
+site on a `wixsite.com` address cannot complete these writes. Report the missing
+prerequisite and stop. When listing sites to find one that qualifies, filter for
+premium sites with a connected domain.
+
+## Set the site up in Search Console
+
+Run the steps the user asked for, in this order, confirming before each write.
+Bodies are empty unless shown.
+
+| Step | Call | Notes |
+|---|---|---|
+| Verify ownership | `POST /gsc/v1/verify-site` with `{ "method": "META" }` | Synchronous against Google, allow up to 60 s. Idempotent. Wix already places the meta tag. |
+| Add the property | `POST /gsc/v1/add-site` | Requires a verified site. |
+| Submit the sitemap | `POST /gsc/v1/submit-sitemap` | Wix hosts and generates the sitemap. Google processes it asynchronously. |
+| Request indexing | `POST /gsc/v1/request-site-indexing` | Success means Google accepted the request, not that the site is indexed. |
+| Request one page | `POST /gsc/v1/request-page-indexing` with `{ "url": "https://www.example.com/about" }` | Full URL of a page on this site. |
+
+All succeed with `{}`. Re-read Get Site Readiness after each step and act on the
+current `blockingReason`. Verify Site on an already-verified site returns `{}` and
+re-stamps the `SITE_VERIFIED` event date: safe, but not a change to report.
+
+Two Google-side failures are retryable. `RESOURCE_EXHAUSTED` (`GOOGLE_QUOTA_EXCEEDED`):
+the quota is daily, tell the user to retry tomorrow. `UNAVAILABLE`
+(`GOOGLE_UNAVAILABLE`): retry once after a few seconds. On any other error your next
+message is the final response: name the step that failed and the error code, and
+make no further Search Console calls.
+
+## Check what was done: List Events and List Sitemaps
+
+```
+GET https://www.wixapis.com/gsc/v1/events
+```
+
+```json
+{ "events": [
+  { "eventType": "ACCOUNT_CONNECTED", "occurredDate": "2025-10-29T11:10:15.869Z" },
+  { "eventType": "SITE_VERIFIED", "occurredDate": "2026-09-07T11:39:31.992Z" },
+  { "eventType": "SITE_ADDED", "occurredDate": "2025-10-29T11:07:39.050Z" } ] }
+```
+
+One entry per event type with the date it **last** occurred, **not sorted by
+date**: never read the last entry as the latest event. Types: `ACCOUNT_CONNECTED`,
+`SITE_VERIFIED`, `SITE_ADDED`, `SITEMAP_SUBMITTED`, `SITE_INDEXING_REQUESTED`,
+`PAGE_INDEXING_REQUESTED`. A missing type means that step never happened.
+
+```
+GET https://www.wixapis.com/gsc/v1/sitemaps
+```
+
+```json
+{ "sitemaps": [ { "url": "https://www.example.com/blog-posts-sitemap.xml", "type": "sitemap", "pending": false,
+  "lastDownloadedDate": "2026-09-05T15:14:47.210Z", "errorCount": "0", "warningCount": "0",
+  "contents": [ { "type": "web", "submittedCount": "1", "indexedCount": "1" } ] } ] }
+```
+
+Wix submits several sitemaps, typically one per content type. `pending: true` with
+an empty `type` means Google has not processed it yet. Counts are strings.
+
+## Read search performance
+
+```
+GET https://www.wixapis.com/gsc/v1/search-analytics?startDate=2026-08-01&endDate=2026-08-31&dimensions=query&rowLimit=5
+```
+
+```json
+{ "results": [ { "keys": ["best of santorini"], "clicks": 0, "impressions": 3, "ctr": 0, "position": 36 } ] }
+```
+
+- `startDate` and `endDate` are required, `YYYY-MM-DD`, end inclusive.
+- `dimensions` repeats: `date`, `query`, `page`, `country`, `device`,
+  `searchAppearance`; omit for one aggregate row. `keys` follow your order.
+- `type`: `web` (default), `image`, `video`, `news`. Page with `rowLimit`/`startRow`.
+- It is Google's own report: the latest days are usually missing, and there is no
+  history from before the property was added. Empty `results` is a real answer.
+
+## Inspect pages
+
+Page IDs are Wix static-page IDs, not URLs. Discover them with
+[List Item SEO Tags](https://dev.wix.com/docs/api-reference/business-management/seo/item-seo-tags-v1/list-item-seo-tags)
+for `STATIC_PAGE`. The request has no body:
+
+```
+GET https://www.wixapis.com/promote/seo/v1/item-seo-tags/STATIC_PAGE
+```
+
+Relevant response fields (unrelated SEO fields omitted; IDs are illustrative):
+
+```json
+{ "itemSeoTags": [ { "id": "STATIC_PAGE:c1dmp", "itemType": "STATIC_PAGE", "itemId": "c1dmp" } ],
+  "pagingMetadata": { "count": 1, "hasNext": false, "cursors": {} } }
+```
+
+If `pagingMetadata.hasNext` is `true`, pass `pagingMetadata.cursors.next` back as
+`paging.cursor` in the next request's query string, URL-encoded. Continue until
+`hasNext` is `false`. The optional `paging.limit` controls the page size; omit the
+cursor on the first request. Treat cursors as opaque.
+
+Use each selected entry's `itemId` as a `pageIds` entry for Inspect URLs. Do not
+use the composite `id` (`STATIC_PAGE:c1dmp`) or a page URL, and never invent an ID.
+The example below assumes discovery returned `c1dmp` for the selected page.
+
+```
+POST https://www.wixapis.com/gsc/v1/inspect-urls
+```
+
+```json
+{ "pageIds": ["c1dmp"], "updateResults": true }
+```
+
+```json
+{ "results": [ { "page": { "pageId": "c1dmp", "name": "Home", "path": "/", "itemType": "STATIC_PAGE" },
+  "status": "OK", "createdDate": "2026-09-07T12:09:55.301Z",
+  "data": { "inspectionResultLink": "https://search.google.com/search-console/inspect?resource_id=https%3A%2F%2Fwww.example.com%2F&id=EXAMPLE_INSPECTION_ID",
+    "indexStatusResult": { "verdict": "PASS", "coverageState": "Submitted and indexed",
+      "indexingState": "INDEXING_ALLOWED", "lastCrawlTime": "2026-08-16T11:39:45Z",
+      "googleCanonical": "https://www.example.com/", "userCanonical": "https://www.example.com/" } } } ],
+  "status": "COMPLETE", "remainingPageCount": 0 }
+```
+
+- `data.inspectionResultLink` is returned by Google. The complete URL above is
+  illustrative; use the actual returned link unchanged, including its query
+  parameters. Do not construct a link from the example values.
+- Each page spends one unit of the account's Google quota (2,000 per property per
+  day): confirm the page list first. Sites over 2,000 pages fail with
+  `SITE_EXCEEDS_INSPECTION_LIMIT`.
+- The site stores **one** inspection; without `updateResults: true` a new call
+  replaces it. Prefer `true` unless the user wants a clean run.
+- `ONGOING`: poll `GET https://www.wixapis.com/gsc/v1/inspection` every few
+  seconds until `COMPLETE` or `ERROR` (same shape plus `updatedDate`).
+- `remainingPageCount > 0` on `COMPLETE` means quota ran out. Name the missing
+  pages; do not call it done.
+- `data` is Google's raw URL Inspection payload: read `indexStatusResult.verdict`
+  (`PASS`, `PARTIAL`, `FAIL`, `NEUTRAL`) and `coverageState`; text is English only.
+  `UNKNOWN_INSPECTION_STATUS` with empty `results` means never inspected.
+
+## Disconnect and clear
+
+Two different removals; confirm which one the user wants.
+
+| Call | Removes | Keeps |
+|---|---|---|
+| `POST /gsc/connection/v1/disconnect` | Stored Google credentials | Verification tag, Search Console property |
+| `POST /gsc/v1/clear-verification` | Verification tag, verification state, **and** credentials | Search Console property |
+
+Neither removes the site from Search Console or revokes Wix's access on Google's
+side. Disconnect with no stored credentials returns `NOT_FOUND`
+(`CONNECTION_NOT_FOUND`).
+
+## When a call fails
+
+- `403` or `PERMISSION_DENIED`: stop after the first and report the missing SEO
+  permission (reads need view access to SEO settings, writes need manage access).
+  Do not try another site, path, or method.
+- `FAILED_PRECONDITION`: act on `details.applicationError.code` as above. Do not
+  retry the same call.
+- Get Connect URL is a recovery step only for `MISSING_TOKEN`, `INVALID`, or
+  `TOKEN_INVALID`, and only after the user agrees to reconnect.

package/skills/wix-manage/references/sites/upload-static-site.md

@@ -0,0 +1,283 @@
+---
+name: "Upload a Website or HTML Files"
+description: Publish a user's ready-made website — an index.html, a static build, or a zip exported from an AI builder or any other tool — as a new live Wix site. Covers both ways to get there — handing the user the Wix Headless drop page, and calling the Wix Headless instant-site REST API yourself when you can reach the files and make outbound HTTPS requests. When you also hold the user's identity, covers putting the published site straight into their Wix account and reading back its final live URL. Use whenever the user wants to upload, publish, deploy, or host their own HTML/CSS/JS as a NEW site, including files generated for them earlier in the conversation, or to update a site already published this way (iterate on the same site instead of creating another). Not for migrating a live store/site from another platform by URL or from CSV exports (use Site Import), not for adding HTML or custom code into an existing Wix site, and not for uploading images or documents to a site's media files.
+---
+
+# Upload a Website or HTML Files
+
+The user has a finished website as files — hand-written HTML, a static build, a
+zip, or the output of an AI site builder — and wants it live on Wix as a new
+site. There are two ways to get there.
+
+## The two paths
+
+**[Path A — hand the user the drop page](#path-a--hand-the-user-the-drop-page).**
+One URL; the user uploads in the browser and gets a live site. This works for
+**any** agent and any user — it's the default. Reach for it whenever you can't
+clearly do Path B.
+
+**[Path B — publish the files yourself](#path-b--publish-the-files-yourself).**
+Three calls put the site live without the user touching a browser. Available only
+when **both** hold: you can read the file bytes (you generated them here, or
+they're reachable from where you run), **and** you can do a `multipart/form-data`
+file upload from a shell (`curl` or equivalent). Reaching APIs *only* through the
+Wix API-call/execute-API tools does **not** count — they can't upload a local
+file.
+
+Prefer Path B when you can genuinely do it — the user gets a live site without
+uploading anything themselves. Otherwise, and by default, take Path A. Decide
+honestly: if you can't read the bytes or can't upload from a shell, hand over the
+drop page rather than attempting Path B and reporting an upload you couldn't
+perform.
+
+## Path A — hand the user the drop page
+
+Send the user here:
+
+```
+https://www.wix.com/headless/drop?utm_campaign=mcp&agent=<your-agent-id>
+```
+
+**Keep `utm_campaign=mcp`** (the drop-flow referral tag — don't change it) **and set
+`agent` to your own identifier** — the coding agent or tool you are (e.g.
+`claude-code`, `cursor`, `codex-cli`, `windsurf`, `github-copilot`, or your product's
+name). Hand the URL with `agent` filled in and both params intact. There the user drags
+in their files (no login), Wix hosts them immediately on a live URL, and a banner
+offers to sign in and keep the site. Tell them the requirements from
+[What the upload accepts](#what-the-upload-accepts-and-how-it-fails) so it doesn't
+fail on the first try.
+
+## Path B — publish the files yourself
+
+> **Run every call from your shell with `curl` — not the Wix API-call/execute-API
+> tools.** The upload (step 2) and the download in
+> [Add a backend](#keep-building-add-a-backend-when-you-need-one) move a **file**
+> to or from disk; those tools proxy JSON and can't (hand-building a multipart
+> body inline silently drops every image and font). Create and release are plain
+> JSON and would work through anything, but the upload needs a real file client
+> anyway, so keep it all in the shell. **None of steps 1–3 (or the download) need
+> auth — they're anonymous.** Only [claim](#4-put-the-site-in-the-users-account)
+> needs the user's identity.
+
+```
+Base URL: https://www.wixapis.com/headless-business-setup
+```
+
+Generate `anonymousId` yourself — any UUID, **once per site, not once per
+request** — and reuse it (with the returned `metaSiteId`) for every call for that
+site, including later changes ([Iterate](#iterate-while-anonymous-dont-create-a-new-site)).
+**Finish within one hour of step 1**: after that the record expires and every
+later step, claim included, returns `404`.
+
+### 1. Create the site
+
+```bash
+curl -sS -X POST \
+  "https://www.wixapis.com/headless-business-setup/v1/headless-business/anonymous/$ANONYMOUS_ID"
+```
+
+```json
+{ "metaSiteId": "f0ad8672-09e9-4111-b6fe-070c70bd2df5",
+  "projectId":  "54528d34-b23c-4fbe-b07d-2c522350abd7" }
+```
+
+Keep both: `metaSiteId` addresses the site in every later call; `projectId`
+builds the save link in step 3b.
+
+### 2. Upload the files
+
+One `multipart/form-data` request carrying every file. Each file is a part named
+`files` whose **filename is its path relative to the site root** — that is how
+subdirectories survive; with `curl`, set it explicitly with `;filename=` whenever
+it isn't just the basename. A single `.zip` part works too — send it alone and
+it's unpacked server-side, a single wrapping folder stripped.
+
+```bash
+AGENT=claude-code   # ← replace with your own identifier (see note below)
+curl -sS -X POST \
+  "https://www.wixapis.com/headless-business-setup/v1/headless-business/anonymous/$ANONYMOUS_ID/$META_SITE_ID/upload?campaign=mcp&agent=$AGENT" \
+  -F "files=@index.html;filename=index.html" \
+  -F "files=@assets/styles.css;filename=assets/styles.css" \
+  -F "files=@assets/logo.png;filename=assets/logo.png"
+```
+
+```json
+{ "uploadId": "03244542-d820-42f6-acfa-166c6658b1a6" }
+```
+
+Keep `campaign=mcp` (the drop-flow referral tag — don't change it) and set
+`agent=$AGENT` to **your own identifier**: the coding agent or tool performing this
+drop, so the upload is attributed to the real client. Use a short, stable,
+lowercase-hyphenated slug — e.g. `claude-code`, `cursor`, `codex-cli`, `windsurf`,
+`github-copilot`, or your product's name; if you genuinely can't name yourself, use
+`unknown-agent`. Send the **same** `agent` on every upload for this site, matching
+the `agent` you'd use in Path A. Nothing is live yet; this only stages and validates.
+
+### 3. Release — the site goes live
+
+```bash
+curl -sS -X POST \
+  "https://www.wixapis.com/headless-business-setup/v1/headless-business/anonymous/$ANONYMOUS_ID/$META_SITE_ID/release" \
+  -H 'Content-Type: application/json' \
+  -d "{\"uploadId\":\"$UPLOAD_ID\"}"
+```
+
+```json
+{ "siteUrl": "https://instant-hguwrvtcrniw-headlessstack-140d.wix-site-host.com" }
+```
+
+The site is live at `siteUrl` immediately.
+
+#### Iterate while anonymous (don't create a new site)
+
+Simple static changes — new copy, another page, a different look — happen here,
+**while the site is still anonymous**, and this is the only window for them:
+re-run steps 2–3 with the **same `anonymousId` and `metaSiteId`**; the upload
+replaces the site's contents and `siteUrl` stays the same. Send the full file set
+each time (release replaces, it doesn't merge). Don't go back to step 1 — a fresh
+site per change leaves the user a trail of abandoned sites on changing URLs; only
+create another for a genuinely separate site.
+
+So **iterate first, claim last**: refine on the same ids until the site is right,
+*then* finish. Once claimed, these anonymous endpoints stop working and the only
+way to keep changing the site in code is a headless project
+([Keep building](#keep-building-add-a-backend-when-you-need-one)).
+
+**When the site is final, finish based on identity:**
+
+- **You have the user's access token** — claim it into their account (step 4).
+  Don't stop at a temporary site: an unclaimed site expires, so saving it is part
+  of publishing, not an extra favour to ask about.
+- **You have no user identity** — stop here; this is a finished, legitimate result
+  (exactly what the drop page produces for every visitor). Give the user `siteUrl`
+  plus the save link, which is how the site survives:
+
+  ```
+  https://www.wix.com/live-headless-site/{projectId}?anonymousId={anonymousId}
+  ```
+
+  That page shows the site with a countdown and signs the user in to keep it.
+  Treat the link as a secret — whoever opens it while signed in to Wix claims the
+  site into *their* account — so give it only to the user who asked.
+
+### 4. Put the site in the user's account
+
+```bash
+curl -sS -X POST \
+  "https://www.wixapis.com/headless-business-setup/v1/headless-business/anonymous/$ANONYMOUS_ID/$META_SITE_ID/claim" \
+  -H "Authorization: Bearer $ACCESS_TOKEN"
+```
+
+Returns `{}` on success; needs a user or account-level identity (else
+`UNAUTHENTICATED`). It consumes the anonymous record, so it's the last call that
+works against these endpoints — do it after the release, never before.
+
+**The site's URL changes here.** The step-3 host stops resolving — the free host
+is scoped to the owning account and re-minted under the user's. Read the new one
+in step 5; never repeat the step-3 URL after a claim.
+
+### 5. Read the site's final URL
+
+[Query Sites](https://dev.wix.com/docs/api-reference/account-level/sites/sites/query-sites)
+filtered to the **`HEADLESS` namespace** — headless sites are omitted from the
+default query, so the filter is required, and an `id` filter is rejected, so match
+the id yourself.
+
+```bash
+curl -sS -X POST "https://www.wixapis.com/site-list/v2/sites/query" \
+  -H "Authorization: Bearer $ACCESS_TOKEN" \
+  -H 'Content-Type: application/json' \
+  -d '{"query":{"filter":{"namespace":"HEADLESS"},"cursorPaging":{"limit":100}}}'
+```
+
+Find the entry whose `id` equals your `metaSiteId`, read `viewUrl` (page with
+`metadata.cursors.next` if needed):
+
+```json
+{ "id": "f0ad8672-09e9-4111-b6fe-070c70bd2df5",
+  "displayName": "Snake", "published": true, "namespace": "HEADLESS",
+  "viewUrl": "https://instant-hguwrvtcrniw-ayalg5-1406.wix-site-host.com/" }
+```
+
+Give the user two links: `viewUrl` for the live site, and its dashboard at
+`https://manage.wix.com/dashboard/{metaSiteId}` to manage it.
+
+### What the upload accepts, and how it fails
+
+The requirements below apply to both paths — an upload that breaks them is why a
+release never happens:
+
+- **A top-level HTML file is required.** It needn't be named `index.html` (a lone
+  top-level HTML of any name becomes the homepage), but once there's more than
+  one, an `index.html` must be among them.
+- **3 MB per file, 20 MB per site.**
+- **Static files only** — HTML, CSS, JS, images, fonts. Framework source that
+  needs a build step (a `package.json`, React/Vue sources) must be built first;
+  upload the build output.
+
+On Path B, failures come back as HTTP 400 with a code in
+`details.applicationError.code`: `MISSING_INDEX_HTML` (add a top-level HTML),
+`FILE_TOO_LARGE` (a file over 3 MB), `TOTAL_TOO_LARGE` (bundle over 20 MB). A
+`404` after step 1 means the one-hour window passed or the site was already
+claimed — start again from step 1.
+
+**If Path B fails for any reason you can't quickly fix — a rejected upload, an
+error, a call you can't make — fall back to [Path A](#path-a--hand-the-user-the-drop-page):
+give the user the drop-page link so they can finish in the browser.** Never leave
+them with a failed publish and no way forward; the drop page reaches the same
+result without the step that broke.
+
+## Keep building: add a backend when you need one
+
+The drop flow publishes **static** files. When the site needs a real backend —
+stores, payments, bookings, a CMS, members, forms — it becomes a **Wix Headless
+project**. This is a solution the user chooses when the need appears, not a
+required step: a static site is a finished result on its own.
+
+Offer it once the site is claimed/owned and you're in a coding environment with a
+shell. It keeps the **same site, appId and URL** (the downloaded project already
+carries a `wix.config.json` binding it), and is released with the Wix CLI from
+then on:
+
+```bash
+curl -sSL -o project.zip \
+  "https://www.wix.com/_api/wixstro-deployments/v1/instant-sites/$META_SITE_ID/download.zip"
+unzip project.zip -d project      # index.html + assets + wix.config.json
+```
+
+Then follow `https://wix.com/headless/skill.md`: it turns the static files into a
+headless project (`@wix/sdk` + the business solutions the site needs), bound to
+the same site.
+
+This is the only way to keep changing a **claimed** site in code, and it's why it
+needs `wix login`: re-releasing to a claimed site is authenticated *and*
+file-based, and an authenticated file operation needs the token in your **shell**
+(via `wix login`), not injected into a tool — the API-call/execute-API tools carry
+the auth but can't do file operations. There's no lighter "re-upload static to my
+claimed site" shortcut.
+
+## Route the request correctly
+
+- **You can't read the files, can't make HTTP calls, or have no shell
+  (API-call/execute-API tools only, which can't upload a file)** — Path A, the
+  drop page. It's also the default whenever Path B isn't clearly available, and
+  the fallback whenever Path B fails partway — hand over the link, don't leave the
+  user stuck.
+- **Files you generated here or can read, and you can upload from a shell** —
+  Path B. If you hold the user's identity, claim it into their account and return
+  the live URL + dashboard.
+- **A change to a site you published this way here** —
+  [iterate in place](#iterate-while-anonymous-dont-create-a-new-site) on the same ids.
+- **A published anonymous site the user wants to keep** — steps 4–5 with their
+  identity, else the step-3 save link.
+- **A claimed site that now needs a backend** (stores, bookings, CMS, members,
+  forms) — [add a backend](#keep-building-add-a-backend-when-you-need-one).
+- **Migrating a live site/store from another platform by URL, or CSV/TSV
+  exports** — [Site Import](site-import.md).
+- **Adding HTML, an embed, or code to an existing Wix site** — not this recipe
+  (that's custom code in the editor).
+- **Images, videos, or documents for a site** —
+  [Upload Media to Wix](../media/upload-media-to-wix.md).
+
+Don't create the site with other tools (meta-site templates, headless-business
+provisioning) — those make an empty site, not a published copy of the user's files.

package/skills/wix-manage/references/stores/change-store-currency.md

@@ -5,6 +5,6 @@ description: "Changes the store's payment currency through Site Properties and e
 
 # Change Store Currency
 
-Use the [Site Properties currency recipe](https://dev.wix.com/docs/api-reference/business-management/site-properties/skills/change-payment-currency-site-properties.md) to set the requested payment currency and read it back. Confirm the change with the user before updating it.
+Use the [Change a Site's Regional Properties (Currency, Time Zone, Language) via Site Properties API](../site-properties/change-payment-currency-site-properties.md) recipe to set the requested payment currency and read it back. Confirm the change with the user before updating it.
 
 Catalog product responses may temporarily show the previous currency after carts and checkout use the new one. Allow time for propagation, then recheck.

package/skills/wix-vibe-headless/platforms/base44-ecom-light-seed-with-install.md

@@ -100,7 +100,9 @@ product **without** `imageUrl` and attach it afterwards with `attachProductImage
 
 ## STEP 4 — Wrap up
 
-### Preview
+### Verify
+
+Verify **once, after the seed** — home, shop, and a product page against the populated catalog.
 
 Images that are still generating may show `/__generating__/…` placeholders;
 the platform replaces these automatically at turn end, with a stock fallback if generation

package/skills/wix-vibe-headless/platforms/base44-ecom-light-seed.md

@@ -85,7 +85,9 @@ product **without** `imageUrl` and attach it afterwards with `attachProductImage
 
 ## STEP 3 — Wrap up
 
-### Preview
+### Verify
+
+Verify **once, after the seed** — home, shop, and a product page against the populated catalog.
 
 Images that are still generating may show `/__generating__/…` placeholders;
 the platform replaces these automatically at turn end, with a stock fallback if generation

package/skills/wix-vibe-headless/platforms/base44-ecom-light.md

@@ -62,7 +62,7 @@ need to diagnose and fix it.
 
 **No seeding in this flow** — the client is the only deliverable. Do not seed, populate, or write data to Wix.
 
-### Preview
+### Verify
 
 Images that are still generating may show `/__generating__/…` placeholders;
 the platform replaces these automatically at turn end, with a stock fallback if generation