@wix/agent-skills 1.21.0 → 1.22.0

package/skills/wix-headless-fast/references/shared/app/styles/global.css

@@ -1,52 +0,0 @@
-@import url('https://fonts.googleapis.com/css2?family=Wix+Madefor+Text:wght@400;500;600;700;800&display=swap');
-@import 'tailwindcss';
-
-/* ─── THE design system ─────────────────────────────────────────────────────────────────
-   Theme the entire store by editing THIS @theme block (same token family as the official
-   Wix headless templates). Every shipped component styles itself from these via Tailwind
-   utilities (bg-primary, text-muted-foreground, rounded-lg, …) — change a token, everything
-   follows. A dark theme is just flipped values (dark background/foreground, adjusted
-   secondary/border). Don't restyle shipped component markup; restyle the tokens.
-
-   Choosing values: argue polarity from the business — light is not "cheap" (wellness/food
-   usually read better light); never dark-by-default for "premium". Palette: one dominant +
-   accents from ADJACENT hues (~30° arc), 2-4 colors total. Every background/foreground pair
-   you set must hit WCAG 4.5:1 (3:1 for text ≥24px); body copy never below 16px/1.5. Derive
-   from THIS brand — a look repeated across projects is a failure, not a shortcut. The user's
-   explicit direction beats all of this except the contrast floor. */
-@theme {
-  --color-background: hsl(0 0% 100%);
-  --color-foreground: hsl(230 24% 14%);
-  --color-primary: hsl(230 24% 14%);
-  --color-primary-foreground: hsl(0 0% 100%);
-  --color-secondary: hsl(228 24% 96%);
-  --color-secondary-foreground: hsl(230 24% 14%);
-  --color-muted-foreground: hsl(228 8% 46%);
-  --color-border: hsl(220 14% 90%);
-
-  --radius-lg: 12px;
-  --radius-md: 8px;
-  --radius-sm: 6px;
-
-  --font-sans: 'Wix Madefor Text', system-ui, sans-serif;
-}
-
-@layer base {
-  body {
-    background-color: var(--color-background);
-    color: var(--color-foreground);
-    font-family: var(--font-sans);
-    -webkit-font-smoothing: antialiased;
-    font-feature-settings: 'cv02', 'cv03', 'cv04', 'cv11';
-  }
-}
-
-@layer utilities {
-  .eyebrow {
-    font-size: 0.8125rem;
-    font-weight: 600;
-    letter-spacing: 0.1em;
-    text-transform: uppercase;
-    color: var(--color-muted-foreground);
-  }
-}

package/skills/wix-headless-fast/references/shared/app/wix/config.ts

@@ -1,15 +0,0 @@
-// Wix connection config — written by the skill's deploy step (install/deploy.mjs).
-//
-// WIX_CLIENT_ID = null  → ambient auth (a Wix-managed Astro project: `@wix/astro` authenticates
-//                         every SDK call automatically; there is no client and nothing to set).
-// WIX_CLIENT_ID = "..." → manual visitor client (any other React setup): the public OAuth client id.
-//                         It is NOT a secret — it only mints anonymous visitor tokens — so
-//                         hardcoding and committing it is fine. On a Wix-managed non-Astro project
-//                         it equals the `appId` in wix.config.json.
-export const WIX_CLIENT_ID: string | null = null;
-
-// The Members vertical uses an explicit OAuthStrategy client only to drive the
-// custom credential form. In managed Astro it writes the resulting member
-// tokens into Astro's wixSession cookie, so subsequent ambient SDK calls use
-// that same member identity.
-export const WIX_MEMBERS_CLIENT_ID: string | null = null;

package/skills/wix-headless-fast/references/shared/app/wix/media.ts

@@ -1,81 +0,0 @@
-// Wix media resolution — define once, use on EVERY image render path. Copy as-is.
-//
-// SDK media fields come back either as an already-absolute https URL, or as a
-// `wix:image://v1/<hash>/<file>#originWidth=…` identifier that a browser cannot load
-// (ERR_UNKNOWN_URL_SCHEME). The wix:image:// form must go through the SDK media module;
-// never hand-build a static.wixstatic.com URL (wrong format → 403).
-// docs: https://dev.wix.com/docs/sdk/core-modules/sdk/media.md
-import { media } from "@wix/sdk";
-
-type MediaLike =
-  | string
-  | null
-  | undefined
-  | { image?: string | null; url?: string | null };
-
-/** Resolve any Wix media value to a browser-loadable URL ("" when absent). */
-export function imgSrc(value: MediaLike, width = 600, height = 600): string {
-  const v =
-    typeof value === "object" && value !== null
-      ? (value.image ?? value.url ?? "")
-      : (value ?? "");
-  if (!v) return "";
-  if (typeof v === "string" && v.startsWith("wix:image://")) {
-    return media.getScaledToFillImageUrl(v, width, height, {});
-  }
-  if (typeof v !== "string") return "";
-  // An absolute Wix media URL (bare, or already carrying a /v1/fill/ segment at some other size):
-  // re-issue it through the scaler at the requested size, so every image path lands on one shape.
-  const m = v.match(/^https:\/\/static\.wixstatic\.com\/media\/([^/?#]+)/);
-  if (m) return `https://static.wixstatic.com/media/${m[1]}/v1/fill/w_${width},h_${height},al_c,q_90/${m[1]}`;
-  return v;
-}
-
-/**
- * Responsive candidates for `srcset`: the same image at several widths through Wix's scaler, so a
- * card never downloads a hero-sized file. Pair with `sizes`:
- *   <img src={imgSrc(m, 640, 640)} srcSet={imgSrcSet(m)} sizes="(min-width: 1024px) 25vw, 50vw"
- *        width={640} height={640} loading="lazy" alt={…} />
- * Accepts every form an image reaches you in: a raw `wix:image://` id, an ALREADY-RESOLVED Wix URL
- * (what the DTOs carry — `imageUrl`, `gallery[]`; its `/v1/fill/w_…,h_…` segment is rewritten per
- * width), or any other https URL (returned as the single candidate). `ratio` is height/width
- * (1 = square). "" only when there is no image at all — still set `src` as well.
- */
-export function imgSrcSet(value: MediaLike, widths: number[] = [320, 480, 640, 960], ratio = 1): string {
-  const raw = typeof value === "object" && value !== null ? (value.image ?? value.url ?? "") : (value ?? "");
-  if (typeof raw !== "string" || !raw) return "";
-  if (raw.startsWith("wix:image://")) {
-    return widths.map((w) => `${imgSrc(value, w, Math.round(w * ratio))} ${w}w`).join(", ");
-  }
-  // A resolved Wix URL: …/v1/fill/w_800,h_800,al_c,… — swap the size for each width.
-  const FILL = /\/v1\/fill\/w_\d+,h_\d+/;
-  if (/static\.wixstatic\.com\//.test(raw) && FILL.test(raw)) {
-    return widths.map((w) => `${raw.replace(FILL, `/v1/fill/w_${w},h_${Math.round(w * ratio)}`)} ${w}w`).join(", ");
-  }
-  return raw; // one candidate, never an empty srcset for a real image
-}
-
-/**
- * Everything an <img> needs for one Wix image, so a tile can never ship `srcSet` without `src`:
- *   <img {...imgAttrs(p.imageUrl, "(min-width: 1024px) 25vw, 50vw")} alt={p.name} />
- * `sizes` is the width the image renders at (a CSS length or media-query list); `ratio` is
- * height/width. Returns an empty object when there is no image — render your placeholder then.
- */
-export function imgAttrs(value: MediaLike, sizes: string, ratio = 1): { src: string; srcSet: string; sizes: string; loading: "lazy"; decoding: "async" } | Record<string, never> {
-  const src = imgSrc(value, 640, Math.round(640 * ratio));
-  if (!src) return {};
-  return { src, srcSet: imgSrcSet(value, undefined, ratio), sizes, loading: "lazy", decoding: "async" };
-}
-
-/**
- * The identity of a media value BEFORE scaling — de-duplicate galleries on this, never on a
- * resolved URL (two scaled URLs of one photo differ in their size parameters).
- */
-export function mediaKey(value: MediaLike): string {
-  const v = typeof value === "object" && value !== null ? (value.image ?? value.url ?? "") : (value ?? "");
-  if (!v) return "";
-  // The file id, whichever form the value takes — a raw id and a resolved URL of one photo share it.
-  if (v.startsWith("wix:image://")) return v.slice("wix:image://v1/".length).split("/")[0].split("#")[0];
-  const m = v.match(/^https:\/\/static\.wixstatic\.com\/media\/([^/?#]+)/);
-  return m ? m[1] : v;
-}

package/skills/wix-headless-fast/references/shared/app/wix/money.ts

@@ -1,24 +0,0 @@
-// Money formatting for API amounts that carry no formatted string. Copy as-is.
-//
-// Catalog prices come with a ready `formattedAmount` — use that directly. But eCom Cart V2
-// amounts are ConvertedMoney `{ amount, convertedAmount }` with NO formatted string, and the
-// currency lives on the cart, not on the money object. Never hardcode "$" or assume USD.
-export interface ConvertedMoneyLike {
-  amount?: string | null;
-  convertedAmount?: string | null;
-}
-
-/** Format a ConvertedMoney in the given currency, using the visitor's locale. */
-export function formatMoney(
-  money: ConvertedMoneyLike | null | undefined,
-  currencyCode: string | null | undefined,
-): string {
-  const value = money?.convertedAmount ?? money?.amount;
-  if (value == null || value === "") return "";
-  const currency = currencyCode || "USD";
-  try {
-    return new Intl.NumberFormat(undefined, { style: "currency", currency }).format(Number(value));
-  } catch {
-    return `${value} ${currency}`;
-  }
-}

package/skills/wix-headless-fast/references/shared/app/wix/sdk.ts

@@ -1,89 +0,0 @@
-// The one auth seam for every Wix SDK call in this app. Copy as-is; do not rewrite.
-//
-// Two modes, switched by WIX_CLIENT_ID in ./config:
-//   null (ambient)  — a Wix-managed Astro project: `@wix/astro` authenticates raw SDK module
-//                     calls automatically, server-side AND in client islands. `wixModule()`
-//                     returns the module untouched.
-//   string (manual) — any other React setup (Vite SPA, non-Astro): one shared client is built
-//                     with OAuthStrategy, and `wixModule()` returns the module bound to it.
-//                     The strategy self-manages visitor tokens on every call (mints on first
-//                     use, renews on expiry) and persists them through the storage below.
-//
-// The visitor token IS the identity of the current cart / member session, so in manual mode
-// tokens persist to localStorage — never re-minted per load (a fresh anonymous mint is a NEW
-// visitor and silently empties the cart).
-// docs: https://dev.wix.com/docs/sdk/core-modules/sdk/oauth-strategy.md
-// docs: https://dev.wix.com/docs/go-headless/wix-managed-headless/authentication/about-the-astro-integration.md
-import { createClient, OAuthStrategy, EMPTY_TOKENS } from "@wix/sdk";
-import { fetchWithAuth as ambientFetch } from "@wix/sdk/context";
-import type { IOAuthStrategy, TokenStorage, Tokens } from "@wix/sdk";
-import { WIX_CLIENT_ID } from "./config";
-
-const STORAGE_KEY = `wix-session-${WIX_CLIENT_ID ?? "ambient"}`;
-
-function browserTokenStorage(): TokenStorage {
-  return {
-    getTokens(): Tokens {
-      if (typeof window !== "undefined") {
-        try {
-          const raw = window.localStorage.getItem(STORAGE_KEY);
-          if (raw) return JSON.parse(raw) as Tokens;
-        } catch {
-          /* disabled/corrupt storage — fall through to empty */
-        }
-      }
-      return EMPTY_TOKENS;
-    },
-    setTokens(tokens: Tokens): void {
-      if (typeof window === "undefined") return;
-      try {
-        window.localStorage.setItem(STORAGE_KEY, JSON.stringify(tokens));
-      } catch {
-        /* storage full/disabled — the session just won't survive a reload */
-      }
-    },
-  };
-}
-
-const client = WIX_CLIENT_ID
-  ? createClient({
-      auth: OAuthStrategy({
-        clientId: WIX_CLIENT_ID,
-        tokenStorage: browserTokenStorage(),
-      }),
-    })
-  : null;
-
-/**
- * Bind an SDK module to this app's auth. Usage (identical in both modes):
- *   import { productsV3 } from "@wix/stores";
- *   const products = wixModule(productsV3);
- *   await products.queryProducts(...)
- */
-export function wixModule<T>(module: T): T {
-  // The cast bridges the SDK's internal Descriptors constraint; the in/out type is identical.
-  return client
-    ? (client.use(module as unknown as Record<string, unknown>) as unknown as T)
-    : module;
-}
-
-/**
- * An authenticated fetch of a Wix REST endpoint under the SAME auth as the SDK modules (ambient
- * on managed Astro, the shared client elsewhere) — for the few APIs whose generated SDK module is
- * too heavy to bundle (the Forms schema module alone is 15 MB: server-side it pushes a Wix
- * deploy past its size limit, client-side every visitor downloads it). Same visitor identity,
- * same token, no second mint. `path` is the wixapis.com path; returns the raw Response.
- */
-export function wixFetch(path: string, init?: RequestInit): Promise<Response> {
-  const url = path.startsWith("http") ? path : `https://www.wixapis.com${path}`;
-  return client ? client.fetchWithAuth(url, init) : ambientFetch(url, init);
-}
-
-/**
- * The shared data client's manual-mode auth strategy, or null under ambient auth. The
- * Members vertical deliberately owns a separate explicit client for its custom in-app login;
- * app code reads that session through the members hooks instead.
- */
-export function wixAuth(): IOAuthStrategy | null {
-  return client ? client.auth : null;
-}

package/skills/wix-headless-fast/references/shared/capabilities/media-upload/app/wix/media-upload/client.ts

@@ -1,46 +0,0 @@
-// Safe browser half of the optional Media Upload capability.
-// The browser supplies bytes only. It cannot choose a destination or elevate a Wix call:
-// the named policy is enforced by /api/wix/media-upload on the server.
-
-export type UploadedMedia = {
-  id: string;
-  url?: string;
-  uploadUrl: string;
-};
-
-type UploadPolicyRequest = {
-  policyId: string;
-  fileName: string;
-  mimeType: string;
-  sizeInBytes: number;
-};
-
-export async function uploadMedia(policyId: string, file: File | Blob, fileName?: string): Promise<UploadedMedia> {
-  const mimeType = file.type;
-  const request: UploadPolicyRequest = {
-    policyId,
-    fileName: fileName ?? (file instanceof File ? file.name : "upload"),
-    mimeType,
-    sizeInBytes: file.size,
-  };
-  const ticket = await fetch("/api/wix/media-upload", {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(request),
-  });
-  if (!ticket.ok) throw new Error(`Upload could not be authorized (${ticket.status})`);
-  const { uploadUrl } = (await ticket.json()) as UploadedMedia;
-
-  const uploaded = await fetch(uploadUrl, {
-    method: "PUT",
-    headers: { "Content-Type": mimeType },
-    body: file,
-  });
-  const payload = (await uploaded.json().catch(() => null)) as
-    | { file?: { id?: string; url?: string }; id?: string; url?: string }
-    | null;
-  const media = payload?.file ?? payload;
-  if (!uploaded.ok || !media?.id) throw new Error(`Upload failed (${uploaded.status})`);
-
-  return { id: media.id, url: media.url, uploadUrl };
-}

package/skills/wix-headless-fast/references/shared/capabilities/media-upload/app-astro/pages/api/wix/media-upload.ts

@@ -1,46 +0,0 @@
-import type { APIRoute } from "astro";
-import { auth } from "@wix/essentials";
-import { files } from "@wix/media";
-import { mediaUploadPolicies } from "../../../wix/media-upload/policies.generated";
-
-const elevatedGenerateUploadUrl = auth.elevate(files.generateFileUploadUrl);
-
-type UploadRequest = {
-  policyId?: unknown;
-  fileName?: unknown;
-  mimeType?: unknown;
-  sizeInBytes?: unknown;
-};
-
-const json = (body: unknown, status = 200) =>
-  new Response(JSON.stringify(body), { status, headers: { "Content-Type": "application/json" } });
-
-export const POST: APIRoute = async ({ request }) => {
-  let body: UploadRequest;
-  try {
-    body = (await request.json()) as UploadRequest;
-  } catch {
-    return json({ error: "Expected JSON" }, 400);
-  }
-
-  if (
-    typeof body.policyId !== "string" ||
-    typeof body.fileName !== "string" ||
-    typeof body.mimeType !== "string" ||
-    typeof body.sizeInBytes !== "number" ||
-    !Number.isSafeInteger(body.sizeInBytes)
-  ) {
-    return json({ error: "Invalid upload request" }, 400);
-  }
-  const policy = mediaUploadPolicies.find((candidate) => candidate.id === body.policyId);
-  if (!policy) return json({ error: "Unknown upload policy" }, 404);
-  if (!policy.accept.includes(body.mimeType as never)) return json({ error: "File type is not allowed" }, 415);
-  if (body.sizeInBytes < 1 || body.sizeInBytes > policy.maxBytes) return json({ error: "File exceeds this policy's size limit" }, 413);
-
-  // Do not accept a folder id, labels, privacy setting, or any other destination choice from
-  // the browser. Add those as fixed policy fields only after the product actually needs them.
-  const result = await elevatedGenerateUploadUrl(body.mimeType, {
-    fileName: body.fileName.slice(0, 255),
-  });
-  return json({ uploadUrl: result.uploadUrl });
-};

package/skills/wix-headless-fast/references/shared/rest/client.ts

@@ -1,155 +0,0 @@
-// The one auth seam for every Wix REST call — the twin of app/wix/sdk.ts, over fetch. No
-// dependencies. deploy.mjs --stack static copies it flat into js/wix/ next to the core files and
-// strips it to JS (comments kept); a port to another language reads it as the specification.
-// Imports carry the .js suffix so the stripped output runs as browser ESM unchanged.
-//
-// WIX_CLIENT_ID is the public OAuth client id (`appId` in wix.config.json). It is NOT a secret — it
-// only mints anonymous VISITOR tokens — so it is fine in page source. deploy.mjs writes ./config.
-//
-// THE TOKEN IS THE CART. A visitor token is the shopper's identity: their cart lives on it. Mint
-// once per shopper, persist it, refresh it — never mint per request (a fresh token is a new visitor
-// with an empty cart). Where it persists depends on where this code runs:
-//   browser — localStorage, keyed by client id so two sites on one origin don't share a token
-//             (what this file does).
-//   server (a Python/PHP/Go port) — the SHOPPER'S SESSION, one token set per shopper. Never one
-//             process-wide token for everyone: that is one shared cart for all visitors.
-//             This is the only part of a port that isn't line-for-line.
-// docs: https://dev.wix.com/docs/go-headless/coding/authentication/visitors.md
-import { WIX_CLIENT_ID } from "./config.js";
-
-export const WIX_API_BASE = "https://www.wixapis.com";
-const TOKEN_URL = `${WIX_API_BASE}/oauth2/token`;
-const STORAGE_KEY = `wix-visitor-${WIX_CLIENT_ID}`;
-
-export interface Tokens {
-  accessToken: string;
-  refreshToken: string;
-  /** Epoch ms. */
-  expiresAt: number;
-  /** Whose tokens: absent or "visitor" for an anonymous visitor, "member" after a login (a vertical's rest/auth.ts). */
-  role?: "visitor" | "member";
-}
-
-/** Swap this for a server-session-backed store in a port; the browser default is localStorage. */
-export interface TokenStore {
-  load(): Tokens | null;
-  save(tokens: Tokens): void;
-}
-
-let memory: Tokens | null = null;
-export const browserTokenStore: TokenStore = {
-  load() {
-    if (memory) return memory;
-    if (typeof localStorage === "undefined") return null;
-    try {
-      const raw = localStorage.getItem(STORAGE_KEY);
-      if (raw) memory = JSON.parse(raw) as Tokens;
-    } catch {
-      /* disabled or corrupt storage — mint a fresh visitor */
-    }
-    return memory;
-  },
-  save(tokens) {
-    memory = tokens;
-    if (typeof localStorage === "undefined") return;
-    try {
-      localStorage.setItem(STORAGE_KEY, JSON.stringify(tokens));
-    } catch {
-      /* storage full or disabled — the session just won't survive a reload */
-    }
-  },
-};
-let store: TokenStore = browserTokenStore;
-/** A port calls this once with its session-backed store. */
-export function useTokenStore(s: TokenStore): void {
-  store = s;
-}
-
-// POST /oauth2/token — grantType "anonymous" mints a visitor; "refresh_token" renews and KEEPS the
-// identity (a member refresh token yields member tokens); "authorization_code" + codeVerifier turns
-// a login's authorization code into MEMBER tokens (a vertical's rest/auth.ts). `role` records which.
-export async function mintTokens(body: Record<string, string>, role: Tokens["role"] = "visitor"): Promise<Tokens> {
-  const res = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ clientId: WIX_CLIENT_ID, ...body }),
-  });
-  if (!res.ok) throw new Error(`Wix auth failed (${res.status}).`);
-  const data = await res.json();
-  return { accessToken: data.access_token, refreshToken: data.refresh_token, expiresAt: Date.now() + data.expires_in * 1000, role };
-}
-
-/** The persisted token set as it is (possibly expired), or null before the first mint. */
-export function loadTokens(): Tokens | null {
-  return store.load();
-}
-
-/** Adopt a token set — a member's after login. Every call from here on runs as that identity. */
-export function setTokens(tokens: Tokens): void {
-  store.save(tokens);
-}
-
-/** Drop the current identity (logout): the next call mints a fresh anonymous visitor. */
-export function clearTokens(): void {
-  store.save({ accessToken: "", refreshToken: "", expiresAt: 0 });
-}
-
-/** A valid access token: cached, refreshed when expired, minted on first use. */
-export async function accessToken(): Promise<string> {
-  const t = store.load();
-  if (t && t.expiresAt - 60_000 > Date.now()) return t.accessToken;
-  let fresh: Tokens | undefined;
-  if (t?.refreshToken) {
-    try {
-      fresh = await mintTokens({ grantType: "refresh_token", refreshToken: t.refreshToken }, t.role ?? "visitor");
-    } catch {
-      /* fall through to a new visitor */
-    }
-  }
-  fresh ??= await mintTokens({ grantType: "anonymous" });
-  store.save(fresh);
-  return fresh.accessToken;
-}
-
-export class WixApiError extends Error {
-  /** The response's `details` as Wix sent it (applicationError, validationError) — for callers that map codes. */
-  public details?: Record<string, any>;
-  constructor(message: string, public status: number, public code?: string, details?: Record<string, any>) {
-    super(message);
-    this.details = details;
-  }
-}
-
-/**
- * Every Wix call goes through here. `path` is relative to WIX_API_BASE; `query` becomes the query
- * string (an array repeats the key: fields=A&fields=B). Throws WixApiError on a non-2xx, including
- * 404 — callers that treat 404 as "not found" catch it. The header carries the RAW access token,
- * no "Bearer " prefix.
- */
-export async function wixRequest<T = any>(
-  path: string,
-  { method = "POST", body, query }: { method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE"; body?: unknown; query?: Record<string, string | readonly string[]> } = {},
-): Promise<T> {
-  const url = new URL(path, WIX_API_BASE);
-  for (const [k, v] of Object.entries(query ?? {})) {
-    for (const item of Array.isArray(v) ? v : [v as string]) url.searchParams.append(k, String(item));
-  }
-  const res = await fetch(url, {
-    method,
-    headers: { Authorization: await accessToken(), "Content-Type": "application/json" },
-    body: body === undefined ? undefined : JSON.stringify(body),
-  });
-  if (!res.ok) {
-    let message = "", code: string | undefined, details: Record<string, any> | undefined;
-    try {
-      const j = await res.json();
-      message = j?.message ?? "";
-      code = j?.details?.applicationError?.code;
-      details = j?.details;
-    } catch {
-      /* no JSON body */
-    }
-    throw new WixApiError(message || `${method} ${url.pathname} failed (${res.status}).`, res.status, code, details);
-  }
-  return (res.status === 204 ? null : await res.json()) as T;
-}

package/skills/wix-headless-fast/references/shared/rest/config.ts

@@ -1,3 +0,0 @@
-// Written by install/deploy.mjs --stack static from wix.config.json (or --client-id).
-// The public OAuth client id — not a secret: it only mints anonymous visitor tokens.
-export const WIX_CLIENT_ID: string = "";

package/skills/wix-headless-fast/references/shared/rest/media.ts

@@ -1,65 +0,0 @@
-// Wix media → browser-loadable URLs — the twin of app/wix/media.ts, without the SDK.
-//
-// A media value arrives as either an absolute https://static.wixstatic.com/... URL or a raw
-// `wix:image://v1/<file>/<name>#originWidth=W&originHeight=H` identifier a browser cannot load
-// (ERR_UNKNOWN_URL_SCHEME). The raw form is scaled through this ONE URL shape; any other hand-built
-// form 403s:   https://static.wixstatic.com/media/<file>/v1/fill/w_<W>,h_<H>,al_c,q_90/<file>
-const STATIC = "https://static.wixstatic.com/media";
-const FILL = /\/v1\/fill\/w_\d+,h_\d+/;
-
-export type MediaLike = string | null | undefined | { image?: string | null; url?: string | null };
-
-function rawOf(value: unknown): string {
-  if (!value) return "";
-  if (typeof value === "string") return value;
-  const o = value as { image?: string | null; url?: string | null };
-  return o.image ?? o.url ?? "";
-}
-
-/** Resolve any Wix media value to a URL sized w×h ("" when absent). */
-export function imgSrc(value: unknown, width = 600, height = 600): string {
-  const v = rawOf(value);
-  if (!v) return "";
-  if (v.startsWith("wix:image://")) {
-    const file = v.slice("wix:image://v1/".length).split("/")[0].split("#")[0];
-    return `${STATIC}/${file}/v1/fill/w_${width},h_${height},al_c,q_90/${file}`;
-  }
-  // An absolute Wix media URL (bare, or already scaled to some other size): re-issue it through the
-  // scaler at the requested size, so every image path lands on one shape.
-  const m = v.match(/^https:\/\/static\.wixstatic\.com\/media\/([^/?#]+)/);
-  if (m) return `${STATIC}/${m[1]}/v1/fill/w_${width},h_${height},al_c,q_90/${m[1]}`;
-  return v;
-}
-
-/** srcset candidates at several widths; `ratio` is height/width. "" only when there is no image. */
-export function imgSrcSet(value: unknown, widths: number[] = [320, 480, 640, 960], ratio = 1): string {
-  const v = rawOf(value);
-  if (!v) return "";
-  if (v.startsWith("wix:image://")) return widths.map((w) => `${imgSrc(value, w, Math.round(w * ratio))} ${w}w`).join(", ");
-  if (v.includes("static.wixstatic.com/") && FILL.test(v)) {
-    return widths.map((w) => `${v.replace(FILL, `/v1/fill/w_${w},h_${Math.round(w * ratio)}`)} ${w}w`).join(", ");
-  }
-  return v;
-}
-
-/**
- * Everything an <img> needs for one Wix image, so a tile can never ship `srcset` without `src`.
- * Attribute names as HTML spells them — spread into a template or apply with setAttribute:
- *   `<img ${attrs(imgAttrs(p.imageUrl, "(min-width: 1024px) 25vw, 50vw"))} alt="…">`
- * `sizes` is the width the image renders at; `ratio` is height/width. {} when there is no image.
- */
-export function imgAttrs(value: unknown, sizes: string, ratio = 1): Record<string, string> {
-  const src = imgSrc(value, 640, Math.round(640 * ratio));
-  if (!src) return {};
-  return { src, srcset: imgSrcSet(value, undefined, ratio), sizes, loading: "lazy", decoding: "async" };
-}
-
-/** The media identity before scaling — de-duplicate galleries on this, never on a resolved URL. */
-export function mediaKey(value: unknown): string {
-  const v = rawOf(value);
-  if (!v) return "";
-  // The file id, whichever form the value takes — a raw id and a resolved URL of one photo share it.
-  if (v.startsWith("wix:image://")) return v.slice("wix:image://v1/".length).split("/")[0].split("#")[0];
-  const m = v.match(/^https:\/\/static\.wixstatic\.com\/media\/([^/?#]+)/);
-  return m ? m[1] : v;
-}