@wix/agent-skills 1.22.0 → 1.24.0

package/skills/wix-headless-kit/install/context.mjs

@@ -0,0 +1,169 @@
+// The site context of a project folder — the one place that says which site a call targets.
+//
+//   node <SKILL_ROOT>/install/context.mjs [--refresh] [--no-pull]     (prints one JSON object)
+//
+// Two identities live in a Wix project and are the same site almost always:
+//   deploy  — `wix.config.json` (`siteId`, `appId`): where `wix release` uploads. The CLI's business.
+//   content — `.env.local` (`WIX_CLIENT_ID`, what `wix env pull` writes): the app the SDK client
+//             runs as, on every stack (the Astro integration reads WIX_CLIENT_ID from the env and
+//             never the config; the other stacks get it copied into src/wix/config.ts by deploy.mjs).
+// They differ on a MIGRATION PREVIEW: a project whose config points at a fresh site created only to
+// host the deployment, while `.env.local` carries the credentials of the site being migrated (the
+// parent) and says so. Then every admin, discovery and seed call targets the parent, the SDK client
+// is the parent's, and only the release goes to the child. Completing the migration is a CLI step
+// that does not exist yet; this module only reads the state.
+//
+// `env pull` runs here when `.env.local` is missing (or --refresh): it is the source of the content
+// identity, and the Astro build refuses to run without it. Non-interactive (CI=1); a failure is
+// reported in `pullError` and the config's ids stand in, so a caller can still work offline.
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+// The variables the editor-to-headless migration writes into the child project's `prod`
+// environment (headless-bo, editorMigrations/environmentMetadata.ts), which `wix env pull` copies
+// into `.env.local` unchanged. The names are the platform's and are spelled once, here.
+export const ENV = {
+  clientId: "WIX_CLIENT_ID",
+  parentSiteId: "EDITOR_MIGRATION_PARENT_SITE_ID",
+  /** ACTIVE while the migration is under way; COMPLETED once the parent serves the child's frontend. */
+  status: "EDITOR_MIGRATION_STATUS",
+  childSiteId: "EDITOR_MIGRATION_CHILD_SITE_ID",
+  childAppId: "EDITOR_MIGRATION_CHILD_APP_ID",
+};
+
+/** KEY=value lines of a dotenv file, quotes stripped; null when the file is absent. */
+export function readEnvFile(file) {
+  if (!existsSync(file)) return null;
+  const out = {};
+  for (const raw of readFileSync(file, "utf8").split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq === -1) continue;
+    const key = line.slice(0, eq).trim().replace(/^export\s+/, "");
+    let value = line.slice(eq + 1).trim();
+    if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
+      value = value.slice(1, -1).replace(/\\"/g, '"');
+    }
+    out[key] = value;
+  }
+  return out;
+}
+
+export function readWixConfig(cwd) {
+  const file = join(cwd, "wix.config.json");
+  if (!existsSync(file)) return null;
+  try { return JSON.parse(readFileSync(file, "utf8")); } catch { return null; }
+}
+
+const ENV_PULL = ["-y", "@wix/cli@latest", "env", "pull"];
+const runPull = (dir) => spawnSync("npx", ENV_PULL, { cwd: dir, env: { ...process.env, CI: "1" }, encoding: "utf8", timeout: 180_000 });
+
+/**
+ * `wix env pull` into `cwd/.env.local`, in place. Every project shape gets the command since Wix CLI
+ * 1.1.253 (2026-09-29): before it, a config with `site.outputDirectory` (the static stack, a site
+ * published through the drop flow) landed in a limited command set without `env`, and this pulled
+ * through a temp copy of the config. Non-interactive; a failure comes back as `error`.
+ */
+export function pullEnv(cwd) {
+  const envFile = join(cwd, ".env.local");
+  const r = runPull(cwd);
+  if (r.status === 0 && existsSync(envFile)) return { ok: true, via: "in place" };
+  return { ok: false, error: (r.stderr || r.stdout || "env pull produced no .env.local — is the Wix CLI logged in? (npx @wix/cli@latest whoami)").trim().slice(-400) };
+}
+
+/**
+ * Whether a frontend exists in this folder: a `package.json` (a bundled project), an `index.html` at
+ * the root (plain pages), or an `index.html` inside the folder the config's `site.outputDirectory`
+ * names (a static site laid out for release, pages under site/). Nothing else counts — not this
+ * skill's code, not the skills folder, not AGENTS.md: those say who ran here, not what is here.
+ */
+export function frontendPresent(cwd = process.cwd()) {
+  const has = (p) => existsSync(join(cwd, p));
+  const outDir = (readWixConfig(cwd)?.site?.outputDirectory ?? "").replace(/^\.\//, "").replace(/\/$/, "");
+  return {
+    packageJson: has("package.json"),
+    rootIndex: has("index.html"),
+    outputIndex: !!outDir && outDir !== "." && has(join(outDir, "index.html")),
+    outputDirectory: outDir || null,
+  };
+}
+
+/**
+ * What the folder IS, from five file facts — the one classification every script and SKILL.md
+ * step 3 share: wix.config.json, its site.outputDirectory, the migration variables in .env.local,
+ * package.json, index.html. `migrationActive` comes from siteContext (it needs `.env.local`).
+ *
+ *   empty             nothing that reads as a project → setup CREATE: the run makes the site, seeds the plan
+ *   project           a frontend, no wix.config.json → setup ADOPT: `init` gives it a new, empty site, seeds the plan
+ *   config-only       a config, no frontend → attach.mjs on the config's site; nothing seeded
+ *   migration         a config whose .env.local declares an ACTIVE editor migration, with or without the blank
+ *                     Astro starter the download carries → setup MIGRATE; nothing seeded. Decided before the
+ *                     frontend test: the starter's package.json must not read as a project to iterate on
+ *   wix-project       a config AND a frontend (package.json, or index.html in the output folder) → iterate:
+ *                     never scaffold, init or reseed; deploy.mjs adds a solution, edits, release
+ *   published-static  a config, index.html at the ROOT, no package.json, no laid-out output folder (a site
+ *                     published through the drop flow and downloaded) → setup makes site/ the upload and
+ *                     deploys the REST layer; the config's site, no init, nothing seeded
+ */
+export function folderShape(cwd = process.cwd(), { migrationActive = false } = {}) {
+  const config = existsSync(join(cwd, "wix.config.json"));
+  const f = frontendPresent(cwd);
+  const next = {
+    empty: "setup.mjs --vertical <v> --business-name <brand> [--plan]: creates the site here and seeds the plan (CREATE)",
+    project: "setup.mjs --vertical <v> --stack <stack> [--plan]: init links the folder to a new, empty site, seeds the plan and deploys (ADOPT)",
+    "config-only": "attach.mjs: the site exists and has no frontend yet; read what it holds (the vertical's read-site.mjs) — nothing is seeded; the vertical's seed module with a plan only when the brief supplies or describes content",
+    migration: "setup.mjs (MIGRATE): the shipped code into the starter the download carries (or the composed template around a bare config); the site being migrated owns its content — guides/migration.md",
+    "wix-project": "iterate: never scaffold, init or reseed. deploy.mjs <vertical…> --stack <stack> adds a solution, then ONE npm install; file edits for a change; release. Read the site (read-site.mjs) before any seed module runs",
+    "published-static": "setup.mjs --vertical <v>: the config's site, no init; site/ becomes the upload and the REST layer lands in site/js/wix/; move the pages, styles and assets into site/. Nothing is seeded: read the site, then run the vertical's seed module with a plan when the brief gives content; release keeps the URL",
+  };
+  let shape;
+  if (!config) shape = f.packageJson || f.rootIndex ? "project" : "empty";
+  else if (migrationActive) shape = "migration";
+  else if (f.packageJson || f.outputIndex) shape = "wix-project";
+  else if (f.rootIndex) shape = "published-static";
+  else shape = "config-only";
+  return { shape, next: next[shape], facts: { config, ...f } };
+}
+
+/**
+ * `{ folder: { shape, next, tells }, deploy: { siteId, appId }, content: { siteId, clientId },
+ *    migration: { active, parentSiteId }, env: { file, present, pulled }, pullError?, warnings: [] }`.
+ * `pull`: "auto" (default) pulls when `.env.local` is missing; true always; false never.
+ */
+export function siteContext({ cwd = process.cwd(), pull = "auto" } = {}) {
+  const config = readWixConfig(cwd) ?? {};
+  const deploy = { siteId: config.siteId ?? config.projectId ?? null, appId: config.appId ?? null };
+  const envFile = join(cwd, ".env.local");
+  let pulled = false, pullError;
+  if (deploy.siteId && (pull === true || (pull === "auto" && !existsSync(envFile)))) {
+    const r = pullEnv(cwd);
+    if (r.ok) pulled = r.via;
+    else pullError = r.error;
+  }
+  const env = readEnvFile(envFile) ?? {};
+  const parentSiteId = env[ENV.parentSiteId] || null;
+  const status = env[ENV.status];
+  // ACTIVE (or a parent id with no status yet) is a migration under way; COMPLETED means the parent
+  // already serves this frontend and the project is an ordinary one again.
+  const active = !!parentSiteId && (status === undefined || status.trim().toUpperCase() === "ACTIVE");
+  const migration = { active, parentSiteId: active ? parentSiteId : null, ...(status ? { status: status.trim().toUpperCase() } : {}) };
+  const clientId = env[ENV.clientId] || deploy.appId;
+  const content = { siteId: active ? parentSiteId : deploy.siteId, clientId };
+  const warnings = [];
+  if (env[ENV.clientId] && deploy.appId && env[ENV.clientId] !== deploy.appId && !active && migration.status !== "COMPLETED") {
+    warnings.push(`.env.local ${ENV.clientId} differs from wix.config.json appId and no migration is declared — the SDK client runs as the env's app, the release goes to the config's site`);
+  }
+  if (active && migration.parentSiteId === deploy.siteId) {
+    warnings.push("the migration's parent site is the deploy site itself — nothing is being migrated");
+  }
+  return { folder: folderShape(cwd, { migrationActive: active }), deploy, content, migration, env: { file: envFile, present: Object.keys(env).length > 0, pulled }, ...(pullError ? { pullError } : {}), warnings };
+}
+
+// ---- CLI ----------------------------------------------------------------------------------------
+if (process.argv[1] && /context\.mjs$/.test(process.argv[1])) {
+  const argv = process.argv.slice(2);
+  const pull = argv.includes("--no-pull") ? false : argv.includes("--refresh") ? true : "auto";
+  console.log(JSON.stringify(siteContext({ pull }), null, 2));
+}

package/skills/{wix-headless-fast → wix-headless-kit}/install/deploy.mjs

@@ -45,6 +45,7 @@ import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { templatesDir } from "./templates.mjs";
 import { syncLockRoot } from "./lock.mjs";
+import { siteContext } from "./context.mjs";
 
 const SKILL_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 // The shipped code: the repository's templates/ (a checkout, the cache, or fetched now).
@@ -80,7 +81,11 @@ const CAPABILITY_DEPS = {
     "@wix/media": "^1.0.271",
     "@wix/essentials": "^1.0.10",
   },
+  "site-search": {
+    "@wix/search": "^1.0.90",
+  },
 };
+const SITE_SEARCH = join("shared", "capabilities", "site-search");
 const VERTICAL_DEPS = {
   storefront: {
     core: {
@@ -106,6 +111,18 @@ const VERTICAL_DEPS = {
       "@wix/essentials": "^1.0.6",
     },
   },
+  rentals: {
+    // A rental is a Bookings service with rentals-specific values: the same SDK modules as bookings.
+    core: {
+      "@wix/bookings": "^1.0.1650",
+      "@wix/auto_sdk_ecom_cart-v-2": "^1.0.192",
+      "@wix/redirects": "^1.0.125",
+    },
+    astro: {
+      "@wix/seo": "^1.0.79",
+      "@wix/essentials": "^1.0.6",
+    },
+  },
   blog: {
     core: {
       "@wix/blog": "^1.0.645",
@@ -160,6 +177,19 @@ const VERTICAL_DEPS = {
       "@wix/redirects": "^1.0.125",
     },
   },
+  faq: {
+    core: {
+      "@wix/faq": "^1.0.76",
+    },
+    // no astro block: the FAQ page is a plain page (no wixMetadata item routing); its JSON-LD is inline
+  },
+  donations: {
+    core: {
+      "@wix/donations": "^1.0.64",
+      "@wix/ecom": "^1.0.2454",
+      "@wix/redirects": "^1.0.125",
+    },
+  },
 };
 
 const COPY = { recursive: true, force: false, errorOnExist: false };
@@ -211,6 +241,27 @@ if (!Array.isArray(uploadPolicies)) {
   console.log(JSON.stringify({ error: "plan.capabilities.mediaUpload.policies must be an array" }));
   process.exit(1);
 }
+// Site search is on when the plan carries the entry (`{}` is enough; `true` too). Its fields are
+// data for the generated config; the shipped core drops unknown type names, so only shapes are checked.
+const siteSearchEntry = plan.capabilities?.siteSearch;
+const siteSearch = siteSearchEntry === true ? {} : siteSearchEntry && typeof siteSearchEntry === "object" ? siteSearchEntry : null;
+if (siteSearchEntry != null && siteSearchEntry !== false && !siteSearch) {
+  console.log(JSON.stringify({ error: "plan.capabilities.siteSearch must be an object (or true)" }));
+  process.exit(1);
+}
+if (siteSearch) {
+  const strings = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
+  const map = (v) => v === undefined || (v && typeof v === "object" && !Array.isArray(v) && Object.values(v).every((x) => typeof x === "string"));
+  if ((siteSearch.types !== undefined && !strings(siteSearch.types)) || !map(siteSearch.routes) || !map(siteSearch.labels)) {
+    console.log(JSON.stringify({ error: "plan.capabilities.siteSearch: types must be string[]; routes and labels must be objects of strings" }));
+    process.exit(1);
+  }
+}
+// The generated file is data only; the shipped core resolves defaults (types, routes, labels) from it.
+const siteSearchConfigSource = () =>
+  `// Generated by wix-headless-kit install/deploy.mjs from plan.capabilities.siteSearch.\n` +
+  `// Edit the plan and redeploy. Defaults for anything omitted are in search-core.ts (resolveConfig).\n` +
+  `export const siteSearchPlan = ${JSON.stringify(siteSearch, null, 2)};\n`;
 // ---- static stack: the REST layer, composed flat and stripped ------------------------------------
 if (stack === "static") {
   const { spawnSync } = await import("node:child_process");
@@ -218,10 +269,9 @@ if (stack === "static") {
   const OUT = outDir ? resolve(PROJECT, outDir) : PROJECT;
   const JS = join(OUT, "js", "wix");
   result.out = outDir ?? ".";
-  let clientId = clientIdFlag;
-  if (!clientId && existsSync(join(PROJECT, "wix.config.json"))) {
-    clientId = JSON.parse(readFileSync(join(PROJECT, "wix.config.json"), "utf8")).appId ?? null;
-  }
+  // The client id the browser mints visitor tokens with: --client-id, else the CONTENT app from
+  // .env.local (`wix env pull`; on a migration preview the parent site's app), else the config's appId.
+  let clientId = clientIdFlag ?? (existsSync(join(PROJECT, "wix.config.json")) ? siteContext({ cwd: PROJECT }).content.clientId : null);
   if (!clientId) {
     console.log(JSON.stringify({ error: "static stack needs the public OAuth client id — run `npm create @wix/new@latest init` here first, or pass --client-id" }));
     process.exit(1);
@@ -233,19 +283,23 @@ if (stack === "static") {
   }
   // Only files that aren't there yet — a re-run restores, never clobbers (same as the copy below).
   cpSync(join(REF, "shared", "rest"), JS, COPY);
-  for (const vertical of requested) {
-    cpSync(join(REF, vertical, "rest"), JS, COPY);
+  // Every layer with a rest/ twin: the requested verticals, plus the site-search capability when the
+  // plan turns it on (same shape — rest/ beside app/wix/<name>/ — at templates/shared/capabilities).
+  const layers = requested.map((vertical) => [vertical, join(REF, vertical)]);
+  if (siteSearch) layers.push(["site-search", join(REF, SITE_SEARCH)]);
+  for (const [vertical, root] of layers) {
+    cpSync(join(root, "rest"), JS, COPY);
     // The vertical's transport-agnostic core: types, every *-core.ts, and every *-store.ts under its
     // app/wix/<vertical>/ — the stores are the hooks' logic without React, over the same function
     // names the REST twin exports, so they run against it unchanged.
-    const appWix = join(REF, vertical, "app", "wix", vertical);
+    const appWix = join(root, "app", "wix", vertical);
     for (const f of readdirSync(appWix)) {
       // Every vertical has a types.ts; flat in one folder they would collide, so each lands as
       // <vertical>-types.ts and the vertical's own files are pointed at it below.
       if (f === "types.ts") cpSync(join(appWix, f), join(JS, `${vertical}-types.ts`), COPY);
       else if (f.endsWith("-core.ts") || f.endsWith("-store.ts")) cpSync(join(appWix, f), join(JS, f), COPY);
     }
-    const own = new Set([...readdirSync(join(REF, vertical, "rest")), ...readdirSync(appWix)].filter((f) => f.endsWith(".ts") && f !== "types.ts"));
+    const own = new Set([...readdirSync(join(root, "rest")), ...readdirSync(appWix)].filter((f) => f.endsWith(".ts") && f !== "types.ts"));
     for (const f of own) {
       const fp = join(JS, f);
       if (!existsSync(fp)) continue;
@@ -253,7 +307,12 @@ if (stack === "static") {
       const fixed = src.replace(/from\s+"\.\/types(?:\.js)?"/g, `from "./${vertical}-types.js"`);
       if (fixed !== src) writeFileSync(fp, fixed);
     }
-    result.verticals.push(vertical);
+    if (VERTICALS.includes(vertical)) result.verticals.push(vertical);
+  }
+  if (siteSearch) {
+    // The REST twin imports the plan as data from beside it (shared/rest already owns config.ts).
+    writeFileSync(join(JS, "site-search-config.generated.ts"), siteSearchConfigSource());
+    result.capabilities = { ...result.capabilities, siteSearch: true };
   }
   // Browser ESM resolves nothing: every relative import needs its .js. The rest/ files are written
   // that way; the files borrowed from app/wix/ are bundler-style and get the suffix here.
@@ -286,7 +345,7 @@ if (stack === "static") {
   result.js = `${outDir ? outDir.replace(/\/$/, "") + "/" : ""}js/wix/*.js`;
   // The note lists what actually landed, so it holds for every vertical (and several at once).
   const stores = readdirSync(JS).filter((f) => f.endsWith("-store.js")).map((f) => `./js/wix/${f}`);
-  const dataFiles = readdirSync(JS).filter((f) => f.endsWith(".js") && !f.endsWith("-store.js") && !f.endsWith("-core.js") && !f.endsWith("-types.js") && !["client.js", "config.js", "media.js"].includes(f)).map((f) => `./js/wix/${f}`);
+  const dataFiles = readdirSync(JS).filter((f) => f.endsWith(".js") && !f.endsWith("-store.js") && !f.endsWith("-core.js") && !f.endsWith("-types.js") && !f.endsWith(".generated.js") && !["client.js", "config.js", "media.js"].includes(f)).map((f) => `./js/wix/${f}`);
   result.note = `import the data layer (${dataFiles.join(", ")})${stores.length ? ` and the stores (${stores.join(", ")})` : ""} relative to ${outDir ?? "the project root"} in a <script type="module">; the .ts beside them are the same files with types, for reading; point wix.config.json site.outputDirectory at "./${outDir ?? "."}"`;
   console.log(JSON.stringify(result));
   process.exit(0);
@@ -319,11 +378,20 @@ if (uploadPolicies.length) {
   cpSync(join(REF, "shared", "capabilities", "media-upload", "app"), SRC, COPY);
   cpSync(join(REF, "shared", "capabilities", "media-upload", "app-astro"), SRC, COPY);
 }
+// Site search ships like a vertical (data layer, stores, hooks, components, a search page) at a
+// disjoint path (src/wix/site-search/, src/components/site-search/, …), so the same per-stack rule
+// applies: lib takes only app/wix/, astro adds app-astro/.
+if (siteSearch) {
+  if (stack === "lib") cpSync(join(REF, SITE_SEARCH, "app", "wix"), join(SRC, "wix"), COPY);
+  else cpSync(join(REF, SITE_SEARCH, "app"), SRC, COPY);
+  if (stack === "astro") cpSync(join(REF, SITE_SEARCH, "app-astro"), SRC, COPY);
+}
 
 const unknown = requested.filter((v) => !VERTICALS.includes(v));
 // lib: only @wix/sdk from the shared deps — the Tailwind pair serves the components, which don't ship there.
 const wantedDeps = stack === "lib" ? { "@wix/sdk": SHARED_DEPS["@wix/sdk"] } : { ...SHARED_DEPS };
 if (uploadPolicies.length) Object.assign(wantedDeps, CAPABILITY_DEPS["media-upload"]);
+if (siteSearch) Object.assign(wantedDeps, CAPABILITY_DEPS["site-search"]);
 for (const vertical of requested.filter((v) => VERTICALS.includes(v))) {
   if (stack === "lib") cpSync(join(REF, vertical, "app", "wix"), join(SRC, "wix"), COPY);
   else cpSync(join(REF, vertical, "app"), SRC, COPY);
@@ -345,12 +413,21 @@ if (uploadPolicies.length) {
   // The generated file is data only. The shipped endpoint owns validation and elevation.
   writeFileSync(
     configFile,
-    `// Generated by wix-headless-fast install/deploy.mjs from plan.capabilities.mediaUpload.\n` +
+    `// Generated by wix-headless-kit install/deploy.mjs from plan.capabilities.mediaUpload.\n` +
       `// Edit the plan and redeploy; do not add browser-controlled policy selection here.\n` +
       `export const mediaUploadPolicies = ${JSON.stringify(uploadPolicies, null, 2)} as const;\n`,
   );
   result.capabilities = { mediaUpload: uploadPolicies.map((policy) => policy.id) };
 }
+if (siteSearch) {
+  // The SDK transport imports the plan as data from beside it; defaults resolve in the shipped core.
+  writeFileSync(join(SRC, "wix", "site-search", "config.generated.ts"), siteSearchConfigSource());
+  result.capabilities = { ...result.capabilities, siteSearch: true };
+  if (siteSearch.install) {
+    // Indexing needs the Wix Site Search app on the site — a site mutation the deploy never makes.
+    result.note = [result.note, "siteSearch.install: run `node <SKILL_ROOT>/templates/shared/capabilities/site-search/seed/install.mjs` from the project root after the seed (results appear about half a minute later)"].filter(Boolean).join("; ");
+  }
+}
 
 // ---- dependency patch (fill-only) ----------------------------------------------------------------
 if (result.verticals.length && existsSync(PKG_JSON)) {
@@ -416,12 +493,15 @@ if (stack === "astro" && result.verticals.length && existsSync(ASTRO_CONFIG)) {
 
 // ---- ready-made links -----------------------------------------------------------------------------
 // Emit the siteId and the dashboard deep links so nothing downstream re-derives or retypes them.
+// The site the links point at is the CONTENT site — the parent on a migration preview, where the
+// config's site only hosts the deployment (install/context.mjs).
 const WIX_CONFIG = join(PROJECT, "wix.config.json");
-if (existsSync(WIX_CONFIG)) {
-  const config = JSON.parse(readFileSync(WIX_CONFIG, "utf8"));
-  const siteId = config.siteId ?? config.projectId;
+const ctx = existsSync(WIX_CONFIG) ? siteContext({ cwd: PROJECT }) : null;
+if (ctx) {
+  const siteId = ctx.content.siteId;
   if (siteId) {
     result.siteId = siteId;
+    if (ctx.migration.active) result.migration = { parentSiteId: ctx.migration.parentSiteId, deploySiteId: ctx.deploy.siteId };
     result.dashboardUrl = `https://manage.wix.com/dashboard/${siteId}`;
     if (result.verticals.includes("storefront")) {
       result.productsUrl = `https://manage.wix.com/dashboard/${siteId}/wix-stores/products`;
@@ -438,15 +518,13 @@ if (!requested.length) {
 }
 
 // ---- client ids ---------------------------------------------------------------------------------
-// The shared data client is ambient on managed Astro. Members are different: their shipped
-// custom credential flow always needs an explicit public OAuth client, including on Astro.
-let clientId = clientIdFlag;
-if (!clientId && existsSync(join(PROJECT, "wix.config.json"))) {
-  // On a Wix-managed project the public OAuth client id IS the appId.
-  clientId =
-    JSON.parse(readFileSync(join(PROJECT, "wix.config.json"), "utf8")).appId ??
-    null;
-}
+// The shared data client is ambient on managed Astro, and so is the members flow there (the
+// integration's built-in /api/auth routes). WIX_MEMBERS_CLIENT_ID is still filled for projects whose
+// members code predates the shared seam; the shipped code reads WIX_CLIENT_ID only.
+// --client-id, else the CONTENT app: .env.local's WIX_CLIENT_ID (what `wix env pull` writes — on a
+// migration preview the parent site's app, the one the Astro integration itself runs as), else the
+// config's appId. Never the config first: on a preview that is the deploy-only child app.
+const clientId = clientIdFlag ?? ctx?.content.clientId ?? null;
 if (stack === "react" || stack === "lib") {
   if (clientId) {
     const current = readFileSync(CONFIG_TS, "utf8");