@wix/agent-skills 1.35.1 → 1.36.1

package/skills/wix-vibe-headless/references/members/app/pages/Account.jsx

@@ -1,36 +0,0 @@
-// Account page (`/account`) — the member's own profile + log out. Gate it with <RequireAuth> in the
-// router (STEP 4) so a visitor is bounced to /login. Reads the member from useMember(); shows the
-// identity-only fallback when the Members Area app isn't installed (member is null but loggedIn is
-// true — that's setup, not a bug). Styled with base44 design tokens (shadcn Tailwind classes).
-import { useMember } from "@/context/MemberContext";
-
-export default function Account() {
-  const { member, logout } = useMember();
-
-  const name = member?.profile?.nickname
-    || [member?.contact?.firstName, member?.contact?.lastName].filter(Boolean).join(" ")
-    || member?.loginEmail
-    || "Member";
-  const email = member?.loginEmail;
-  const photo = member?.profile?.photo?.url;
-
-  return (
-    <main className="max-w-[420px] mx-auto py-8 px-4">
-      <div className="flex flex-col items-center gap-3 text-center p-6 bg-card border border-border rounded-lg shadow-sm">
-        <div className="w-[72px] h-[72px] rounded-full overflow-hidden bg-background border border-border">
-          {photo && <img src={photo.startsWith("//") ? `https:${photo}` : photo} alt="" className="w-full h-full object-cover" />}
-        </div>
-        <h1 className="font-display m-0 text-[22px]">{name}</h1>
-        {email && <p className="text-muted-foreground m-0">{email}</p>}
-        {!member && (
-          <p className="text-muted-foreground m-0 text-[13px] leading-normal">
-            You're signed in. Install the Wix Members Area app to show profile details here.
-          </p>
-        )}
-        <button type="button" onClick={() => logout()}
-          className="mt-2 py-2.5 px-6 cursor-pointer text-sm font-semibold bg-primary text-primary-foreground border-none rounded-sm"
-        >Log out</button>
-      </div>
-    </main>
-  );
-}

package/skills/wix-vibe-headless/references/members/app/pages/Callback.jsx

@@ -1,32 +0,0 @@
-// Social/SSO callback page — mount at EXACTLY `/callback` (the URL you allow-list on the OAuth app;
-// it must match SocialButtons' callbackUri character-for-character). The provider redirects the whole
-// page back here with `#code`/`#state` in the hash; completeSocialLogin() verifies state, exchanges
-// the code for member tokens, and logs the member in on the shared client. Then refresh the session
-// and send them to `returnTo`. Styled with base44 design tokens (shadcn Tailwind classes).
-import { useEffect, useState } from "react";
-import { completeSocialLogin } from "@/rest/wix-members-auth";
-import { useMember } from "@/context/MemberContext";
-
-export default function Callback() {
-  const { refresh } = useMember();
-  const [error, setError] = useState(null);
-
-  useEffect(() => {
-    let cancelled = false;
-    completeSocialLogin()
-      .then(async ({ returnTo }) => {
-        await refresh();
-        if (!cancelled) window.location.replace(returnTo || "/");
-      })
-      .catch((e) => { if (!cancelled) setError(e.message || "Login failed."); });
-    return () => { cancelled = true; };
-  }, [refresh]);
-
-  return (
-    <main className="p-12 text-center text-muted-foreground">
-      {error
-        ? <p className="text-destructive" role="alert">{error} <a href="/login" className="text-primary">Try again</a></p>
-        : <p>Signing you in…</p>}
-    </main>
-  );
-}

package/skills/wix-vibe-headless/references/members/app/pages/Login.jsx

@@ -1,35 +0,0 @@
-// Login page (`/login`) — composes the shipped LoginForm (credential state machine) with
-// SocialButtons (Google/Facebook redirect). On credential SUCCESS it returns the member to where
-// they came from (RequireAuth stashes it in location.state.from) or home. Social login returns via
-// /callback instead. Styled with base44 design tokens (shadcn Tailwind classes) — don't rewrite this page to add chrome
-// (the Header/Footer live in the Layout).
-import { useNavigate, useLocation } from "@/lib/nav";
-import LoginForm from "@/components/LoginForm";
-import SocialButtons from "@/components/SocialButtons";
-
-export default function Login() {
-  const navigate = useNavigate();
-  const location = useLocation();
-  const from = location.state?.from || "/";
-
-  return (
-    <main className="max-w-[420px] mx-auto py-8 px-4 flex flex-col gap-5">
-      <h1 className="font-display text-center m-0">Welcome</h1>
-
-      <LoginForm onSuccess={() => navigate(from, { replace: true })} />
-
-      <Divider>or</Divider>
-      <SocialButtons />
-    </main>
-  );
-}
-
-function Divider({ children }) {
-  return (
-    <div className="flex items-center gap-3 text-muted-foreground text-[13px]">
-      <span className="flex-1 h-px bg-border" />
-      {children}
-      <span className="flex-1 h-px bg-border" />
-    </div>
-  );
-}

package/skills/wix-vibe-headless/references/members/app/rest/wix-members-auth.js

@@ -1,390 +0,0 @@
-import {
-  wixApiRequest,
-  WIX_API_BASE,
-  WIX_CLIENT_ID,
-  setSessionTokens,
-  clearSession,
-  isMember,
-} from "./wix-client.js";
-
-/**
- * Custom member login for a client-only headless front end — the REST analog of
- * the SDK `OAuthStrategy` (`register`/`login`/`getMemberTokensForDirectLogin`/
- * `getAuthUrl`/`getMemberTokens`/`logout`). **The front owns its login UI**; the
- * member never bounces to a Wix-hosted login page.
- *
- * Two mechanisms — pick by the brief (a page can use both):
- *   (A) DIRECT-CREDENTIAL — your own email+password form. `register()` / `login()`
- *       → on SUCCESS an INVISIBLE iframe (`web_message`) mints member tokens. No
- *       navigation. Supports custom sign-up fields via `profile`.
- *   (B) SOCIAL / SSO — your own "Continue with Google/Facebook" (or custom SSO)
- *       button. Full-page redirect to the provider → back to YOUR `/callback` →
- *       token exchange. `idp` is always a connection id (see `IDP`).
- *
- * All paths converge on ONE end state: member tokens written onto the shared
- * client via `setSessionTokens` (wix-client.js). Member tokens are the SAME shape
- * as visitor tokens, so EVERY later `wixApiRequest` (cart, orders, "my …" reads)
- * now runs as the member — login just swaps the token set on the client you have.
- *
- * State machine — `register()`/`login()`/`verifyEmail()` return `{ state, ... }`:
- *   - "SUCCESS"                    → logged in; `{ state, member }`.
- *   - "REQUIRE_EMAIL_VERIFICATION" → a 6-digit code was emailed; `{ state, stateToken }`.
- *                                    Collect the code, call `verifyEmail(code, stateToken)`.
- *   - "REQUIRE_OWNER_APPROVAL"     → membership pending owner approval; `{ state }`.
- * Hard failures throw a `MemberAuthError` with a `.code` (invalidCredentials,
- * emailAlreadyExists, …) — surface `.message` in your form.
- *
- * `profile` (register, all optional): firstName, lastName, nickname, picture,
- * language, privacyStatus ("PUBLIC"|"PRIVATE"), labels[], phonesV2[], addresses[],
- * company, position, birthdate, and `customFields` (name→value map). Standard
- * fields work as-is; arbitrary `customFields` keys must first be DEFINED in the
- * Members Area app or they're silently dropped. Social (B) can't collect any of
- * these — that's the reason to pick direct-credential.
- *
- * Docs (curl the .md): Login https://dev.wix.com/docs/api-reference/business-management/headless/authentication/login-v-2.md
- * · Register https://dev.wix.com/docs/api-reference/business-management/headless/authentication/register-v-2.md
- * · Logout https://dev.wix.com/docs/api-reference/business-management/headless/authentication/logout.md
- * · Change Password https://dev.wix.com/docs/api-reference/business-management/headless/authentication/change-password.md
- * · Retrieve Tokens https://dev.wix.com/docs/api-reference/business-management/headless/authentication/retrieve-tokens.md
- * · external/social login https://dev.wix.com/docs/api-reference/business-management/headless/redirects/create-redirect-session.md
- */
-
-const AUTH_BASE = "/_api/iam/authentication/v2";
-const VERIFY_URL = "/_api/iam/verification/v1/auth/verify";
-const RECOVERY_URL = "/_api/iam/recovery/v1/send-email";
-const REDIRECT_SESSION_URL = "/_api/redirects-api/v1/redirect-session";
-const CURRENT_MEMBER_URL = "/members/v1/members/my";
-const OAUTH_STASH_KEY = `wix-oauth-data-${WIX_CLIENT_ID}`;
-
-/**
- * `idp` connection ids for social login. Google & Facebook are enabled by default
- * on every headless client. For custom SSO / OIDC (Okta, Auth0, …) pass the
- * connection id of a connection you created in the Business Manager instead.
- */
-export const IDP = {
-  GOOGLE: "0e6a50f5-b523-4e29-990d-f37fa2ffdd69",
-  FACEBOOK: "3ecad13f-52c3-483d-911f-31dbcf2a6d23",
-};
-
-/** Auth outcome you can show the user. `.code` is stable; `.message` is human text. */
-export class MemberAuthError extends Error {
-  constructor(code, message) {
-    super(message || code);
-    this.name = "MemberAuthError";
-    this.code = code;
-  }
-}
-
-// ─────────────────────────── (A) direct-credential ───────────────────────────
-
-/**
- * Sign up a new member with email + password (+ optional custom `profile`).
- * On SUCCESS the member is logged in (member tokens written to the shared client).
- *
- * @param {string} email
- * @param {string} password
- * @param {object} [profile] see the `profile` note in the file header
- * @returns {Promise<{ state: string, member?: object|null, stateToken?: string }>}
- */
-export async function register(email, password, profile) {
-  return runCredentialFlow(`${AUTH_BASE}/register`, {
-    loginId: { email },
-    password,
-    ...(profile ? { profile } : {}),
-  });
-}
-
-/**
- * Log an existing member in with email + password.
- * @param {string} email
- * @param {string} password
- * @returns {Promise<{ state: string, member?: object|null, stateToken?: string }>}
- */
-export async function login(email, password) {
-  return runCredentialFlow(`${AUTH_BASE}/login`, { loginId: { email }, password });
-}
-
-/**
- * Continue a "REQUIRE_EMAIL_VERIFICATION" flow with the 6-digit code from the email.
- * @param {string} code verification code the member received by email
- * @param {string} stateToken the `stateToken` returned alongside REQUIRE_EMAIL_VERIFICATION
- * @returns {Promise<{ state: string, member?: object|null, stateToken?: string }>}
- */
-export async function verifyEmail(code, stateToken) {
-  let res;
-  try {
-    res = await wixApiRequest(VERIFY_URL, { body: { code, stateToken } });
-  } catch (e) {
-    throw mapAuthError(e);
-  }
-  return resolveState(res);
-}
-
-/**
- * Email the member a password-reset link. Wix hosts the reset page and returns
- * them to `redirectUri`, which MUST be an allow-listed authorization redirect URI
- * on the OAuth app (see INSTRUCTIONS.md → dashboard links).
- * @param {string} email
- * @param {string} redirectUri full URL to return to after reset
- */
-export async function sendPasswordResetEmail(email, redirectUri) {
-  await wixApiRequest(RECOVERY_URL, {
-    body: { email, redirect: { url: redirectUri, clientId: WIX_CLIENT_ID } },
-  });
-}
-
-async function runCredentialFlow(path, body) {
-  let res;
-  try {
-    res = await wixApiRequest(path, { body });
-  } catch (e) {
-    throw mapAuthError(e);
-  }
-  return resolveState(res);
-}
-
-// On SUCCESS, finish login and return the member; otherwise hand the state (and
-// stateToken, if any) back to the UI so it can prompt for verification etc.
-async function resolveState(res) {
-  if (res.state === "SUCCESS") {
-    const member = await completeDirectLogin(res.sessionToken);
-    return { state: res.state, member };
-  }
-  return { state: res.state, stateToken: res.stateToken };
-}
-
-// The `getMemberTokensForDirectLogin` analog: turn a session token into member
-// tokens via an INVISIBLE iframe (responseMode: web_message, prompt: none). The
-// member never sees a page — this is the silent plumbing behind your own form.
-async function completeDirectLogin(sessionToken) {
-  const pkce = await generatePkce();
-  const { fullUrl } = await createRedirectSession({
-    authRequest: { responseMode: "web_message", sessionToken, pkce },
-  });
-  const { code } = await authorizeViaHiddenIframe(fullUrl, pkce.state);
-  const tokens = await exchangeCode(code, pkce.codeVerifier);
-  setSessionTokens(tokens);
-  return getCurrentMember();
-}
-
-// ─────────────────────────── (B) social / SSO ───────────────────────────
-
-/**
- * Start a social / SSO login. Redirects the whole page to the provider; returns
- * through YOUR `callbackUri`, where you must call `completeSocialLogin()`.
- *
- * @param {string} idp `IDP.GOOGLE` / `IDP.FACEBOOK`, or a custom SSO connection id
- * @param {string} callbackUri your `/callback` URL — MUST be an allow-listed
- *   authorization redirect URI on the OAuth app (see INSTRUCTIONS.md)
- * @param {string} [returnTo="/"] where to send the member after login completes
- */
-export async function startSocialLogin(idp, callbackUri, returnTo = "/") {
-  const pkce = await generatePkce();
-  const { fullUrl } = await createRedirectSession({
-    authRequest: { responseMode: "fragment", idp, redirectUri: callbackUri, pkce },
-  });
-  // The callback runs on a separate page load — carry what the exchange needs.
-  window.localStorage.setItem(
-    OAUTH_STASH_KEY,
-    JSON.stringify({ codeVerifier: pkce.codeVerifier, state: pkce.state, redirectUri: callbackUri, returnTo }),
-  );
-  window.location.href = fullUrl;
-}
-
-/**
- * Finish a social / SSO login on the `/callback` page: reads `#code`/`#state`
- * from the URL, verifies state, exchanges the code, logs the member in.
- * @returns {Promise<{ member: object|null, returnTo: string }>}
- */
-export async function completeSocialLogin() {
-  const raw = window.localStorage.getItem(OAUTH_STASH_KEY);
-  if (!raw) throw new MemberAuthError("missingOAuthData", "No pending login found — start the login again.");
-  window.localStorage.removeItem(OAUTH_STASH_KEY);
-  const stash = JSON.parse(raw);
-
-  const params = new URLSearchParams(window.location.hash.replace(/^#/, ""));
-  const error = params.get("error");
-  if (error) throw new MemberAuthError(error, params.get("error_description") || error);
-  const code = params.get("code");
-  const state = params.get("state");
-  if (!code || !state) throw new MemberAuthError("missingCode", "No authorization code returned.");
-  if (state !== stash.state) throw new MemberAuthError("stateMismatch", "OAuth state mismatch — possible CSRF; login aborted.");
-
-  const tokens = await exchangeCode(code, stash.codeVerifier, stash.redirectUri);
-  setSessionTokens(tokens);
-  return { member: await getCurrentMember(), returnTo: stash.returnTo || "/" };
-}
-
-// ─────────────────────────── session ───────────────────────────
-
-/** True once a member is logged in on this client. Gate account UI on it. */
-export function isLoggedIn() {
-  return isMember();
-}
-
-/**
- * Read the logged-in member (name / photo / roles / custom fields). Needs the
- * **Members Area app** installed; returns `null` for an anonymous visitor or when
- * the app isn't installed (that's setup, not a code bug — see INSTRUCTIONS.md).
- * @returns {Promise<object|null>}
- */
-export async function getCurrentMember() {
-  try {
-    const res = await wixApiRequest(CURRENT_MEMBER_URL, { method: "GET", query: { fieldSet: "FULL" } });
-    return res?.member || null;
-  } catch (e) {
-    if (e.status === 401 || e.status === 403 || e.status === 404) return null;
-    throw e;
-  }
-}
-
-/**
- * Log the member out: clears the local session immediately, then redirects
- * through the Wix logout URL so the server session is dropped too. After this the
- * client is a clean anonymous visitor again.
- * @param {string} [returnTo] where to land after logout (defaults to the origin)
- */
-export async function logout(returnTo) {
-  const postFlowUrl = returnTo || (typeof window !== "undefined" ? window.location.origin : "/");
-  let logoutUrl;
-  try {
-    const { redirectSession } = await wixApiRequest(REDIRECT_SESSION_URL, {
-      body: { logout: { clientId: WIX_CLIENT_ID }, callbacks: { postFlowUrl } },
-    });
-    logoutUrl = redirectSession?.fullUrl;
-  } finally {
-    clearSession(); // drop local tokens even if building the logout URL failed
-  }
-  if (logoutUrl && typeof window !== "undefined") window.location.href = logoutUrl;
-}
-
-// ─────────────────────────── internals ───────────────────────────
-
-async function createRedirectSession({ authRequest }) {
-  const { responseMode, sessionToken, idp, redirectUri, pkce } = authRequest;
-  // ⚠️ EXACT Wix wire shape — do NOT simplify or inline this. It is NOT the input
-  // object: the request needs the `auth.authRequest` wrapper, the PKCE fields FLAT
-  // (`codeChallenge` + `codeChallengeMethod`, not a nested `pkce` object; the
-  // `codeVerifier` is NOT sent here — it's kept for the token exchange), and
-  // `responseType`/`scope` present. Spreading the input straight onto the body →
-  // 400 Bad Request.
-  const { redirectSession } = await wixApiRequest(REDIRECT_SESSION_URL, {
-    body: {
-      auth: {
-        authRequest: {
-          clientId: WIX_CLIENT_ID,
-          codeChallenge: pkce.codeChallenge,
-          codeChallengeMethod: "S256",
-          responseMode,
-          responseType: "code",
-          scope: "offline_access",
-          state: pkce.state,
-          ...(redirectUri ? { redirectUri } : {}),
-          ...(sessionToken ? { sessionToken } : {}),
-          ...(idp ? { idp } : {}),
-        },
-      },
-    },
-  });
-  if (!redirectSession?.fullUrl) throw new MemberAuthError("noRedirectSession", "Wix did not return an authorization URL.");
-  return { fullUrl: redirectSession.fullUrl };
-}
-
-// Open the authorize URL in a hidden iframe and wait for the web_message postMessage
-// carrying { code, state }. Matches @wix/sdk iframeUtils.addPostMessageListener.
-function authorizeViaHiddenIframe(authUrl, expectedState) {
-  return new Promise((resolve, reject) => {
-    const iframe = document.createElement("iframe");
-    iframe.style.display = "none";
-    let settled = false;
-    const cleanup = () => {
-      window.removeEventListener("message", onMessage);
-      clearTimeout(timer);
-      if (iframe.parentNode) iframe.parentNode.removeChild(iframe);
-    };
-    const onMessage = (e) => {
-      if (!e.data || e.data.state !== expectedState) return; // not our message
-      settled = true;
-      cleanup();
-      if (e.data.error) reject(new MemberAuthError(e.data.error, e.data.error_description || e.data.error));
-      else resolve({ code: e.data.code, state: e.data.state });
-    };
-    window.addEventListener("message", onMessage);
-    const timer = setTimeout(() => {
-      if (!settled) {
-        cleanup();
-        // The overwhelmingly common cause: this app's ORIGIN is not an allowed
-        // authorization redirect URI on the OAuth app, so the browser silently
-        // blocks the iframe's postMessage (check the console for a "target origin
-        // … does not match" error). Register the origin — see INSTRUCTIONS.md.
-        reject(new MemberAuthError(
-          "timeout",
-          `Login timed out. Most likely this app's origin (${typeof window !== "undefined" ? window.location.origin : "?"}) ` +
-            `is not an allowed authorization redirect URI on the Wix OAuth app — register it in the site's Headless Settings.`,
-        ));
-      }
-    }, 120000);
-    iframe.src = authUrl;
-    document.body.appendChild(iframe);
-  });
-}
-
-// Exchange an authorization code for member tokens. No Authorization header — this
-// is the token-minting endpoint (mirrors the SDK's fetchTokens). `redirectUri` is
-// sent only for social (it must match the redirect-session's redirectUri).
-async function exchangeCode(code, codeVerifier, redirectUri) {
-  if (!code) throw new MemberAuthError("missingCode", "No authorization code to exchange.");
-  const res = await fetch(`${WIX_API_BASE}/oauth2/token`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({
-      clientId: WIX_CLIENT_ID,
-      grantType: "authorization_code",
-      code,
-      codeVerifier,
-      ...(redirectUri ? { redirectUri } : {}),
-    }),
-  });
-  if (!res.ok) {
-    let body;
-    try { body = await res.json(); } catch { /* ignore */ }
-    throw new MemberAuthError(body?.error || "tokenExchangeFailed", `Token exchange failed: ${res.status}${body ? ` ${JSON.stringify(body)}` : ""}`);
-  }
-  const data = await res.json();
-  return { accessToken: data.access_token, refreshToken: data.refresh_token, expiresIn: data.expires_in };
-}
-
-function mapAuthError(e) {
-  const code = e?.body?.details?.applicationError?.code;
-  // Email already exists (register) — route them to log in.
-  if (code === "-19995" || e?.status === 409) {
-    return new MemberAuthError("emailAlreadyExists", "An account with this email already exists — try logging in instead.");
-  }
-  // Bad credentials: -19999 identity-not-found (404), -19976 wrong-password (401).
-  if (code === "-19999" || code === "-19976" || e?.status === 404 || e?.status === 401) {
-    return new MemberAuthError("invalidCredentials", "Incorrect email or password.");
-  }
-  if (e instanceof MemberAuthError) return e;
-  return e; // unknown — bubble the raw transport error (fail loudly)
-}
-
-// ── PKCE (RFC 7636, S256) — browser Web Crypto, dependency-free ──
-async function generatePkce() {
-  const codeVerifier = randomUnreserved(43);
-  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(codeVerifier));
-  return { codeVerifier, codeChallenge: base64Url(new Uint8Array(digest)), state: randomUnreserved(24) };
-}
-
-function randomUnreserved(length) {
-  const mask = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~";
-  const bytes = crypto.getRandomValues(new Uint8Array(length));
-  let out = "";
-  for (let i = 0; i < length; i++) out += mask[bytes[i] % mask.length];
-  return out;
-}
-
-function base64Url(bytes) {
-  let binary = "";
-  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}

package/skills/wix-vibe-headless/references/members/install/Register.jsx

@@ -1,22 +0,0 @@
-// Repair stub for `/register` — NOT part of the shipped route surface.
-//
-// This vertical has no registration page by design: sign-up is the "Sign up" tab inside the shipped
-// LoginForm (see components/LoginForm.jsx), and the routes are `/login`, `/callback`, `/account`.
-// Base44, however, seeds its OWN src/pages/Register.jsx (email/password + OTP against base44.auth)
-// into every custom-auth-enrolled app at app creation, before any Wix skill runs. deploy.cjs writes
-// this file over that leftover so a stale Base44 registration flow can't stay live — a redirect
-// rather than a delete, because App.jsx may already route `/register` and a missing import would
-// break the build.
-//
-// Lives outside `app/` on purpose: `app/` is copied into src/ for EVERY members install, and a fresh
-// app with no Base44 leftover has no use for this page.
-import { useEffect } from "react";
-import { useNavigate } from "react-router-dom";
-
-export default function Register() {
-  const navigate = useNavigate();
-  useEffect(() => {
-    navigate("/login", { replace: true });
-  }, [navigate]);
-  return null;
-}

package/skills/wix-vibe-headless/references/members/seed/SEED.md

@@ -1,21 +0,0 @@
-# Members — seeding
-
-**Nothing to seed.** Members login is the identity layer: members **self-register** through the
-Wix login page, so there is no member to create at build time and nothing lands in a `seeded`
-map. There is intentionally no `seed-*.cjs` here.
-
-The members work is entirely **frontend wiring** (custom login, account area, gated content) —
-see this vertical's `INSTRUCTIONS.md` and the reference components.
-
-_Optional, off by default:_ only if a run's prompt explicitly asks to exercise the pricing-plans
-purchase path end-to-end, one test member may be created — keep this off so headless runs stay
-deterministic and don't stall on an interactive login. If you need that, use the documentation skill available in your environment for the current member-create shape (source: `wix-headless/references/SEED.md` § members).
-
-## Reference
-Members self-register, so this vertical seeds nothing. These are the methods to read if you do reach
-for one — each page carries the exact body shape, the required permission scope, and the response
-envelope. `Create Member` needs an elevated credential; the rest run from the client.
-- Create Member (admin — pre-creating a member, e.g. a blog author): https://dev.wix.com/docs/api-reference/crm/members-contacts/members/member-management/members/create-member.md
-- Login: https://dev.wix.com/docs/api-reference/business-management/headless/authentication/login-v-2.md
-- Register: https://dev.wix.com/docs/api-reference/business-management/headless/authentication/register-v-2.md
-- Retrieve Tokens: https://dev.wix.com/docs/api-reference/business-management/headless/authentication/retrieve-tokens.md