@wix/mcp 1.0.86 → 1.0.88

package/build/cjs/toolkit.cjs

@@ -17655,6 +17655,7 @@ function rethrowIfUnauthorized(error) {
 
 // src/config/api-request-rules.ts
 var ARRAY_QUERY_PARAMS_RULE = "Repeat array query params once per value: `?fieldsets=URL&fieldsets=RICH_CONTENT`. Do NOT comma-join values (`fieldsets=URL,RICH_CONTENT`), do NOT leave a trailing comma, and do NOT use a value the method schema does not list, even if a sibling method accepts it (draft posts have no `SEO` fieldset).";
+var WQL_FILTER_RULE = "Query and search filters are written in WQL: each field takes a single operator, so combine conditions with the logical operators \u2014 `$and` and `$or` take an array of expressions, `$not` takes one, and they can nest.";
 
 // src/config/default-config.ts
 var AGENT_GOAL = dedent_default`
@@ -17755,7 +17756,7 @@ var SITE_CREATION_COPY = {
 var SITE_GUIDANCE = dedent_default`
   A new-site request has two things to settle: what the site is for, and how to build it. The how is AI generation vs. starting from a template, so naming templates, a template id or Wix Studio (Wix Studio is also the template side) already settles it.
 
-  One case skips all of this: the user ALREADY HAS the finished site as files — hand-written HTML/CSS/JS, a zip, or the export of an AI builder. There is nothing to build, so don't offer AI or templates and don't call any site-creation tool. Send them to https://www.wix.com/headless/drop?utm_campaign=mcp — they drag the files in and get a live Wix-hosted site. Give that URL exactly as written, keeping the utm_campaign=mcp parameter.
+  One case skips all of this: the user ALREADY HAS the finished site as files — hand-written HTML/CSS/JS, a zip, or the export of an AI builder. There is nothing to build, so don't offer AI or templates and don't call any site-creation tool. For a full agentic flow, read the recipe first and publish the files yourself: https://dev.wix.com/docs/api-reference/account-level/sites/skills/upload-a-website-or-html-files.md — it walks you through creating the site and uploading the files end to end. If you can't follow it, or it doesn't apply (you can't reach the file bytes, or something fails), fall back to sending the user to https://www.wix.com/headless/drop?utm_campaign=mcp — they drag the files in and get a live Wix-hosted site. Give that URL exactly as written, keeping the utm_campaign=mcp parameter.
 
   Settle what the site is for first: its purpose, topic, business type, audience, or main visitor action. Naming a method is not a description of the site, and neither is the business or industry on its own.
   If you can't tell yet, ask the preferred question below and nothing else — one question, no creation-method question in the same reply, and no internal tool names.
@@ -17814,18 +17815,56 @@ var ACCOUNT_SITE_EXECUTE_SCOPE = dedent_default`
     siteId?: string;
     method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
     url: string;
+    // Plain object → JSON. A string is sent verbatim (set your own Content-Type,
+    // e.g. multipart/form-data). A Uint8Array/ArrayBuffer is sent as raw bytes
+    // for binary uploads (set your own Content-Type).
     body?: unknown;
     headers?: Record<string, string>;
+    // "base64" returns the response body as a base64 string (data), with
+    // encoding: "base64" on the result — use it for binary downloads (zip,
+    // image, pdf); decoding those as text corrupts them. Binary content types
+    // are returned as base64 automatically even without this. Decode, edit and
+    // re-upload binary WITHIN this script and return only a small summary. If you
+    // must return the bytes, return the wix.request response object itself (so
+    // encoding: "base64" is preserved and it isn't truncated); a bare base64
+    // string you return is treated as plain text and may be truncated.
+    responseType?: "base64";
   }
   interface WixResponse<T = unknown> {
     status: number;
     data: T;
+    encoding?: "base64";
     json(): Promise<T>;
   }
   declare const wix: {
     request<T = unknown>(options: WixRequestOptions): Promise<WixResponse<T>>;
+    // Build a multipart/form-data body from files (defaults to the \`files\`
+    // global). Each file becomes a part named fieldName (default "files") with
+    // its path as the filename. Pass body + contentType to wix.request.
+    multipart(
+      files?: Array<{ path: string; content: string; contentType?: string }>,
+      options?: { fieldName?: string }
+    ): { body: string; contentType: string };
   };
   declare const siteId: string | undefined;
+  // Files from the ExecuteWixAPI \`files\` param (raw content, no escaping).
+  declare const files: Array<{ path: string; content: string }>;
+  \`\`\`
+
+  FILE UPLOADS: pass file bodies via the \`files\` param (not inside \`code\` — no escaping), then build the multipart body with \`wix.multipart()\`:
+  \`\`\`javascript
+  // files param: "=== FILE: index.html ===\\n<!doctype html>...\\n=== FILE: app.js ===\\nconsole.log(1)"
+  async () => {
+    const mp = wix.multipart(); // parts named "files", filename = each path
+    const res = await wix.request({
+      scope: "account",
+      method: "POST",
+      url: "https://www.wixapis.com/.../upload",
+      headers: { "Content-Type": mp.contentType },
+      body: mp.body
+    });
+    return res.data;
+  }
   \`\`\`
 `;
 var EXECUTE_WIX_API_WQL = dedent_default`
@@ -17958,6 +17997,7 @@ function buildToolDescriptions(includeReadme, includeImageUploadGuidance = true)
     ReadFullDocsArticle: dedent_default`
     Fetches the full Wix docs article or method article with code examples for using the method.
     Docs articles looks like this: https://dev.wix.com/docs/... and they can either be general docs articles or method articles.
+    Take the URL from the user's message or an earlier tool result. To reach an article you have no URL for, search or browse the docs first.
     For REST docs, use the URL as-is. For SDK docs, the URL SHOULD include ?apiView=SDK.
     ${reminder}
   `,
@@ -18090,7 +18130,7 @@ function buildToolDescriptions(includeReadme, includeImageUploadGuidance = true)
   `,
     "import-claude-design-from-url": dedent_default`
     Import a design created in Claude's design tool into Wix. Takes the signed claudeusercontent.com URL Claude Design produces for its self-contained HTML bundle (all images, fonts, and styles inlined); any other host is rejected. Creates a live Wix-hosted site and returns its URL.
-    NOT for site files the user provides themselves (their own HTML/CSS/JS, a zip, another builder's export) — for those, don't call this tool: send the user to https://www.wix.com/headless/drop?utm_campaign=mcp, where they upload the files and get a live hosted site. Give that URL exactly as written, keeping the utm_campaign=mcp parameter.
+    NOT for site files the user provides themselves (their own HTML/CSS/JS, a zip, another builder's export) — for those, don't call this tool. For a full agentic flow, read the recipe and publish the files yourself: https://dev.wix.com/docs/api-reference/account-level/sites/skills/upload-a-website-or-html-files.md — it covers creating the site and uploading the files end to end. If you can't follow it, or it doesn't apply, fall back to sending the user to https://www.wix.com/headless/drop?utm_campaign=mcp, where they upload the files and get a live hosted site. Give that URL exactly as written, keeping the utm_campaign=mcp parameter.
   `,
     RunWixCliCommand: dedent_default`
     Executes Wix CLI commands for Wix app development and management.
@@ -18517,7 +18557,7 @@ function buildToolDescriptions(includeReadme, includeImageUploadGuidance = true)
     CreateWixBusinessGuide: dedent_default`
     Provides comprehensive documentation for creating a new Wix business (site, app, etc.).
     Call this ONLY when the user explicitly asks for a headless site, a Wix Classic Editor site, or manual/advanced account/API-based site creation — these don't need the site's purpose first. For normal site-creation ${SITE_CREATION_COPY.normalCreationRoute.nonWidget}; for a specific template id, call \`CreateSiteFromTemplate\`.
-    Exception, even when the user says "headless": if they ALREADY HAVE the finished site as files (their own HTML/CSS/JS, a zip, an AI-builder export) and want those files hosted, don't call this tool — send them to https://www.wix.com/headless/drop?utm_campaign=mcp to upload the files and get a live hosted site (give that URL exactly, keeping the utm_campaign=mcp parameter). This guide's CLI flow is for BUILDING a headless frontend, not for hosting ready-made files.
+    Exception, even when the user says "headless": if they ALREADY HAVE the finished site as files (their own HTML/CSS/JS, a zip, an AI-builder export) and want those files hosted, don't call this tool. For a full agentic flow, read the recipe and publish the files yourself: https://dev.wix.com/docs/api-reference/account-level/sites/skills/upload-a-website-or-html-files.md — it covers creating the site and uploading the files end to end. If you can't follow it, or it doesn't apply, fall back to sending the user to https://www.wix.com/headless/drop?utm_campaign=mcp to upload the files and get a live hosted site (give that URL exactly, keeping the utm_campaign=mcp parameter). This guide's CLI flow is for BUILDING a headless frontend, not for hosting ready-made files.
 
     ## What This Tool Contains
 
@@ -19154,7 +19194,10 @@ var paramDescriptions = {
       ARRAY_QUERY_PARAMS_RULE
     ].join("\n"),
     method: "The HTTP method to use for the API call (e.g. GET, POST, PUT, DELETE)",
-    body: 'The request body as a JSON object or array with all the required fields and values, including nested objects. Pass the actual value (object or array), NOT a JSON string. YOU MUST NEVER MAKE UP A BODY - the body should be based on the conversation context, i.e from the user prompt OR got into the conversation context by the "ReadFullDocsArticle" tool OR by the "SearchWixAPISpec" tool OR by the "ReadFullDocsMethodSchema" tool - i.e based on the API docs, a relevant recipe you read (preferably), a code example you found in the docs, a schema you read etc.. YOU MUST NEVER ASSUME YOU KNOW WHAT THE BODY SCHEMA IS WITHOUT CONCRETE EXAMPLES OR SCHEMA DEFINITIONS FROM THE CONVERSATION CONTEXT. Prefer reading relevant recipes if you have them in context for understand the body schema for API calls.',
+    body: [
+      'The request body as a JSON object or array with all the required fields and values, including nested objects. Pass the actual value (object or array), NOT a JSON string. YOU MUST NEVER MAKE UP A BODY - the body should be based on the conversation context, i.e from the user prompt OR got into the conversation context by the "ReadFullDocsArticle" tool OR by the "SearchWixAPISpec" tool OR by the "ReadFullDocsMethodSchema" tool - i.e based on the API docs, a relevant recipe you read (preferably), a code example you found in the docs, a schema you read etc.. YOU MUST NEVER ASSUME YOU KNOW WHAT THE BODY SCHEMA IS WITHOUT CONCRETE EXAMPLES OR SCHEMA DEFINITIONS FROM THE CONVERSATION CONTEXT. Prefer reading relevant recipes if you have them in context for understand the body schema for API calls.',
+      WQL_FILTER_RULE
+    ].join("\n"),
     reason: "One sentence explaining the original user request and why you are calling this API to complete it.",
     sourceDocUrl: [
       "The URL of the documentation or recipe where you found this API endpoint.",
@@ -19478,15 +19521,17 @@ Failed to fetch content: ${errorMsg}`
       const baseContentsPromise = Promise.all(
         baseDocsWithoutRecipes.map(fetchDoc)
       );
-      const skillsContentPromise = getSkillsByPortal(httpClient, {
+      const skillsContentPromise = skillsTags?.length ? getSkillsByPortal(httpClient, {
         portalId: REST_PORTAL_ID,
         ...repo && { repo },
         ...commitHash && { commitHash },
-        ...skillsTags && skillsTags.length > 0 && { tags: skillsTags }
+        tags: skillsTags
       }).catch((err) => {
         console.error("[WixREADME] Failed to fetch skills by portal:", err);
         return null;
-      });
+      }) : fetchDoc({ action: "include", url: RECIPES_INDEX_URL }).then(
+        (doc) => doc?.text ?? null
+      );
       const filter = {};
       if (siteId) filter.siteId = siteId;
       else if (siteName) filter.siteName = siteName;
@@ -20525,6 +20570,14 @@ var import_http_client2 = __toESM(require_index_node(), 1);
 
 // src/tool-utils.ts
 var REST_METHOD_CONTRACT_RETRY_HINT = "Before retrying, make sure you have everything needed for a correct call: the right endpoint URL, HTTP method, request body shape, and response shape. Use the SearchWixRESTDocumentation tool or BrowseWixRESTDocsMenu tool to find the correct method or relevant related articles, the ReadFullDocsArticle tool to read the method description and all code examples, and the SearchWixAPISpec tool for precise field names and schema details.";
+var SINGLE_OPERATOR_PER_FIELD_HINT = 'WQL takes one operator per field object. Split the conditions into separate expressions under the matching logical operator \u2014 `{"$and": [{"field": {"$gte": ...}}, {"field": {"$lte": ...}}]}` \u2014 and retry without re-searching the docs.';
+var FIELD_CAPABILITIES_HINT = "This endpoint declares its filterable and sortable fields with their operators. Read the map with SearchWixAPISpec (`queryMethodData.queryFieldsCapabilitiesMap`, or `searchMethodData.searchFieldsCapabilitiesMap` on search methods) and use only what it lists; otherwise fetch a bounded page and filter or sort the results yourself.";
+var getRetryHint = (errorDetails) => {
+  if (!/Filter contains unsupported operator/i.test(errorDetails)) {
+    return REST_METHOD_CONTRACT_RETRY_HINT;
+  }
+  return /"operator":"\{/.test(errorDetails) ? SINGLE_OPERATOR_PER_FIELD_HINT : FIELD_CAPABILITIES_HINT;
+};
 var safeParseJSON = (text) => {
   try {
     return JSON.parse(text);
@@ -20548,7 +20601,7 @@ var buildErrorMessage = ({
   ].filter((str) => !!str).join("\n");
   return `${baseMessage}
 
-${REST_METHOD_CONTRACT_RETRY_HINT}`;
+${getRetryHint(String(errorDetails))}`;
 };
 var handleWixAPIResponse = async (response) => {
   const requestId = response.headers?.["x-wix-request-id"];
@@ -22215,12 +22268,31 @@ function formatExecuteResult(data, maxResponseSize, reportBi) {
   reportBi?.({
     originalLength: typeof data.result === "string" ? data.result.length : JSON.stringify(data.result)?.length
   });
+  const base64Text = base64PayloadText(data.result);
+  if (base64Text !== null) {
+    if (base64Text.length <= MAX_ALLOWED_RESPONSE_CHARS) {
+      return { content: [{ type: "text", text: base64Text }] };
+    }
+    const approxKb = Math.ceil(base64Text.length / 1024).toLocaleString();
+    const limitKb = Math.floor(
+      MAX_ALLOWED_RESPONSE_CHARS / 1024
+    ).toLocaleString();
+    return executeErrorResult(
+      `Binary (base64) result is ~${approxKb} KB, too large to return intact (limit ~${limitKb} KB); truncating it would corrupt the base64. Process the bytes inside your ExecuteWixAPI script \u2014 decode, edit, and re-upload in the same call \u2014 and return only a small summary.`
+    );
+  }
   return {
     content: [
       { type: "text", text: truncateResponse(data.result, maxResponseSize) }
     ]
   };
 }
+function base64PayloadText(result) {
+  if (result !== null && typeof result === "object" && result.encoding === "base64" && typeof result.data === "string") {
+    return JSON.stringify(result);
+  }
+  return null;
+}
 function addExecuteTool(server, options) {
   const {
     codeModeBaseUrl,
@@ -22252,6 +22324,14 @@ function addExecuteTool(server, options) {
         visitor ? "Whether this code creates, updates, deletes, publishes, imports, uploads, or otherwise mutates site data on the visitor\u2019s behalf. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false." : "Whether this code creates, updates, deletes, publishes, installs, imports, uploads, or otherwise mutates Wix data or site/account state. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false."
       ),
       sourceDocUrls: external_exports.array(external_exports.string()).describe(d.sourceDocUrls),
+      files: external_exports.string().optional().describe(
+        [
+          "Optional bundle of raw file contents for uploads, so file bytes never go through the `code` JavaScript (no escaping, no string-literal/`${}`/backtick pitfalls).",
+          "Format: one or more sections, each a line `=== FILE: <path> ===` on its own, followed by that file's raw text content; `<path>` is the path relative to the site root (e.g. `index.html`, `assets/app.js`). Example: `=== FILE: index.html ===\\n<!doctype html>...\\n=== FILE: assets/app.js ===\\nconsole.log(1)`.",
+          'In `code`, the parsed files are the `files` global (array of `{ path, content }`), and `wix.multipart(files)` returns `{ body, contentType }` for a `multipart/form-data` upload \u2014 e.g. `const mp = wix.multipart(); await wix.request({ scope: "account", method: "POST", url, headers: { "Content-Type": mp.contentType }, body: mp.body });`.',
+          "Text files only; for binary assets pass bytes as a base64 request body instead. A file whose content itself contains a line exactly like the delimiter is not supported."
+        ].join(" ")
+      ),
       // Visitor mode takes an agent-supplied token and pins the site; account/site
       // mode lets the agent pick the site.
       ...visitor ? {
@@ -22266,7 +22346,7 @@ function addExecuteTool(server, options) {
     },
     { readOnlyHint: false, destructiveHint: true, openWorldHint: false },
     async (rawArgs, extra) => {
-      const { code, reason, hasMutations, sourceDocUrls, visitorToken } = rawArgs;
+      const { code, reason, hasMutations, sourceDocUrls, visitorToken, files } = rawArgs;
       const siteId = visitor ? visitor.siteId : rawArgs.siteId;
       logger.log(
         `[ExecuteWixAPI]${visitor ? " (visitor)" : ""} Executing code (${code.length} chars), siteId=${siteId ?? "none"}, hasMutations=${hasMutations}, sourceDocUrls=${JSON.stringify(sourceDocUrls)}, reason="${reason}"`
@@ -22311,7 +22391,8 @@ function addExecuteTool(server, options) {
             siteToken: visitor ? visitorToken : siteHeaders?.Authorization,
             accountToken: visitor ? visitorToken : accountHeaders?.Authorization,
             accountId: accountHeaders?.["wix-account-id"],
-            siteAuthContext
+            siteAuthContext,
+            ...files ? { files } : {}
           },
           visitor ? visitorToken : accountHeaders?.Authorization ?? siteHeaders?.Authorization,
           codeModeFetch

package/build/dts/code-mode/index.js

@@ -2,6 +2,7 @@ import { z } from 'zod';
 import { logger } from '../infra/logger.js';
 import { defaultToolDescriptions } from '../config/default-config.js';
 import { truncateResponse } from './truncate-response.js';
+import { MAX_ALLOWED_RESPONSE_CHARS } from '../infra/response-size-limits.js';
 import { validateExecuteCode } from './validation.js';
 import { desc } from '../config/param-descriptions.js';
 import { rethrowIfUnauthorized } from '../auth/index.js';
@@ -176,12 +177,39 @@ function formatExecuteResult(data, maxResponseSize, reportBi) {
             ? data.result.length
             : JSON.stringify(data.result)?.length
     });
+    // A base64/binary payload (a downloaded zip, image, …) must never be sliced:
+    // a cut base64 string decodes to garbage, so the usual char-limit truncation
+    // would silently corrupt it. Return it whole up to the hard ceiling; past
+    // that, fail cleanly rather than hand back a broken blob.
+    const base64Text = base64PayloadText(data.result);
+    if (base64Text !== null) {
+        if (base64Text.length <= MAX_ALLOWED_RESPONSE_CHARS) {
+            return { content: [{ type: 'text', text: base64Text }] };
+        }
+        const approxKb = Math.ceil(base64Text.length / 1024).toLocaleString();
+        const limitKb = Math.floor(MAX_ALLOWED_RESPONSE_CHARS / 1024).toLocaleString();
+        return executeErrorResult(`Binary (base64) result is ~${approxKb} KB, too large to return intact (limit ~${limitKb} KB); truncating it would corrupt the base64. Process the bytes inside your ExecuteWixAPI script — decode, edit, and re-upload in the same call — and return only a small summary.`);
+    }
     return {
         content: [
             { type: 'text', text: truncateResponse(data.result, maxResponseSize) }
         ]
     };
 }
+// A base64 payload the caller returned as a WixResponse carrying
+// `encoding: "base64"` — the shape `wix.request` produces for a binary body.
+// We key off that explicit marker, never a content heuristic: a long string in
+// the base64 alphabet can be ordinary text (e.g. "x".repeat(30000)) and must
+// still truncate normally. Returns the text to keep intact, or null otherwise.
+function base64PayloadText(result) {
+    if (result !== null &&
+        typeof result === 'object' &&
+        result.encoding === 'base64' &&
+        typeof result.data === 'string') {
+        return JSON.stringify(result);
+    }
+    return null;
+}
 function addExecuteTool(server, options) {
     const { codeModeBaseUrl, codeModeFetch, authStrategy, visitor, toolDescriptions, maxResponseSize } = options;
     const executeUrl = `${codeModeBaseUrl}/api/code-mode/execute`;
@@ -208,6 +236,15 @@ function addExecuteTool(server, options) {
             ? 'Whether this code creates, updates, deletes, publishes, imports, uploads, or otherwise mutates site data on the visitor’s behalf. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false.'
             : 'Whether this code creates, updates, deletes, publishes, installs, imports, uploads, or otherwise mutates Wix data or site/account state. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false.'),
         sourceDocUrls: z.array(z.string()).describe(d.sourceDocUrls),
+        files: z
+            .string()
+            .optional()
+            .describe([
+            'Optional bundle of raw file contents for uploads, so file bytes never go through the `code` JavaScript (no escaping, no string-literal/`${}`/backtick pitfalls).',
+            "Format: one or more sections, each a line `=== FILE: <path> ===` on its own, followed by that file's raw text content; `<path>` is the path relative to the site root (e.g. `index.html`, `assets/app.js`). Example: `=== FILE: index.html ===\\n<!doctype html>...\\n=== FILE: assets/app.js ===\\nconsole.log(1)`.",
+            'In `code`, the parsed files are the `files` global (array of `{ path, content }`), and `wix.multipart(files)` returns `{ body, contentType }` for a `multipart/form-data` upload — e.g. `const mp = wix.multipart(); await wix.request({ scope: "account", method: "POST", url, headers: { "Content-Type": mp.contentType }, body: mp.body });`.',
+            'Text files only; for binary assets pass bytes as a base64 request body instead. A file whose content itself contains a line exactly like the delimiter is not supported.'
+        ].join(' ')),
         // Visitor mode takes an agent-supplied token and pins the site; account/site
         // mode lets the agent pick the site.
         ...(visitor
@@ -226,7 +263,7 @@ function addExecuteTool(server, options) {
     // Partial: duck-typed servers (the toolkit's capturing server, test
     // doubles) build their own extra and may not supply every field.
     extra) => {
-        const { code, reason, hasMutations, sourceDocUrls, visitorToken } = rawArgs;
+        const { code, reason, hasMutations, sourceDocUrls, visitorToken, files } = rawArgs;
         // In visitor mode the site is pinned; otherwise it comes from the param.
         const siteId = visitor ? visitor.siteId : rawArgs.siteId;
         logger.log(`[ExecuteWixAPI]${visitor ? ' (visitor)' : ''} Executing code (${code.length} chars), siteId=${siteId ?? 'none'}, hasMutations=${hasMutations}, sourceDocUrls=${JSON.stringify(sourceDocUrls)}, reason="${reason}"`);
@@ -290,7 +327,8 @@ function addExecuteTool(server, options) {
                     ? visitorToken
                     : accountHeaders?.Authorization,
                 accountId: accountHeaders?.['wix-account-id'],
-                siteAuthContext
+                siteAuthContext,
+                ...(files ? { files } : {})
             }, visitor
                 ? visitorToken
                 : (accountHeaders?.Authorization ?? siteHeaders?.Authorization), codeModeFetch);

package/build/dts/config/api-request-rules.d.ts

@@ -8,4 +8,5 @@
  * single unknown enum member and rejected with HTTP 400.
  */
 export declare const ARRAY_QUERY_PARAMS_RULE = "Repeat array query params once per value: `?fieldsets=URL&fieldsets=RICH_CONTENT`. Do NOT comma-join values (`fieldsets=URL,RICH_CONTENT`), do NOT leave a trailing comma, and do NOT use a value the method schema does not list, even if a sibling method accepts it (draft posts have no `SEO` fieldset).";
+export declare const WQL_FILTER_RULE = "Query and search filters are written in WQL: each field takes a single operator, so combine conditions with the logical operators \u2014 `$and` and `$or` take an array of expressions, `$not` takes one, and they can nest.";
 //# sourceMappingURL=api-request-rules.d.ts.map

package/build/dts/config/api-request-rules.js

@@ -8,4 +8,5 @@
  * single unknown enum member and rejected with HTTP 400.
  */
 export const ARRAY_QUERY_PARAMS_RULE = 'Repeat array query params once per value: `?fieldsets=URL&fieldsets=RICH_CONTENT`. Do NOT comma-join values (`fieldsets=URL,RICH_CONTENT`), do NOT leave a trailing comma, and do NOT use a value the method schema does not list, even if a sibling method accepts it (draft posts have no `SEO` fieldset).';
+export const WQL_FILTER_RULE = 'Query and search filters are written in WQL: each field takes a single operator, so combine conditions with the logical operators — `$and` and `$or` take an array of expressions, `$not` takes one, and they can nest.';
 //# sourceMappingURL=api-request-rules.js.map

package/build/dts/config/default-config.js

@@ -80,7 +80,7 @@ export const SITE_CREATION_COPY = {
 const SITE_GUIDANCE = dedent `
   A new-site request has two things to settle: what the site is for, and how to build it. The how is AI generation vs. starting from a template, so naming templates, a template id or Wix Studio (Wix Studio is also the template side) already settles it.
 
-  One case skips all of this: the user ALREADY HAS the finished site as files — hand-written HTML/CSS/JS, a zip, or the export of an AI builder. There is nothing to build, so don't offer AI or templates and don't call any site-creation tool. Send them to https://www.wix.com/headless/drop?utm_campaign=mcp — they drag the files in and get a live Wix-hosted site. Give that URL exactly as written, keeping the utm_campaign=mcp parameter.
+  One case skips all of this: the user ALREADY HAS the finished site as files — hand-written HTML/CSS/JS, a zip, or the export of an AI builder. There is nothing to build, so don't offer AI or templates and don't call any site-creation tool. For a full agentic flow, read the recipe first and publish the files yourself: https://dev.wix.com/docs/api-reference/account-level/sites/skills/upload-a-website-or-html-files.md — it walks you through creating the site and uploading the files end to end. If you can't follow it, or it doesn't apply (you can't reach the file bytes, or something fails), fall back to sending the user to https://www.wix.com/headless/drop?utm_campaign=mcp — they drag the files in and get a live Wix-hosted site. Give that URL exactly as written, keeping the utm_campaign=mcp parameter.
 
   Settle what the site is for first: its purpose, topic, business type, audience, or main visitor action. Naming a method is not a description of the site, and neither is the business or industry on its own.
   If you can't tell yet, ask the preferred question below and nothing else — one question, no creation-method question in the same reply, and no internal tool names.
@@ -142,18 +142,56 @@ const ACCOUNT_SITE_EXECUTE_SCOPE = dedent `
     siteId?: string;
     method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
     url: string;
+    // Plain object → JSON. A string is sent verbatim (set your own Content-Type,
+    // e.g. multipart/form-data). A Uint8Array/ArrayBuffer is sent as raw bytes
+    // for binary uploads (set your own Content-Type).
     body?: unknown;
     headers?: Record<string, string>;
+    // "base64" returns the response body as a base64 string (data), with
+    // encoding: "base64" on the result — use it for binary downloads (zip,
+    // image, pdf); decoding those as text corrupts them. Binary content types
+    // are returned as base64 automatically even without this. Decode, edit and
+    // re-upload binary WITHIN this script and return only a small summary. If you
+    // must return the bytes, return the wix.request response object itself (so
+    // encoding: "base64" is preserved and it isn't truncated); a bare base64
+    // string you return is treated as plain text and may be truncated.
+    responseType?: "base64";
   }
   interface WixResponse<T = unknown> {
     status: number;
     data: T;
+    encoding?: "base64";
     json(): Promise<T>;
   }
   declare const wix: {
     request<T = unknown>(options: WixRequestOptions): Promise<WixResponse<T>>;
+    // Build a multipart/form-data body from files (defaults to the \`files\`
+    // global). Each file becomes a part named fieldName (default "files") with
+    // its path as the filename. Pass body + contentType to wix.request.
+    multipart(
+      files?: Array<{ path: string; content: string; contentType?: string }>,
+      options?: { fieldName?: string }
+    ): { body: string; contentType: string };
   };
   declare const siteId: string | undefined;
+  // Files from the ExecuteWixAPI \`files\` param (raw content, no escaping).
+  declare const files: Array<{ path: string; content: string }>;
+  \`\`\`
+
+  FILE UPLOADS: pass file bodies via the \`files\` param (not inside \`code\` — no escaping), then build the multipart body with \`wix.multipart()\`:
+  \`\`\`javascript
+  // files param: "=== FILE: index.html ===\\n<!doctype html>...\\n=== FILE: app.js ===\\nconsole.log(1)"
+  async () => {
+    const mp = wix.multipart(); // parts named "files", filename = each path
+    const res = await wix.request({
+      scope: "account",
+      method: "POST",
+      url: "https://www.wixapis.com/.../upload",
+      headers: { "Content-Type": mp.contentType },
+      body: mp.body
+    });
+    return res.data;
+  }
   \`\`\`
 `;
 const EXECUTE_WIX_API_WQL = dedent `
@@ -283,6 +321,7 @@ export function buildToolDescriptions(includeReadme, includeImageUploadGuidance
         ReadFullDocsArticle: dedent `
     Fetches the full Wix docs article or method article with code examples for using the method.
     Docs articles looks like this: https://dev.wix.com/docs/... and they can either be general docs articles or method articles.
+    Take the URL from the user's message or an earlier tool result. To reach an article you have no URL for, search or browse the docs first.
     For REST docs, use the URL as-is. For SDK docs, the URL SHOULD include ?apiView=SDK.
     ${reminder}
   `,
@@ -415,7 +454,7 @@ export function buildToolDescriptions(includeReadme, includeImageUploadGuidance
   `,
         'import-claude-design-from-url': dedent `
     Import a design created in Claude's design tool into Wix. Takes the signed claudeusercontent.com URL Claude Design produces for its self-contained HTML bundle (all images, fonts, and styles inlined); any other host is rejected. Creates a live Wix-hosted site and returns its URL.
-    NOT for site files the user provides themselves (their own HTML/CSS/JS, a zip, another builder's export) — for those, don't call this tool: send the user to https://www.wix.com/headless/drop?utm_campaign=mcp, where they upload the files and get a live hosted site. Give that URL exactly as written, keeping the utm_campaign=mcp parameter.
+    NOT for site files the user provides themselves (their own HTML/CSS/JS, a zip, another builder's export) — for those, don't call this tool. For a full agentic flow, read the recipe and publish the files yourself: https://dev.wix.com/docs/api-reference/account-level/sites/skills/upload-a-website-or-html-files.md — it covers creating the site and uploading the files end to end. If you can't follow it, or it doesn't apply, fall back to sending the user to https://www.wix.com/headless/drop?utm_campaign=mcp, where they upload the files and get a live hosted site. Give that URL exactly as written, keeping the utm_campaign=mcp parameter.
   `,
         RunWixCliCommand: dedent `
     Executes Wix CLI commands for Wix app development and management.
@@ -842,7 +881,7 @@ export function buildToolDescriptions(includeReadme, includeImageUploadGuidance
         CreateWixBusinessGuide: dedent `
     Provides comprehensive documentation for creating a new Wix business (site, app, etc.).
     Call this ONLY when the user explicitly asks for a headless site, a Wix Classic Editor site, or manual/advanced account/API-based site creation — these don't need the site's purpose first. For normal site-creation ${SITE_CREATION_COPY.normalCreationRoute.nonWidget}; for a specific template id, call \`CreateSiteFromTemplate\`.
-    Exception, even when the user says "headless": if they ALREADY HAVE the finished site as files (their own HTML/CSS/JS, a zip, an AI-builder export) and want those files hosted, don't call this tool — send them to https://www.wix.com/headless/drop?utm_campaign=mcp to upload the files and get a live hosted site (give that URL exactly, keeping the utm_campaign=mcp parameter). This guide's CLI flow is for BUILDING a headless frontend, not for hosting ready-made files.
+    Exception, even when the user says "headless": if they ALREADY HAVE the finished site as files (their own HTML/CSS/JS, a zip, an AI-builder export) and want those files hosted, don't call this tool. For a full agentic flow, read the recipe and publish the files yourself: https://dev.wix.com/docs/api-reference/account-level/sites/skills/upload-a-website-or-html-files.md — it covers creating the site and uploading the files end to end. If you can't follow it, or it doesn't apply, fall back to sending the user to https://www.wix.com/headless/drop?utm_campaign=mcp to upload the files and get a live hosted site (give that URL exactly, keeping the utm_campaign=mcp parameter). This guide's CLI flow is for BUILDING a headless frontend, not for hosting ready-made files.
 
     ## What This Tool Contains
 

package/build/dts/config/param-descriptions.js

@@ -1,5 +1,5 @@
 import { ALLOWED_HOSTNAMES } from '../api-call/validation.js';
-import { ARRAY_QUERY_PARAMS_RULE } from './api-request-rules.js';
+import { ARRAY_QUERY_PARAMS_RULE, WQL_FILTER_RULE } from './api-request-rules.js';
 /**
  * Centralized parameter descriptions organized by tool.
  * Each tool has all its parameter descriptions in one place.
@@ -15,7 +15,10 @@ export const paramDescriptions = {
             ARRAY_QUERY_PARAMS_RULE
         ].join('\n'),
         method: 'The HTTP method to use for the API call (e.g. GET, POST, PUT, DELETE)',
-        body: 'The request body as a JSON object or array with all the required fields and values, including nested objects. Pass the actual value (object or array), NOT a JSON string. YOU MUST NEVER MAKE UP A BODY - the body should be based on the conversation context, i.e from the user prompt OR got into the conversation context by the "ReadFullDocsArticle" tool OR by the "SearchWixAPISpec" tool OR by the "ReadFullDocsMethodSchema" tool - i.e based on the API docs, a relevant recipe you read (preferably), a code example you found in the docs, a schema you read etc.. YOU MUST NEVER ASSUME YOU KNOW WHAT THE BODY SCHEMA IS WITHOUT CONCRETE EXAMPLES OR SCHEMA DEFINITIONS FROM THE CONVERSATION CONTEXT. Prefer reading relevant recipes if you have them in context for understand the body schema for API calls.',
+        body: [
+            'The request body as a JSON object or array with all the required fields and values, including nested objects. Pass the actual value (object or array), NOT a JSON string. YOU MUST NEVER MAKE UP A BODY - the body should be based on the conversation context, i.e from the user prompt OR got into the conversation context by the "ReadFullDocsArticle" tool OR by the "SearchWixAPISpec" tool OR by the "ReadFullDocsMethodSchema" tool - i.e based on the API docs, a relevant recipe you read (preferably), a code example you found in the docs, a schema you read etc.. YOU MUST NEVER ASSUME YOU KNOW WHAT THE BODY SCHEMA IS WITHOUT CONCRETE EXAMPLES OR SCHEMA DEFINITIONS FROM THE CONVERSATION CONTEXT. Prefer reading relevant recipes if you have them in context for understand the body schema for API calls.',
+            WQL_FILTER_RULE
+        ].join('\n'),
         reason: 'One sentence explaining the original user request and why you are calling this API to complete it.',
         sourceDocUrl: [
             'The URL of the documentation or recipe where you found this API endpoint.',

package/build/dts/docs/get-to-know.js

@@ -169,17 +169,20 @@ export async function addGetToKnowTools({ server, disableTools = [], toolDescrip
         //     return '';
         //   });
         const baseContentsPromise = Promise.all(baseDocsWithoutRecipes.map(fetchDoc));
-        // Fetch the skills index from the portal. In PR mode, pass repo+commitHash
-        // to get the PR-aware index (includes recipes added via YAML in the PR).
-        const skillsContentPromise = getSkillsByPortal(httpClient, {
-            portalId: REST_PORTAL_ID,
-            ...(repo && { repo }),
-            ...(commitHash && { commitHash }),
-            ...(skillsTags && skillsTags.length > 0 && { tags: skillsTags })
-        }).catch((err) => {
-            console.error('[WixREADME] Failed to fetch skills by portal:', err);
-            return null;
-        });
+        // Filtered lists still come from the portal. The full management index is
+        // authored alongside the recipes and is fetched like any other article,
+        // using its commit version when a PR override is configured.
+        const skillsContentPromise = skillsTags?.length
+            ? getSkillsByPortal(httpClient, {
+                portalId: REST_PORTAL_ID,
+                ...(repo && { repo }),
+                ...(commitHash && { commitHash }),
+                tags: skillsTags
+            }).catch((err) => {
+                console.error('[WixREADME] Failed to fetch skills by portal:', err);
+                return null;
+            })
+            : fetchDoc({ action: 'include', url: RECIPES_INDEX_URL }).then((doc) => doc?.text ?? null);
         // Auto-inject site context. With no site targeted this is the account-wide
         // view: single-site accounts "just work", and accounts with more than the
         // cap show the first N sites plus a note to use GetSiteContext for the rest.

package/build/dts/import-claude-design-tool/index.js

@@ -86,11 +86,11 @@ export function addImportClaudeDesignTool(server, authStrategy, options) {
             designUrl = new URL(args.url);
         }
         catch {
-            return errorResult('Invalid design URL — this tool only accepts the claudeusercontent.com URL produced by Claude Design. For site files the user provided themselves, do not retry: send the user to https://www.wix.com/headless/drop?utm_campaign=mcp to upload them and get a live hosted site.');
+            return errorResult("Invalid design URL — this tool only accepts the claudeusercontent.com URL produced by Claude Design. For site files the user provided themselves, do not retry this tool. For a full agentic flow, read the recipe and publish the files yourself: https://dev.wix.com/docs/api-reference/account-level/sites/skills/upload-a-website-or-html-files.md — it covers creating the site and uploading the files end to end. If you can't follow it, or it doesn't apply, send the user to https://www.wix.com/headless/drop?utm_campaign=mcp to upload them and get a live hosted site.");
         }
         if (designUrl.protocol !== 'https:' ||
             !designUrl.hostname.endsWith(CLAUDE_USER_CONTENT_HOST_SUFFIX)) {
-            return errorResult('Invalid design URL — this tool only accepts the claudeusercontent.com URL produced by Claude Design. For site files the user provided themselves, do not retry: send the user to https://www.wix.com/headless/drop?utm_campaign=mcp to upload them and get a live hosted site.');
+            return errorResult("Invalid design URL — this tool only accepts the claudeusercontent.com URL produced by Claude Design. For site files the user provided themselves, do not retry this tool. For a full agentic flow, read the recipe and publish the files yourself: https://dev.wix.com/docs/api-reference/account-level/sites/skills/upload-a-website-or-html-files.md — it covers creating the site and uploading the files end to end. If you can't follow it, or it doesn't apply, send the user to https://www.wix.com/headless/drop?utm_campaign=mcp to upload them and get a live hosted site.");
         }
         // Resolve the caller's account identity BEFORE the design fetch — the
         // design URL is single-use, so an unauthenticated caller must fail

package/build/dts/tool-utils.js

@@ -1,5 +1,16 @@
 const REST_METHOD_CONTRACT_RETRY_HINT = 'Before retrying, make sure you have everything needed for a correct call: the right endpoint URL, HTTP method, request body shape, and response shape. ' +
     'Use the SearchWixRESTDocumentation tool or BrowseWixRESTDocsMenu tool to find the correct method or relevant related articles, the ReadFullDocsArticle tool to read the method description and all code examples, and the SearchWixAPISpec tool for precise field names and schema details.';
+const SINGLE_OPERATOR_PER_FIELD_HINT = 'WQL takes one operator per field object. Split the conditions into separate expressions under the matching logical operator — `{"$and": [{"field": {"$gte": ...}}, {"field": {"$lte": ...}}]}` — and retry without re-searching the docs.';
+const FIELD_CAPABILITIES_HINT = 'This endpoint declares its filterable and sortable fields with their operators. Read the map with SearchWixAPISpec (`queryMethodData.queryFieldsCapabilitiesMap`, or `searchMethodData.searchFieldsCapabilitiesMap` on search methods) and use only what it lists; otherwise fetch a bounded page and filter or sort the results yourself.';
+const getRetryHint = (errorDetails) => {
+    if (!/Filter contains unsupported operator/i.test(errorDetails)) {
+        return REST_METHOD_CONTRACT_RETRY_HINT;
+    }
+    // The API reports a field object with several operators as one unknown operator whose name is that object.
+    return /"operator":"\{/.test(errorDetails)
+        ? SINGLE_OPERATOR_PER_FIELD_HINT
+        : FIELD_CAPABILITIES_HINT;
+};
 export const DEFAULT_OPENAI_SECURITY_SCHEMES = [
     { type: 'oauth2', scopes: ['offline_access'] }
 ];
@@ -28,7 +39,7 @@ export const buildErrorMessage = ({ status, statusText, requestId, responseData
     ]
         .filter((str) => !!str)
         .join('\n');
-    return `${baseMessage}\n\n${REST_METHOD_CONTRACT_RETRY_HINT}`;
+    return `${baseMessage}\n\n${getRetryHint(String(errorDetails))}`;
 };
 export const handleWixAPIResponse = async (response) => {
     const requestId = response.headers?.['x-wix-request-id'];