@wix/mcp 1.0.92 → 1.0.93

package/build/esm/index.js

@@ -30371,9 +30371,12 @@ var runSemanticSearch = async (toolName, toolParams, maxResults = 20, rerank = f
   );
   return data?.results;
 };
-var runPlatformizedSemanticSearch = async (toolName, searchTerm, maxResults = 20, linesInEachResult) => {
+var runPlatformizedSemanticSearch = async (toolName, searchTerm, maxResults = 20, linesInEachResult, extraDocumentTypes) => {
   const startTime = Date.now();
-  logger2.log(`[SemanticSearch/v2] Tool: ${toolName}, Query: "${searchTerm}"`);
+  const documentTypes = extraDocumentTypes?.length ? [toolName, ...extraDocumentTypes] : void 0;
+  logger2.log(
+    `[SemanticSearch/v2] Tool: ${documentTypes ? documentTypes.join("+") : toolName}, Query: "${searchTerm}"`
+  );
   const response = await fetch(
     "https://www.wixapis.com/mcp-docs-search/v1/docs/search/markdown",
     {
@@ -30384,7 +30387,7 @@ var runPlatformizedSemanticSearch = async (toolName, searchTerm, maxResults = 20
       },
       body: JSON.stringify({
         search_term: searchTerm,
-        document_type: toolName,
+        ...documentTypes ? { document_types: documentTypes } : { document_type: toolName },
         maximum_results: maxResults,
         lines_in_each_result: linesInEachResult
       })
@@ -30413,14 +30416,16 @@ var runSemanticSearchAndFormat = async ({
   maxResults = DEFAULT_MAX_RESULTS,
   rerank,
   linesInEachResult,
-  usePlatformizedSearch = true
+  usePlatformizedSearch = true,
+  extraDocumentTypes
 }) => {
   if (usePlatformizedSearch) {
     return runPlatformizedSemanticSearch(
       toolName,
       toolParams.searchTerm,
       maxResults,
-      linesInEachResult
+      linesInEachResult,
+      extraDocumentTypes
     );
   } else {
     const results = await runSemanticSearch(
@@ -31109,13 +31114,14 @@ var ACCOUNT_SITE_EXECUTE_SCOPE = dedent_default`
     unzip(input: string | Uint8Array): Promise<Array<{ path: string; bytes: Uint8Array; text(): string }>>;
   };
   declare const siteId: string | undefined;
-  // Files from the ExecuteWixAPI \`files\` param. Text entries have \`content\`;
-  // an entry tagged \`=== FILE: <path> base64 ===\` has encoding:'base64' and
-  // base64 \`content\` (a binary file — image, font).
+  // Files from the ExecuteWixAPI \`files\` param, followed by the resolved
+  // \`attachments\`. Text entries have \`content\`; an entry tagged
+  // \`=== FILE: <path> base64 ===\` — and every attachment, path = its file name —
+  // has encoding:'base64' and base64 \`content\`.
   declare const files: Array<{ path: string; content: string; encoding?: "base64" }>;
   \`\`\`
 
-  FILE UPLOADS: put every file in the \`files\` param (never inline in \`code\`). Text goes raw; a small binary (icon, logo, font) rides as a \`base64\`-tagged entry — large images/video are referenced by URL (\`<img src="https://...">\`), not bundled. \`wix.multipart()\` turns the whole set into one upload body (bytes, so binary is safe):
+  FILE UPLOADS: files never go inline in \`code\`; two params feed the \`files\` global. \`attachments\` takes files attached in the chat or created in your file sandbox, of any type and size up to 10 MB per call (a zip of a whole site, HTML, images, PDFs): pass the files themselves, all in one call, and the platform resolves each into \`{ download_url, file_id, file_name?, mime_type? }\` — the bytes are fetched for you and arrive as base64 entries named by file name. The \`files\` param takes content you have as text here: text goes raw; a small binary (icon, logo, font) rides as a \`base64\`-tagged entry — large images/video are referenced by URL (\`<img src="https://...">\`), not bundled. \`wix.multipart()\` turns the whole set into one upload body (bytes, so binary is safe):
   \`\`\`javascript
   // files param:
   //   === FILE: index.html ===
@@ -31130,6 +31136,12 @@ var ACCOUNT_SITE_EXECUTE_SCOPE = dedent_default`
     return res.data;
   }
   \`\`\`
+  A site zip passed through \`attachments\` is one base64 entry; unzip it and upload the entries:
+  \`\`\`javascript
+  // attachments: [site.zip] → files = [{ path: "site.zip", content: "<base64>", encoding: "base64" }]
+  const entries = await wix.unzip(files[0].content); // [{ path, bytes, text() }]
+  const mp = wix.multipart(entries);
+  \`\`\`
   DOWNLOAD + EDIT + RE-UPLOAD: fetch the zip as base64, \`wix.unzip()\` it, edit text via \`entry.text()\`, keep binary as bytes, and hand the entries back to \`wix.multipart()\`:
   \`\`\`javascript
   const r = await wix.request({ scope: "account", method: "GET", responseType: "base64", url: zipUrl });
@@ -31334,12 +31346,12 @@ function buildToolDescriptions(includeReadme, includeImageUploadGuidance = true)
     NEVER call this tool with a missing, empty, or guessed siteId — ask first instead.
 
     Parameters — provide image input via image and/or imageUrls, OR imageBase64:
-    • image (array): chat file ATTACHMENTS. Each item is an object with download_url and file_id (both required), plus optional file_name and mime_type. Pass ALL attachments in one call.
+    • image (array): chat file ATTACHMENTS — files the user attached, or files you created in your own file sandbox. Each item is an object with download_url and file_id (both required), plus optional file_name and mime_type. Pass ALL attachments in one call.
     • imageUrls (array): plain public image URLs the user pasted or other tools produced (no file_id). Pass ALL URLs in one call. Can be combined with image.
     • imageBase64 (string): base64-encoded image + mimeType. One image at a time. Do NOT combine with image/imageUrls.
 
     Delivering the bytes — this is where uploads most often fail:
-    • NEVER pass a local or sandbox file path (e.g. /mnt/..., /home/user/..., /Users/...) in any field — the server cannot reach your filesystem. Use a public http(s) URL (imageUrls) or the complete base64 (imageBase64).
+    • Pass a file as a file, in image: the platform resolves it into download_url and file_id before it reaches this tool — this includes files you created in your sandbox. This server does not share your filesystem, so a bare path string (e.g. /mnt/..., /home/user/..., /Users/...) is not a file. Without a file to pass, use a public http(s) URL (imageUrls) or the complete base64 (imageBase64).
     • imageBase64 must be the WHOLE file, not truncated. For large images prefer imageUrls, since long base64 is easily cut off and will be rejected as unreadable.
   `,
     SupportAndFeedback: dedent_default`
@@ -32591,7 +32603,7 @@ var paramDescriptions = {
   },
   SearchWixRESTDocumentation: {
     searchTerm: `The search term to look up in the Wix REST API Documentation \u2014 a natural-language description of the endpoint, resource, or action you need across any Wix domain (Stores, eCommerce, Bookings, CRM, Members, CMS, Events, Blog, Forms, Media, site settings, etc.), e.g. "create a catalog item with inventory", "book a service", "update data collection items". Match the wording to how many entities you will act on: a plural term ("update products") surfaces the resource's bulk methods, which a singular term ("update a product") ranks lower or leaves out. Results are ranked by relevance, so describe the goal rather than guessing an exact API name.`,
-    maxResults: "The maximum number of results to return, default is 10, max is 15",
+    maxResults: "The maximum number of results to return (1\u201317, default 17). Results mix REST API documentation with matching recipes and skills.",
     reason: "One sentence describing the original user request and the task you are trying to accomplish with this search."
   },
   WixBusinessFlowsDocumentation: {
@@ -32612,7 +32624,7 @@ var paramDescriptions = {
   },
   SearchWixHeadlessDocumentation: {
     searchTerm: "The search term to search for in the Headless Documentation",
-    maxResults: "The maximum number of results to return, default is 10, max is 15"
+    maxResults: "The maximum number of results to return (1\u201317, default 17). Results mix Headless documentation with matching recipes and skills."
   },
   SearchWixVeloDocumentation: {
     searchTerm: "The search term to search for in the Velo Documentation",
@@ -32640,7 +32652,7 @@ var paramDescriptions = {
   },
   UploadImageToWixSite: {
     siteId: "The ID (UUID) of the Wix site to upload to. REQUIRED. If the user has not clearly specified which site, ASK them which site to upload to (or use ListWixSites to help them pick) BEFORE calling this tool. NEVER call this tool with a missing, empty, placeholder, or guessed siteId \u2014 ask first instead.",
-    image: "Array of file ATTACHMENTS the user uploaded in the chat. Each item requires download_url and file_id, and may optionally include file_name and mime_type \u2014 attached files are automatically resolved to these fields by the platform, so just include them here. For plain image URLs the user pasted, use imageUrls instead. ALWAYS pass ALL attachments together in a single call \u2014 NEVER call this tool once per image. Do NOT use together with imageBase64.",
+    image: "Array of file ATTACHMENTS: files the user uploaded in the chat, or files you created in your own file sandbox. Each item requires download_url and file_id, and may optionally include file_name and mime_type \u2014 the platform resolves a file passed here into these fields automatically, so just include the files. For plain image URLs the user pasted, use imageUrls instead. ALWAYS pass ALL attachments together in a single call \u2014 NEVER call this tool once per image. Do NOT use together with imageBase64.",
     imageUrls: "Array of publicly accessible image URLs (e.g. links the user pasted or URLs produced by other tools). Use this for plain URLs that are NOT chat attachments \u2014 no file_id is needed. ALWAYS pass ALL URLs together in a single call. Can be combined with image; do NOT use together with imageBase64.",
     imageBase64: 'Base64-encoded image data. Use when the client can read a file and encode it as base64. May include a data URL prefix (e.g. "data:image/jpeg;base64,...") or be raw base64. Do NOT use together with image.',
     mimeType: 'MIME type of the image (e.g. "image/jpeg", "image/png", "image/webp"). Required when imageBase64 does not include a data URL prefix.',
@@ -33310,7 +33322,7 @@ var addDocsTools = (server, allowedTools = [
         const d2 = desc("SearchWixRESTDocumentation");
         return {
           searchTerm: external_exports.string().describe(d2.searchTerm),
-          maxResults: external_exports.number().describe(d2.maxResults).min(1).max(15).optional().default(15),
+          maxResults: external_exports.number().describe(d2.maxResults).min(1).max(17).optional().default(17),
           reason: external_exports.string().describe(d2.reason)
         };
       })(),
@@ -33325,9 +33337,12 @@ var addDocsTools = (server, allowedTools = [
             toolParams: {
               searchTerm
             },
-            maxResults: Math.max(1, Math.min(maxResults ?? 15, 15)),
+            maxResults: Math.max(1, Math.min(maxResults ?? 17, 17)),
             linesInEachResult: 30,
-            usePlatformizedSearch
+            usePlatformizedSearch,
+            // Merge recipes/skills into the REST ranking — they live in a
+            // separate corpus the REST document_type doesn't cover on its own.
+            extraDocumentTypes: ["SKILLS"]
           });
           const grounding = result.includes(QUERY_CAPABILITY_MARKER) ? [
             REST_SEARCH_API_GROUNDING_REMINDER,
@@ -33590,7 +33605,7 @@ var addDocsTools = (server, allowedTools = [
         const d2 = desc("SearchWixHeadlessDocumentation");
         return {
           searchTerm: external_exports.string().describe(d2.searchTerm),
-          maxResults: external_exports.number().describe(d2.maxResults).min(1).max(15).optional().default(15)
+          maxResults: external_exports.number().describe(d2.maxResults).min(1).max(17).optional().default(17)
         };
       })(),
       { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
@@ -33602,8 +33617,11 @@ var addDocsTools = (server, allowedTools = [
             toolParams: {
               searchTerm
             },
-            maxResults: Math.max(1, Math.min(maxResults ?? 15, 15)),
-            usePlatformizedSearch
+            maxResults: Math.max(1, Math.min(maxResults ?? 17, 17)),
+            usePlatformizedSearch,
+            // Merge recipes/skills into the headless ranking — same separate
+            // corpus the WIX_HEADLESS document_type doesn't cover on its own.
+            extraDocumentTypes: ["SKILLS"]
           });
           return {
             content: [
@@ -46886,6 +46904,189 @@ ${text.slice(0, 2e3)}`
   );
 }
 
+// src/code-mode/attachments.ts
+var MAX_ATTACHMENTS_BYTES = 10 * 1024 * 1024;
+var MAX_REDIRECTS = 4;
+var OAI_USERCONTENT_HOST = /^[a-z0-9-]+\.oaiusercontent\.com$/;
+var OAI_BLOB_ACCOUNTS = new Set(
+  [
+    "australiaeast",
+    "brazilsouth",
+    "cacentral",
+    "centralindia",
+    "centralus",
+    "centralusdr",
+    "denmarkeast",
+    "eastus",
+    "eastus2",
+    "indiasocentral",
+    "italynorth",
+    "japaneast",
+    "koreacentral",
+    "northcentralus",
+    "northeu",
+    "nznorth",
+    "polandcentral",
+    "seasia",
+    "southcentralus",
+    "southeastus3",
+    "ukwest",
+    "westcentralus",
+    "westus",
+    "westus2",
+    "westus3"
+  ].map((region) => `oaisdmntpr${region}.blob.core.windows.net`)
+);
+function isAllowedAttachmentHost(hostname2) {
+  const h2 = hostname2.toLowerCase();
+  return OAI_USERCONTENT_HOST.test(h2) || OAI_BLOB_ACCOUNTS.has(h2);
+}
+function checkAttachmentUrl(url) {
+  if (url.protocol !== "https:") return "is not an https URL";
+  if (url.port) return "uses a non-default port";
+  if (!isAllowedAttachmentHost(url.hostname)) {
+    return `host "${url.hostname}" is not a ChatGPT file host`;
+  }
+  return void 0;
+}
+var AttachmentError = class extends Error {
+};
+function attachmentPath(a2, url) {
+  let fromUrl = "";
+  try {
+    fromUrl = decodeURIComponent(
+      url.pathname.split("/").filter(Boolean).pop() ?? ""
+    );
+  } catch {
+    fromUrl = "";
+  }
+  const raw = (a2.file_name?.trim() || fromUrl || a2.file_id).replace(/\\/g, "/");
+  const segments = raw.split("/").filter((s2) => s2 && s2 !== "." && s2 !== "..");
+  return segments.join("/") || a2.file_id;
+}
+function toBase64(bytes2) {
+  let binary = "";
+  const chunk = 32768;
+  for (let i = 0; i < bytes2.length; i += chunk) {
+    binary += String.fromCharCode(...bytes2.subarray(i, i + chunk));
+  }
+  return btoa(binary);
+}
+async function fetchAllowed(start, fetchImpl, label) {
+  let url = start;
+  for (let hop = 0; ; hop++) {
+    const res = await fetchImpl(url.toString(), { redirect: "manual" });
+    const location = res.headers.get("location");
+    const isRedirect = res.status >= 300 && res.status < 400 && location;
+    if (!isRedirect) return res;
+    await res.body?.cancel().catch(() => void 0);
+    if (hop >= MAX_REDIRECTS) {
+      throw new AttachmentError(`${label}: too many redirects.`);
+    }
+    let next;
+    try {
+      next = new URL(location, url);
+    } catch {
+      throw new AttachmentError(`${label}: redirect to an invalid URL.`);
+    }
+    const problem = checkAttachmentUrl(next);
+    if (problem) {
+      throw new AttachmentError(
+        `${label}: the download redirected to a URL that ${problem}; refused.`
+      );
+    }
+    url = next;
+  }
+}
+async function readWithin(res, budget, overBudget) {
+  const declared = Number(res.headers.get("content-length") ?? 0);
+  if (declared > budget) throw overBudget();
+  if (!res.body) {
+    const bytes2 = new Uint8Array(await res.arrayBuffer());
+    if (bytes2.byteLength > budget) throw overBudget();
+    return bytes2;
+  }
+  const reader = res.body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > budget) {
+      await reader.cancel().catch(() => void 0);
+      throw overBudget();
+    }
+    chunks.push(value);
+  }
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const c of chunks) {
+    out.set(c, offset);
+    offset += c.byteLength;
+  }
+  return out;
+}
+async function resolveAttachments(attachments, fetchImpl = fetch) {
+  if (!Array.isArray(attachments) || attachments.length === 0) return [];
+  const items = [];
+  attachments.forEach((raw, i) => {
+    const a2 = typeof raw === "object" && raw;
+    const downloadUrl = a2 && typeof a2.download_url === "string" ? a2.download_url : "";
+    let url;
+    try {
+      url = /^https?:\/\//i.test(downloadUrl) ? new URL(downloadUrl) : void 0;
+    } catch {
+      url = void 0;
+    }
+    if (!a2 || !url) {
+      throw new AttachmentError(
+        `attachments[${i}] was not resolved to a download URL (got ${JSON.stringify(
+          typeof raw === "string" ? raw : (a2 && a2.download_url) ?? raw
+        )}). The platform did not hydrate this attachment; retry once, and if it still arrives like this put the file in the \`files\` bundle instead (\`=== FILE: <path> base64 ===\` for binary).`
+      );
+    }
+    const problem = checkAttachmentUrl(url);
+    if (problem) {
+      throw new AttachmentError(
+        `attachments[${i}].download_url ${problem}. Only platform-resolved attachments are accepted here; for any other URL fetch it in \`code\` via wix.request or put the bytes in the \`files\` bundle.`
+      );
+    }
+    items.push({ a: a2, url });
+  });
+  let remaining = MAX_ATTACHMENTS_BYTES;
+  const out = [];
+  for (const [i, { a: a2, url }] of items.entries()) {
+    const path = attachmentPath(a2, url);
+    const label = `attachments[${i}] (${path})`;
+    let res;
+    try {
+      res = await fetchAllowed(url, fetchImpl, label);
+    } catch (e) {
+      if (e instanceof AttachmentError) throw e;
+      throw new AttachmentError(
+        `${label}: download failed (${e.message}).`
+      );
+    }
+    if (!res.ok) {
+      await res.body?.cancel().catch(() => void 0);
+      throw new AttachmentError(
+        `${label}: download returned HTTP ${res.status}. The download_url may have expired; attach the file again.`
+      );
+    }
+    const bytes2 = await readWithin(
+      res,
+      remaining,
+      () => new AttachmentError(
+        `${label} pushes the attachments past ${MAX_ATTACHMENTS_BYTES} bytes in total for this call; split the upload across calls.`
+      )
+    );
+    remaining -= bytes2.byteLength;
+    out.push({ path, content: toBase64(bytes2), encoding: "base64" });
+  }
+  return out;
+}
+
 // src/code-mode/validation.ts
 var EXECUTE_FUNCTION_EXPRESSION_HINT = 'ExecuteWixAPI code must be a function expression, not a script body. Pass code like: async () => { const response = await wix.request({ scope: "site", method: "GET", url: "https://www.wixapis.com/..." }); return response.data; }. Do not write top-level const/await/return outside the function and do not invoke the function yourself.';
 function validateExecuteCode(code) {
@@ -47118,7 +47319,7 @@ function addExecuteTool(server, options) {
   } = options;
   const executeUrl = `${codeModeBaseUrl}/api/code-mode/execute`;
   const d2 = desc("ExecuteWixAPI");
-  server.tool(
+  const registered = server.tool(
     EXECUTE_TOOL_NAME,
     toolDescriptions?.[EXECUTE_TOOL_NAME] ?? defaultToolDescriptions.ExecuteWixAPI,
     {
@@ -47147,6 +47348,20 @@ function addExecuteTool(server, options) {
           'Use base64 entries for small assets (icons, logos, fonts) and for files you downloaded and are re-uploading; large images/video go in by URL (`<img src="https://...">`), not in the bundle. A file containing a line exactly like the delimiter is not supported.'
         ].join(" ")
       ),
+      // ChatGPT file attachments (`openai/fileParams`). Item shape must match
+      // OpenAI's file schema: download_url + file_id required, the rest optional.
+      // Declaring it is what makes the platform hand us a download URL instead
+      // of a sandbox path. Resolved host-side into base64 `files` entries.
+      attachments: external_exports.array(
+        external_exports.object({
+          download_url: external_exports.string(),
+          file_id: external_exports.string(),
+          file_name: external_exports.string().optional(),
+          mime_type: external_exports.string().optional()
+        })
+      ).optional().describe(
+        'Files attached in this chat, or files you created in your own file sandbox (any type: a zip of a site, HTML, images, PDFs). Pass the files themselves and the platform resolves each into { download_url, file_id, file_name?, mime_type? }; the bytes are fetched here and appended to the `files` global as { path, content, encoding: "base64" } entries (path = file_name), so `wix.multipart()` and `wix.unzip()` work on them unchanged. Prefer this over base64 in `files` whenever you have a file handle. Up to 10 MB per call.'
+      ),
       // Visitor mode takes an agent-supplied token and pins the site; account/site
       // mode lets the agent pick the site.
       ...visitor ? {
@@ -47161,7 +47376,15 @@ function addExecuteTool(server, options) {
     },
     { readOnlyHint: false, destructiveHint: true, openWorldHint: false },
     async (rawArgs, extra) => {
-      const { code, reason, hasMutations, sourceDocUrls, visitorToken, files } = rawArgs;
+      const {
+        code,
+        reason,
+        hasMutations,
+        sourceDocUrls,
+        visitorToken,
+        files,
+        attachments
+      } = rawArgs;
       const siteId = visitor ? visitor.siteId : rawArgs.siteId;
       logger2.log(
         `[ExecuteWixAPI]${visitor ? " (visitor)" : ""} Executing code (${code.length} chars), siteId=${siteId ?? "none"}, hasMutations=${hasMutations}, sourceDocUrls=${JSON.stringify(sourceDocUrls)}, reason="${reason}"`
@@ -47173,6 +47396,13 @@ function addExecuteTool(server, options) {
         );
         return executeTextResult(validation.error);
       }
+      let attachmentFiles = [];
+      try {
+        attachmentFiles = await resolveAttachments(attachments);
+      } catch (e) {
+        if (e instanceof AttachmentError) return executeErrorResult(e.message);
+        throw e;
+      }
       const accountHeaders = await authStrategy?.getAccountAuthHeaders();
       const siteAuthContext = !visitor && authStrategy?.getSiteAuthContext ? await authStrategy.getSiteAuthContext() : void 0;
       let siteHeaders;
@@ -47207,7 +47437,8 @@ function addExecuteTool(server, options) {
             accountToken: visitor ? visitorToken : accountHeaders?.Authorization,
             accountId: accountHeaders?.["wix-account-id"],
             siteAuthContext,
-            ...files ? { files } : {}
+            ...files ? { files } : {},
+            ...attachmentFiles.length ? { attachmentFiles } : {}
           },
           visitor ? visitorToken : accountHeaders?.Authorization ?? siteHeaders?.Authorization,
           codeModeFetch
@@ -47238,6 +47469,9 @@ function addExecuteTool(server, options) {
       }
     }
   );
+  registered?.update?.({
+    _meta: { ...registered._meta, "openai/fileParams": ["attachments"] }
+  });
 }
 
 // src/toolkit.ts