@wix/mcp 1.0.92 → 1.0.94

package/build/dts/code-mode/attachments.js

@@ -0,0 +1,218 @@
+/**
+ * ChatGPT file attachments for ExecuteWixAPI (`openai/fileParams`).
+ *
+ * ChatGPT resolves a file the user attached — or one the model wrote in its
+ * own sandbox — into `{ download_url, file_id, file_name?, mime_type? }` for a
+ * param the tool lists under `_meta["openai/fileParams"]`. The bytes never go
+ * through the model. We fetch each `download_url` host-side and hand the
+ * runtime ready-made base64 file entries, the same shape the `files` bundle
+ * parses into, so `files`, `wix.multipart()` and `wix.unzip()` are unchanged.
+ *
+ * This is additive: clients without the extension never populate the param
+ * and keep using the `files` bundle (text + base64 sections).
+ */
+// Per call, across all attachments. The base64 (~4/3 of this) is embedded in
+// the generated sandbox module next to the `files` bundle, and both the host
+// Worker and the sandbox isolate hold it alongside the decoded bytes and the
+// multipart body within a 128 MB isolate — 10 MB keeps the whole chain well
+// inside that. A site zip or a handful of images fits.
+export const MAX_ATTACHMENTS_BYTES = 10 * 1024 * 1024;
+// Follow at most this many redirects, revalidating the host at every hop.
+const MAX_REDIRECTS = 4;
+// Hosts ChatGPT hands out in `download_url` (every host seen in
+// UploadImageToWixSite download_urls, 2026-08-01..10-08). Two families:
+// - `<label>.oaiusercontent.com`: an OpenAI-owned domain, so any one-label
+//   subdomain is OpenAI's (observed: sdmntpr<region>, files).
+// - Azure blob accounts behind them, one per OpenAI region.
+//   `blob.core.windows.net` is a shared namespace, so these are exact — a
+//   prefix could be registered by anyone. A new region shows up as an
+//   "is not a ChatGPT file host" error in BI; add it here.
+const OAI_USERCONTENT_HOST = /^[a-z0-9-]+\.oaiusercontent\.com$/;
+const OAI_BLOB_ACCOUNTS = new Set([
+    'australiaeast',
+    'brazilsouth',
+    'cacentral',
+    'centralindia',
+    'centralus',
+    'centralusdr',
+    'denmarkeast',
+    'eastus',
+    'eastus2',
+    'indiasocentral',
+    'italynorth',
+    'japaneast',
+    'koreacentral',
+    'northcentralus',
+    'northeu',
+    'nznorth',
+    'polandcentral',
+    'seasia',
+    'southcentralus',
+    'southeastus3',
+    'ukwest',
+    'westcentralus',
+    'westus',
+    'westus2',
+    'westus3'
+].map((region) => `oaisdmntpr${region}.blob.core.windows.net`));
+export function isAllowedAttachmentHost(hostname) {
+    const h = hostname.toLowerCase();
+    return OAI_USERCONTENT_HOST.test(h) || OAI_BLOB_ACCOUNTS.has(h);
+}
+/** https, default port, allowed host — applied to the first URL and every redirect. */
+function checkAttachmentUrl(url) {
+    if (url.protocol !== 'https:')
+        return 'is not an https URL';
+    if (url.port)
+        return 'uses a non-default port';
+    if (!isAllowedAttachmentHost(url.hostname)) {
+        return `host "${url.hostname}" is not a ChatGPT file host`;
+    }
+    return undefined;
+}
+export class AttachmentError extends Error {
+}
+/** Path inside the upload: the file name, else the URL's last segment, else the id. */
+function attachmentPath(a, url) {
+    let fromUrl = '';
+    try {
+        fromUrl = decodeURIComponent(url.pathname.split('/').filter(Boolean).pop() ?? '');
+    }
+    catch {
+        fromUrl = '';
+    }
+    const raw = (a.file_name?.trim() || fromUrl || a.file_id).replace(/\\/g, '/');
+    // Relative, no traversal, no empty segments.
+    const segments = raw.split('/').filter((s) => s && s !== '.' && s !== '..');
+    return segments.join('/') || a.file_id;
+}
+function toBase64(bytes) {
+    let binary = '';
+    const chunk = 0x8000;
+    for (let i = 0; i < bytes.length; i += chunk) {
+        binary += String.fromCharCode(...bytes.subarray(i, i + chunk));
+    }
+    return btoa(binary);
+}
+/**
+ * GET with manual redirects: every hop must pass checkAttachmentUrl, so an
+ * allowed host cannot bounce the server to an arbitrary or internal one.
+ */
+async function fetchAllowed(start, fetchImpl, label) {
+    let url = start;
+    for (let hop = 0;; hop++) {
+        const res = await fetchImpl(url.toString(), { redirect: 'manual' });
+        const location = res.headers.get('location');
+        const isRedirect = res.status >= 300 && res.status < 400 && location;
+        if (!isRedirect)
+            return res;
+        await res.body?.cancel().catch(() => undefined);
+        if (hop >= MAX_REDIRECTS) {
+            throw new AttachmentError(`${label}: too many redirects.`);
+        }
+        let next;
+        try {
+            next = new URL(location, url);
+        }
+        catch {
+            throw new AttachmentError(`${label}: redirect to an invalid URL.`);
+        }
+        const problem = checkAttachmentUrl(next);
+        if (problem) {
+            throw new AttachmentError(`${label}: the download redirected to a URL that ${problem}; refused.`);
+        }
+        url = next;
+    }
+}
+/**
+ * Read a body while counting bytes against `budget`; stops reading (and
+ * cancels the stream) as soon as it is exceeded, instead of buffering first.
+ */
+async function readWithin(res, budget, overBudget) {
+    const declared = Number(res.headers.get('content-length') ?? 0);
+    if (declared > budget)
+        throw overBudget();
+    if (!res.body) {
+        const bytes = new Uint8Array(await res.arrayBuffer());
+        if (bytes.byteLength > budget)
+            throw overBudget();
+        return bytes;
+    }
+    const reader = res.body.getReader();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > budget) {
+            await reader.cancel().catch(() => undefined);
+            throw overBudget();
+        }
+        chunks.push(value);
+    }
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const c of chunks) {
+        out.set(c, offset);
+        offset += c.byteLength;
+    }
+    return out;
+}
+/**
+ * Fetch every attachment and return base64 file entries for the runtime.
+ * Throws AttachmentError with an agent-facing message: an unresolved item
+ * (ChatGPT passed a sandbox path or a bare id instead of a URL), a host we
+ * don't trust, a failed download, or more bytes than MAX_ATTACHMENTS_BYTES.
+ */
+export async function resolveAttachments(attachments, fetchImpl = fetch) {
+    if (!Array.isArray(attachments) || attachments.length === 0)
+        return [];
+    const items = [];
+    attachments.forEach((raw, i) => {
+        const a = (typeof raw === 'object' && raw);
+        const downloadUrl = a && typeof a.download_url === 'string' ? a.download_url : '';
+        let url;
+        try {
+            url = /^https?:\/\//i.test(downloadUrl)
+                ? new URL(downloadUrl)
+                : undefined;
+        }
+        catch {
+            url = undefined;
+        }
+        if (!a || !url) {
+            throw new AttachmentError(`attachments[${i}] was not resolved to a download URL (got ${JSON.stringify(typeof raw === 'string' ? raw : ((a && a.download_url) ?? raw))}). \`attachments\` works only in ChatGPT, which swaps each file for a download URL before the call reaches Wix. Here it arrived as written, and Wix cannot read a path on your machine, so retrying the same value fails the same way. Upload another way. With a shell that reaches the internet, send the file from there (for a site, the StartDeployWebsite recipe's curl drop). Otherwise leave \`attachments\` out and put the files in \`files\`: text as is, and a binary as a \`=== FILE: <path> base64 ===\` entry only when it is a few KB (an icon, a logo), since a larger base64 payload does not survive your own output. A larger image goes in by public URL or through the user (the Media Manager).`);
+        }
+        const problem = checkAttachmentUrl(url);
+        if (problem) {
+            throw new AttachmentError(`attachments[${i}].download_url ${problem}. Only platform-resolved attachments are accepted here; for any other URL fetch it in \`code\` via wix.request or put the bytes in the \`files\` bundle.`);
+        }
+        items.push({ a, url });
+    });
+    let remaining = MAX_ATTACHMENTS_BYTES;
+    const out = [];
+    for (const [i, { a, url }] of items.entries()) {
+        const path = attachmentPath(a, url);
+        const label = `attachments[${i}] (${path})`;
+        let res;
+        try {
+            res = await fetchAllowed(url, fetchImpl, label);
+        }
+        catch (e) {
+            if (e instanceof AttachmentError)
+                throw e;
+            throw new AttachmentError(`${label}: download failed (${e.message}).`);
+        }
+        if (!res.ok) {
+            await res.body?.cancel().catch(() => undefined);
+            throw new AttachmentError(`${label}: download returned HTTP ${res.status}. The download_url may have expired; attach the file again.`);
+        }
+        const bytes = await readWithin(res, remaining, () => new AttachmentError(`${label} pushes the attachments past ${MAX_ATTACHMENTS_BYTES} bytes in total for this call; split the upload across calls.`));
+        remaining -= bytes.byteLength;
+        out.push({ path, content: toBase64(bytes), encoding: 'base64' });
+    }
+    return out;
+}
+//# sourceMappingURL=attachments.js.map

package/build/dts/code-mode/index.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { AttachmentError, resolveAttachments } from './attachments.js';
 import { logger } from '../infra/logger.js';
 import { defaultToolDescriptions } from '../config/default-config.js';
 import { truncateResponse } from './truncate-response.js';
@@ -7,6 +8,7 @@ import { validateExecuteCode } from './validation.js';
 import { desc } from '../config/param-descriptions.js';
 import { rethrowIfUnauthorized } from '../auth/index.js';
 import { WixFetchError } from '../wix-fetch-error.js';
+import { addUploadHeadlessWebsiteFilesTool, UPLOAD_HEADLESS_WEBSITE_FILES_TOOL_NAME } from '../api-call/upload-headless-website-files.js';
 // Looks `fetch` up per call so a host or test that swaps the global is honored.
 const defaultCodeModeFetch = (url, init) => fetch(url, init);
 const SEARCH_TOOL_NAME = 'SearchWixAPISpec';
@@ -24,6 +26,15 @@ export async function addCodeModeTools(server, options) {
             maxResponseSize
         });
     }
+    // Account-owner flow, registered beside the code-mode tools (same file
+    // inputs, no runtime dependency); never in visitor mode.
+    if (!disableTools.includes(UPLOAD_HEADLESS_WEBSITE_FILES_TOOL_NAME) &&
+        authStrategy) {
+        addUploadHeadlessWebsiteFilesTool(server, {
+            authStrategy,
+            toolDescriptions
+        });
+    }
 }
 /**
  * Register SearchWixAPISpec. The description must stay a byte-stable
@@ -214,7 +225,7 @@ function addExecuteTool(server, options) {
     const { codeModeBaseUrl, codeModeFetch, authStrategy, visitor, toolDescriptions, maxResponseSize } = options;
     const executeUrl = `${codeModeBaseUrl}/api/code-mode/execute`;
     const d = desc('ExecuteWixAPI');
-    server.tool(EXECUTE_TOOL_NAME, toolDescriptions?.[EXECUTE_TOOL_NAME] ??
+    const registered = server.tool(EXECUTE_TOOL_NAME, toolDescriptions?.[EXECUTE_TOOL_NAME] ??
         defaultToolDescriptions.ExecuteWixAPI, {
         code: z
             .string()
@@ -233,8 +244,8 @@ function addExecuteTool(server, options) {
         hasMutations: z
             .boolean()
             .describe(visitor
-            ? 'Whether this code creates, updates, deletes, publishes, imports, uploads, or otherwise mutates site data on the visitor’s behalf. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false.'
-            : 'Whether this code creates, updates, deletes, publishes, installs, imports, uploads, or otherwise mutates Wix data or site/account state. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false.'),
+            ? 'True if the code changes site data on the visitor’s behalf (create, update, delete, import, upload); false if it only reads (get, query, list, search).'
+            : 'True if the code changes anything in the Wix account or a site (create, update, delete, publish, install, import, upload); false if it only reads (get, query, list, search).'),
         sourceDocUrls: z.array(z.string()).describe(d.sourceDocUrls),
         files: z
             .string()
@@ -246,6 +257,19 @@ function addExecuteTool(server, options) {
             'In `code` they are the `files` global (`{ path, content, encoding?: "base64" }[]`); `wix.multipart()` turns them into one binary-safe `multipart/form-data` body: `const mp = wix.multipart(); await wix.request({ scope: "account", method: "POST", url, headers: { "Content-Type": mp.contentType }, body: mp.body });`.',
             'Use base64 entries for small assets (icons, logos, fonts) and for files you downloaded and are re-uploading; large images/video go in by URL (`<img src="https://...">`), not in the bundle. A file containing a line exactly like the delimiter is not supported.'
         ].join(' ')),
+        // ChatGPT file attachments (`openai/fileParams`). Item shape must match
+        // OpenAI's file schema: download_url + file_id required, the rest optional.
+        // Declaring it is what makes the platform hand us a download URL instead
+        // of a sandbox path. Resolved host-side into base64 `files` entries.
+        attachments: z
+            .array(z.object({
+            download_url: z.string(),
+            file_id: z.string(),
+            file_name: z.string().optional(),
+            mime_type: z.string().optional()
+        }))
+            .optional()
+            .describe('ChatGPT only. Files attached in the chat or created in your sandbox (any type: a zip of a site, HTML, images, PDFs): pass each file as you have it, its file id or its /mnt/data path, and ChatGPT swaps it for { download_url, file_id, file_name?, mime_type? } before the call reaches Wix. No other client does this swap, so outside ChatGPT a path or file:// URL here fails at once; leave this out and use `files`, or upload from your shell if it reaches the internet. The bytes are fetched here and appended to the `files` global as { path, content, encoding: "base64" } entries (path = file_name), so `wix.multipart()` and `wix.unzip()` work on them unchanged. Prefer this over base64 in `files` whenever you have a file handle. Up to 10 MB per call.'),
         // Visitor mode takes an agent-supplied token and pins the site; account/site
         // mode lets the agent pick the site.
         ...(visitor
@@ -260,11 +284,15 @@ function addExecuteTool(server, options) {
                     .optional()
                     .describe('Default Wix site ID for the `wix.request()` calls in this execution. Optional in the schema, but required for site-level work: supply a `siteId` either here, as the default for every request, or on an individual request. Without one, a request runs at account scope, where site-level endpoints fail. Setting `scope: "account"` on a request runs it at account scope and ignores any `siteId`. Determine the target site with GetSiteContext or ListWixSites before calling; do not pass a guessed or empty value.')
             })
-    }, { readOnlyHint: false, destructiveHint: true, openWorldHint: false }, async (rawArgs, 
+    }, 
+    // openWorldHint true: agent code picks the Wix endpoints at run time (and may
+    // receive platform-resolved attachment URLs); the sandbox's host allowlist
+    // bounds it, but the operation set is open-ended, which is what the hint means.
+    { readOnlyHint: false, destructiveHint: true, openWorldHint: true }, async (rawArgs, 
     // Partial: duck-typed servers (the toolkit's capturing server, test
     // doubles) build their own extra and may not supply every field.
     extra) => {
-        const { code, reason, hasMutations, sourceDocUrls, visitorToken, files } = rawArgs;
+        const { code, reason, hasMutations, sourceDocUrls, visitorToken, files, attachments } = rawArgs;
         // In visitor mode the site is pinned; otherwise it comes from the param.
         const siteId = visitor ? visitor.siteId : rawArgs.siteId;
         logger.log(`[ExecuteWixAPI]${visitor ? ' (visitor)' : ''} Executing code (${code.length} chars), siteId=${siteId ?? 'none'}, hasMutations=${hasMutations}, sourceDocUrls=${JSON.stringify(sourceDocUrls)}, reason="${reason}"`);
@@ -276,6 +304,18 @@ function addExecuteTool(server, options) {
             logger.log(`[ExecuteWixAPI]${visitor ? ' (visitor)' : ''} Rejected invalid code: ${validation.error}`);
             return executeTextResult(validation.error);
         }
+        // ChatGPT attachments → base64 file entries, fetched host-side from the
+        // platform's download URLs. Before any token work: an unresolved item is
+        // an agent-facing error, not a server failure.
+        let attachmentFiles = [];
+        try {
+            attachmentFiles = await resolveAttachments(attachments);
+        }
+        catch (e) {
+            if (e instanceof AttachmentError)
+                return executeErrorResult(e.message);
+            throw e;
+        }
         // Account/site mode resolves tokens from the strategy (before the try so
         // an UnauthorizedError propagates to wrapToolCallback). Visitor mode has no
         // strategy — these stay undefined and the visitor token is used instead.
@@ -329,7 +369,8 @@ function addExecuteTool(server, options) {
                     : accountHeaders?.Authorization,
                 accountId: accountHeaders?.['wix-account-id'],
                 siteAuthContext,
-                ...(files ? { files } : {})
+                ...(files ? { files } : {}),
+                ...(attachmentFiles.length ? { attachmentFiles } : {})
             }, visitor
                 ? visitorToken
                 : (accountHeaders?.Authorization ?? siteHeaders?.Authorization), codeModeFetch);
@@ -354,5 +395,11 @@ function addExecuteTool(server, options) {
             return executeErrorResult(message);
         }
     });
+    // ChatGPT resolves `attachments` into download URLs only for params listed
+    // here (OpenAI's `openai/fileParams` extension). Other clients ignore it.
+    // Optional-chained: duck-typed servers (tests, the toolkit) return nothing.
+    registered?.update?.({
+        _meta: { ...registered._meta, 'openai/fileParams': ['attachments'] }
+    });
 }
 //# sourceMappingURL=index.js.map

package/build/dts/config/default-config.d.ts

@@ -33,10 +33,6 @@ export declare const SITE_CREATION_COPY: {
         readonly nonWidget: "you MUST ask whether they want to build with AI or start from a template, and create nothing and show nothing until they answer";
         readonly widget: "you MUST call `WixSiteCreation` and let them choose";
     };
-    readonly normalCreationRoute: {
-        readonly nonWidget: "route those through `WixSiteBuilder` or `SearchSiteTemplates`";
-        readonly widget: "route those through `WixSiteCreation`";
-    };
 };
 /** Rewrites non-widget copy into its widget form; a no-op on text that carries no divergence. */
 export declare const toWidget: (text: string) => string;