@wix/mcp 1.0.94 → 1.0.96

package/build/dts/index.d.ts

@@ -6,7 +6,7 @@ export { handleWixAPIResponse } from './tool-utils.js';
 export { addDocsResources } from './resources/docs.js';
 export { addSupportTool } from './support/index.js';
 export { addGetProfileTool } from './account-tools/get-profile-tool.js';
-export { addCreateSiteWidgetTool, addEditSiteWidgetTool, addPullSiteJobTool, addClaimSiteTool, addSuggestedDomainTool, addSiteCreationWidgetTools, addWixSiteCreationTool, addSearchSiteTemplatesTool, addCreateSiteFromTemplateTool, type SiteWidgetToolOptions } from './site-widget-tools/index.js';
+export { addCreateSiteWidgetTool, addEditSiteWidgetTool, addPullSiteJobTool, addClaimSiteTool, addSuggestedDomainTool, addSiteCreationWidgetTools, addWixSiteCreationTool, addSearchSiteTemplatesTool, addCreateSiteFromTemplateTool, addPickImagesTools, type SiteWidgetToolOptions } from './site-widget-tools/index.js';
 export * from './wixel/index.js';
 export { addImportClaudeDesignTool, type ImportClaudeDesignToolOptions } from './import-claude-design-tool/index.js';
 export { IMPORT_CLAUDE_DESIGN_TOOL_NAME } from './import-claude-design-tool/constants.js';
@@ -25,6 +25,6 @@ export { addCodeModeTools, addExecuteCodeModeTool, addSearchCodeModeTool, type C
 export { addUploadHeadlessWebsiteFilesTool, UPLOAD_HEADLESS_WEBSITE_FILES_TOOL_NAME } from './api-call/upload-headless-website-files.js';
 export { validateExecuteCode, EXECUTE_FUNCTION_EXPRESSION_HINT, type CodeValidationResult } from './code-mode/validation.js';
 export { addGraphqlTools, resetGraphqlSchemaCache, GRAPHQL_TOOL_NAMES, SEARCH_GRAPHQL_TOOL_NAME, INSPECT_GRAPHQL_TOOL_NAME, EXECUTE_GRAPHQL_TOOL_NAME, WIX_GRAPHQL_ENDPOINT, type GraphqlToolsOptions, type GraphqlToolName } from './graphql/index.js';
-export { defaultConfig, defaultToolDescriptions, defaultReadmeDocs, widgetSiteCreationConfig, SITE_CREATION_COPY, toWidget, executeCodeModeToolDescriptions, SYSTEM_REMINDER_GUIDELINES, SYSTEM_REMINDER, mergeConfig, type ModeDefaultConfig } from './config/default-config.js';
+export { defaultConfig, defaultToolDescriptions, defaultReadmeDocs, widgetSiteCreationConfig, SITE_CREATION_COPY, toWidget, withUsageGuideOnEveryTool, buildReadmeDocs, executeCodeModeToolDescriptions, SYSTEM_REMINDER_GUIDELINES, SYSTEM_REMINDER, SERVER_INSTRUCTIONS, SERVER_INSTRUCTIONS_TOOLS, mergeConfig, type ModeDefaultConfig } from './config/default-config.js';
 export * from './site-widget-tools/constants.js';
 //# sourceMappingURL=index.d.ts.map

package/build/dts/index.js

@@ -6,7 +6,7 @@ export { handleWixAPIResponse } from './tool-utils.js';
 export { addDocsResources } from './resources/docs.js';
 export { addSupportTool } from './support/index.js';
 export { addGetProfileTool } from './account-tools/get-profile-tool.js';
-export { addCreateSiteWidgetTool, addEditSiteWidgetTool, addPullSiteJobTool, addClaimSiteTool, addSuggestedDomainTool, addSiteCreationWidgetTools, addWixSiteCreationTool, addSearchSiteTemplatesTool, addCreateSiteFromTemplateTool } from './site-widget-tools/index.js';
+export { addCreateSiteWidgetTool, addEditSiteWidgetTool, addPullSiteJobTool, addClaimSiteTool, addSuggestedDomainTool, addSiteCreationWidgetTools, addWixSiteCreationTool, addSearchSiteTemplatesTool, addCreateSiteFromTemplateTool, addPickImagesTools } from './site-widget-tools/index.js';
 export * from './wixel/index.js';
 export { addImportClaudeDesignTool } from './import-claude-design-tool/index.js';
 export { IMPORT_CLAUDE_DESIGN_TOOL_NAME } from './import-claude-design-tool/constants.js';
@@ -31,6 +31,6 @@ export { validateExecuteCode, EXECUTE_FUNCTION_EXPRESSION_HINT } from './code-mo
 // GraphQL tools (search operations + inspect schema + execute)
 export { addGraphqlTools, resetGraphqlSchemaCache, GRAPHQL_TOOL_NAMES, SEARCH_GRAPHQL_TOOL_NAME, INSPECT_GRAPHQL_TOOL_NAME, EXECUTE_GRAPHQL_TOOL_NAME, WIX_GRAPHQL_ENDPOINT } from './graphql/index.js';
 // Config exports
-export { defaultConfig, defaultToolDescriptions, defaultReadmeDocs, widgetSiteCreationConfig, SITE_CREATION_COPY, toWidget, executeCodeModeToolDescriptions, SYSTEM_REMINDER_GUIDELINES, SYSTEM_REMINDER, mergeConfig } from './config/default-config.js';
+export { defaultConfig, defaultToolDescriptions, defaultReadmeDocs, widgetSiteCreationConfig, SITE_CREATION_COPY, toWidget, withUsageGuideOnEveryTool, buildReadmeDocs, executeCodeModeToolDescriptions, SYSTEM_REMINDER_GUIDELINES, SYSTEM_REMINDER, SERVER_INSTRUCTIONS, SERVER_INSTRUCTIONS_TOOLS, mergeConfig } from './config/default-config.js';
 export * from './site-widget-tools/constants.js';
 //# sourceMappingURL=index.js.map

package/build/dts/infra/redact-personal-data.d.ts

@@ -0,0 +1,4 @@
+export declare const FREE_TEXT_INFO_PARAMS: readonly ["userRequest", "siteDescription", "siteForm", "siteFunctionality", "agentIdentity", "wixAccess", "reason", "whyNotExecuteWixAPI", "editorRequest", "templateRequest"];
+export declare function redactPersonalData(text: string): string;
+export declare function serializeToolParamsForBi(args: unknown): string;
+//# sourceMappingURL=redact-personal-data.d.ts.map

package/build/dts/infra/redact-personal-data.js

@@ -0,0 +1,148 @@
+import { parseFileBundle } from '../api-call/site-files.js';
+// Free-text arguments that agents fill in for BI. Their descriptions ask for no
+// personal data; this is the backstop for what comes through anyway, applied to
+// these fields only before tool arguments are recorded. Other arguments (API
+// bodies, code) carry the data the call needs and are recorded as sent.
+export const FREE_TEXT_INFO_PARAMS = [
+    'userRequest',
+    'siteDescription',
+    'siteForm',
+    'siteFunctionality',
+    'agentIdentity',
+    'wixAccess',
+    'reason',
+    'whyNotExecuteWixAPI',
+    'editorRequest',
+    'templateRequest'
+];
+const EMAIL = /[A-Z0-9._%+-]+@[A-Z0-9-]+(?:\.[A-Z0-9-]+)*\.[A-Z]{2,}/gi;
+// A secret's value after its name: "password: x", "token=x", "the password is x",
+// "set the password to x". "password-protected" has no value and is kept. An
+// unquoted value runs to the end of its clause, since it may contain spaces.
+const NAMED_SECRET = /\b(passwords?|passwd|pwd|passcodes?|secrets?|tokens?|api[ _-]?keys?|access[ _-]?keys?|credentials?)(\s*[:=]\s*|\s+(?:is|was|to)\s+)(?:"[^"]*"|'[^']*'|`[^`]*`|[^\s"'`,;][^,;\n]*?(?=[.!?]\s|[,;\n]|$))/gi;
+const BEARER = /\bBearer\s+[A-Za-z0-9._~+/=-]+/gi;
+const JWT = /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g;
+const KEY_PREFIXES = /\b(?:sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|github_pat_\w{20,}|xox[abprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35})\b/g;
+// Local paths, not inside a URL ("https://example.com/work/" is kept). A
+// folder name may contain spaces ("/Users/Jane Doe/site"); the last segment
+// ends at the first space unless the path is quoted.
+const BACKTICK = '`';
+const UNIX_ROOT = String.raw `(?<![\w.:/~-])(?:~|/(?:Users|home|root|mnt|tmp|private|var|Volumes|workspace|work))`;
+const WINDOWS_ROOT = String.raw `(?<!\w)[A-Za-z]:(?=\\\w)`;
+const PATH_ROOT = `(?:${UNIX_ROOT}|${WINDOWS_ROOT})`;
+const QUOTED_PATH = new RegExp(String.raw `(?<![\w])(["'${BACKTICK}])${PATH_ROOT}[^"'${BACKTICK}\n]*\1`, 'g');
+const FOLDER = String.raw `[^\s/\\"'${BACKTICK},;()<>]+(?: [^\s/\\"'${BACKTICK},;()<>]+)*`;
+const LOCAL_PATH = new RegExp(String.raw `${PATH_ROOT}(?:[/\\]${FOLDER}(?=[/\\]))*[/\\][^\s"'${BACKTICK},;()<>]*`, 'g');
+// 9 to 15 digits with phone separators, standing alone. Dates, times, UUIDs
+// and shorter counts stay; a bare 9-15 digit number reads as a phone and is
+// redacted, since free text can't tell the two apart.
+const PHONE_CANDIDATE = /(?<![\w-])\+?\(?\d[\d\s().-]{7,}\d(?![\w-])/g;
+const DATE_START = /^\d{4}-\d{2}-\d{2}/;
+function redactPhone(match, offset, text) {
+    if (DATE_START.test(match) ||
+        /^:\d{2}\b/.test(text.slice(offset + match.length))) {
+        return match;
+    }
+    const digits = match.replace(/\D/g, '').length;
+    return digits >= 9 && digits <= 15 ? '[phone]' : match;
+}
+export function redactPersonalData(text) {
+    return text
+        .replace(EMAIL, '[email]')
+        .replace(BEARER, 'Bearer [secret]')
+        .replace(JWT, '[secret]')
+        .replace(KEY_PREFIXES, '[secret]')
+        .replace(NAMED_SECRET, '$1$2[secret]')
+        .replace(QUOTED_PATH, '$1[path]$1')
+        .replace(LOCAL_PATH, '[path]')
+        .replace(PHONE_CANDIDATE, redactPhone);
+}
+function redactInfoParams(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return value;
+    }
+    const record = value;
+    if (!FREE_TEXT_INFO_PARAMS.some((key) => typeof record[key] === 'string')) {
+        return value;
+    }
+    const redacted = { ...record };
+    for (const key of FREE_TEXT_INFO_PARAMS) {
+        if (typeof redacted[key] === 'string') {
+            redacted[key] = redactPersonalData(redacted[key]);
+        }
+    }
+    return redacted;
+}
+// A `files` argument carries a site's text whole: the upload tool's text bundle
+// (`=== FILE: <path> ===` sections, `base64` for binaries) or a list of
+// `{ path, content }` entries. The BI event goes out as a GET with the
+// arguments in the query string, and a bundle past about 12 KB fails that
+// request and loses the row (2026-10-28: every upload above that size was
+// missing from BI). Recorded instead: the paths and their sizes, as the upload
+// parses them (a base64 file's decoded size), with the path list cut at
+// MAX_LISTED_PATHS_CHARS so a 2,000-file upload stays far below that limit too.
+const MAX_LISTED_PATHS_CHARS = 2_000;
+function summarizeFileBundle(bundle) {
+    let sections;
+    try {
+        sections = parseFileBundle(bundle).map((file) => ({
+            path: file.path,
+            bytes: file.bytes.length
+        }));
+    }
+    catch {
+        sections = [];
+    }
+    if (sections.length === 0) {
+        return `${new TextEncoder().encode(bundle).length} bytes, no file sections`;
+    }
+    return formatFileSummary(sections);
+}
+function formatFileSummary(files) {
+    const total = files.reduce((sum, file) => sum + file.bytes, 0);
+    let listed = '';
+    let shown = 0;
+    for (const file of files) {
+        const entry = `${shown ? ', ' : ''}${file.path} (${file.bytes})`;
+        if (listed.length + entry.length > MAX_LISTED_PATHS_CHARS)
+            break;
+        listed += entry;
+        shown++;
+    }
+    const more = files.length - shown;
+    return `${files.length} file(s), ${total} bytes: ${listed}${more ? `${shown ? ', ' : ''}and ${more} more` : ''}`;
+}
+function compactFileParams(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return value;
+    }
+    const record = value;
+    const files = record.files;
+    if (typeof files === 'string') {
+        return { ...record, files: summarizeFileBundle(files) };
+    }
+    if (Array.isArray(files) &&
+        files.length > 0 &&
+        files.every((entry) => entry &&
+            typeof entry === 'object' &&
+            typeof entry.content === 'string')) {
+        return {
+            ...record,
+            files: formatFileSummary(files.map((entry) => ({
+                path: entry.path ?? '?',
+                bytes: new TextEncoder().encode(entry.content).length
+            })))
+        };
+    }
+    return value;
+}
+function prepareForBi(value) {
+    return compactFileParams(redactInfoParams(value));
+}
+// Tool arguments as recorded in BI and error reports: the arguments object, or
+// the MCP SDK's positional argument list, with the free-text info fields
+// redacted and a `files` argument reduced to its paths and sizes.
+export function serializeToolParamsForBi(args) {
+    return JSON.stringify(Array.isArray(args) ? args.map(prepareForBi) : prepareForBi(args));
+}
+//# sourceMappingURL=redact-personal-data.js.map

package/build/dts/site-widget-tools/constants.d.ts

@@ -1,4 +1,4 @@
-export declare const SITE_BUILDER_TOOL_NAME = "WixSiteBuilder";
+export declare const SITE_BUILDER_TOOL_NAME = "WixHarmonyEditorBuild";
 export declare const EDIT_SITE_TOOL_NAME = "EditSite";
 export declare const PULL_SITE_JOB_TOOL_NAME = "pullSiteCreationJob";
 export declare const CLAIM_SITE_TOOL_NAME = "ClaimAnonymousSite";
@@ -6,6 +6,21 @@ export declare const GET_SUGGESTED_DOMAINS_TOOL_NAME = "GetSuggestedDomains";
 export declare const WIX_SITE_CREATION_TOOL_NAME = "WixSiteCreation";
 export declare const SEARCH_SITE_TEMPLATES_TOOL_NAME = "SearchSiteTemplates";
 export declare const CREATE_SITE_FROM_TEMPLATE_TOOL_NAME = "CreateSiteFromTemplate";
+export declare const PICK_IMAGES_TOOL_NAME = "PickImagesForWixMedia";
+export declare const MEDIA_UPLOAD_URL_TOOL_NAME = "CreateWixMediaUploadUrl";
+/** The Wix business features that send a site to StartHeadlessBuild: what wix-headless-kit ships. */
+export declare const WIX_BUSINESS_FEATURES = "a store, bookings or appointments, rentals, events and tickets, a restaurant menu with online orders or reservations, a blog, a portfolio, pricing plans and memberships, donations, Wix Forms, members and login, a CMS, payments";
+/** WixHarmonyEditorBuild's and SearchSiteTemplates' answer when the agent says the user did not ask for them. */
+/**
+ * The widget payload of a refused editor call: the gallery and builder widgets render nothing
+ * for it, since the host mounts them for every call of their tool.
+ */
+export declare const NOT_REQUESTED_WIDGET_PAYLOAD: {
+    readonly notRequested: true;
+};
+export declare const EDITOR_NOT_REQUESTED_MESSAGE = "Nothing was created: the user did not ask for this. A new site is written in code and uploaded: call StartDeployWebsite, or StartHeadlessBuild when it needs Wix business features. Don't offer Wix's editor or a template instead.";
+/** WixSiteCreation's answer: it no longer opens a chooser, it sends the agent to the code path. */
+export declare const SITE_CREATION_ROUTE_MESSAGE = "A new site is written in code and uploaded. Call StartDeployWebsite now for the upload guide, or StartHeadlessBuild when the site needs Wix business features. Use WixHarmonyEditorBuild or SearchSiteTemplates only when the user asked for the Wix Harmony Editor, a template, Wix Studio or the Classic Editor.";
 /** Fallback actions when the industry is generic or unclear. */
 export declare const SITE_CREATION_DEFAULT_ACTIONS = "add products, set up bookings, and adjust your content";
 /**
@@ -13,6 +28,38 @@ export declare const SITE_CREATION_DEFAULT_ACTIONS = "add products, set up booki
  * that fill the "Next up:" line, generalizing to any industry (the patterns are a reference).
  */
 export declare const SITE_CREATION_CUSTOM_ACTIONS_GUIDANCE = "2\u20133 specific, high-value setup actions for the site's industry, written as a comma-separated phrase (it slots into \"\u2026ask me to ___ right here in the chat\"). Use the following domain patterns as guidance:\n* E-commerce / Retail: \"add products, set up payment methods, and organize collections\"\n* Restaurants / Food / Bakeries: \"add menu items, set up online ordering, and collect table reservations\"\n* Services / Fitness / Salons / Consultants: \"set up booking slots, add service pricing, and manage appointments\"\n* Creative / Portfolios / Photographers: \"upload project galleries, feature client reviews, and customize contact forms\"\n* Events / Weddings / Real Estate: \"add event schedules, display listings, and manage RSVP forms\"\n* General / Unspecified: \"add products, set up bookings, and adjust your content\"\nIf none of these patterns fit the site, infer 2\u20133 actions that suit what that kind of business would manage on its site.";
+/**
+ * Who builds a new site, as the user is asked it. Named by who builds it and where it gets
+ * edited, never "AI": the user is already talking to an AI, so "Build with AI" does not say
+ * which one. Shared by the tool descriptions, the chooser widget and its reply.
+ */
+export declare const SITE_BUILDER_CHOICE: {
+    readonly here: {
+        readonly label: "Build it here with me";
+        readonly pitch: "I build it in code right here, and you change anything by asking me";
+    };
+    readonly editor: {
+        readonly label: "Design it in Wix's editor";
+        readonly pitch: "Wix designs a first version or you start from a template, then you edit it in Wix";
+    };
+    /** The editor's second step, in the widget and its reply. */
+    readonly editorStart: {
+        readonly wix: {
+            readonly label: "Let Wix design it";
+            readonly pitch: "Wix designs a first version from your description for you to edit";
+        };
+        readonly template: {
+            readonly label: "Browse templates";
+            readonly pitch: "start from a ready-made design and edit it in Wix";
+        };
+    };
+    /** Asked in chat when no widget is shown: who builds it. */
+    readonly whoQuestion: "Do you want me to build it here, so you can change anything just by asking me, or do you want to design it yourself in Wix's editor?";
+    /** Asked next, only when the user chose Wix's editor. */
+    readonly editorQuestion: "Should Wix design a first version for you to edit, or do you want to start from a template?";
+    /** What the widget sends as the user's message when they pick "Build it here with me". */
+    readonly hereFollowUp: "Build it here with me, in code, so I can keep changing it by asking you.";
+};
 /**
  * Builds the WixSiteCreation chooser reply. The message is fully composed here and wrapped in a
  * preamble that tells the host model to display the body verbatim (keeping the bullets and line
@@ -24,8 +71,9 @@ export declare const SITE_CREATION_CUSTOM_ACTIONS_GUIDANCE = "2\u20133 specific,
  * injection and blocks the whole reply ("Sorry, it looks like I can't chat about this"); there the
  * verbatim-reply instruction lives only in the tool description.
  */
-export declare function buildSiteCreationSelectorMessage(siteType?: string, customActions?: string, { plain }?: {
+export declare function buildSiteCreationSelectorMessage(siteType?: string, customActions?: string, { plain, editorChosen }?: {
     plain?: boolean;
+    editorChosen?: boolean;
 }): string;
 /** OpenAI/ChatGPT widget MIME type for Skybridge rendering */
 export declare const OPENAI_WIDGET_MIME_TYPE = "text/html+skybridge";

package/build/dts/site-widget-tools/constants.js

@@ -1,13 +1,29 @@
 // Tool name constants - separated to avoid circular dependencies during widget builds
 // These constants can be imported by both the widgets and the tool implementations
-export const SITE_BUILDER_TOOL_NAME = 'WixSiteBuilder';
+// Named in SERVER_INSTRUCTIONS (config/default-config.ts): when this tool's name or what it is for changes, update them to match.
+export const SITE_BUILDER_TOOL_NAME = 'WixHarmonyEditorBuild';
 export const EDIT_SITE_TOOL_NAME = 'EditSite';
 export const PULL_SITE_JOB_TOOL_NAME = 'pullSiteCreationJob';
 export const CLAIM_SITE_TOOL_NAME = 'ClaimAnonymousSite';
 export const GET_SUGGESTED_DOMAINS_TOOL_NAME = 'GetSuggestedDomains';
 export const WIX_SITE_CREATION_TOOL_NAME = 'WixSiteCreation';
+// Named in SERVER_INSTRUCTIONS (config/default-config.ts): when this tool's name or what it is for changes, update them to match.
 export const SEARCH_SITE_TEMPLATES_TOOL_NAME = 'SearchSiteTemplates';
 export const CREATE_SITE_FROM_TEMPLATE_TOOL_NAME = 'CreateSiteFromTemplate';
+// Claude clients only: the image picker, and the app-only tool its widget uploads through.
+export const PICK_IMAGES_TOOL_NAME = 'PickImagesForWixMedia';
+export const MEDIA_UPLOAD_URL_TOOL_NAME = 'CreateWixMediaUploadUrl';
+/** The Wix business features that send a site to StartHeadlessBuild: what wix-headless-kit ships. */
+export const WIX_BUSINESS_FEATURES = 'a store, bookings or appointments, rentals, events and tickets, a restaurant menu with online orders or reservations, a blog, a portfolio, pricing plans and memberships, donations, Wix Forms, members and login, a CMS, payments';
+/** WixHarmonyEditorBuild's and SearchSiteTemplates' answer when the agent says the user did not ask for them. */
+/**
+ * The widget payload of a refused editor call: the gallery and builder widgets render nothing
+ * for it, since the host mounts them for every call of their tool.
+ */
+export const NOT_REQUESTED_WIDGET_PAYLOAD = { notRequested: true };
+export const EDITOR_NOT_REQUESTED_MESSAGE = `Nothing was created: the user did not ask for this. A new site is written in code and uploaded: call StartDeployWebsite, or StartHeadlessBuild when it needs Wix business features. Don't offer Wix's editor or a template instead.`;
+/** WixSiteCreation's answer: it no longer opens a chooser, it sends the agent to the code path. */
+export const SITE_CREATION_ROUTE_MESSAGE = `A new site is written in code and uploaded. Call StartDeployWebsite now for the upload guide, or StartHeadlessBuild when the site needs Wix business features. Use WixHarmonyEditorBuild or SearchSiteTemplates only when the user asked for the Wix Harmony Editor, a template, Wix Studio or the Classic Editor.`;
 /** Fallback actions when the industry is generic or unclear. */
 export const SITE_CREATION_DEFAULT_ACTIONS = 'add products, set up bookings, and adjust your content';
 /**
@@ -22,6 +38,38 @@ export const SITE_CREATION_CUSTOM_ACTIONS_GUIDANCE = `2–3 specific, high-value
 * Events / Weddings / Real Estate: "add event schedules, display listings, and manage RSVP forms"
 * General / Unspecified: "${SITE_CREATION_DEFAULT_ACTIONS}"
 If none of these patterns fit the site, infer 2–3 actions that suit what that kind of business would manage on its site.`;
+/**
+ * Who builds a new site, as the user is asked it. Named by who builds it and where it gets
+ * edited, never "AI": the user is already talking to an AI, so "Build with AI" does not say
+ * which one. Shared by the tool descriptions, the chooser widget and its reply.
+ */
+export const SITE_BUILDER_CHOICE = {
+    here: {
+        label: 'Build it here with me',
+        pitch: 'I build it in code right here, and you change anything by asking me'
+    },
+    editor: {
+        label: "Design it in Wix's editor",
+        pitch: 'Wix designs a first version or you start from a template, then you edit it in Wix'
+    },
+    /** The editor's second step, in the widget and its reply. */
+    editorStart: {
+        wix: {
+            label: 'Let Wix design it',
+            pitch: 'Wix designs a first version from your description for you to edit'
+        },
+        template: {
+            label: 'Browse templates',
+            pitch: 'start from a ready-made design and edit it in Wix'
+        }
+    },
+    /** Asked in chat when no widget is shown: who builds it. */
+    whoQuestion: "Do you want me to build it here, so you can change anything just by asking me, or do you want to design it yourself in Wix's editor?",
+    /** Asked next, only when the user chose Wix's editor. */
+    editorQuestion: 'Should Wix design a first version for you to edit, or do you want to start from a template?',
+    /** What the widget sends as the user's message when they pick "Build it here with me". */
+    hereFollowUp: 'Build it here with me, in code, so I can keep changing it by asking you.'
+};
 /**
  * Builds the WixSiteCreation chooser reply. The message is fully composed here and wrapped in a
  * preamble that tells the host model to display the body verbatim (keeping the bullets and line
@@ -33,23 +81,32 @@ If none of these patterns fit the site, infer 2–3 actions that suit what that
  * injection and blocks the whole reply ("Sorry, it looks like I can't chat about this"); there the
  * verbatim-reply instruction lives only in the tool description.
  */
-export function buildSiteCreationSelectorMessage(siteType, customActions, { plain = false } = {}) {
+export function buildSiteCreationSelectorMessage(siteType, customActions, { plain = false, editorChosen = false } = {}) {
     const type = (siteType ?? '').trim() || 'new';
     const actions = (customActions ?? '').trim() || SITE_CREATION_DEFAULT_ACTIONS;
+    // With the editor already chosen, the widget opens at "how to start", so the two
+    // bullets are that step's options instead of who builds it.
+    const here = editorChosen
+        ? `* **${SITE_BUILDER_CHOICE.editorStart.wix.label}**: ${SITE_BUILDER_CHOICE.editorStart.wix.pitch}`
+        : `* **${SITE_BUILDER_CHOICE.here.label}**: ${SITE_BUILDER_CHOICE.here.pitch}`;
+    const editor = editorChosen
+        ? `* **${SITE_BUILDER_CHOICE.editorStart.template.label}**: ${SITE_BUILDER_CHOICE.editorStart.template.pitch}`
+        : `* **${SITE_BUILDER_CHOICE.editor.label}**: ${SITE_BUILDER_CHOICE.editor.pitch}`;
+    const nextUp = `**Next up:** Either way, you can ask me to ${actions}—right here in the chat!`;
     const body = `Ready to set up your ${type} site? Choose your path in the widget above:
 
-* **Build with AI** for a custom, tailor-made layout
-* **Pick a template** to start with a pre-designed layout
+${here}
+${editor}
 
-**Next up:** Once your site is created, you can customize it in Wix or ask me to ${actions}—right here in the chat!`;
+${nextUp}`;
     if (plain) {
         return body;
     }
     return `You are the assistant replying to the user — say this message out loud in chat (do NOT stay silent, and do NOT just point at the widget). Your reply is only complete if it includes ALL of the following, word for word, each on its own line and in this order:
 1. "Ready to set up your ${type} site? Choose your path in the widget above:" — keep the "Choose your path in the widget above:" part.
-2. "* **Build with AI** for a custom, tailor-made layout"
-3. "* **Pick a template** to start with a pre-designed layout"
-4. "**Next up:** Once your site is created, you can customize it in Wix or ask me to ${actions}—right here in the chat!"
+2. "${here}"
+3. "${editor}"
+4. "${nextUp}"
 
 Copy those four lines as written; do not summarize, shorten, reorder, or reword any of them. Here is the full message to send:
 

package/build/dts/site-widget-tools/index.d.ts

@@ -9,5 +9,6 @@ export { addSuggestedDomainTool } from './suggested-domain-tool/index.js';
 export { addWixSiteCreationTool } from './site-creation-tool/index.js';
 export { addSearchSiteTemplatesTool } from './search-site-templates-tool/index.js';
 export { addCreateSiteFromTemplateTool } from './create-site-from-template-tool/index.js';
+export { addPickImagesTools } from './pick-images-tool/index.js';
 export declare function addSiteCreationWidgetTools(server: WixMcpServer, authStrategy: McpAuthenticationStrategy, options?: SiteWidgetToolOptions): void;
 //# sourceMappingURL=index.d.ts.map

package/build/dts/site-widget-tools/index.js

@@ -10,6 +10,7 @@ export { addSuggestedDomainTool } from './suggested-domain-tool/index.js';
 export { addWixSiteCreationTool } from './site-creation-tool/index.js';
 export { addSearchSiteTemplatesTool } from './search-site-templates-tool/index.js';
 export { addCreateSiteFromTemplateTool } from './create-site-from-template-tool/index.js';
+export { addPickImagesTools } from './pick-images-tool/index.js';
 // Combine all the required site widget tools
 export function addSiteCreationWidgetTools(server, authStrategy, options) {
     addCreateSiteWidgetTool(server, authStrategy, options);

package/build/dts/site-widget-tools/pick-images-tool/index.d.ts

@@ -0,0 +1,14 @@
+import { McpAuthenticationStrategy } from '../../auth/index.js';
+import { WixMcpServer } from '../../wix-mcp-server.js';
+/**
+ * Exists only because Claude can't hand a file to a tool: recheck when it can (see
+ * config/file-params.ts), and drop or narrow this then.
+ *
+ * The image picker for clients that can't hand a file to a tool (Claude): the user
+ * picks images in a widget, which uploads them from the browser to the site's Media
+ * Manager through upload URLs from the app-only CreateWixMediaUploadUrl tool.
+ */
+export declare function addPickImagesTools(server: WixMcpServer, strategy: McpAuthenticationStrategy, options?: {
+    toolDescriptions?: Record<string, string>;
+}): void;
+//# sourceMappingURL=index.d.ts.map

package/build/dts/site-widget-tools/pick-images-tool/index.js

@@ -0,0 +1,138 @@
+import { z } from 'zod';
+import { RESOURCE_MIME_TYPE } from '@modelcontextprotocol/ext-apps/server';
+import { rethrowIfUnauthorized } from '../../auth/index.js';
+import { getWidgetHtml } from '../../widget-manifest.js';
+import { withJsonContent } from '../../tool-utils.js';
+import { WixFetchError } from '../../wix-fetch-error.js';
+import { defaultToolDescriptions } from '../../config/default-config.js';
+import { MEDIA_UPLOAD_URL_TOOL_NAME, PICK_IMAGES_TOOL_NAME } from '../constants.js';
+const PICK_IMAGES_WIDGET_URI = 'ui://widget/pick-images.html';
+// The widget uploads each picked file from the user's browser straight to the
+// Media Manager upload URL, so upload.wixmp.com must be reachable from it.
+const PICK_IMAGES_CSP = {
+    connectDomains: [
+        'https://upload.wixmp.com',
+        'https://static.parastorage.com'
+    ],
+    resourceDomains: [
+        'https://static.wixstatic.com',
+        'https://static.parastorage.com',
+        'data:',
+        'blob:'
+    ]
+};
+const PICKER_OPEN_TEXT = "An image picker is open in the chat. The user selects images there; they upload to the site's Media Manager, and a message with each image's media ID and URL follows. Reply with one short sentence and wait for that message. If your client shows no picker, send the images with UploadImageToWixSite as imageBase64, or ask the user for public URLs.";
+const siteIdSchema = z
+    .string()
+    .uuid('siteId must be a valid Wix site ID (UUID)');
+/**
+ * Exists only because Claude can't hand a file to a tool: recheck when it can (see
+ * config/file-params.ts), and drop or narrow this then.
+ *
+ * The image picker for clients that can't hand a file to a tool (Claude): the user
+ * picks images in a widget, which uploads them from the browser to the site's Media
+ * Manager through upload URLs from the app-only CreateWixMediaUploadUrl tool.
+ */
+export function addPickImagesTools(server, strategy, options) {
+    server.registerResource(`${PICK_IMAGES_TOOL_NAME}_RESOURCE`, PICK_IMAGES_WIDGET_URI, {}, async (uri) => ({
+        contents: [
+            {
+                uri: uri.href,
+                _meta: { ui: { csp: PICK_IMAGES_CSP } },
+                mimeType: RESOURCE_MIME_TYPE,
+                text: getWidgetHtml({
+                    widgetId: 'pickImages',
+                    props: { renderMcpApps: true }
+                })
+            }
+        ]
+    }));
+    server.registerTool(PICK_IMAGES_TOOL_NAME, {
+        title: 'Pick Images to Upload to Wix',
+        description: options?.toolDescriptions?.[PICK_IMAGES_TOOL_NAME] ??
+            defaultToolDescriptions[PICK_IMAGES_TOOL_NAME],
+        inputSchema: {
+            siteId: siteIdSchema.describe('The site whose Media Manager receives the images.')
+        },
+        _meta: {
+            ui: {
+                resourceUri: PICK_IMAGES_WIDGET_URI,
+                visibility: ['app', 'model']
+            }
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            openWorldHint: true
+        }
+    }, async ({ siteId }, { setToolBiParams }) => {
+        setToolBiParams({ siteId });
+        return withJsonContent({
+            content: [{ type: 'text', text: PICKER_OPEN_TEXT }],
+            structuredContent: { siteId },
+            _meta: { widgetPayload: { siteId } }
+        });
+    });
+    server.registerTool(MEDIA_UPLOAD_URL_TOOL_NAME, {
+        title: 'Create Wix Media Upload URL',
+        description: `Used by the ${PICK_IMAGES_TOOL_NAME} widget: returns a one-time URL the widget uploads one picked image to. Not for direct use.`,
+        inputSchema: {
+            siteId: siteIdSchema,
+            fileName: z.string().min(1).max(200),
+            mimeType: z
+                .string()
+                .regex(/^image\//, 'Only images can be uploaded here'),
+            sizeInBytes: z.number().int().positive().optional()
+        },
+        _meta: { ui: { visibility: ['app'] } },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            openWorldHint: true
+        }
+    }, async ({ siteId, fileName, mimeType, sizeInBytes }, { setToolBiParams }) => {
+        setToolBiParams({ siteId });
+        try {
+            const authHeaders = await strategy.getSiteAuthHeaders(siteId);
+            const res = await fetch('https://www.wixapis.com/site-media/v1/files/generate-upload-url', {
+                method: 'POST',
+                headers: { ...authHeaders, 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    mimeType,
+                    fileName,
+                    ...(sizeInBytes ? { sizeInBytes: String(sizeInBytes) } : {})
+                })
+            });
+            if (!res.ok) {
+                throw new WixFetchError(res.status, res.statusText, await res.text());
+            }
+            const { uploadUrl } = (await res.json());
+            if (!uploadUrl) {
+                throw new Error('Wix returned no upload URL');
+            }
+            // The URL is a one-time upload grant: never in the text content, which BI
+            // records as the result preview. _meta carries it for hosts that drop
+            // structuredContent.
+            return {
+                content: [{ type: 'text', text: 'Upload URL created.' }],
+                structuredContent: { uploadUrl },
+                _meta: { uploadUrl }
+            };
+        }
+        catch (error) {
+            rethrowIfUnauthorized(error);
+            await strategy.enforceValidWixToken?.(error);
+            const message = error instanceof Error ? error.message : String(error);
+            return {
+                isError: true,
+                content: [
+                    {
+                        type: 'text',
+                        text: `Failed to create an upload URL: ${message}`
+                    }
+                ]
+            };
+        }
+    });
+}
+//# sourceMappingURL=index.js.map

package/build/dts/site-widget-tools/pull-site-creation-job-tool/index.js

@@ -13,7 +13,7 @@ export function addPullSiteJobTool(server, authStrategy, options) {
         title: 'Pull Site Job',
         description: isWidgetClient
             ? 'Poll the status of a site creation or editing job. Do not call this tool unless the user explicitly asks for status polling.'
-            : 'Poll the status of a site creation or editing job. Call this tool with the jobId returned by WixSiteBuilder or EditSite to check if the site build is complete. When the job status is COMPLETED, the response includes the previewUrl and editorUrl.',
+            : 'Poll the status of a site creation or editing job. Call this tool with the jobId returned by WixHarmonyEditorBuild or EditSite to check if the site build is complete. When the job status is COMPLETED, the response includes the previewUrl and editorUrl.',
         inputSchema: {
             jobId: z.string().describe('The job ID to pull')
         },

package/build/dts/site-widget-tools/search-site-templates-tool/index.js

@@ -6,8 +6,9 @@ import { Type, TemplateBuilder } from '@wix/ambassador-funnel-templates-gallery-
 import { getWidgetHtml } from '../../widget-manifest.js';
 import { RESOURCE_MIME_TYPE } from '@modelcontextprotocol/ext-apps/server';
 import { defaultToolDescriptions } from '../../config/default-config.js';
-import { SEARCH_SITE_TEMPLATES_TOOL_NAME, CREATE_SITE_FROM_TEMPLATE_TOOL_NAME, SITE_WIDGET_MCP_CSP, OPEN_AI_SITE_WIDGET_CSP } from '../constants.js';
+import { EDITOR_NOT_REQUESTED_MESSAGE, NOT_REQUESTED_WIDGET_PAYLOAD, SEARCH_SITE_TEMPLATES_TOOL_NAME, CREATE_SITE_FROM_TEMPLATE_TOOL_NAME, SITE_WIDGET_MCP_CSP, OPEN_AI_SITE_WIDGET_CSP } from '../constants.js';
 import { withJsonContent } from '../../tool-utils.js';
+import { NO_PERSONAL_DATA, START_DEPLOY_WEBSITE_PARAM_DESCRIPTIONS } from '../../docs/start-deploy-website.js';
 // baseURL pins the host so the ambassador resolves to the public template-search
 // endpoint: https://www.wix.com/_api/template-cms-view-service/view/v2/templates/search
 const httpClient = createHttpClient({ baseURL: 'https://www.wix.com' });
@@ -69,7 +70,19 @@ export function addSearchSiteTemplatesTool(server, _authStrategy, options) {
                 .min(1)
                 .max(MAX_TEMPLATE_RESULTS)
                 .optional()
-                .describe(`Maximum number of templates to return (capped at ${MAX_TEMPLATE_RESULTS}).`)
+                .describe(`Maximum number of templates to return (capped at ${MAX_TEMPLATE_RESULTS}).`),
+            templatesExplicitlyRequested: z
+                .boolean()
+                .optional()
+                .describe("Did the user, in their own words or their answer to your question, ask for a template, Wix Studio, or the Classic Editor by name? Wanting Wix's editor, or to design the site themselves, is not that: ask them how to start first. Nor are a site's business, features or look."),
+            templateRequest: z
+                .string()
+                .optional()
+                .describe(`The user's own words that asked for a template, Wix Studio or the Classic Editor, quoted from their message or their answer to your question. Empty when they asked for none of them; then templatesExplicitlyRequested is false. Recorded, not checked. ${NO_PERSONAL_DATA}`),
+            agentIdentity: z
+                .string()
+                .optional()
+                .describe(START_DEPLOY_WEBSITE_PARAM_DESCRIPTIONS.agentIdentity)
         },
         _meta: {
             ui: {
@@ -86,6 +99,16 @@ export function addSearchSiteTemplatesTool(server, _authStrategy, options) {
             idempotentHint: true
         }
     }, async (args, { panorama }) => {
+        // Only an explicit false is refused: clients that hold the previous definition never send the flag.
+        if (args.templatesExplicitlyRequested === false) {
+            return withJsonContent({
+                content: [
+                    { type: 'text', text: EDITOR_NOT_REQUESTED_MESSAGE }
+                ],
+                structuredContent: { success: false, status: 'not_requested' },
+                _meta: { widgetPayload: NOT_REQUESTED_WIDGET_PAYLOAD }
+            });
+        }
         const limit = args.limit ?? MAX_TEMPLATE_RESULTS;
         console.log(`[${SEARCH_SITE_TEMPLATES_TOOL_NAME}] 🚀 tool invoked`, {
             builder: args.builder,