@wix/mcp 1.0.97 → 1.0.98

package/build/bin-standalone.js

@@ -100102,10 +100102,7 @@ function addSuggestedDomainTool(server2, authStrategy2) {
         openWorldHint: false
       },
       _meta: {
-        securitySchemes: [
-          { type: "noauth" },
-          { type: "oauth2", scopes: ["offline_access"] }
-        ],
+        securitySchemes: [{ type: "oauth2", scopes: ["offline_access"] }],
         // Model-visible so hosts (e.g. Microsoft 365 Copilot) can call it directly and show it
         // in their debug info; 'app' keeps it callable from the site-builder widget.
         ui: { visibility: ["app", "model"] },
@@ -100331,10 +100328,7 @@ function addDomainAvailabilityTool(server2) {
         openWorldHint: false
       },
       _meta: {
-        securitySchemes: [
-          { type: "noauth" },
-          { type: "oauth2", scopes: ["offline_access"] }
-        ],
+        securitySchemes: [{ type: "oauth2", scopes: ["offline_access"] }],
         ui: { visibility: ["app", "model"] },
         "openai/toolInvocation/invoking": "Checking domain availability",
         "openai/toolInvocation/invoked": "Domain availability checked"

package/build/cjs/index.cjs

@@ -20923,6 +20923,7 @@ __export(index_exports, {
   addEditSiteWidgetTool: () => addEditSiteWidgetTool,
   addExecuteCodeModeTool: () => addExecuteCodeModeTool,
   addGetProfileTool: () => addGetProfileTool,
+  addGetWixelAssetFilesTool: () => addGetWixelAssetFilesTool,
   addGetWixelAssetTool: () => addGetWixelAssetTool,
   addGetWixelJobStatusTool: () => addGetWixelJobStatusTool,
   addGetWixelProjectAssetsTool: () => addGetWixelProjectAssetsTool,
@@ -49123,10 +49124,7 @@ function addSuggestedDomainTool(server, authStrategy) {
         openWorldHint: false
       },
       _meta: {
-        securitySchemes: [
-          { type: "noauth" },
-          { type: "oauth2", scopes: ["offline_access"] }
-        ],
+        securitySchemes: [{ type: "oauth2", scopes: ["offline_access"] }],
         // Model-visible so hosts (e.g. Microsoft 365 Copilot) can call it directly and show it
         // in their debug info; 'app' keeps it callable from the site-builder widget.
         ui: { visibility: ["app", "model"] },
@@ -49352,10 +49350,7 @@ function addDomainAvailabilityTool(server) {
         openWorldHint: false
       },
       _meta: {
-        securitySchemes: [
-          { type: "noauth" },
-          { type: "oauth2", scopes: ["offline_access"] }
-        ],
+        securitySchemes: [{ type: "oauth2", scopes: ["offline_access"] }],
         ui: { visibility: ["app", "model"] },
         "openai/toolInvocation/invoking": "Checking domain availability",
         "openai/toolInvocation/invoked": "Domain availability checked"
@@ -51915,6 +51910,59 @@ async function getStylePresetsByIds2({
     };
   });
 }
+function wixelHostClient({
+  siteAuthHeaders,
+  apiBaseURL = WWW_ASSET_V1_ASSET_API_BASE_URL,
+  conductorOverride
+}) {
+  return (0, import_http_client14.createHttpClient)({
+    headers: {
+      ...COMMON_HEADERS,
+      ...siteAuthHeaders,
+      ...conductorOverride ? { ...CONDUCTOR_OVERRIDE_HEADERS } : {}
+    },
+    baseURL: apiBaseURL
+  });
+}
+var WIXEL_HOST_EXPORT_ASSET_PATH = "/_api/wixel/v1/export/asset";
+var WIXEL_HOST_EXPORT_STATE_PATH = "/_api/wixel/v1/export/state";
+async function startAssetExport({
+  assetId,
+  params,
+  ...options
+}) {
+  const { data } = await wixelHostClient(options).post(
+    WIXEL_HOST_EXPORT_ASSET_PATH,
+    {
+      projectId: options.projectId,
+      assetId,
+      assetType: options.assetType,
+      ...params ? { params } : {}
+    }
+  );
+  if (!data?.jobId) {
+    throw new Error("Wixel did not start an export job for this asset");
+  }
+  return data.jobId;
+}
+async function getAssetExportState({
+  jobId,
+  ...options
+}) {
+  const { data } = await wixelHostClient(options).post(WIXEL_HOST_EXPORT_STATE_PATH, {
+    jobId,
+    projectId: options.projectId,
+    assetType: options.assetType
+  });
+  const state = data?.state ?? {};
+  return {
+    complete: state.complete === true,
+    progress: state.progress ?? null,
+    url: state.url ?? null,
+    errorDescription: state.errorDescription ?? null,
+    title: state.title ?? null
+  };
+}
 
 // src/wixel/get-wixel-job-status-tool.ts
 var TOOL_NAME = "getWixelJobStatus";
@@ -52571,6 +52619,29 @@ async function getWixelSessionProjectId({
   const session = data?.sessions?.find((entry) => entry.id === sessionId);
   return session?.projectId ?? null;
 }
+var PREVIEW_TOOLS = /* @__PURE__ */ new Set([
+  "generate_image",
+  "edit_image",
+  "remove_image_background"
+]);
+var MAX_PREVIEW_URLS = 4;
+function collectPreviewUrls(messages, askIndex, turnId) {
+  const urls = [];
+  for (let i = 0; i <= askIndex; i++) {
+    const message = messages[i];
+    if (turnId && message.turnId !== turnId) continue;
+    for (const part of message.parts ?? []) {
+      const response = part.functionResponse;
+      if (!response?.name || !PREVIEW_TOOLS.has(response.name)) continue;
+      for (const url of extractMediaUrls(
+        JSON.stringify(response.response ?? "")
+      )) {
+        if (!urls.includes(url)) urls.push(url);
+      }
+    }
+  }
+  return urls.slice(-MAX_PREVIEW_URLS);
+}
 async function getWixelSessionActivity({
   sessionId,
   ...base
@@ -52662,10 +52733,12 @@ async function getWixelPendingQuestion({
         const questions = call.args?.questions ?? [];
         if (!questions.length) continue;
         if (ownTurn && message.turnId !== ownTurn) return null;
+        const previewUrls = collectPreviewUrls(messages, i, message.turnId);
         return {
           toolCallId: call.id,
           turnId: message.turnId,
-          questions
+          questions,
+          ...previewUrls.length ? { previewUrls } : {}
         };
       }
       if (part.text || part.functionCall || part.functionResponse) {
@@ -53026,14 +53099,20 @@ Call this when get_wixel_task flags a question, or its reply asks the user somet
         const summary = pending.questions.map(
           (question, index) => `${index + 1}. [${question.kind}] ${question.title ?? ""}${question.customCanvas?.componentName ? ` (${question.customCanvas.componentName})` : ""}`
         ).join("\n");
+        const previewUrls = pending.previewUrls ?? [];
+        const previewText = previewUrls.length ? `
+
+Sample made so far (what the user is approving):
+${previewUrls.map((url) => `- ${url}`).join("\n")}` : "";
+        const previewInstruction = previewUrls.length ? "Show the user the sample first: give the link(s) above and, when you can write files, save them under assets/_preview/ (for example assets/_preview/sample-1.png) and name the path, so the user sees the look before answering. " : "";
         const responseText = widgetShown ? `An interactive question widget is displayed to the user (questionId: ${pending.toolCallId}):
 ${summary}
 <agent_instruction>Do NOT repeat the question content as text \u2014 the user answers inside the widget, which sends the answer to Wixel itself. This is NOT a turn-taking situation: the result of the user's widget answer reaches YOU only through get_wixel_task \u2014 nothing wakes you if you stop, and ending your turn BREAKS the flow (the result would never be delivered).
 Therefore: briefly tell the user to answer in the widget, then keep calling get_wixel_task (taskId: "${args.taskId}", metaSiteId: "${args.metaSiteId}", waitSeconds: 25) in a continuous loop, and do NOT end your turn until it reports the turn done, however long it takes (the user may think for a while, then generation takes minutes). If it names a newer taskId (the widget's answer opened a new turn), follow that one.
 - Polls that flag questionId ${pending.toolCallId} mean the user has not answered THIS question yet \u2014 do NOT call get_wixel_pending_question again for it, just keep polling.
 - When the turn is done: if the response flags a NEW interactive question, call get_wixel_pending_question again (it renders the next widget). Otherwise present the reply to the user as a normal chat message, always including the "Edit in Wixel" link when provided.</agent_instruction>` : `The Wixel agent asked:
-${summary}
-<agent_instruction>Present the question(s) with their options/content to the user, then send their answer as plain text via send_wixel_message (contextId: "${args.contextId}", metaSiteId: "${args.metaSiteId}") and poll get_wixel_task for the taskId it returns.</agent_instruction>`;
+${summary}${previewText}
+<agent_instruction>${previewInstruction}Present the question(s) with their options/content to the user, then send their answer as plain text via send_wixel_message (contextId: "${args.contextId}", metaSiteId: "${args.metaSiteId}") and poll get_wixel_task for the taskId it returns.</agent_instruction>`;
         return {
           isError: false,
           content: [{ type: "text", text: responseText }],
@@ -53996,6 +54075,358 @@ function addWixelSessionTools(server, authStrategy, options = {}) {
   addGetWixelTurnResultTool(server, authStrategy, shared);
 }
 
+// src/wixel/app-icon-files.ts
+var WIX_MEDIA_FILE = /^(https:\/\/static\.wixstatic\.com\/media\/[^/?#]+)/;
+var ANDROID_MIPMAPS = [
+  ["mdpi", 48],
+  ["hdpi", 72],
+  ["xhdpi", 96],
+  ["xxhdpi", 144],
+  ["xxxhdpi", 192]
+];
+function wixMediaFileUrl(url) {
+  return WIX_MEDIA_FILE.exec(url)?.[1] ?? null;
+}
+function wixMediaSquarePng(fileUrl, size) {
+  return `${fileUrl}/v1/fill/w_${size},h_${size},al_c,q_95/icon-${size}.png`;
+}
+function buildAppIconFiles(exportedPngUrl, appName) {
+  const file = wixMediaFileUrl(exportedPngUrl);
+  if (!file) {
+    return null;
+  }
+  const png = (path, size) => ({
+    path,
+    url: wixMediaSquarePng(file, size)
+  });
+  return [
+    png("ios/AppIcon.appiconset/icon-1024.png", 1024),
+    {
+      path: "ios/AppIcon.appiconset/Contents.json",
+      content: JSON.stringify(
+        {
+          images: [
+            {
+              filename: "icon-1024.png",
+              idiom: "universal",
+              platform: "ios",
+              size: "1024x1024"
+            }
+          ],
+          info: { author: "wixel", version: 1 }
+        },
+        null,
+        2
+      )
+    },
+    ...ANDROID_MIPMAPS.map(
+      ([density, size]) => png(`android/res/mipmap-${density}/ic_launcher.png`, size)
+    ),
+    png("android/play-store-512.png", 512),
+    png("web/favicon-16.png", 16),
+    png("web/favicon-32.png", 32),
+    png("web/favicon-48.png", 48),
+    png("web/apple-touch-icon.png", 180),
+    png("web/icon-192.png", 192),
+    png("web/icon-512.png", 512),
+    {
+      path: "web/site.webmanifest",
+      content: JSON.stringify(
+        {
+          name: appName,
+          short_name: appName.slice(0, 12),
+          icons: [
+            { src: "icon-192.png", sizes: "192x192", type: "image/png" },
+            { src: "icon-512.png", sizes: "512x512", type: "image/png" }
+          ],
+          display: "standalone"
+        },
+        null,
+        2
+      )
+    }
+  ];
+}
+
+// src/wixel/wixel-asset-files-tool.ts
+var ASSET_FILE_LAYOUTS = ["files", "spriteSheet", "appIcons"];
+var ICONS_FILE_TYPES = [
+  "png",
+  "pngTransparentBackground",
+  "svg",
+  "svgTransparentBackground"
+];
+var ICONS_SIZES = [
+  "16px",
+  "24px",
+  "32px",
+  "64px",
+  "128px",
+  "256px",
+  "512px"
+];
+var POLL_INTERVAL_MS = 2e3;
+var MAX_WAIT_SECONDS = 25;
+function buildExportParams(assetType, args) {
+  const layout = args.layout ?? "files";
+  if (assetType === "IMAGE" && layout === "appIcons") {
+    return { format: "png", quality: 100, scale: 1 };
+  }
+  if (assetType !== "ICONS") {
+    if (layout !== "files") {
+      throw new Error(
+        layout === "appIcons" ? `layout "appIcons" needs an ICONS or IMAGE asset (the app icon); this asset is ${assetType}` : `layout "${layout}" needs an ICONS asset (an icon / sprite set); this asset is ${assetType}`
+      );
+    }
+    return void 0;
+  }
+  if (layout === "files") {
+    return {
+      // Engines and app projects want plain transparent PNGs, not the
+      // editor's default SVG-wrapped PNG.
+      fileType: args.fileType ?? "pngTransparentBackground",
+      ...args.size ? { size: args.size } : { size: "512px" }
+    };
+  }
+  return {
+    layout,
+    ...layout === "spriteSheet" && args.size ? { size: args.size } : {}
+  };
+}
+async function waitForExport(read, waitSeconds) {
+  const deadline = Date.now() + waitSeconds * 1e3;
+  let state = await read();
+  while (!state.complete && !state.errorDescription && Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+    state = await read();
+  }
+  return state;
+}
+function describeContents(layout, assetType) {
+  if (assetType !== "ICONS") {
+    return "The file is the asset as the editor downloads it.";
+  }
+  switch (layout) {
+    case "spriteSheet":
+      return 'The zip holds <set>-sheet.png (frames on one grid, feet on one baseline), <set>-sheet.json (Aseprite array frame map: frames "0","1"\u2026, one frameTags entry per pose \u2014 load with Phaser this.load.aseprite + this.anims.createFromAseprite) and frames/<n>-<pose>.png.';
+    case "appIcons":
+      return "The zip holds ios/AppIcon.appiconset (1024 px + Contents.json, drop into Assets.xcassets), android/res/mipmap-*/ic_launcher.png + android/play-store-512.png, and web/ favicons, apple-touch-icon.png, icon-192/512.png and site.webmanifest.";
+    default:
+      return "The zip holds one transparent PNG per tile, named after the tile.";
+  }
+}
+function addGetWixelAssetFilesTool(server, authStrategy, options = {}) {
+  const { getSiteAuthHeaders } = authStrategy;
+  server.registerTool(
+    "get_wixel_asset_files",
+    {
+      title: "Get Wixel asset files",
+      description: `Download the files of an asset made in a Wixel conversation, to use them in code (a game, an app, a site). Pass the metaSiteId and sessionId that send_wixel_message returned.
+- Without assetId: lists the project's assets (id, name, type) \u2014 pick one.
+- With assetId: exports it and returns a zip URL. For an ICONS asset choose layout:
+  "files" (default) one transparent PNG per tile;
+  "spriteSheet" for a character's poses / animation frames: one aligned sheet + Aseprite JSON frame map (Phaser createFromAseprite) + aligned frames;
+  "appIcons" for an app or game icon: iOS app icon set, Android mipmaps + Play Store 512, web favicons + manifest.
+  An IMAGE asset (an app icon tile) also takes layout "appIcons": you get one URL per file instead of a zip.
+- If the export is still running, call again with the returned jobId, assetType, layout and assetId.
+Download the URL and unzip it into the project; never re-draw or re-generate assets the user already approved.`,
+      inputSchema: {
+        metaSiteId: external_exports.string().describe("metaSiteId returned by send_wixel_message"),
+        sessionId: external_exports.string().describe("sessionId returned by send_wixel_message"),
+        assetId: external_exports.string().optional().describe("Asset to export; omit to list the project assets"),
+        layout: external_exports.enum(ASSET_FILE_LAYOUTS).optional().describe(
+          "ICONS assets only: files (default), spriteSheet, appIcons"
+        ),
+        fileType: external_exports.enum(ICONS_FILE_TYPES).optional().describe(
+          'ICONS layout "files" only; default pngTransparentBackground'
+        ),
+        size: external_exports.enum(ICONS_SIZES).optional().describe(
+          'ICONS: tile size for "files" (default 512px), frame cell size for "spriteSheet" (default 256px)'
+        ),
+        jobId: external_exports.string().optional().describe("Continue waiting on an export this tool started"),
+        assetType: external_exports.string().optional().describe("With jobId: the assetType this tool returned"),
+        waitSeconds: external_exports.number().min(0).max(MAX_WAIT_SECONDS).optional().describe("How long to wait for the export (default 25)")
+      },
+      annotations: {
+        readOnlyHint: true,
+        destructiveHint: false,
+        openWorldHint: false
+      }
+    },
+    async (args, extra) => {
+      setWixelToolBi(extra, { siteId: args.metaSiteId });
+      const siteAuthHeaders = await getSiteAuthHeaders(args.metaSiteId);
+      try {
+        const projectId = await getWixelSessionProjectId({
+          authHeaders: siteAuthHeaders,
+          conductorOverride: options.conductorOverride,
+          sessionId: args.sessionId
+        });
+        if (!projectId) {
+          throw new Error(
+            "This Wixel conversation has no project yet \u2014 make something first"
+          );
+        }
+        const base = {
+          siteAuthHeaders,
+          projectId,
+          conductorOverride: options.conductorOverride
+        };
+        const waitSeconds = args.waitSeconds ?? MAX_WAIT_SECONDS;
+        if (args.jobId) {
+          if (!args.assetType) {
+            throw new Error("Pass the assetType returned with the jobId");
+          }
+          const assetType2 = args.assetType;
+          const state2 = await waitForExport(
+            () => getAssetExportState({ ...base, assetType: assetType2, jobId: args.jobId }),
+            waitSeconds
+          );
+          const assetName = state2.complete && args.assetId && assetType2 === "IMAGE" && args.layout === "appIcons" ? await getAsset({ ...base, assetId: args.assetId }).then((asset2) => asset2?.name).catch(() => void 0) : void 0;
+          return exportResult(state2, args, assetType2, args.jobId, assetName);
+        }
+        if (!args.assetId) {
+          const { assets } = await queryAssets(base);
+          const list = (assets ?? []).filter((asset2) => !asset2.archived).map((asset2) => ({
+            id: asset2.id,
+            name: asset2.name ?? null,
+            type: asset2.type ?? null
+          }));
+          return {
+            isError: false,
+            content: [
+              {
+                type: "text",
+                text: `${list.length} assets in this Wixel project:
+${list.map(
+                  (a2) => `- ${a2.name ?? "(unnamed)"} [${a2.type}] id=${a2.id}`
+                ).join(
+                  "\n"
+                )}
+Call get_wixel_asset_files again with the assetId to download one.`
+              }
+            ],
+            structuredContent: { success: true, projectId, assets: list }
+          };
+        }
+        const asset = await getAsset({ ...base, assetId: args.assetId });
+        const assetType = asset?.type;
+        if (!assetType) {
+          throw new Error(
+            `Asset ${args.assetId} was not found in this project`
+          );
+        }
+        const params = buildExportParams(assetType, args);
+        const jobId = await startAssetExport({
+          ...base,
+          assetType,
+          assetId: args.assetId,
+          params
+        });
+        const state = await waitForExport(
+          () => getAssetExportState({ ...base, assetType, jobId }),
+          waitSeconds
+        );
+        return exportResult(state, args, assetType, jobId, asset?.name);
+      } catch (error2) {
+        rethrowIfUnauthorized(error2);
+        console.error("\u274C Error getting Wixel asset files:", {
+          message: error2.message,
+          requestId: error2.requestId
+        });
+        const errorMessage = error2.message;
+        return {
+          isError: true,
+          content: [{ type: "text", text: errorMessage }],
+          structuredContent: { success: false, error: errorMessage }
+        };
+      }
+    }
+  );
+}
+function exportResult(state, args, assetType, jobId, assetName) {
+  if (state.errorDescription) {
+    return {
+      isError: true,
+      content: [
+        {
+          type: "text",
+          text: `Export failed: ${state.errorDescription}`
+        }
+      ],
+      structuredContent: {
+        success: false,
+        error: state.errorDescription,
+        jobId,
+        assetType
+      }
+    };
+  }
+  const layout = args.layout ?? "files";
+  if (!state.complete || !state.url) {
+    return {
+      isError: false,
+      content: [
+        {
+          type: "text",
+          text: `Export still running${state.progress != null ? ` (${state.progress}%)` : ""}. Call get_wixel_asset_files again with jobId "${jobId}", assetType "${assetType}", layout "${layout}"${args.assetId ? ` and assetId "${args.assetId}"` : ""}.`
+        }
+      ],
+      structuredContent: {
+        success: true,
+        status: "running",
+        progress: state.progress,
+        jobId,
+        assetType,
+        layout,
+        ...args.assetId ? { assetId: args.assetId } : {}
+      }
+    };
+  }
+  if (assetType === "IMAGE" && layout === "appIcons") {
+    const files = buildAppIconFiles(state.url, assetName || "App");
+    if (files) {
+      return {
+        isError: false,
+        content: [
+          {
+            type: "text",
+            text: `App icon files ready \u2014 download each URL to its path, write the JSON files as given:
+${files.map((f2) => `- ${f2.path}: ${f2.url ?? f2.content}`).join("\n")}`
+          }
+        ],
+        structuredContent: {
+          success: true,
+          status: "ready",
+          url: state.url,
+          files,
+          jobId,
+          assetType,
+          layout
+        }
+      };
+    }
+  }
+  return {
+    isError: false,
+    content: [
+      {
+        type: "text",
+        text: `Files ready: ${state.url}
+${describeContents(args.layout, assetType)}`
+      }
+    ],
+    structuredContent: {
+      success: true,
+      status: "ready",
+      url: state.url,
+      jobId,
+      assetType,
+      layout: args.layout ?? "files"
+    }
+  };
+}
+
 // src/wixel/index.ts
 function addWixelTools(server, authStrategy, options = {}) {
   addGetWixelJobStatusTool(server, authStrategy, options);
@@ -54003,6 +54434,7 @@ function addWixelTools(server, authStrategy, options = {}) {
   addGetWixelAssetTool(server, authStrategy, options);
   addGetWixelProjectAssetsTool(server, authStrategy, options);
   addWixelSessionTools(server, authStrategy, options);
+  addGetWixelAssetFilesTool(server, authStrategy, options);
 }
 
 // src/import-claude-design-tool/constants.ts
@@ -56989,6 +57421,7 @@ function createWixToolkit(options) {
   addEditSiteWidgetTool,
   addExecuteCodeModeTool,
   addGetProfileTool,
+  addGetWixelAssetFilesTool,
   addGetWixelAssetTool,
   addGetWixelJobStatusTool,
   addGetWixelProjectAssetsTool,

package/build/dts/api-call/availability-tool/index.js

@@ -45,10 +45,7 @@ export function addDomainAvailabilityTool(server) {
             openWorldHint: false
         },
         _meta: {
-            securitySchemes: [
-                { type: 'noauth' },
-                { type: 'oauth2', scopes: ['offline_access'] }
-            ],
+            securitySchemes: [{ type: 'oauth2', scopes: ['offline_access'] }],
             ui: { visibility: ['app', 'model'] },
             'openai/toolInvocation/invoking': 'Checking domain availability',
             'openai/toolInvocation/invoked': 'Domain availability checked'

package/build/dts/api-call/suggested-domain-tool/index.js

@@ -68,10 +68,7 @@ export function addSuggestedDomainTool(server, authStrategy) {
             openWorldHint: false
         },
         _meta: {
-            securitySchemes: [
-                { type: 'noauth' },
-                { type: 'oauth2', scopes: ['offline_access'] }
-            ],
+            securitySchemes: [{ type: 'oauth2', scopes: ['offline_access'] }],
             // Model-visible so hosts (e.g. Microsoft 365 Copilot) can call it directly and show it
             // in their debug info; 'app' keeps it callable from the site-builder widget.
             ui: { visibility: ['app', 'model'] },

package/build/dts/auth/index.d.ts

@@ -2,14 +2,25 @@ export declare const UNAUTHORIZED_ERROR_NAME = "UnauthorizedError";
 export type McpHeaders = Record<string, string>;
 /**
  * Material the execute runtime needs to obtain a site-scoped token for any site
- * on demand (multi-site ExecuteWixAPI). `oauth` is exchanged for a per-site
- * token via the oauth2/token refresh-grant; `apiKey` works for any site as-is.
- * The oauth refresh token is sensitive: never log it, never expose to sandbox JS.
+ * on demand (multi-site ExecuteWixAPI).
+ *
+ * - `oauth`: exchanged per site via the oauth2/token refresh grant.
+ * - `accountToken`: an account-level user access token, exchanged per site via
+ *   the oauth2/token RFC 8693 token-exchange grant (account token + site_id →
+ *   site-scoped token, no client secret, no refresh token issued). For callers
+ *   that mint short-lived account tokens and hold no refresh token, such as
+ *   the AI Assistant platform.
+ * - `apiKey`: works for any site as-is; the runtime only adds `wix-site-id`.
+ *
+ * Every variant is a credential: never log it, never expose it to sandbox JS.
  */
 export type SiteAuthContext = {
     type: 'oauth';
     clientId: string;
     refreshToken: string;
+} | {
+    type: 'accountToken';
+    accessToken: string;
 } | {
     type: 'apiKey';
     accessToken: string;

package/build/dts/toolkit-entry.d.cts

@@ -39,14 +39,25 @@ export declare const UNAUTHORIZED_ERROR_NAME = "UnauthorizedError";
 export type McpHeaders = Record<string, string>;
 /**
  * Material the execute runtime needs to obtain a site-scoped token for any site
- * on demand (multi-site ExecuteWixAPI). `oauth` is exchanged for a per-site
- * token via the oauth2/token refresh-grant; `apiKey` works for any site as-is.
- * The oauth refresh token is sensitive: never log it, never expose to sandbox JS.
+ * on demand (multi-site ExecuteWixAPI).
+ *
+ * - `oauth`: exchanged per site via the oauth2/token refresh grant.
+ * - `accountToken`: an account-level user access token, exchanged per site via
+ *   the oauth2/token RFC 8693 token-exchange grant (account token + site_id →
+ *   site-scoped token, no client secret, no refresh token issued). For callers
+ *   that mint short-lived account tokens and hold no refresh token, such as
+ *   the AI Assistant platform.
+ * - `apiKey`: works for any site as-is; the runtime only adds `wix-site-id`.
+ *
+ * Every variant is a credential: never log it, never expose it to sandbox JS.
  */
 export type SiteAuthContext = {
 	type: "oauth";
 	clientId: string;
 	refreshToken: string;
+} | {
+	type: "accountToken";
+	accessToken: string;
 } | {
 	type: "apiKey";
 	accessToken: string;

package/build/dts/toolkit-entry.d.ts

@@ -39,14 +39,25 @@ export declare const UNAUTHORIZED_ERROR_NAME = "UnauthorizedError";
 export type McpHeaders = Record<string, string>;
 /**
  * Material the execute runtime needs to obtain a site-scoped token for any site
- * on demand (multi-site ExecuteWixAPI). `oauth` is exchanged for a per-site
- * token via the oauth2/token refresh-grant; `apiKey` works for any site as-is.
- * The oauth refresh token is sensitive: never log it, never expose to sandbox JS.
+ * on demand (multi-site ExecuteWixAPI).
+ *
+ * - `oauth`: exchanged per site via the oauth2/token refresh grant.
+ * - `accountToken`: an account-level user access token, exchanged per site via
+ *   the oauth2/token RFC 8693 token-exchange grant (account token + site_id →
+ *   site-scoped token, no client secret, no refresh token issued). For callers
+ *   that mint short-lived account tokens and hold no refresh token, such as
+ *   the AI Assistant platform.
+ * - `apiKey`: works for any site as-is; the runtime only adds `wix-site-id`.
+ *
+ * Every variant is a credential: never log it, never expose it to sandbox JS.
  */
 export type SiteAuthContext = {
 	type: "oauth";
 	clientId: string;
 	refreshToken: string;
+} | {
+	type: "accountToken";
+	accessToken: string;
 } | {
 	type: "apiKey";
 	accessToken: string;