AutoGineer
Generated banner for Wix Replatform
Generated logo for Wix Replatform

Wix Replatform

WixOfficialPublished by Wix

  • Skill
  • Workflow
  • Automation and integrations
  • MIT
  • Low risk
  • Has scripts
Download ZIP

From the author

Routes RePlatform source-to-Wix migrations to the next required workflow module by inspecting authoritative migration artifacts. Use when starting, resuming, or recovering a migration run.
— the description by Wix

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

wix-replatform acts as a central supervisor for migrating data and content to Wix. It does not perform migration tasks directly but instead inspects migration artifacts to determine the next required stage in the pipeline. By maintaining a deterministic state, it ensures that migrations can be started, resumed, or recovered reliably without duplicating work or creating redundant destination sites. It manages the flow through various phases including discovery, mapping, setup, and import, while enforcing strict validation and approval gates.

What it does

  • Routes migration tasks to appropriate sub-modules based on current project state.
  • Ensures resumability by tracking migration progress through authoritative artifacts.
  • Enforces mandatory approval gates before performing write operations.
  • Dispatches specialized subagents for specific tasks to maintain context boundaries.
  • Validates artifacts at each stage to prevent proceeding with corrupted or stale data.
  • Handles reruns for incremental data updates without re-scaffolding the entire project.

When to use it

  • When initiating a new migration from an external source to a Wix site.
  • When resuming a migration that was interrupted or stopped.
  • When recovering from a failed migration stage by addressing specific errors.
  • When performing incremental imports to sync new or modified records after an initial migration.

Advantages

  • Prevents data duplication by enforcing idempotent write operations.
  • Maintains a clear audit trail through structured telemetry and completion reports.
  • Reduces risk by requiring explicit approvals before critical setup or import steps.
  • Supports both standard interactive flows and automated 1-click execution modes.

Usage examples

“Start a new migration for my project in ./migrations/my-store.”
The agent resolves the project directory, initializes orchestration artifacts, and routes to the project intake module.
“Resume the migration in ./migrations/my-store.”
The agent inspects the existing artifacts, determines the last completed stage, and dispatches the next required module.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/wix/wix-replatform-fya3/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip wix-replatform.zip -d .agents/skills

Documentation by Wix

wix-replatform

wix-replatform is the compact supervisor for a resumable source-to-Wix migration. It selects one internal module for the active stage; it does not carry every stage procedure in its own context.

Always-active contract

  • Resolve the active project under migrations/<project>/ (or REPLATFORM_MIGRATIONS_DIR) before inspecting or creating anything. Only that project's artifacts are authoritative.

  • Preserve EXPECTATIONS.md at that project root. It is the user's free-form record of how they expected the run to behave; initialization creates it once and never overwrites it.

  • Start/resume resources/rp-telemetry/ at the beginning of every run and finalize it at a terminal state. Never hand-write telemetry events.

  • Use orchestration JSON plus validated stage artifacts as resume authority. Logs and chat history are diagnostic context only.

  • Preserve user data: write idempotently, dedupe by source identity, resume rather than restart, and never create a second destination site for a migration.

  • Never print secrets, secret-bearing config contents, tokens, or credentials. Report only key names and present/blank/missing status.

  • Do not declare a migration complete from prose or a single artifact. The deterministic router and aggregate completion artifact own terminal completion.

  • Preserve the owner's cutover handoff: unresolved data, applicable manual setup, missing apps and changed plugin behavior. Reconcile discovery, mapping decisions, setup receipts and final outcomes; imported records alone do not establish working functionality. The producing resources own this guidance and durable completion/handoff artifacts. Use a supported cutover publisher when available; report missing publication integration explicitly rather than claiming the application received local artifacts.

CLI-launched runs and human actions

When a migration is started through replatform, the terminal is deliberately non-interactive: do not use an agent question UI, ask for stdin, or wait for a person in the current agent turn. The runner owns process lifecycle and emits only observed events; it does not replace this skill's router or completion receipts.

When a human choice, review, approval, or manual prerequisite is needed, create a durable request with node skills/wix-replatform/scripts/user-action.js create --project <projectDir> --request-file <request.json>, then end the turn. Put only reviewed artifact paths in the request. The person can later use replatform requests, replatform show, and replatform answer; a resumed agent reads the answered request from orchestration/user-actions/, never from reconstructed chat context.

Cancellation is not completion. If the runner has recorded cancel_requested, canceled, interrupted or an explicit stop (blocked, transition --status blocked --resume-from '<json>'; routes run_blocked until explicit resume or --status running, never answer --continue), preserve partial/recovery artifacts and let a later explicit replatform resume route recovery. Never create aggregate migration completion from an aborted execution report.

Pipeline

intake → destination → source inputs → preflight → (standard: discovery → mapping → codegen;
quick: adapter preflight → quick plan) → setup discovery → website handoff
→ safety review/approval → setup → import
→ storefront continuation (website only) → aggregate finalization → Migration review

Delivery modes are management (backend only), website (frontend only), and management_and_website (the integrated flow above). Accept user input both as management_and_website and persist the canonical value.

For deliveryMode=management, aggregate finalization requires valid backend import accounting. For deliveryMode=management_and_website, it additionally requires a current website/completion.json with completed screenshot review, no unresolved critical/high gaps, and release evidence. execution/completion-report.json is backend accounting, never website-migration completion by itself.

Route before acting

On every new or resumed turn:

  1. Resolve the project and initialize/load its orchestration artifacts.

  2. Run node skills/wix-replatform/scripts/orchestration-route.js <projectDir>.

  3. Dispatch the nextResource to a Developer subagent instead of loading and following it yourself. Give it the project directory and the resource to run; it follows that resource's contract exactly as written, unchanged. Read back only its result — never its transcript, tool output, or logs.

    • Every dispatch (Developer or QA) is a fresh subagent, never a resumed one; pass only a handoff file and stay within a context budget — follow resources/rp-subagent-dispatch/. Never read state/attempts/write-attempts.ndjson raw; use scripts/write-log-summary.js.

    • A Developer may fan out to sub-subagents only for harmless read-only work with no shared state, and only if the host supports it; writes stay one at a time, as each resource says.

  4. Dispatch a QA subagent to check the Developer's result against that resource's own stated required outputs (its own "artifacts to create or update" or "## Output" section, and any review/gap documents it defines). QA is read-only — it never writes or calls Wix. If something's missing, dispatch a new Developer for the same resource with QA's findings; otherwise the stage is done.

  5. At the end of each pipeline phase (discovery, mapping, setup discovery, import, and so on — see the pipeline above; a phase spans several resource-level stages), dispatch a QA subagent to review that phase's documents as a whole (for example mapping/review/mapping-summary.md and mapping-gaps.json, or execution/completion-report.json) before routing to the next phase. This catches anything a single per-task check could miss. For the import phase specifically, this review must be entity-by-entity against the accepted mapping plan, not a skim of the top-level status string — see rp-execute-import's "Entity-by-entity QA" section. Any run-fixing dispatch mid-phase (a crash fix, a slowness fix, a resumed pass) does not itself satisfy this; run the phase-level QA again once the fix lands, since fixing one entity's defect certifies nothing about its neighbors. Mapping QA also checks exact source coverage, decided operation/path semantics and canonical projections. Codegen QA reads the Developer's independently expected synthetic request evidence and its freshness; it does not execute examples. Semantic defects return to mapper, implementation defects to codegen. One-click tests defer unresolved scope and finish independent work with a typed incomplete result, without questions or repeated redispatch; customer runs retain their existing checkpoints.

  6. Route again after every stage boundary. Stale requests use resources/rp-user-action-recovery/; unreadable request artifacts block until repaired. Never discard pending requests or decide the next stage from memory.

The router (lib/orchestration-router.js) is the only routing and resume authority. It recomputes the route from decisions, approvals, preflight, run.json status and the phase outputs on every call; run.json.currentState is diagnostic only, never a routing input.

  • A recorded rejection stops the route in every mode, one-click included: execution_approval_rejected is blocked before any setup or import write, and mapping_approval_rejected returns to rp-mapper for a new plan.

  • A gated output that exists but is unusable (source_schema_invalid, mapping_plan_invalid, setup_plan_invalid, setup_requirements_invalid, execution_manifest_invalid) is blocked with errors and the producer as nextResource. Do not re-run the producer automatically; report the errors to the Import Operator and stop.

  • The import routes (missing_completion_report, import_interrupted = a stopped run's aborted report, quick_mode_import_required) carry importProgress. interrupted lists recoveryArtifacts: resume it, never a second import. interruptedReport: "missing": first run scripts/interrupted-completion-report.js.

If an artifact is malformed, partial, stale, or fails its validator, treat its producing stage as incomplete and route to the producer. Do not make parallel replacement artifacts.

A user action whose reviewed artifacts changed after it was created is refused with user_action_stale and stays pending. Create a new request from the current artifacts.

Catching up a finished migration is a rerun, not a new project. When the user asks to pull in records that arrived or changed since the import — "the source kept selling", "these orders are missing", "re-run it" — reuse the same project, destination, mapping, generated importer and crosswalk, and route to rp-execute-import → "Rerunning an import for new and modified records". Do not scaffold a second project or re-approve an unchanged mapping; a mapping or scope change does go back through the existing gates. A rerun's revision conflicts are user decisions even in 1-click mode.

Demand-loaded module map

Router situationDispatch
project, delivery mode, source mode, or grouped intake is unresolvedresources/rp-project-intake/
destination is absent, conflicting, or needs creation/adoptionresources/rp-destination/
source URL/files/config/acquisition mode/credentials are required, including source credentials said to exist already on another siteresources/rp-source-inputs/
deterministic preflight is missing, repaired, or blocked on CLI checksresources/rp-preflight/
quick mode needs platform resolution, endpoint preflight, plan, extraction, or importselected resources/rp-quick-<platform>/
source schema is missingresources/rp-discovery/ and its selected source adapter
mapping is missing or needs reviewresources/rp-mapper/
Wix requirements are missingresources/rp-setup-discovery/
import code/review is missing or staleresources/rp-import-codegen/
setup verification is missingresources/rp-execute-setup/
backend completion report is missingresources/rp-execute-import/
frontend-only work, or integrated website handoff/build/gap loop/release receipt is incompleteresources/rp-website-continuation/
aggregate completion is missingresources/rp-execution-policy/
aggregate completion exists but the local review publication or current recap is missingresources/rp-migration-review/

The resource named by the route is the complete stage contract, dispatched as described in "Route before acting" — the main session itself never loads it directly. Only the dispatched Developer loads source-file, secret, scaffolding, or storefront procedures, and only for the stage that actually needs them; nothing about a stage where they're irrelevant is loaded, by the main session or the Developer.

Interaction policy

Normal mode asks only for a missing required input, a genuinely ambiguous active project, or a mandatory write approval. Ask one question at a time unless a module says otherwise.

When the user says add to expectations: <note> (or an unambiguous natural-language equivalent), append the note to the active project's EXPECTATIONS.md before continuing. Use scripts/expectations-ledger.js so the entry retains the supplied statement plus safe current context (stage/state, relevant project-relative artifacts, and known entity/field labels). Do not treat this as approval or silently change a mapping. Never record secrets, tokens, raw customer data, or raw source records; redact them if supplied and say so.

Before writes, preserve the mandatory execution-plan approval gate. Read-only discovery, mapping, setup verification, code generation, and review happen before it.

Quick management import mode

When managementImportMode=quick, select the platform adapter only after the deterministic source probe identifies a compatible platform. Quick mode is a bounded public-data import: the adapter's versioned quick-mode.json owns its source routes, entity graph, field matrix, and exclusions. Do not run agentic discovery, mapping, or project-specific code generation for the quick backend branch. Still run destination setup, application installation, Catalog-V3 and notification safety checks, execution approval, shared write runtime, crosswalks, and completion accounting. If no adapter qualifies, persist the unsupported-mode result and ask the user to select standard mode; never silently fall back.

Halt only for missing/invalid required input, a manual action with no API, or a systemic failure/data-loss risk. A halt must persist the code, evidence, owner, and exact unblock action; never silently stop.

1-click mode

When explicitly requested by the user, record automationMode=one_click with source=user and apply the following. A missing mode or a one_click value recorded as deterministic_inference/prior_artifact is normal interactive mode and must not skip a checkpoint:

  • collect all still-missing intake values in one grouped request; then do not pause for routine approvals;

  • record mapping and execution approvals as approved, decidedBy=agent; skipping a pause without state is invalid;

  • for CSV/file-only runs, validate and accept the required sample preview as the agent; without explicit user-authored one-click, pause for the normal mapping review, sample preview validation, and execution approval;

  • default to a new isolated site unless an existing destination is explicitly supplied or already pinned, but never default the new site's type (Headless, Studio or Harmony): ask it in the grouped intake; choose website scope deterministically from discovered route families;

  • retry PATH/tool-resolution failures under the operator's compatible interactive login shell; request required browser/network sandbox escalation and retry before calling it blocked;

  • retry the obvious recovery before stopping: aligned shell first for PATH/tool failures, then the required escalation retry for sandboxed browser or network/API failures;

  • continue through the complete selected deliverable. In management_and_website mode that includes frontend build, post-build gap analysis, bounded fix loop, and release receipt; when the user selected facelift at intake, it also includes the separate post-clone facelift review;

  • before yielding, re-route. A 1-click run is only completed with completion/migration-completion.json, or blocked with a typed durable blocker.

Use the operator's compatible local Node/Yarn shell when recovering from a PATH or tool resolution failure. Machine-specific shell paths belong only in local, git-excluded agent instructions.

Repo-local interactive shell contract: a PATH/tool-resolution failure on first attempt may mean the command ran under a plain, non-interactive shell that never sourced the operator's Node/Yarn profile. Resolve the operator's compatible login shell from the local environment or git-excluded agent instructions, verify that it is executable, and retry the exact same command through that shell in interactive login mode so the profile that resolves node/yarn/npx loads. Do not hardcode a machine-specific shell path in this public skill. Only escalate to a durable blocker if the compatible-shell retry itself fails.

Guardrails

  • Never bypass a validator, approval-state update, verified notification mute, or Catalog-V3 gate to make a stage appear finished.

  • website means frontend only; management_and_website means the integrated backend and frontend migration. Never hand the integrated migration destination to the frontend skill or create a second frontend site in that mode.

  • A Studio or Harmony destination (targetSiteType) is created and verified by rp-destination's coordinator and is never published, unpublished or handed to wix-headless-replatform; its website and publication remain operator handoff items.

  • Do not implement a storefront manually when wix-headless-replatform is unavailable; persist a blocker with the exact required runtime capability.

  • In management mode, still generate website/handoff.* after setup discovery so a later storefront can start without repeating backend discovery.

Files

lib/document-url-guard.js

'use strict';

// One home for "is this URL safe to hand to something that will fetch it".
//
// A discovered invoice document URL is untrusted input from source-site metadata, and TWO modules
// act on it: discovery classifies and probes it, and the target writer hands it to Wix Media to
// fetch server-side. Both must apply the same rules, so the rules live here rather than in either
// one. While they lived only in discovery, the writer accepted a bare URL and imported
// `https://169.254.169.254/latest/meta-data` without complaint.
//
// The URL is also a bearer link whose filename can carry a customer name and an invoice number,
// so nothing here logs it or returns it in full.
//
// WHAT THIS CANNOT DO, stated because a guard that looks stronger than it is invites misuse.
// `classifyDocumentUrl` is a LEXICAL check on the URL as written: it does not resolve DNS and it
// does not follow redirects, so a public hostname that resolves to a private address, or one that
// redirects to it, passes it. It must therefore never be the only thing between an untrusted URL
// and a server-side fetch. `fetchPublicDocument` is the fetch that is safe to run on our side:
// it resolves the host, refuses any private answer, connects to the ADDRESS IT VALIDATED (so the
// name cannot resolve differently between check and connect -- no DNS rebinding), walks redirects
// hop by hop applying the same checks, and caps the response size. The bytes are then uploaded to
// Wix Media, so Wix never fetches an untrusted URL at all.

const dns = require('node:dns');
const net = require('node:net');

// Only a GLOBAL UNICAST address may be fetched. This is an allowlist, not a list of known-private
// ranges: a deny list misses whatever it forgot (multicast, broadcast, benchmarking, documentation,
// newer IPv6 scopes). The ranges below are the IANA IPv4/IPv6 Special-Purpose Address Registries'
// entries that are not globally reachable, plus multicast and reserved space. IPv6 must also lie in
// 2000::/3, the only block IANA allocates for global unicast. The same rules live in
// wix-harmony-editor's copy/public-address.mjs (a separate published skill that cannot import this
// file); tests/target-wix/public-address-parity-test.js keeps the two identical.
const NON_GLOBAL = new net.BlockList();
for (const [address, prefix] of [
  ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8], ['169.254.0.0', 16],
  ['172.16.0.0', 12], ['192.0.0.0', 24], ['192.0.2.0', 24], ['192.88.99.0', 24], ['192.168.0.0', 16],
  ['198.18.0.0', 15], ['198.51.100.0', 24], ['203.0.113.0', 24], ['224.0.0.0', 4], ['240.0.0.0', 4],
]) NON_GLOBAL.addSubnet(address, prefix, 'ipv4');
// Inside 2000::/3: IETF protocol assignments (incl. Teredo), documentation, 6to4 (it can wrap any
// IPv4 address, private ones included), and the second documentation block.
for (const [address, prefix] of [['2001::', 23], ['2001:db8::', 32], ['2002::', 16], ['3fff::', 20]]) NON_GLOBAL.addSubnet(address, prefix, 'ipv6');

function ipv6Hextets(address) {
  let text = address;
  const dotted = text.match(/^(.*:)(\d{1,3}(?:\.\d{1,3}){3})$/);
  if (dotted) {
    const octets = dotted[2].split('.').map(Number);
    text = `${dotted[1]}${((octets[0] << 8) | octets[1]).toString(16)}:${((octets[2] << 8) | octets[3]).toString(16)}`;
  }
  const [head, tail] = text.includes('::') ? text.split('::') : [text, null];
  const left = head ? head.split(':') : [];
  const right = tail ? tail.split(':') : [];
  const fill = tail === null ? [] : new Array(8 - left.length - right.length).fill('0');
  return [...left, ...fill, ...right].map((part) => parseInt(part, 16));
}

// True only for a literal IP address that is globally routable unicast. Anything else -- a
// hostname, an unparseable string, a private/special-purpose address -- is false.
function isGlobalUnicastAddress(value) {
  const address = String(value || '').toLowerCase().replace(/^\[|\]$/g, '');
  const family = net.isIP(address);
  if (family === 4) return !NON_GLOBAL.check(address, 'ipv4');
  if (family !== 6) return false;
  const hextets = ipv6Hextets(address);
  // An IPv4-mapped address (::ffff:a.b.c.d, which Node prints as ::ffff:hhhh:hhhh) is the IPv4
  // destination in another notation: judge the IPv4 address it carries.
  if (hextets.slice(0, 5).every((part) => part === 0) && hextets[5] === 0xffff) {
    return isGlobalUnicastAddress([hextets[6] >> 8, hextets[6] & 0xff, hextets[7] >> 8, hextets[7] & 0xff].join('.'));
  }
  if ((hextets[0] & 0xe000) !== 0x2000) return false;
  return !NON_GLOBAL.check(address, 'ipv6');
}

// Lexical check on a URL hostname: an IP literal must be global unicast; a name is refused only
// when it is local by definition, and is otherwise judged later by the addresses it resolves to.
function isPrivateHostname(hostname) {
  // A trailing dot is the same name (`localhost.` resolves like `localhost`) and WHATWG URL keeps it on a name host.
  const host = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '').replace(/\.+$/, '');
  if (!host) return true;
  if (net.isIP(host)) return !isGlobalUnicastAddress(host);
  return host === 'localhost' || host.endsWith('.localhost') || host.endsWith('.local');
}

// Signal D. Every discovered document is classified, not only the sampled ones -- the strategy
// depends on where the bytes are, and one WordPress-hosted document in an otherwise PSP-hosted
// store still dies with the source site.
function classifyDocumentUrl(rawUrl, { sourceSiteHost = null } = {}) {
  const text = String(rawUrl || '').trim();
  if (text.length === 0) return { safe: false, location: null, reason: 'empty-url' };

  let url;
  try {
    url = new URL(text);
  } catch (error) {
    return { safe: false, location: null, reason: 'unparseable-url' };
  }

  if (url.protocol !== 'https:') return { safe: false, location: null, reason: 'not-https' };
  if (url.username || url.password) return { safe: false, location: null, reason: 'embedded-credentials' };
  if (url.port && url.port !== '443') return { safe: false, location: null, reason: 'non-standard-port' };
  if (isPrivateHostname(url.hostname)) return { safe: false, location: null, reason: 'private-or-loopback-host' };

  const host = url.hostname.toLowerCase();
  const sameSite = sourceSiteHost
    && (host === String(sourceSiteHost).toLowerCase() || host.endsWith(`.${String(sourceSiteHost).toLowerCase()}`));

  // A same-origin uploads path is the WordPress filesystem: those bytes are gone when the site
  // goes. Anything else is somebody else's archive, which survives the migration but not the
  // merchant leaving that provider.
  const location = sameSite ? 'wordpress' : 'third-party';
  return { safe: true, location, reason: null, host };
}

const MAX_REDIRECTS = 3;
const FETCH_TIMEOUT_MS = 20000;
// The bytes go to Media's Generate File Upload URL, which is non-resumable; Wix sends files over
// 10 MB to the resumable endpoint, so a document is capped below that.
const DEFAULT_MAX_BYTES = 10 * 1000 * 1000;

// Default transport: one GET over HTTPS, pinned to an address the caller already validated. TLS
// still verifies the certificate against the hostname (`servername`), so pinning the address does
// not weaken it. The body is read up to `maxBytes` and the connection is dropped past that.
function pinnedHttpsGet(url, { address, family, timeoutMs, maxBytes }) {
  const https = require('node:https');
  const target = new URL(url);
  return new Promise((resolve, reject) => {
    let settled = false;
    const done = (fn, value) => { if (!settled) { settled = true; fn(value); } };
    const request = https.request({
      protocol: 'https:',
      hostname: target.hostname,
      port: 443,
      path: `${target.pathname}${target.search}`,
      method: 'GET',
      servername: target.hostname,
      headers: { Accept: '*/*', 'Accept-Encoding': 'identity', 'User-Agent': 'wix-replatform-document-fetch' },
      lookup: (hostname, options, callback) => (options && options.all
        ? callback(null, [{ address, family }])
        : callback(null, address, family)),
      timeout: timeoutMs,
    }, (response) => {
      const status = response.statusCode || 0;
      const headers = { get: (name) => { const value = response.headers[String(name).toLowerCase()]; return Array.isArray(value) ? value[0] : (value === undefined ? null : value); } };
      if (status >= 300 && status < 400) { response.resume(); done(resolve, { status, headers, body: Buffer.alloc(0) }); return; }
      const declared = Number(response.headers['content-length']);
      if (Number.isFinite(declared) && declared > maxBytes) { response.destroy(); done(reject, Object.assign(new Error('response-too-large'), { code: 'TOO_LARGE' })); return; }
      const chunks = [];
      let total = 0;
      response.on('data', (chunk) => {
        total += chunk.length;
        if (total > maxBytes) { response.destroy(); done(reject, Object.assign(new Error('response-too-large'), { code: 'TOO_LARGE' })); return; }
        chunks.push(chunk);
      });
      response.on('end', () => done(resolve, { status, headers, body: Buffer.concat(chunks) }));
      response.on('error', (error) => done(reject, error));
    });
    request.on('timeout', () => { request.destroy(); done(reject, Object.assign(new Error('timeout'), { code: 'TIMEOUT' })); });
    request.on('error', (error) => done(reject, error));
    request.end();
  });
}

// Fetches the document's bytes on our side, never handing the URL to anything else. Returns
// { ok: true, bytes, contentType } or { ok: false, unsafe, reason }. `unsafe` separates a URL we
// refuse on principle (internal address, redirect to one, bad scheme) from a document that is
// merely unavailable (404, timeout, too large). `lookup` and `transport` are injectable.
async function fetchPublicDocument(rawUrl, {
  lookup = dns.promises.lookup,
  transport = pinnedHttpsGet,
  maxRedirects = MAX_REDIRECTS,
  timeoutMs = FETCH_TIMEOUT_MS,
  maxBytes = DEFAULT_MAX_BYTES,
} = {}) {
  let current = String(rawUrl || '').trim();
  for (let hop = 0; hop <= maxRedirects; hop += 1) {
    const classification = classifyDocumentUrl(current);
    if (!classification.safe) return { ok: false, unsafe: true, reason: hop === 0 ? classification.reason : `redirect-${classification.reason}` };
    let addresses;
    try {
      addresses = await lookup(new URL(current).hostname, { all: true });
    } catch (error) {
      return { ok: false, unsafe: false, reason: 'host-not-resolvable' };
    }
    const list = (Array.isArray(addresses) ? addresses : [addresses]).filter(Boolean);
    if (!list.length || list.some((entry) => !isGlobalUnicastAddress(entry && entry.address))) {
      return { ok: false, unsafe: true, reason: 'resolves-to-private-address' };
    }
    const pinned = list[0];
    let response;
    try {
      response = await transport(current, { address: pinned.address, family: pinned.family || (String(pinned.address).includes(':') ? 6 : 4), timeoutMs, maxBytes });
    } catch (error) {
      return { ok: false, unsafe: false, reason: error && error.code === 'TOO_LARGE' ? 'response-too-large' : 'unreachable' };
    }
    if (response.status >= 300 && response.status < 400) {
      const location = response.headers && response.headers.get && response.headers.get('location');
      if (!location) return { ok: false, unsafe: true, reason: 'redirect-without-location' };
      try {
        current = new URL(location, current).toString();
      } catch (error) {
        return { ok: false, unsafe: true, reason: 'redirect-unparseable-url' };
      }
      continue;
    }
    if (response.status < 200 || response.status >= 300) return { ok: false, unsafe: false, reason: `http-${response.status}` };
    const body = Buffer.isBuffer(response.body) ? response.body : Buffer.from(response.body || '');
    if (body.length > maxBytes) return { ok: false, unsafe: false, reason: 'response-too-large' };
    if (body.length === 0) return { ok: false, unsafe: false, reason: 'empty-document' };
    const contentType = response.headers && response.headers.get ? response.headers.get('content-type') : null;
    return { ok: true, bytes: body, contentType: contentType ? String(contentType).split(';')[0].trim().toLowerCase() : null };
  }
  return { ok: false, unsafe: true, reason: 'too-many-redirects' };
}

// Never log or persist a raw document URL: the query string can carry a bearer token and the
// filename can carry the customer's name and the invoice number.
function redactUrlForLog(rawUrl) {
  try {
    const url = new URL(String(rawUrl));
    const segments = url.pathname.split('/').filter(Boolean).length;
    return `${url.protocol}//${url.hostname}/<${segments} path segment(s) redacted>`;
  } catch (error) {
    return '<unparseable url redacted>';
  }
}

module.exports = {
  isGlobalUnicastAddress,
  isPrivateHostname,
  classifyDocumentUrl,
  fetchPublicDocument,
  redactUrlForLog,
};

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs Node.js

Security

What our scanner noticed· Low risk

  • Scripts that your agent may run

This skill includes scripts that your agent may run. Read them before you use it.

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
Wix
Publisher
Wix (Official)
Source
wix/skills · skills/wix-replatform · commit d168bc2
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Wix or Wix.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download wix-replatform.zip