@wix/mcp 1.0.87 → 1.0.88

package/build/bin-standalone.js

@@ -71735,8 +71735,33 @@ var ACCOUNT_SITE_EXECUTE_SCOPE = dedent_default`
   }
   declare const wix: {
     request<T = unknown>(options: WixRequestOptions): Promise<WixResponse<T>>;
+    // Build a multipart/form-data body from files (defaults to the \`files\`
+    // global). Each file becomes a part named fieldName (default "files") with
+    // its path as the filename. Pass body + contentType to wix.request.
+    multipart(
+      files?: Array<{ path: string; content: string; contentType?: string }>,
+      options?: { fieldName?: string }
+    ): { body: string; contentType: string };
   };
   declare const siteId: string | undefined;
+  // Files from the ExecuteWixAPI \`files\` param (raw content, no escaping).
+  declare const files: Array<{ path: string; content: string }>;
+  \`\`\`
+
+  FILE UPLOADS: pass file bodies via the \`files\` param (not inside \`code\` — no escaping), then build the multipart body with \`wix.multipart()\`:
+  \`\`\`javascript
+  // files param: "=== FILE: index.html ===\\n<!doctype html>...\\n=== FILE: app.js ===\\nconsole.log(1)"
+  async () => {
+    const mp = wix.multipart(); // parts named "files", filename = each path
+    const res = await wix.request({
+      scope: "account",
+      method: "POST",
+      url: "https://www.wixapis.com/.../upload",
+      headers: { "Content-Type": mp.contentType },
+      body: mp.body
+    });
+    return res.data;
+  }
   \`\`\`
 `;
 var EXECUTE_WIX_API_WQL = dedent_default`

package/build/cjs/index.cjs

@@ -37351,8 +37351,33 @@ var ACCOUNT_SITE_EXECUTE_SCOPE = dedent_default`
   }
   declare const wix: {
     request<T = unknown>(options: WixRequestOptions): Promise<WixResponse<T>>;
+    // Build a multipart/form-data body from files (defaults to the \`files\`
+    // global). Each file becomes a part named fieldName (default "files") with
+    // its path as the filename. Pass body + contentType to wix.request.
+    multipart(
+      files?: Array<{ path: string; content: string; contentType?: string }>,
+      options?: { fieldName?: string }
+    ): { body: string; contentType: string };
   };
   declare const siteId: string | undefined;
+  // Files from the ExecuteWixAPI \`files\` param (raw content, no escaping).
+  declare const files: Array<{ path: string; content: string }>;
+  \`\`\`
+
+  FILE UPLOADS: pass file bodies via the \`files\` param (not inside \`code\` — no escaping), then build the multipart body with \`wix.multipart()\`:
+  \`\`\`javascript
+  // files param: "=== FILE: index.html ===\\n<!doctype html>...\\n=== FILE: app.js ===\\nconsole.log(1)"
+  async () => {
+    const mp = wix.multipart(); // parts named "files", filename = each path
+    const res = await wix.request({
+      scope: "account",
+      method: "POST",
+      url: "https://www.wixapis.com/.../upload",
+      headers: { "Content-Type": mp.contentType },
+      body: mp.body
+    });
+    return res.data;
+  }
   \`\`\`
 `;
 var EXECUTE_WIX_API_WQL = dedent_default`
@@ -53156,6 +53181,14 @@ function addExecuteTool(server, options) {
         visitor ? "Whether this code creates, updates, deletes, publishes, imports, uploads, or otherwise mutates site data on the visitor\u2019s behalf. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false." : "Whether this code creates, updates, deletes, publishes, installs, imports, uploads, or otherwise mutates Wix data or site/account state. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false."
       ),
       sourceDocUrls: external_exports.array(external_exports.string()).describe(d2.sourceDocUrls),
+      files: external_exports.string().optional().describe(
+        [
+          "Optional bundle of raw file contents for uploads, so file bytes never go through the `code` JavaScript (no escaping, no string-literal/`${}`/backtick pitfalls).",
+          "Format: one or more sections, each a line `=== FILE: <path> ===` on its own, followed by that file's raw text content; `<path>` is the path relative to the site root (e.g. `index.html`, `assets/app.js`). Example: `=== FILE: index.html ===\\n<!doctype html>...\\n=== FILE: assets/app.js ===\\nconsole.log(1)`.",
+          'In `code`, the parsed files are the `files` global (array of `{ path, content }`), and `wix.multipart(files)` returns `{ body, contentType }` for a `multipart/form-data` upload \u2014 e.g. `const mp = wix.multipart(); await wix.request({ scope: "account", method: "POST", url, headers: { "Content-Type": mp.contentType }, body: mp.body });`.',
+          "Text files only; for binary assets pass bytes as a base64 request body instead. A file whose content itself contains a line exactly like the delimiter is not supported."
+        ].join(" ")
+      ),
       // Visitor mode takes an agent-supplied token and pins the site; account/site
       // mode lets the agent pick the site.
       ...visitor ? {
@@ -53170,7 +53203,7 @@ function addExecuteTool(server, options) {
     },
     { readOnlyHint: false, destructiveHint: true, openWorldHint: false },
     async (rawArgs, extra) => {
-      const { code, reason, hasMutations, sourceDocUrls, visitorToken } = rawArgs;
+      const { code, reason, hasMutations, sourceDocUrls, visitorToken, files } = rawArgs;
       const siteId = visitor ? visitor.siteId : rawArgs.siteId;
       logger2.log(
         `[ExecuteWixAPI]${visitor ? " (visitor)" : ""} Executing code (${code.length} chars), siteId=${siteId ?? "none"}, hasMutations=${hasMutations}, sourceDocUrls=${JSON.stringify(sourceDocUrls)}, reason="${reason}"`
@@ -53215,7 +53248,8 @@ function addExecuteTool(server, options) {
             siteToken: visitor ? visitorToken : siteHeaders?.Authorization,
             accountToken: visitor ? visitorToken : accountHeaders?.Authorization,
             accountId: accountHeaders?.["wix-account-id"],
-            siteAuthContext
+            siteAuthContext,
+            ...files ? { files } : {}
           },
           visitor ? visitorToken : accountHeaders?.Authorization ?? siteHeaders?.Authorization,
           codeModeFetch

package/build/cjs/toolkit.cjs

@@ -17838,8 +17838,33 @@ var ACCOUNT_SITE_EXECUTE_SCOPE = dedent_default`
   }
   declare const wix: {
     request<T = unknown>(options: WixRequestOptions): Promise<WixResponse<T>>;
+    // Build a multipart/form-data body from files (defaults to the \`files\`
+    // global). Each file becomes a part named fieldName (default "files") with
+    // its path as the filename. Pass body + contentType to wix.request.
+    multipart(
+      files?: Array<{ path: string; content: string; contentType?: string }>,
+      options?: { fieldName?: string }
+    ): { body: string; contentType: string };
   };
   declare const siteId: string | undefined;
+  // Files from the ExecuteWixAPI \`files\` param (raw content, no escaping).
+  declare const files: Array<{ path: string; content: string }>;
+  \`\`\`
+
+  FILE UPLOADS: pass file bodies via the \`files\` param (not inside \`code\` — no escaping), then build the multipart body with \`wix.multipart()\`:
+  \`\`\`javascript
+  // files param: "=== FILE: index.html ===\\n<!doctype html>...\\n=== FILE: app.js ===\\nconsole.log(1)"
+  async () => {
+    const mp = wix.multipart(); // parts named "files", filename = each path
+    const res = await wix.request({
+      scope: "account",
+      method: "POST",
+      url: "https://www.wixapis.com/.../upload",
+      headers: { "Content-Type": mp.contentType },
+      body: mp.body
+    });
+    return res.data;
+  }
   \`\`\`
 `;
 var EXECUTE_WIX_API_WQL = dedent_default`
@@ -22299,6 +22324,14 @@ function addExecuteTool(server, options) {
         visitor ? "Whether this code creates, updates, deletes, publishes, imports, uploads, or otherwise mutates site data on the visitor\u2019s behalf. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false." : "Whether this code creates, updates, deletes, publishes, installs, imports, uploads, or otherwise mutates Wix data or site/account state. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false."
       ),
       sourceDocUrls: external_exports.array(external_exports.string()).describe(d.sourceDocUrls),
+      files: external_exports.string().optional().describe(
+        [
+          "Optional bundle of raw file contents for uploads, so file bytes never go through the `code` JavaScript (no escaping, no string-literal/`${}`/backtick pitfalls).",
+          "Format: one or more sections, each a line `=== FILE: <path> ===` on its own, followed by that file's raw text content; `<path>` is the path relative to the site root (e.g. `index.html`, `assets/app.js`). Example: `=== FILE: index.html ===\\n<!doctype html>...\\n=== FILE: assets/app.js ===\\nconsole.log(1)`.",
+          'In `code`, the parsed files are the `files` global (array of `{ path, content }`), and `wix.multipart(files)` returns `{ body, contentType }` for a `multipart/form-data` upload \u2014 e.g. `const mp = wix.multipart(); await wix.request({ scope: "account", method: "POST", url, headers: { "Content-Type": mp.contentType }, body: mp.body });`.',
+          "Text files only; for binary assets pass bytes as a base64 request body instead. A file whose content itself contains a line exactly like the delimiter is not supported."
+        ].join(" ")
+      ),
       // Visitor mode takes an agent-supplied token and pins the site; account/site
       // mode lets the agent pick the site.
       ...visitor ? {
@@ -22313,7 +22346,7 @@ function addExecuteTool(server, options) {
     },
     { readOnlyHint: false, destructiveHint: true, openWorldHint: false },
     async (rawArgs, extra) => {
-      const { code, reason, hasMutations, sourceDocUrls, visitorToken } = rawArgs;
+      const { code, reason, hasMutations, sourceDocUrls, visitorToken, files } = rawArgs;
       const siteId = visitor ? visitor.siteId : rawArgs.siteId;
       logger.log(
         `[ExecuteWixAPI]${visitor ? " (visitor)" : ""} Executing code (${code.length} chars), siteId=${siteId ?? "none"}, hasMutations=${hasMutations}, sourceDocUrls=${JSON.stringify(sourceDocUrls)}, reason="${reason}"`
@@ -22358,7 +22391,8 @@ function addExecuteTool(server, options) {
             siteToken: visitor ? visitorToken : siteHeaders?.Authorization,
             accountToken: visitor ? visitorToken : accountHeaders?.Authorization,
             accountId: accountHeaders?.["wix-account-id"],
-            siteAuthContext
+            siteAuthContext,
+            ...files ? { files } : {}
           },
           visitor ? visitorToken : accountHeaders?.Authorization ?? siteHeaders?.Authorization,
           codeModeFetch

package/build/dts/code-mode/index.js

@@ -236,6 +236,15 @@ function addExecuteTool(server, options) {
             ? 'Whether this code creates, updates, deletes, publishes, imports, uploads, or otherwise mutates site data on the visitor’s behalf. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false.'
             : 'Whether this code creates, updates, deletes, publishes, installs, imports, uploads, or otherwise mutates Wix data or site/account state. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false.'),
         sourceDocUrls: z.array(z.string()).describe(d.sourceDocUrls),
+        files: z
+            .string()
+            .optional()
+            .describe([
+            'Optional bundle of raw file contents for uploads, so file bytes never go through the `code` JavaScript (no escaping, no string-literal/`${}`/backtick pitfalls).',
+            "Format: one or more sections, each a line `=== FILE: <path> ===` on its own, followed by that file's raw text content; `<path>` is the path relative to the site root (e.g. `index.html`, `assets/app.js`). Example: `=== FILE: index.html ===\\n<!doctype html>...\\n=== FILE: assets/app.js ===\\nconsole.log(1)`.",
+            'In `code`, the parsed files are the `files` global (array of `{ path, content }`), and `wix.multipart(files)` returns `{ body, contentType }` for a `multipart/form-data` upload — e.g. `const mp = wix.multipart(); await wix.request({ scope: "account", method: "POST", url, headers: { "Content-Type": mp.contentType }, body: mp.body });`.',
+            'Text files only; for binary assets pass bytes as a base64 request body instead. A file whose content itself contains a line exactly like the delimiter is not supported.'
+        ].join(' ')),
         // Visitor mode takes an agent-supplied token and pins the site; account/site
         // mode lets the agent pick the site.
         ...(visitor
@@ -254,7 +263,7 @@ function addExecuteTool(server, options) {
     // Partial: duck-typed servers (the toolkit's capturing server, test
     // doubles) build their own extra and may not supply every field.
     extra) => {
-        const { code, reason, hasMutations, sourceDocUrls, visitorToken } = rawArgs;
+        const { code, reason, hasMutations, sourceDocUrls, visitorToken, files } = rawArgs;
         // In visitor mode the site is pinned; otherwise it comes from the param.
         const siteId = visitor ? visitor.siteId : rawArgs.siteId;
         logger.log(`[ExecuteWixAPI]${visitor ? ' (visitor)' : ''} Executing code (${code.length} chars), siteId=${siteId ?? 'none'}, hasMutations=${hasMutations}, sourceDocUrls=${JSON.stringify(sourceDocUrls)}, reason="${reason}"`);
@@ -318,7 +327,8 @@ function addExecuteTool(server, options) {
                     ? visitorToken
                     : accountHeaders?.Authorization,
                 accountId: accountHeaders?.['wix-account-id'],
-                siteAuthContext
+                siteAuthContext,
+                ...(files ? { files } : {})
             }, visitor
                 ? visitorToken
                 : (accountHeaders?.Authorization ?? siteHeaders?.Authorization), codeModeFetch);

package/build/dts/config/default-config.js

@@ -165,8 +165,33 @@ const ACCOUNT_SITE_EXECUTE_SCOPE = dedent `
   }
   declare const wix: {
     request<T = unknown>(options: WixRequestOptions): Promise<WixResponse<T>>;
+    // Build a multipart/form-data body from files (defaults to the \`files\`
+    // global). Each file becomes a part named fieldName (default "files") with
+    // its path as the filename. Pass body + contentType to wix.request.
+    multipart(
+      files?: Array<{ path: string; content: string; contentType?: string }>,
+      options?: { fieldName?: string }
+    ): { body: string; contentType: string };
   };
   declare const siteId: string | undefined;
+  // Files from the ExecuteWixAPI \`files\` param (raw content, no escaping).
+  declare const files: Array<{ path: string; content: string }>;
+  \`\`\`
+
+  FILE UPLOADS: pass file bodies via the \`files\` param (not inside \`code\` — no escaping), then build the multipart body with \`wix.multipart()\`:
+  \`\`\`javascript
+  // files param: "=== FILE: index.html ===\\n<!doctype html>...\\n=== FILE: app.js ===\\nconsole.log(1)"
+  async () => {
+    const mp = wix.multipart(); // parts named "files", filename = each path
+    const res = await wix.request({
+      scope: "account",
+      method: "POST",
+      url: "https://www.wixapis.com/.../upload",
+      headers: { "Content-Type": mp.contentType },
+      body: mp.body
+    });
+    return res.data;
+  }
   \`\`\`
 `;
 const EXECUTE_WIX_API_WQL = dedent `

package/build/esm/index.js

@@ -31064,8 +31064,33 @@ var ACCOUNT_SITE_EXECUTE_SCOPE = dedent_default`
   }
   declare const wix: {
     request<T = unknown>(options: WixRequestOptions): Promise<WixResponse<T>>;
+    // Build a multipart/form-data body from files (defaults to the \`files\`
+    // global). Each file becomes a part named fieldName (default "files") with
+    // its path as the filename. Pass body + contentType to wix.request.
+    multipart(
+      files?: Array<{ path: string; content: string; contentType?: string }>,
+      options?: { fieldName?: string }
+    ): { body: string; contentType: string };
   };
   declare const siteId: string | undefined;
+  // Files from the ExecuteWixAPI \`files\` param (raw content, no escaping).
+  declare const files: Array<{ path: string; content: string }>;
+  \`\`\`
+
+  FILE UPLOADS: pass file bodies via the \`files\` param (not inside \`code\` — no escaping), then build the multipart body with \`wix.multipart()\`:
+  \`\`\`javascript
+  // files param: "=== FILE: index.html ===\\n<!doctype html>...\\n=== FILE: app.js ===\\nconsole.log(1)"
+  async () => {
+    const mp = wix.multipart(); // parts named "files", filename = each path
+    const res = await wix.request({
+      scope: "account",
+      method: "POST",
+      url: "https://www.wixapis.com/.../upload",
+      headers: { "Content-Type": mp.contentType },
+      body: mp.body
+    });
+    return res.data;
+  }
   \`\`\`
 `;
 var EXECUTE_WIX_API_WQL = dedent_default`
@@ -46920,6 +46945,14 @@ function addExecuteTool(server, options) {
         visitor ? "Whether this code creates, updates, deletes, publishes, imports, uploads, or otherwise mutates site data on the visitor\u2019s behalf. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false." : "Whether this code creates, updates, deletes, publishes, installs, imports, uploads, or otherwise mutates Wix data or site/account state. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false."
       ),
       sourceDocUrls: external_exports.array(external_exports.string()).describe(d2.sourceDocUrls),
+      files: external_exports.string().optional().describe(
+        [
+          "Optional bundle of raw file contents for uploads, so file bytes never go through the `code` JavaScript (no escaping, no string-literal/`${}`/backtick pitfalls).",
+          "Format: one or more sections, each a line `=== FILE: <path> ===` on its own, followed by that file's raw text content; `<path>` is the path relative to the site root (e.g. `index.html`, `assets/app.js`). Example: `=== FILE: index.html ===\\n<!doctype html>...\\n=== FILE: assets/app.js ===\\nconsole.log(1)`.",
+          'In `code`, the parsed files are the `files` global (array of `{ path, content }`), and `wix.multipart(files)` returns `{ body, contentType }` for a `multipart/form-data` upload \u2014 e.g. `const mp = wix.multipart(); await wix.request({ scope: "account", method: "POST", url, headers: { "Content-Type": mp.contentType }, body: mp.body });`.',
+          "Text files only; for binary assets pass bytes as a base64 request body instead. A file whose content itself contains a line exactly like the delimiter is not supported."
+        ].join(" ")
+      ),
       // Visitor mode takes an agent-supplied token and pins the site; account/site
       // mode lets the agent pick the site.
       ...visitor ? {
@@ -46934,7 +46967,7 @@ function addExecuteTool(server, options) {
     },
     { readOnlyHint: false, destructiveHint: true, openWorldHint: false },
     async (rawArgs, extra) => {
-      const { code, reason, hasMutations, sourceDocUrls, visitorToken } = rawArgs;
+      const { code, reason, hasMutations, sourceDocUrls, visitorToken, files } = rawArgs;
       const siteId = visitor ? visitor.siteId : rawArgs.siteId;
       logger2.log(
         `[ExecuteWixAPI]${visitor ? " (visitor)" : ""} Executing code (${code.length} chars), siteId=${siteId ?? "none"}, hasMutations=${hasMutations}, sourceDocUrls=${JSON.stringify(sourceDocUrls)}, reason="${reason}"`
@@ -46979,7 +47012,8 @@ function addExecuteTool(server, options) {
             siteToken: visitor ? visitorToken : siteHeaders?.Authorization,
             accountToken: visitor ? visitorToken : accountHeaders?.Authorization,
             accountId: accountHeaders?.["wix-account-id"],
-            siteAuthContext
+            siteAuthContext,
+            ...files ? { files } : {}
           },
           visitor ? visitorToken : accountHeaders?.Authorization ?? siteHeaders?.Authorization,
           codeModeFetch

package/build/esm/toolkit.js

@@ -12260,8 +12260,33 @@ var ACCOUNT_SITE_EXECUTE_SCOPE = dedent_default`
   }
   declare const wix: {
     request<T = unknown>(options: WixRequestOptions): Promise<WixResponse<T>>;
+    // Build a multipart/form-data body from files (defaults to the \`files\`
+    // global). Each file becomes a part named fieldName (default "files") with
+    // its path as the filename. Pass body + contentType to wix.request.
+    multipart(
+      files?: Array<{ path: string; content: string; contentType?: string }>,
+      options?: { fieldName?: string }
+    ): { body: string; contentType: string };
   };
   declare const siteId: string | undefined;
+  // Files from the ExecuteWixAPI \`files\` param (raw content, no escaping).
+  declare const files: Array<{ path: string; content: string }>;
+  \`\`\`
+
+  FILE UPLOADS: pass file bodies via the \`files\` param (not inside \`code\` — no escaping), then build the multipart body with \`wix.multipart()\`:
+  \`\`\`javascript
+  // files param: "=== FILE: index.html ===\\n<!doctype html>...\\n=== FILE: app.js ===\\nconsole.log(1)"
+  async () => {
+    const mp = wix.multipart(); // parts named "files", filename = each path
+    const res = await wix.request({
+      scope: "account",
+      method: "POST",
+      url: "https://www.wixapis.com/.../upload",
+      headers: { "Content-Type": mp.contentType },
+      body: mp.body
+    });
+    return res.data;
+  }
   \`\`\`
 `;
 var EXECUTE_WIX_API_WQL = dedent_default`
@@ -16718,6 +16743,14 @@ function addExecuteTool(server, options) {
         visitor ? "Whether this code creates, updates, deletes, publishes, imports, uploads, or otherwise mutates site data on the visitor\u2019s behalf. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false." : "Whether this code creates, updates, deletes, publishes, installs, imports, uploads, or otherwise mutates Wix data or site/account state. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false."
       ),
       sourceDocUrls: external_exports.array(external_exports.string()).describe(d.sourceDocUrls),
+      files: external_exports.string().optional().describe(
+        [
+          "Optional bundle of raw file contents for uploads, so file bytes never go through the `code` JavaScript (no escaping, no string-literal/`${}`/backtick pitfalls).",
+          "Format: one or more sections, each a line `=== FILE: <path> ===` on its own, followed by that file's raw text content; `<path>` is the path relative to the site root (e.g. `index.html`, `assets/app.js`). Example: `=== FILE: index.html ===\\n<!doctype html>...\\n=== FILE: assets/app.js ===\\nconsole.log(1)`.",
+          'In `code`, the parsed files are the `files` global (array of `{ path, content }`), and `wix.multipart(files)` returns `{ body, contentType }` for a `multipart/form-data` upload \u2014 e.g. `const mp = wix.multipart(); await wix.request({ scope: "account", method: "POST", url, headers: { "Content-Type": mp.contentType }, body: mp.body });`.',
+          "Text files only; for binary assets pass bytes as a base64 request body instead. A file whose content itself contains a line exactly like the delimiter is not supported."
+        ].join(" ")
+      ),
       // Visitor mode takes an agent-supplied token and pins the site; account/site
       // mode lets the agent pick the site.
       ...visitor ? {
@@ -16732,7 +16765,7 @@ function addExecuteTool(server, options) {
     },
     { readOnlyHint: false, destructiveHint: true, openWorldHint: false },
     async (rawArgs, extra) => {
-      const { code, reason, hasMutations, sourceDocUrls, visitorToken } = rawArgs;
+      const { code, reason, hasMutations, sourceDocUrls, visitorToken, files } = rawArgs;
       const siteId = visitor ? visitor.siteId : rawArgs.siteId;
       logger.log(
         `[ExecuteWixAPI]${visitor ? " (visitor)" : ""} Executing code (${code.length} chars), siteId=${siteId ?? "none"}, hasMutations=${hasMutations}, sourceDocUrls=${JSON.stringify(sourceDocUrls)}, reason="${reason}"`
@@ -16777,7 +16810,8 @@ function addExecuteTool(server, options) {
             siteToken: visitor ? visitorToken : siteHeaders?.Authorization,
             accountToken: visitor ? visitorToken : accountHeaders?.Authorization,
             accountId: accountHeaders?.["wix-account-id"],
-            siteAuthContext
+            siteAuthContext,
+            ...files ? { files } : {}
           },
           visitor ? visitorToken : accountHeaders?.Authorization ?? siteHeaders?.Authorization,
           codeModeFetch

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/mcp",
-  "version": "1.0.87",
+  "version": "1.0.88",
   "description": "A Model Context Protocol server for Wix AI tools",
   "bin": "./build/bin-standalone.js",
   "dependencies": {
@@ -133,5 +133,5 @@
       ]
     }
   },
-  "falconPackageHash": "c9087b06450361359889e6ef0ea5562b59ca3f0ea641de700d905ce2"
+  "falconPackageHash": "ca9fecd4d1efd1afea0d159f209aea15cf9475c2edec6f5a172bd92f"
 }