@wix/mcp 1.0.87 → 1.0.89

package/build/bin-standalone.js

@@ -71735,8 +71735,50 @@ var ACCOUNT_SITE_EXECUTE_SCOPE = dedent_default`
   }
   declare const wix: {
     request<T = unknown>(options: WixRequestOptions): Promise<WixResponse<T>>;
+    // Build a multipart/form-data body from files (defaults to the \`files\`
+    // global). Each file becomes a part named fieldName (default "files") with
+    // its path as the filename; \`body\` is bytes so binary parts stay intact.
+    // Pass a base64 entry for binary (an image/font): { path, base64 }, or a
+    // \`files\`-param entry tagged \`base64\`.
+    multipart(
+      files?: Array<{ path: string; content?: string; base64?: string; bytes?: Uint8Array; contentType?: string }>,
+      options?: { fieldName?: string }
+    ): { body: Uint8Array; contentType: string };
+    // Unzip a downloaded site archive (base64 string or bytes) into entries with
+    // RAW bytes (binary-safe); entry.text() decodes a text file. Entries can be
+    // passed straight back to wix.multipart() for a re-upload.
+    unzip(input: string | Uint8Array): Promise<Array<{ path: string; bytes: Uint8Array; text(): string }>>;
   };
   declare const siteId: string | undefined;
+  // Files from the ExecuteWixAPI \`files\` param. Text entries have \`content\`;
+  // an entry tagged \`=== FILE: <path> base64 ===\` has encoding:'base64' and
+  // base64 \`content\` (a binary file — image, font).
+  declare const files: Array<{ path: string; content: string; encoding?: "base64" }>;
+  \`\`\`
+
+  FILE UPLOADS: put every file in the \`files\` param (never inline in \`code\`). Text goes raw; a small binary (icon, logo, font) rides as a \`base64\`-tagged entry — large images/video are referenced by URL (\`<img src="https://...">\`), not bundled. \`wix.multipart()\` turns the whole set into one upload body (bytes, so binary is safe):
+  \`\`\`javascript
+  // files param:
+  //   === FILE: index.html ===
+  //   <!doctype html><img src="logo.png">...
+  //   === FILE: logo.png base64 ===
+  //   iVBORw0KGgoAAA...
+  async () => {
+    const mp = wix.multipart(); // all entries from the files param; base64 ones decoded to raw bytes
+    const res = await wix.request({ scope: "account", method: "POST",
+      url: "https://www.wixapis.com/.../drop",
+      headers: { "Content-Type": mp.contentType }, body: mp.body });
+    return res.data;
+  }
+  \`\`\`
+  DOWNLOAD + EDIT + RE-UPLOAD: fetch the zip as base64, \`wix.unzip()\` it, edit text via \`entry.text()\`, keep binary as bytes, and hand the entries back to \`wix.multipart()\`:
+  \`\`\`javascript
+  const r = await wix.request({ scope: "account", method: "GET", responseType: "base64", url: zipUrl });
+  const entries = await wix.unzip(r.data); // [{ path, bytes, text() }]
+  const edited = entries.map(e => e.path === "index.html"
+    ? { path: e.path, content: e.text().replace("Old title", "New title") }
+    : e); // images etc. pass through untouched as bytes
+  const mp = wix.multipart(edited);
   \`\`\`
 `;
 var EXECUTE_WIX_API_WQL = dedent_default`

package/build/cjs/index.cjs

@@ -37351,8 +37351,50 @@ var ACCOUNT_SITE_EXECUTE_SCOPE = dedent_default`
   }
   declare const wix: {
     request<T = unknown>(options: WixRequestOptions): Promise<WixResponse<T>>;
+    // Build a multipart/form-data body from files (defaults to the \`files\`
+    // global). Each file becomes a part named fieldName (default "files") with
+    // its path as the filename; \`body\` is bytes so binary parts stay intact.
+    // Pass a base64 entry for binary (an image/font): { path, base64 }, or a
+    // \`files\`-param entry tagged \`base64\`.
+    multipart(
+      files?: Array<{ path: string; content?: string; base64?: string; bytes?: Uint8Array; contentType?: string }>,
+      options?: { fieldName?: string }
+    ): { body: Uint8Array; contentType: string };
+    // Unzip a downloaded site archive (base64 string or bytes) into entries with
+    // RAW bytes (binary-safe); entry.text() decodes a text file. Entries can be
+    // passed straight back to wix.multipart() for a re-upload.
+    unzip(input: string | Uint8Array): Promise<Array<{ path: string; bytes: Uint8Array; text(): string }>>;
   };
   declare const siteId: string | undefined;
+  // Files from the ExecuteWixAPI \`files\` param. Text entries have \`content\`;
+  // an entry tagged \`=== FILE: <path> base64 ===\` has encoding:'base64' and
+  // base64 \`content\` (a binary file — image, font).
+  declare const files: Array<{ path: string; content: string; encoding?: "base64" }>;
+  \`\`\`
+
+  FILE UPLOADS: put every file in the \`files\` param (never inline in \`code\`). Text goes raw; a small binary (icon, logo, font) rides as a \`base64\`-tagged entry — large images/video are referenced by URL (\`<img src="https://...">\`), not bundled. \`wix.multipart()\` turns the whole set into one upload body (bytes, so binary is safe):
+  \`\`\`javascript
+  // files param:
+  //   === FILE: index.html ===
+  //   <!doctype html><img src="logo.png">...
+  //   === FILE: logo.png base64 ===
+  //   iVBORw0KGgoAAA...
+  async () => {
+    const mp = wix.multipart(); // all entries from the files param; base64 ones decoded to raw bytes
+    const res = await wix.request({ scope: "account", method: "POST",
+      url: "https://www.wixapis.com/.../drop",
+      headers: { "Content-Type": mp.contentType }, body: mp.body });
+    return res.data;
+  }
+  \`\`\`
+  DOWNLOAD + EDIT + RE-UPLOAD: fetch the zip as base64, \`wix.unzip()\` it, edit text via \`entry.text()\`, keep binary as bytes, and hand the entries back to \`wix.multipart()\`:
+  \`\`\`javascript
+  const r = await wix.request({ scope: "account", method: "GET", responseType: "base64", url: zipUrl });
+  const entries = await wix.unzip(r.data); // [{ path, bytes, text() }]
+  const edited = entries.map(e => e.path === "index.html"
+    ? { path: e.path, content: e.text().replace("Old title", "New title") }
+    : e); // images etc. pass through untouched as bytes
+  const mp = wix.multipart(edited);
   \`\`\`
 `;
 var EXECUTE_WIX_API_WQL = dedent_default`
@@ -53156,6 +53198,15 @@ function addExecuteTool(server, options) {
         visitor ? "Whether this code creates, updates, deletes, publishes, imports, uploads, or otherwise mutates site data on the visitor\u2019s behalf. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false." : "Whether this code creates, updates, deletes, publishes, installs, imports, uploads, or otherwise mutates Wix data or site/account state. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false."
       ),
       sourceDocUrls: external_exports.array(external_exports.string()).describe(d2.sourceDocUrls),
+      files: external_exports.string().optional().describe(
+        [
+          "Optional bundle of raw file contents for uploads, so file bytes never go through the `code` JavaScript (no escaping, no string-literal/`${}`/backtick pitfalls). Never inline file contents in `code`.",
+          "Format: sections delimited by a line `=== FILE: <path> ===` (text, raw) or `=== FILE: <path> base64 ===` (binary, base64); `<path>` is relative to the site root. Example:",
+          '`=== FILE: index.html ===\\n<!doctype html><img src="logo.png">\\n=== FILE: assets/app.js ===\\nconsole.log(1)\\n=== FILE: logo.png base64 ===\\niVBORw0KGgo...`',
+          'In `code` they are the `files` global (`{ path, content, encoding?: "base64" }[]`); `wix.multipart()` turns them into one binary-safe `multipart/form-data` body: `const mp = wix.multipart(); await wix.request({ scope: "account", method: "POST", url, headers: { "Content-Type": mp.contentType }, body: mp.body });`.',
+          'Use base64 entries for small assets (icons, logos, fonts) and for files you downloaded and are re-uploading; large images/video go in by URL (`<img src="https://...">`), not in the bundle. A file containing a line exactly like the delimiter is not supported.'
+        ].join(" ")
+      ),
       // Visitor mode takes an agent-supplied token and pins the site; account/site
       // mode lets the agent pick the site.
       ...visitor ? {
@@ -53170,7 +53221,7 @@ function addExecuteTool(server, options) {
     },
     { readOnlyHint: false, destructiveHint: true, openWorldHint: false },
     async (rawArgs, extra) => {
-      const { code, reason, hasMutations, sourceDocUrls, visitorToken } = rawArgs;
+      const { code, reason, hasMutations, sourceDocUrls, visitorToken, files } = rawArgs;
       const siteId = visitor ? visitor.siteId : rawArgs.siteId;
       logger2.log(
         `[ExecuteWixAPI]${visitor ? " (visitor)" : ""} Executing code (${code.length} chars), siteId=${siteId ?? "none"}, hasMutations=${hasMutations}, sourceDocUrls=${JSON.stringify(sourceDocUrls)}, reason="${reason}"`
@@ -53215,7 +53266,8 @@ function addExecuteTool(server, options) {
             siteToken: visitor ? visitorToken : siteHeaders?.Authorization,
             accountToken: visitor ? visitorToken : accountHeaders?.Authorization,
             accountId: accountHeaders?.["wix-account-id"],
-            siteAuthContext
+            siteAuthContext,
+            ...files ? { files } : {}
           },
           visitor ? visitorToken : accountHeaders?.Authorization ?? siteHeaders?.Authorization,
           codeModeFetch

package/build/cjs/toolkit.cjs

@@ -17838,8 +17838,50 @@ var ACCOUNT_SITE_EXECUTE_SCOPE = dedent_default`
   }
   declare const wix: {
     request<T = unknown>(options: WixRequestOptions): Promise<WixResponse<T>>;
+    // Build a multipart/form-data body from files (defaults to the \`files\`
+    // global). Each file becomes a part named fieldName (default "files") with
+    // its path as the filename; \`body\` is bytes so binary parts stay intact.
+    // Pass a base64 entry for binary (an image/font): { path, base64 }, or a
+    // \`files\`-param entry tagged \`base64\`.
+    multipart(
+      files?: Array<{ path: string; content?: string; base64?: string; bytes?: Uint8Array; contentType?: string }>,
+      options?: { fieldName?: string }
+    ): { body: Uint8Array; contentType: string };
+    // Unzip a downloaded site archive (base64 string or bytes) into entries with
+    // RAW bytes (binary-safe); entry.text() decodes a text file. Entries can be
+    // passed straight back to wix.multipart() for a re-upload.
+    unzip(input: string | Uint8Array): Promise<Array<{ path: string; bytes: Uint8Array; text(): string }>>;
   };
   declare const siteId: string | undefined;
+  // Files from the ExecuteWixAPI \`files\` param. Text entries have \`content\`;
+  // an entry tagged \`=== FILE: <path> base64 ===\` has encoding:'base64' and
+  // base64 \`content\` (a binary file — image, font).
+  declare const files: Array<{ path: string; content: string; encoding?: "base64" }>;
+  \`\`\`
+
+  FILE UPLOADS: put every file in the \`files\` param (never inline in \`code\`). Text goes raw; a small binary (icon, logo, font) rides as a \`base64\`-tagged entry — large images/video are referenced by URL (\`<img src="https://...">\`), not bundled. \`wix.multipart()\` turns the whole set into one upload body (bytes, so binary is safe):
+  \`\`\`javascript
+  // files param:
+  //   === FILE: index.html ===
+  //   <!doctype html><img src="logo.png">...
+  //   === FILE: logo.png base64 ===
+  //   iVBORw0KGgoAAA...
+  async () => {
+    const mp = wix.multipart(); // all entries from the files param; base64 ones decoded to raw bytes
+    const res = await wix.request({ scope: "account", method: "POST",
+      url: "https://www.wixapis.com/.../drop",
+      headers: { "Content-Type": mp.contentType }, body: mp.body });
+    return res.data;
+  }
+  \`\`\`
+  DOWNLOAD + EDIT + RE-UPLOAD: fetch the zip as base64, \`wix.unzip()\` it, edit text via \`entry.text()\`, keep binary as bytes, and hand the entries back to \`wix.multipart()\`:
+  \`\`\`javascript
+  const r = await wix.request({ scope: "account", method: "GET", responseType: "base64", url: zipUrl });
+  const entries = await wix.unzip(r.data); // [{ path, bytes, text() }]
+  const edited = entries.map(e => e.path === "index.html"
+    ? { path: e.path, content: e.text().replace("Old title", "New title") }
+    : e); // images etc. pass through untouched as bytes
+  const mp = wix.multipart(edited);
   \`\`\`
 `;
 var EXECUTE_WIX_API_WQL = dedent_default`
@@ -22299,6 +22341,15 @@ function addExecuteTool(server, options) {
         visitor ? "Whether this code creates, updates, deletes, publishes, imports, uploads, or otherwise mutates site data on the visitor\u2019s behalf. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false." : "Whether this code creates, updates, deletes, publishes, installs, imports, uploads, or otherwise mutates Wix data or site/account state. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false."
       ),
       sourceDocUrls: external_exports.array(external_exports.string()).describe(d.sourceDocUrls),
+      files: external_exports.string().optional().describe(
+        [
+          "Optional bundle of raw file contents for uploads, so file bytes never go through the `code` JavaScript (no escaping, no string-literal/`${}`/backtick pitfalls). Never inline file contents in `code`.",
+          "Format: sections delimited by a line `=== FILE: <path> ===` (text, raw) or `=== FILE: <path> base64 ===` (binary, base64); `<path>` is relative to the site root. Example:",
+          '`=== FILE: index.html ===\\n<!doctype html><img src="logo.png">\\n=== FILE: assets/app.js ===\\nconsole.log(1)\\n=== FILE: logo.png base64 ===\\niVBORw0KGgo...`',
+          'In `code` they are the `files` global (`{ path, content, encoding?: "base64" }[]`); `wix.multipart()` turns them into one binary-safe `multipart/form-data` body: `const mp = wix.multipart(); await wix.request({ scope: "account", method: "POST", url, headers: { "Content-Type": mp.contentType }, body: mp.body });`.',
+          'Use base64 entries for small assets (icons, logos, fonts) and for files you downloaded and are re-uploading; large images/video go in by URL (`<img src="https://...">`), not in the bundle. A file containing a line exactly like the delimiter is not supported.'
+        ].join(" ")
+      ),
       // Visitor mode takes an agent-supplied token and pins the site; account/site
       // mode lets the agent pick the site.
       ...visitor ? {
@@ -22313,7 +22364,7 @@ function addExecuteTool(server, options) {
     },
     { readOnlyHint: false, destructiveHint: true, openWorldHint: false },
     async (rawArgs, extra) => {
-      const { code, reason, hasMutations, sourceDocUrls, visitorToken } = rawArgs;
+      const { code, reason, hasMutations, sourceDocUrls, visitorToken, files } = rawArgs;
       const siteId = visitor ? visitor.siteId : rawArgs.siteId;
       logger.log(
         `[ExecuteWixAPI]${visitor ? " (visitor)" : ""} Executing code (${code.length} chars), siteId=${siteId ?? "none"}, hasMutations=${hasMutations}, sourceDocUrls=${JSON.stringify(sourceDocUrls)}, reason="${reason}"`
@@ -22358,7 +22409,8 @@ function addExecuteTool(server, options) {
             siteToken: visitor ? visitorToken : siteHeaders?.Authorization,
             accountToken: visitor ? visitorToken : accountHeaders?.Authorization,
             accountId: accountHeaders?.["wix-account-id"],
-            siteAuthContext
+            siteAuthContext,
+            ...files ? { files } : {}
           },
           visitor ? visitorToken : accountHeaders?.Authorization ?? siteHeaders?.Authorization,
           codeModeFetch

package/build/dts/code-mode/index.js

@@ -236,6 +236,16 @@ function addExecuteTool(server, options) {
             ? 'Whether this code creates, updates, deletes, publishes, imports, uploads, or otherwise mutates site data on the visitor’s behalf. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false.'
             : 'Whether this code creates, updates, deletes, publishes, installs, imports, uploads, or otherwise mutates Wix data or site/account state. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false.'),
         sourceDocUrls: z.array(z.string()).describe(d.sourceDocUrls),
+        files: z
+            .string()
+            .optional()
+            .describe([
+            'Optional bundle of raw file contents for uploads, so file bytes never go through the `code` JavaScript (no escaping, no string-literal/`${}`/backtick pitfalls). Never inline file contents in `code`.',
+            'Format: sections delimited by a line `=== FILE: <path> ===` (text, raw) or `=== FILE: <path> base64 ===` (binary, base64); `<path>` is relative to the site root. Example:',
+            '`=== FILE: index.html ===\\n<!doctype html><img src="logo.png">\\n=== FILE: assets/app.js ===\\nconsole.log(1)\\n=== FILE: logo.png base64 ===\\niVBORw0KGgo...`',
+            'In `code` they are the `files` global (`{ path, content, encoding?: "base64" }[]`); `wix.multipart()` turns them into one binary-safe `multipart/form-data` body: `const mp = wix.multipart(); await wix.request({ scope: "account", method: "POST", url, headers: { "Content-Type": mp.contentType }, body: mp.body });`.',
+            'Use base64 entries for small assets (icons, logos, fonts) and for files you downloaded and are re-uploading; large images/video go in by URL (`<img src="https://...">`), not in the bundle. A file containing a line exactly like the delimiter is not supported.'
+        ].join(' ')),
         // Visitor mode takes an agent-supplied token and pins the site; account/site
         // mode lets the agent pick the site.
         ...(visitor
@@ -254,7 +264,7 @@ function addExecuteTool(server, options) {
     // Partial: duck-typed servers (the toolkit's capturing server, test
     // doubles) build their own extra and may not supply every field.
     extra) => {
-        const { code, reason, hasMutations, sourceDocUrls, visitorToken } = rawArgs;
+        const { code, reason, hasMutations, sourceDocUrls, visitorToken, files } = rawArgs;
         // In visitor mode the site is pinned; otherwise it comes from the param.
         const siteId = visitor ? visitor.siteId : rawArgs.siteId;
         logger.log(`[ExecuteWixAPI]${visitor ? ' (visitor)' : ''} Executing code (${code.length} chars), siteId=${siteId ?? 'none'}, hasMutations=${hasMutations}, sourceDocUrls=${JSON.stringify(sourceDocUrls)}, reason="${reason}"`);
@@ -318,7 +328,8 @@ function addExecuteTool(server, options) {
                     ? visitorToken
                     : accountHeaders?.Authorization,
                 accountId: accountHeaders?.['wix-account-id'],
-                siteAuthContext
+                siteAuthContext,
+                ...(files ? { files } : {})
             }, visitor
                 ? visitorToken
                 : (accountHeaders?.Authorization ?? siteHeaders?.Authorization), codeModeFetch);

package/build/dts/config/default-config.js

@@ -165,8 +165,50 @@ const ACCOUNT_SITE_EXECUTE_SCOPE = dedent `
   }
   declare const wix: {
     request<T = unknown>(options: WixRequestOptions): Promise<WixResponse<T>>;
+    // Build a multipart/form-data body from files (defaults to the \`files\`
+    // global). Each file becomes a part named fieldName (default "files") with
+    // its path as the filename; \`body\` is bytes so binary parts stay intact.
+    // Pass a base64 entry for binary (an image/font): { path, base64 }, or a
+    // \`files\`-param entry tagged \`base64\`.
+    multipart(
+      files?: Array<{ path: string; content?: string; base64?: string; bytes?: Uint8Array; contentType?: string }>,
+      options?: { fieldName?: string }
+    ): { body: Uint8Array; contentType: string };
+    // Unzip a downloaded site archive (base64 string or bytes) into entries with
+    // RAW bytes (binary-safe); entry.text() decodes a text file. Entries can be
+    // passed straight back to wix.multipart() for a re-upload.
+    unzip(input: string | Uint8Array): Promise<Array<{ path: string; bytes: Uint8Array; text(): string }>>;
   };
   declare const siteId: string | undefined;
+  // Files from the ExecuteWixAPI \`files\` param. Text entries have \`content\`;
+  // an entry tagged \`=== FILE: <path> base64 ===\` has encoding:'base64' and
+  // base64 \`content\` (a binary file — image, font).
+  declare const files: Array<{ path: string; content: string; encoding?: "base64" }>;
+  \`\`\`
+
+  FILE UPLOADS: put every file in the \`files\` param (never inline in \`code\`). Text goes raw; a small binary (icon, logo, font) rides as a \`base64\`-tagged entry — large images/video are referenced by URL (\`<img src="https://...">\`), not bundled. \`wix.multipart()\` turns the whole set into one upload body (bytes, so binary is safe):
+  \`\`\`javascript
+  // files param:
+  //   === FILE: index.html ===
+  //   <!doctype html><img src="logo.png">...
+  //   === FILE: logo.png base64 ===
+  //   iVBORw0KGgoAAA...
+  async () => {
+    const mp = wix.multipart(); // all entries from the files param; base64 ones decoded to raw bytes
+    const res = await wix.request({ scope: "account", method: "POST",
+      url: "https://www.wixapis.com/.../drop",
+      headers: { "Content-Type": mp.contentType }, body: mp.body });
+    return res.data;
+  }
+  \`\`\`
+  DOWNLOAD + EDIT + RE-UPLOAD: fetch the zip as base64, \`wix.unzip()\` it, edit text via \`entry.text()\`, keep binary as bytes, and hand the entries back to \`wix.multipart()\`:
+  \`\`\`javascript
+  const r = await wix.request({ scope: "account", method: "GET", responseType: "base64", url: zipUrl });
+  const entries = await wix.unzip(r.data); // [{ path, bytes, text() }]
+  const edited = entries.map(e => e.path === "index.html"
+    ? { path: e.path, content: e.text().replace("Old title", "New title") }
+    : e); // images etc. pass through untouched as bytes
+  const mp = wix.multipart(edited);
   \`\`\`
 `;
 const EXECUTE_WIX_API_WQL = dedent `

package/build/esm/index.js

@@ -31064,8 +31064,50 @@ var ACCOUNT_SITE_EXECUTE_SCOPE = dedent_default`
   }
   declare const wix: {
     request<T = unknown>(options: WixRequestOptions): Promise<WixResponse<T>>;
+    // Build a multipart/form-data body from files (defaults to the \`files\`
+    // global). Each file becomes a part named fieldName (default "files") with
+    // its path as the filename; \`body\` is bytes so binary parts stay intact.
+    // Pass a base64 entry for binary (an image/font): { path, base64 }, or a
+    // \`files\`-param entry tagged \`base64\`.
+    multipart(
+      files?: Array<{ path: string; content?: string; base64?: string; bytes?: Uint8Array; contentType?: string }>,
+      options?: { fieldName?: string }
+    ): { body: Uint8Array; contentType: string };
+    // Unzip a downloaded site archive (base64 string or bytes) into entries with
+    // RAW bytes (binary-safe); entry.text() decodes a text file. Entries can be
+    // passed straight back to wix.multipart() for a re-upload.
+    unzip(input: string | Uint8Array): Promise<Array<{ path: string; bytes: Uint8Array; text(): string }>>;
   };
   declare const siteId: string | undefined;
+  // Files from the ExecuteWixAPI \`files\` param. Text entries have \`content\`;
+  // an entry tagged \`=== FILE: <path> base64 ===\` has encoding:'base64' and
+  // base64 \`content\` (a binary file — image, font).
+  declare const files: Array<{ path: string; content: string; encoding?: "base64" }>;
+  \`\`\`
+
+  FILE UPLOADS: put every file in the \`files\` param (never inline in \`code\`). Text goes raw; a small binary (icon, logo, font) rides as a \`base64\`-tagged entry — large images/video are referenced by URL (\`<img src="https://...">\`), not bundled. \`wix.multipart()\` turns the whole set into one upload body (bytes, so binary is safe):
+  \`\`\`javascript
+  // files param:
+  //   === FILE: index.html ===
+  //   <!doctype html><img src="logo.png">...
+  //   === FILE: logo.png base64 ===
+  //   iVBORw0KGgoAAA...
+  async () => {
+    const mp = wix.multipart(); // all entries from the files param; base64 ones decoded to raw bytes
+    const res = await wix.request({ scope: "account", method: "POST",
+      url: "https://www.wixapis.com/.../drop",
+      headers: { "Content-Type": mp.contentType }, body: mp.body });
+    return res.data;
+  }
+  \`\`\`
+  DOWNLOAD + EDIT + RE-UPLOAD: fetch the zip as base64, \`wix.unzip()\` it, edit text via \`entry.text()\`, keep binary as bytes, and hand the entries back to \`wix.multipart()\`:
+  \`\`\`javascript
+  const r = await wix.request({ scope: "account", method: "GET", responseType: "base64", url: zipUrl });
+  const entries = await wix.unzip(r.data); // [{ path, bytes, text() }]
+  const edited = entries.map(e => e.path === "index.html"
+    ? { path: e.path, content: e.text().replace("Old title", "New title") }
+    : e); // images etc. pass through untouched as bytes
+  const mp = wix.multipart(edited);
   \`\`\`
 `;
 var EXECUTE_WIX_API_WQL = dedent_default`
@@ -46920,6 +46962,15 @@ function addExecuteTool(server, options) {
         visitor ? "Whether this code creates, updates, deletes, publishes, imports, uploads, or otherwise mutates site data on the visitor\u2019s behalf. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false." : "Whether this code creates, updates, deletes, publishes, installs, imports, uploads, or otherwise mutates Wix data or site/account state. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false."
       ),
       sourceDocUrls: external_exports.array(external_exports.string()).describe(d2.sourceDocUrls),
+      files: external_exports.string().optional().describe(
+        [
+          "Optional bundle of raw file contents for uploads, so file bytes never go through the `code` JavaScript (no escaping, no string-literal/`${}`/backtick pitfalls). Never inline file contents in `code`.",
+          "Format: sections delimited by a line `=== FILE: <path> ===` (text, raw) or `=== FILE: <path> base64 ===` (binary, base64); `<path>` is relative to the site root. Example:",
+          '`=== FILE: index.html ===\\n<!doctype html><img src="logo.png">\\n=== FILE: assets/app.js ===\\nconsole.log(1)\\n=== FILE: logo.png base64 ===\\niVBORw0KGgo...`',
+          'In `code` they are the `files` global (`{ path, content, encoding?: "base64" }[]`); `wix.multipart()` turns them into one binary-safe `multipart/form-data` body: `const mp = wix.multipart(); await wix.request({ scope: "account", method: "POST", url, headers: { "Content-Type": mp.contentType }, body: mp.body });`.',
+          'Use base64 entries for small assets (icons, logos, fonts) and for files you downloaded and are re-uploading; large images/video go in by URL (`<img src="https://...">`), not in the bundle. A file containing a line exactly like the delimiter is not supported.'
+        ].join(" ")
+      ),
       // Visitor mode takes an agent-supplied token and pins the site; account/site
       // mode lets the agent pick the site.
       ...visitor ? {
@@ -46934,7 +46985,7 @@ function addExecuteTool(server, options) {
     },
     { readOnlyHint: false, destructiveHint: true, openWorldHint: false },
     async (rawArgs, extra) => {
-      const { code, reason, hasMutations, sourceDocUrls, visitorToken } = rawArgs;
+      const { code, reason, hasMutations, sourceDocUrls, visitorToken, files } = rawArgs;
       const siteId = visitor ? visitor.siteId : rawArgs.siteId;
       logger2.log(
         `[ExecuteWixAPI]${visitor ? " (visitor)" : ""} Executing code (${code.length} chars), siteId=${siteId ?? "none"}, hasMutations=${hasMutations}, sourceDocUrls=${JSON.stringify(sourceDocUrls)}, reason="${reason}"`
@@ -46979,7 +47030,8 @@ function addExecuteTool(server, options) {
             siteToken: visitor ? visitorToken : siteHeaders?.Authorization,
             accountToken: visitor ? visitorToken : accountHeaders?.Authorization,
             accountId: accountHeaders?.["wix-account-id"],
-            siteAuthContext
+            siteAuthContext,
+            ...files ? { files } : {}
           },
           visitor ? visitorToken : accountHeaders?.Authorization ?? siteHeaders?.Authorization,
           codeModeFetch

package/build/esm/toolkit.js

@@ -12260,8 +12260,50 @@ var ACCOUNT_SITE_EXECUTE_SCOPE = dedent_default`
   }
   declare const wix: {
     request<T = unknown>(options: WixRequestOptions): Promise<WixResponse<T>>;
+    // Build a multipart/form-data body from files (defaults to the \`files\`
+    // global). Each file becomes a part named fieldName (default "files") with
+    // its path as the filename; \`body\` is bytes so binary parts stay intact.
+    // Pass a base64 entry for binary (an image/font): { path, base64 }, or a
+    // \`files\`-param entry tagged \`base64\`.
+    multipart(
+      files?: Array<{ path: string; content?: string; base64?: string; bytes?: Uint8Array; contentType?: string }>,
+      options?: { fieldName?: string }
+    ): { body: Uint8Array; contentType: string };
+    // Unzip a downloaded site archive (base64 string or bytes) into entries with
+    // RAW bytes (binary-safe); entry.text() decodes a text file. Entries can be
+    // passed straight back to wix.multipart() for a re-upload.
+    unzip(input: string | Uint8Array): Promise<Array<{ path: string; bytes: Uint8Array; text(): string }>>;
   };
   declare const siteId: string | undefined;
+  // Files from the ExecuteWixAPI \`files\` param. Text entries have \`content\`;
+  // an entry tagged \`=== FILE: <path> base64 ===\` has encoding:'base64' and
+  // base64 \`content\` (a binary file — image, font).
+  declare const files: Array<{ path: string; content: string; encoding?: "base64" }>;
+  \`\`\`
+
+  FILE UPLOADS: put every file in the \`files\` param (never inline in \`code\`). Text goes raw; a small binary (icon, logo, font) rides as a \`base64\`-tagged entry — large images/video are referenced by URL (\`<img src="https://...">\`), not bundled. \`wix.multipart()\` turns the whole set into one upload body (bytes, so binary is safe):
+  \`\`\`javascript
+  // files param:
+  //   === FILE: index.html ===
+  //   <!doctype html><img src="logo.png">...
+  //   === FILE: logo.png base64 ===
+  //   iVBORw0KGgoAAA...
+  async () => {
+    const mp = wix.multipart(); // all entries from the files param; base64 ones decoded to raw bytes
+    const res = await wix.request({ scope: "account", method: "POST",
+      url: "https://www.wixapis.com/.../drop",
+      headers: { "Content-Type": mp.contentType }, body: mp.body });
+    return res.data;
+  }
+  \`\`\`
+  DOWNLOAD + EDIT + RE-UPLOAD: fetch the zip as base64, \`wix.unzip()\` it, edit text via \`entry.text()\`, keep binary as bytes, and hand the entries back to \`wix.multipart()\`:
+  \`\`\`javascript
+  const r = await wix.request({ scope: "account", method: "GET", responseType: "base64", url: zipUrl });
+  const entries = await wix.unzip(r.data); // [{ path, bytes, text() }]
+  const edited = entries.map(e => e.path === "index.html"
+    ? { path: e.path, content: e.text().replace("Old title", "New title") }
+    : e); // images etc. pass through untouched as bytes
+  const mp = wix.multipart(edited);
   \`\`\`
 `;
 var EXECUTE_WIX_API_WQL = dedent_default`
@@ -16718,6 +16760,15 @@ function addExecuteTool(server, options) {
         visitor ? "Whether this code creates, updates, deletes, publishes, imports, uploads, or otherwise mutates site data on the visitor\u2019s behalf. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false." : "Whether this code creates, updates, deletes, publishes, installs, imports, uploads, or otherwise mutates Wix data or site/account state. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false."
       ),
       sourceDocUrls: external_exports.array(external_exports.string()).describe(d.sourceDocUrls),
+      files: external_exports.string().optional().describe(
+        [
+          "Optional bundle of raw file contents for uploads, so file bytes never go through the `code` JavaScript (no escaping, no string-literal/`${}`/backtick pitfalls). Never inline file contents in `code`.",
+          "Format: sections delimited by a line `=== FILE: <path> ===` (text, raw) or `=== FILE: <path> base64 ===` (binary, base64); `<path>` is relative to the site root. Example:",
+          '`=== FILE: index.html ===\\n<!doctype html><img src="logo.png">\\n=== FILE: assets/app.js ===\\nconsole.log(1)\\n=== FILE: logo.png base64 ===\\niVBORw0KGgo...`',
+          'In `code` they are the `files` global (`{ path, content, encoding?: "base64" }[]`); `wix.multipart()` turns them into one binary-safe `multipart/form-data` body: `const mp = wix.multipart(); await wix.request({ scope: "account", method: "POST", url, headers: { "Content-Type": mp.contentType }, body: mp.body });`.',
+          'Use base64 entries for small assets (icons, logos, fonts) and for files you downloaded and are re-uploading; large images/video go in by URL (`<img src="https://...">`), not in the bundle. A file containing a line exactly like the delimiter is not supported.'
+        ].join(" ")
+      ),
       // Visitor mode takes an agent-supplied token and pins the site; account/site
       // mode lets the agent pick the site.
       ...visitor ? {
@@ -16732,7 +16783,7 @@ function addExecuteTool(server, options) {
     },
     { readOnlyHint: false, destructiveHint: true, openWorldHint: false },
     async (rawArgs, extra) => {
-      const { code, reason, hasMutations, sourceDocUrls, visitorToken } = rawArgs;
+      const { code, reason, hasMutations, sourceDocUrls, visitorToken, files } = rawArgs;
       const siteId = visitor ? visitor.siteId : rawArgs.siteId;
       logger.log(
         `[ExecuteWixAPI]${visitor ? " (visitor)" : ""} Executing code (${code.length} chars), siteId=${siteId ?? "none"}, hasMutations=${hasMutations}, sourceDocUrls=${JSON.stringify(sourceDocUrls)}, reason="${reason}"`
@@ -16777,7 +16828,8 @@ function addExecuteTool(server, options) {
             siteToken: visitor ? visitorToken : siteHeaders?.Authorization,
             accountToken: visitor ? visitorToken : accountHeaders?.Authorization,
             accountId: accountHeaders?.["wix-account-id"],
-            siteAuthContext
+            siteAuthContext,
+            ...files ? { files } : {}
           },
           visitor ? visitorToken : accountHeaders?.Authorization ?? siteHeaders?.Authorization,
           codeModeFetch

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/mcp",
-  "version": "1.0.87",
+  "version": "1.0.89",
   "description": "A Model Context Protocol server for Wix AI tools",
   "bin": "./build/bin-standalone.js",
   "dependencies": {
@@ -133,5 +133,5 @@
       ]
     }
   },
-  "falconPackageHash": "c9087b06450361359889e6ef0ea5562b59ca3f0ea641de700d905ce2"
+  "falconPackageHash": "56dddfd3c4abc5ee20298c4a7f54f409dc405abaf86f58fcc82d48ab"
 }