@wix/mcp 1.0.93 → 1.0.95

package/build/dts/api-call/headless-release.d.ts

@@ -0,0 +1,56 @@
+/**
+ * A Wix Astro build among the files UploadHeadlessWebsiteFiles received (the output
+ * of `astro build` with the Wix hosting adapter, zipped from the project root):
+ * recognised here, released by headless-business-setup's bundle routes (the tool
+ * PUTs the zip and calls `release-bundle`), not dropped as static files.
+ *
+ * The build is recognised by `.wix/build-metadata.json`, which the adapter writes
+ * beside `dist/`: it names the client folder (served as static files), the server
+ * folder (run on the hosting runtime) and the app manifest. The folder that holds
+ * `.wix/` is the project root; the project's other files there are its source.
+ *
+ * Runs in the MCP server (a Cloudflare Worker): no `node:` imports, only web APIs.
+ */
+import type { SiteFile } from './site-files.js';
+export declare const BUILD_METADATA_SUFFIX = ".wix/build-metadata.json";
+export interface BuildMetadata {
+    appManifestPath: string;
+    clientDir?: string;
+    serverDir?: string;
+    staticsUrlPlaceholder?: string;
+    serverUrlPlaceholder?: string;
+    generateAppDeploymentGroupId?: boolean;
+}
+export interface HeadlessBuild {
+    metadata: BuildMetadata;
+    /** The project root in the upload: `''`, or the one folder that wraps the project (`proj/`). */
+    root: string;
+    /** The manifest as the build wrote it (`{ appId, components }`). */
+    manifestText: string;
+    clientFiles: SiteFile[];
+    serverFiles: SiteFile[];
+    /** The client folder in the upload (`dist/client/`), when the metadata names one. */
+    clientDir?: string;
+}
+/**
+ * The upload without the build's empty static files: the hosting refuses a static file
+ * of size 0 (`size got 0, expected 1 or more`), and an empty file serves nothing.
+ */
+export declare function withoutEmptyStatics(files: SiteFile[], build: HeadlessBuild): {
+    files: SiteFile[];
+    dropped: string[];
+};
+/**
+ * Recognise a Wix Astro build among the uploaded files: the file set holds
+ * `.wix/build-metadata.json` (at the root, or under one folder that wraps the project).
+ * Returns null for a static site, so the caller drops it as before. Throws an agent-facing
+ * error for a build whose metadata or files are not usable.
+ */
+export declare function findHeadlessBuild(files: SiteFile[]): HeadlessBuild | null;
+/**
+ * The project's source among the uploaded files: every file under the build's
+ * project root outside `dist/`, `.wix/`, `.astro/`, `.agents/`, `node_modules/` and
+ * `.env*`, with paths relative to the root. Empty when only the build was uploaded.
+ */
+export declare function buildSourceFiles(files: SiteFile[], build: HeadlessBuild): SiteFile[];
+//# sourceMappingURL=headless-release.d.ts.map

package/build/dts/api-call/headless-release.js

@@ -0,0 +1,135 @@
+export const BUILD_METADATA_SUFFIX = '.wix/build-metadata.json';
+/**
+ * The upload without the build's empty static files: the hosting refuses a static file
+ * of size 0 (`size got 0, expected 1 or more`), and an empty file serves nothing.
+ */
+export function withoutEmptyStatics(files, build) {
+    const dir = build.clientDir;
+    if (dir === undefined)
+        return { files, dropped: [] };
+    const dropped = [];
+    const kept = files.filter((f) => {
+        const path = normalizePath(f.path);
+        if (f.bytes.byteLength === 0 && path.startsWith(dir)) {
+            dropped.push(path.slice(dir.length));
+            return false;
+        }
+        return true;
+    });
+    return { files: kept, dropped };
+}
+const normalizePath = (p) => p.replace(/\\/g, '/').replace(/^\.?\//, '');
+/**
+ * Recognise a Wix Astro build among the uploaded files: the file set holds
+ * `.wix/build-metadata.json` (at the root, or under one folder that wraps the project).
+ * Returns null for a static site, so the caller drops it as before. Throws an agent-facing
+ * error for a build whose metadata or files are not usable.
+ */
+export function findHeadlessBuild(files) {
+    const entries = new Map(files.map((f) => [normalizePath(f.path), f.bytes]));
+    const metadataEntry = [...entries.keys()].find((name) => name === BUILD_METADATA_SUFFIX ||
+        name.endsWith(`/${BUILD_METADATA_SUFFIX}`));
+    if (metadataEntry === undefined)
+        return null;
+    const zipRoot = metadataEntry.slice(0, metadataEntry.length - BUILD_METADATA_SUFFIX.length);
+    let metadata;
+    try {
+        metadata = JSON.parse(new TextDecoder().decode(entries.get(metadataEntry)));
+    }
+    catch {
+        throw new Error(`${BUILD_METADATA_SUFFIX} is not valid JSON.`);
+    }
+    if (typeof metadata.appManifestPath !== 'string') {
+        throw new Error(`${BUILD_METADATA_SUFFIX} has no appManifestPath; send the build as the Wix hosting adapter wrote it (.wix/ and dist/ zipped from the project root).`);
+    }
+    // The metadata holds the builder's absolute paths; the files in the zip are relative to the
+    // project root. The manifest is found by the longest tail of its path that exists, and the
+    // part of the path before that tail is the builder's project root.
+    const manifestPath = resolveZipPath(metadata.appManifestPath, zipRoot, entries);
+    if (manifestPath === undefined) {
+        throw new Error(`The build's app manifest (${metadata.appManifestPath}) is not in the upload; zip .wix/ and dist/ together from the project root after \`astro build\`.`);
+    }
+    const builderRoot = metadata.appManifestPath.slice(0, metadata.appManifestPath.length - (manifestPath.length - zipRoot.length));
+    const clientDir = metadata.clientDir === undefined
+        ? undefined
+        : toZipDir(metadata.clientDir, builderRoot, zipRoot);
+    const serverDir = metadata.serverDir === undefined
+        ? undefined
+        : toZipDir(metadata.serverDir, builderRoot, zipRoot);
+    const clientFiles = [];
+    const serverFiles = [];
+    for (const [name, bytes] of entries) {
+        if (name === manifestPath)
+            continue;
+        if (serverDir !== undefined && name.startsWith(serverDir)) {
+            serverFiles.push({ path: name.slice(serverDir.length), bytes });
+        }
+        else if (clientDir !== undefined && name.startsWith(clientDir)) {
+            clientFiles.push({ path: name.slice(clientDir.length), bytes });
+        }
+    }
+    if (clientFiles.length + serverFiles.length === 0) {
+        throw new Error('The build has no client or server output files; run `astro build` first and zip .wix/ and dist/ from the project root.');
+    }
+    if (serverFiles.length > 0 &&
+        !serverFiles.some((f) => f.path === 'entry.mjs')) {
+        throw new Error("The server build has no entry.mjs, which the Wix hosting adapter (@wix/astro-wix-hosting-adapter) writes into the server folder on every build. Build with the project's own `astro build` (the adapter in astro.config) and zip .wix/ and dist/ from the project root as the build left them.");
+    }
+    const manifestText = new TextDecoder().decode(entries.get(manifestPath));
+    return {
+        metadata,
+        root: zipRoot,
+        manifestText,
+        clientFiles,
+        serverFiles,
+        clientDir
+    };
+}
+// What the source zip leaves out, relative to the project root: the build output, the
+// adapter's and Astro's caches, the agent's own folder at the top; dependencies and
+// environment files at any depth.
+const NOT_SOURCE_TOP = new Set(['dist', '.wix', '.astro', '.agents']);
+const isSourcePath = (relative) => {
+    const segments = relative.split('/');
+    return (!NOT_SOURCE_TOP.has(segments[0]) &&
+        !segments.some((s) => s === 'node_modules' || s.startsWith('.env')));
+};
+/**
+ * The project's source among the uploaded files: every file under the build's
+ * project root outside `dist/`, `.wix/`, `.astro/`, `.agents/`, `node_modules/` and
+ * `.env*`, with paths relative to the root. Empty when only the build was uploaded.
+ */
+export function buildSourceFiles(files, build) {
+    return files.flatMap((f) => {
+        const path = normalizePath(f.path);
+        if (!path.startsWith(build.root))
+            return [];
+        const relative = path.slice(build.root.length);
+        return relative && isSourcePath(relative)
+            ? [{ path: relative, bytes: f.bytes }]
+            : [];
+    });
+}
+function resolveZipPath(builderPath, zipRoot, entries) {
+    const segments = normalizePath(builderPath)
+        .split('/')
+        .filter((s) => s.length > 0);
+    for (let k = 0; k < segments.length; k++) {
+        const candidate = zipRoot + segments.slice(k).join('/');
+        if (entries.has(candidate))
+            return candidate;
+    }
+    return undefined;
+}
+function toZipDir(builderDir, builderRoot, zipRoot) {
+    const normalized = normalizePath(builderDir);
+    const normalizedRoot = normalizePath(builderRoot);
+    const relative = builderDir.startsWith(builderRoot)
+        ? builderDir.slice(builderRoot.length)
+        : normalized.startsWith(normalizedRoot)
+            ? normalized.slice(normalizedRoot.length)
+            : normalized;
+    const dir = zipRoot + normalizePath(relative);
+    return dir.endsWith('/') ? dir : `${dir}/`;
+}
+//# sourceMappingURL=headless-release.js.map

package/build/dts/api-call/index.d.ts

@@ -6,5 +6,13 @@ export interface ToolHintsConfig {
     openWorldHint?: boolean;
 }
 export { addUploadImageTool } from './upload-image-tool.js';
-export declare function addApiCallTool(server: WixMcpServer, strategy: McpAuthenticationStrategy, allowedTools?: string[], disableTools?: string[], enableTools?: string[], toolDescriptions?: Record<string, string>, toolHints?: Record<string, ToolHintsConfig>, maxResponseSize?: number): void;
+export declare function addApiCallTool(server: WixMcpServer, strategy: McpAuthenticationStrategy, allowedTools?: string[], disableTools?: string[], enableTools?: string[], toolDescriptions?: Record<string, string>, toolHints?: Record<string, ToolHintsConfig>, maxResponseSize?: number, options?: {
+    imagePickerToolName?: string;
+    /**
+     * This server serves ExecuteWixAPI. Only then does CallWixSiteAPI tell the user to reconnect when
+     * the client lists no ExecuteWixAPI (an old or cached tool list); where it is off on purpose, the
+     * agent just uses CallWixSiteAPI.
+     */
+    executeWixAPIServed?: boolean;
+}): void;
 //# sourceMappingURL=index.d.ts.map

package/build/dts/api-call/index.js

@@ -5,8 +5,8 @@ import { handleWixAPIResponse } from '../tool-utils.js';
 import { rethrowIfUnauthorized } from '../auth/index.js';
 import { isApiUrlAllowed } from './validation.js';
 import { addUploadImageTool } from './upload-image-tool.js';
-import { defaultToolDescriptions } from '../config/default-config.js';
-import { desc } from '../config/param-descriptions.js';
+import { CALL_WIX_SITE_API_NO_EXECUTE_LINE, CALL_WIX_SITE_API_RECONNECT_LINE, defaultToolDescriptions } from '../config/default-config.js';
+import { desc, WHY_NOT_EXECUTE_NO_EXECUTE, WHY_NOT_EXECUTE_RECONNECT } from '../config/param-descriptions.js';
 import { MAX_ALLOWED_RESPONSE_CHARS } from '../infra/response-size-limits.js';
 export { addUploadImageTool } from './upload-image-tool.js';
 const DEFAULT_MAX_RESPONSE_SIZE = 50000; // ~50KB cap
@@ -56,7 +56,8 @@ function formatApiResponse(responseData, maxResponseSize = DEFAULT_MAX_RESPONSE_
     }
     return { text: responseText, isError: false, originalLength, returnedRows };
 }
-export function addApiCallTool(server, strategy, allowedTools = ['CallWixSiteAPI', 'ListWixSites', 'ManageWixSite'], disableTools = [], enableTools = [], toolDescriptions, toolHints, maxResponseSize) {
+export function addApiCallTool(server, strategy, allowedTools = ['CallWixSiteAPI', 'ListWixSites', 'ManageWixSite'], disableTools = [], enableTools = [], toolDescriptions, toolHints, maxResponseSize, options) {
+    const executeAdvice = (text, reconnect, plain) => options?.executeWixAPIServed ? text : text.replace(reconnect, plain);
     // Compute effective allowed tools: (default + enableTools) - disableTools
     const effectiveAllowedTools = [
         ...new Set([...allowedTools, ...enableTools])
@@ -71,7 +72,7 @@ export function addApiCallTool(server, strategy, allowedTools = ['CallWixSiteAPI
     const getDescription = (toolName, defaultDesc) => toolDescriptions?.[toolName] ?? defaultDesc;
     if (effectiveAllowedTools.includes('CallWixSiteAPI') &&
         !disableTools.includes('CallWixSiteAPI')) {
-        server.tool('CallWixSiteAPI', getDescription('CallWixSiteAPI', defaultToolDescriptions.CallWixSiteAPI), (() => {
+        server.tool('CallWixSiteAPI', executeAdvice(getDescription('CallWixSiteAPI', defaultToolDescriptions.CallWixSiteAPI), CALL_WIX_SITE_API_RECONNECT_LINE, CALL_WIX_SITE_API_NO_EXECUTE_LINE), (() => {
             const d = desc('CallWixSiteAPI');
             return {
                 siteId: z.string().describe(d.siteId),
@@ -82,14 +83,21 @@ export function addApiCallTool(server, strategy, allowedTools = ['CallWixSiteAPI
                     .optional()
                     .describe(d.body),
                 reason: z.string().describe(d.reason),
+                whyNotExecuteWixAPI: z
+                    .string()
+                    .optional()
+                    .describe(executeAdvice(d.whyNotExecuteWixAPI, WHY_NOT_EXECUTE_RECONNECT, WHY_NOT_EXECUTE_NO_EXECUTE)),
                 sourceDocUrl: z.string().describe(d.sourceDocUrl)
             };
-        })(), getHints('CallWixSiteAPI', {
+        })(), 
+        // openWorldHint true: a free-form URL into the whole Wix REST surface is an
+        // open-ended target, even though auth is bounded to the user's account.
+        getHints('CallWixSiteAPI', {
             readOnlyHint: false,
             destructiveHint: true,
-            openWorldHint: false
-        }), async ({ url, body, method, siteId, reason, sourceDocUrl }, { httpClient, setToolBiParams }) => {
-            logger.log(`[CallWixSiteAPI] siteId=${siteId}, method=${method}, url=${url}, sourceDocUrl=${sourceDocUrl}, reason="${reason}", body=${JSON.stringify(body)}`);
+            openWorldHint: true
+        }), async ({ url, body, method, siteId, reason, whyNotExecuteWixAPI, sourceDocUrl }, { httpClient, setToolBiParams }) => {
+            logger.log(`[CallWixSiteAPI] siteId=${siteId}, method=${method}, url=${url}, sourceDocUrl=${sourceDocUrl}, reason="${reason}", whyNotExecuteWixAPI="${whyNotExecuteWixAPI ?? ''}", body=${JSON.stringify(body)}`);
             const requestHeaders = {
                 // Ask the Wix API edge for JSON error bodies (it serves a branded HTML
                 // error page on 4xx otherwise); */* keeps non-JSON responses working.
@@ -255,7 +263,7 @@ export function addApiCallTool(server, strategy, allowedTools = ['CallWixSiteAPI
         })(), getHints('ManageWixSite', {
             readOnlyHint: false,
             destructiveHint: true,
-            openWorldHint: false
+            openWorldHint: true
         }), async ({ url, body, method, reason }, { httpClient, setToolBiParams }) => {
             logger.log(`Calling Wix Account level API: ${url}, reason="${reason}", body: ${JSON.stringify(body)}`);
             const { isAllowed, error: urlError } = isApiUrlAllowed(url);
@@ -325,7 +333,8 @@ export function addApiCallTool(server, strategy, allowedTools = ['CallWixSiteAPI
         !disableTools.includes('UploadImageToWixSite')) {
         addUploadImageTool(server, strategy, {
             description: getDescription('UploadImageToWixSite', ''),
-            hints: toolHints?.['UploadImageToWixSite']
+            hints: toolHints?.['UploadImageToWixSite'],
+            imagePickerToolName: options?.imagePickerToolName
         });
     }
 }

package/build/dts/api-call/site-files.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Site files for UploadHeadlessWebsiteFiles, handled directly in the tool (no sandbox):
+ * the `=== FILE: … ===` text bundle, zip extraction, site-shape checks and the
+ * multipart body for the drop endpoint. Same formats the code-mode runtime
+ * accepts, so an agent can switch between ExecuteWixAPI and this tool freely.
+ */
+export interface SiteFile {
+    path: string;
+    bytes: Uint8Array;
+}
+export declare const MAX_FILES_BUNDLE_CHARS = 4000000;
+export declare const MAX_UNZIP_BYTES: number;
+export declare const MAX_SITE_FILES = 2000;
+export declare function base64ToBytes(b64: string): Uint8Array;
+/** Parse the `=== FILE: <path> ===` / `=== FILE: <path> base64 ===` bundle into bytes. */
+export declare function parseFileBundle(bundle: string | undefined): SiteFile[];
+/** Unzip (stored + deflate entries) into raw bytes. Validates the EOCD and the declared sizes. */
+export declare function unzip(z: Uint8Array): Promise<SiteFile[]>;
+export declare function crc32(bytes: Uint8Array): number;
+/** A zip of the files, every entry stored (no compression), names in UTF-8. No zip64: under 4 GB and 65,535 entries. */
+export declare function zipStored(files: SiteFile[]): Uint8Array;
+export declare const isZip: (f: SiteFile) => boolean;
+/**
+ * The file set as uploaded: zips unpacked, paths cleaned, junk dropped, within the file
+ * count and the byte budget for the whole upload. No site-shape rule yet: a Wix Astro
+ * build is told apart from a static site on this list.
+ */
+export declare function expandSiteFiles(input: SiteFile[]): Promise<SiteFile[]>;
+/**
+ * Turn the raw inputs into the file set to drop: unpack zips, drop junk, strip a
+ * single wrapping folder, require a root index.html. Throws an agent-facing error.
+ */
+export declare function normalizeSiteFiles(input: SiteFile[]): Promise<SiteFile[]>;
+/**
+ * The static-site rules on a list `expandSiteFiles` already made (its zips are not
+ * unpacked again): strip a single wrapping folder, require a root index.html.
+ */
+export declare function staticSiteFiles(expanded: SiteFile[]): SiteFile[];
+export declare function guessContentType(path: string): string;
+/** The drop endpoint's body: one `files` part per file, the path as the filename. */
+export declare function buildFormData(files: SiteFile[]): FormData;
+//# sourceMappingURL=site-files.d.ts.map

package/build/dts/api-call/site-files.js

@@ -0,0 +1,290 @@
+/**
+ * Site files for UploadHeadlessWebsiteFiles, handled directly in the tool (no sandbox):
+ * the `=== FILE: … ===` text bundle, zip extraction, site-shape checks and the
+ * multipart body for the drop endpoint. Same formats the code-mode runtime
+ * accepts, so an agent can switch between ExecuteWixAPI and this tool freely.
+ */
+// Keep the bundle to text + small base64 assets; large media belongs behind a URL.
+export const MAX_FILES_BUNDLE_CHARS = 4_000_000;
+// A dropped site is capped at 20 MB; anything expanding near this is a bomb.
+export const MAX_UNZIP_BYTES = 64 * 1024 * 1024;
+export const MAX_SITE_FILES = 2_000;
+const textEncoder = new TextEncoder();
+export function base64ToBytes(b64) {
+    const clean = b64.replace(/^data:[^,]*,/, '').replace(/\s+/g, '');
+    return Uint8Array.from(atob(clean), (c) => c.charCodeAt(0));
+}
+/** Parse the `=== FILE: <path> ===` / `=== FILE: <path> base64 ===` bundle into bytes. */
+export function parseFileBundle(bundle) {
+    if (!bundle || !bundle.trim())
+        return [];
+    if (bundle.length > MAX_FILES_BUNDLE_CHARS) {
+        throw new Error(`files bundle is too large (${bundle.length} chars; max ${MAX_FILES_BUNDLE_CHARS}). Keep it to text and small base64 assets; pass larger files through attachments or reference media by URL.`);
+    }
+    const delimiter = /^=== FILE: (.+?)(?: (base64))? ===[ \t]*$/gm;
+    const matches = [...bundle.matchAll(delimiter)];
+    if (matches.length === 0) {
+        throw new Error('files bundle has no `=== FILE: <path> ===` sections. Start each file with that line (add ` base64` before the closing === for binary content).');
+    }
+    return matches.map((match, i) => {
+        const path = match[1].trim();
+        const start = (match.index ?? 0) + match[0].length;
+        const end = i + 1 < matches.length
+            ? (matches[i + 1].index ?? bundle.length)
+            : bundle.length;
+        const content = bundle
+            .slice(start, end)
+            .replace(/^\r?\n/, '')
+            .replace(/\r?\n$/, '');
+        return {
+            path,
+            bytes: match[2] === 'base64'
+                ? base64ToBytes(content)
+                : textEncoder.encode(content)
+        };
+    });
+}
+/** Unzip (stored + deflate entries) into raw bytes. Validates the EOCD and the declared sizes. */
+export async function unzip(z) {
+    const u16 = (o) => z[o] | (z[o + 1] << 8);
+    const u32 = (o) => (u16(o) | (u16(o + 2) << 16)) >>> 0;
+    let end = z.length - 22;
+    while (end >= 0 &&
+        !(u32(end) === 0x06054b50 && end + 22 + u16(end + 20) === z.length))
+        end--;
+    if (end < 0)
+        throw new Error('not a zip file (no end-of-central-directory)');
+    const out = [];
+    let p = u32(end + 16);
+    let total = 0;
+    const decoder = new TextDecoder();
+    const n = u16(end + 10);
+    if (n > MAX_SITE_FILES) {
+        throw new Error(`zip holds ${n} entries; a site upload is at most ${MAX_SITE_FILES} files`);
+    }
+    for (let i = 0; i < n; i++) {
+        const path = decoder.decode(z.slice(p + 46, p + 46 + u16(p + 28)));
+        const method = u16(p + 10);
+        const size = u32(p + 24);
+        total += size;
+        if (total > MAX_UNZIP_BYTES) {
+            throw new Error(`zip expands past ${MAX_UNZIP_BYTES} bytes; a static site is at most 20 MB`);
+        }
+        const at = u32(p + 42);
+        const start = at + 30 + u16(at + 26) + u16(at + 28);
+        const comp = z.slice(start, start + u32(p + 20));
+        p += 46 + u16(p + 28) + u16(p + 30) + u16(p + 32);
+        if (path.endsWith('/'))
+            continue; // directory entry
+        let bytes;
+        if (method === 0)
+            bytes = comp;
+        else if (method === 8) {
+            bytes = new Uint8Array(await new Response(new Blob([comp])
+                .stream()
+                .pipeThrough(new DecompressionStream('deflate-raw'))).arrayBuffer());
+        }
+        else
+            throw new Error(`zip entry '${path}' uses unsupported compression method ${method}`);
+        if (bytes.length !== size) {
+            throw new Error(`zip entry '${path}' declares ${size} bytes but holds ${bytes.length}`);
+        }
+        out.push({ path, bytes });
+    }
+    return out;
+}
+const CRC_TABLE = (() => {
+    const t = new Uint32Array(256);
+    for (let n = 0; n < 256; n++) {
+        let c = n;
+        for (let k = 0; k < 8; k++)
+            c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+        t[n] = c >>> 0;
+    }
+    return t;
+})();
+export function crc32(bytes) {
+    let c = 0xffffffff;
+    for (let i = 0; i < bytes.length; i++)
+        c = CRC_TABLE[(c ^ bytes[i]) & 0xff] ^ (c >>> 8);
+    return (c ^ 0xffffffff) >>> 0;
+}
+/** A zip of the files, every entry stored (no compression), names in UTF-8. No zip64: under 4 GB and 65,535 entries. */
+export function zipStored(files) {
+    const encoder = new TextEncoder();
+    const entries = files.map((f) => ({
+        name: encoder.encode(f.path),
+        bytes: f.bytes,
+        crc: crc32(f.bytes)
+    }));
+    const localSize = entries.reduce((sum, e) => sum + 30 + e.name.length + e.bytes.length, 0);
+    const centralSize = entries.reduce((sum, e) => sum + 46 + e.name.length, 0);
+    const out = new Uint8Array(localSize + centralSize + 22);
+    const view = new DataView(out.buffer);
+    const UTF8_FLAG = 0x0800;
+    let p = 0;
+    const offsets = [];
+    for (const e of entries) {
+        offsets.push(p);
+        view.setUint32(p, 0x04034b50, true);
+        view.setUint16(p + 4, 20, true); // version needed
+        view.setUint16(p + 6, UTF8_FLAG, true);
+        view.setUint16(p + 8, 0, true); // stored
+        view.setUint32(p + 10, 0, true); // time, date
+        view.setUint32(p + 14, e.crc, true);
+        view.setUint32(p + 18, e.bytes.length, true);
+        view.setUint32(p + 22, e.bytes.length, true);
+        view.setUint16(p + 26, e.name.length, true);
+        view.setUint16(p + 28, 0, true);
+        out.set(e.name, p + 30);
+        out.set(e.bytes, p + 30 + e.name.length);
+        p += 30 + e.name.length + e.bytes.length;
+    }
+    const centralStart = p;
+    entries.forEach((e, i) => {
+        view.setUint32(p, 0x02014b50, true);
+        view.setUint16(p + 4, 20, true); // version made by
+        view.setUint16(p + 6, 20, true); // version needed
+        view.setUint16(p + 8, UTF8_FLAG, true);
+        view.setUint16(p + 10, 0, true);
+        view.setUint32(p + 12, 0, true);
+        view.setUint32(p + 16, e.crc, true);
+        view.setUint32(p + 20, e.bytes.length, true);
+        view.setUint32(p + 24, e.bytes.length, true);
+        view.setUint16(p + 28, e.name.length, true);
+        // extra, comment, disk, internal attrs, external attrs: zero
+        view.setUint32(p + 42, offsets[i], true);
+        out.set(e.name, p + 46);
+        p += 46 + e.name.length;
+    });
+    view.setUint32(p, 0x06054b50, true);
+    view.setUint16(p + 8, entries.length, true);
+    view.setUint16(p + 10, entries.length, true);
+    view.setUint32(p + 12, p - centralStart, true);
+    view.setUint32(p + 16, centralStart, true);
+    return out;
+}
+// A zip is recognised by its bytes (local-file-header or empty-archive signature), not its name:
+// an attachment can arrive without a file name, and a zip's path then carries no extension.
+export const isZip = (f) => (f.bytes.length >= 4 &&
+    f.bytes[0] === 0x50 &&
+    f.bytes[1] === 0x4b &&
+    ((f.bytes[2] === 0x03 && f.bytes[3] === 0x04) ||
+        (f.bytes[2] === 0x05 && f.bytes[3] === 0x06))) ||
+    /\.zip$/i.test(f.path);
+const isRootIndex = (p) => /^index\.html?$/i.test(p);
+/**
+ * The file set as uploaded: zips unpacked, paths cleaned, junk dropped, within the file
+ * count and the byte budget for the whole upload. No site-shape rule yet: a Wix Astro
+ * build is told apart from a static site on this list.
+ */
+export async function expandSiteFiles(input) {
+    const list = [];
+    let bytes = 0;
+    for (const f of input) {
+        const added = isZip(f) ? await unzip(f.bytes) : [f];
+        list.push(...added);
+        bytes += added.reduce((sum, a) => sum + a.bytes.byteLength, 0);
+        if (list.length > MAX_SITE_FILES) {
+            throw new Error(`Too many files (more than ${MAX_SITE_FILES}); a site upload is at most ${MAX_SITE_FILES}.`);
+        }
+        if (bytes > MAX_UNZIP_BYTES) {
+            throw new Error(`The upload expands past ${MAX_UNZIP_BYTES} bytes; send only the site's files.`);
+        }
+    }
+    return list
+        .map((f) => ({
+        ...f,
+        path: f.path.replace(/\\/g, '/').replace(/^\.?\//, '')
+    }))
+        .filter((f) => f.path &&
+        !f.path.startsWith('__MACOSX/') &&
+        !/(^|\/)\.DS_Store$/.test(f.path) &&
+        !f.path.split('/').includes('..'));
+}
+/**
+ * Turn the raw inputs into the file set to drop: unpack zips, drop junk, strip a
+ * single wrapping folder, require a root index.html. Throws an agent-facing error.
+ */
+export async function normalizeSiteFiles(input) {
+    return staticSiteFiles(await expandSiteFiles(input));
+}
+/**
+ * The static-site rules on a list `expandSiteFiles` already made (its zips are not
+ * unpacked again): strip a single wrapping folder, require a root index.html.
+ */
+export function staticSiteFiles(expanded) {
+    let list = expanded;
+    if (list.length === 0) {
+        throw new Error('No files to upload: pass the site in `files` or `attachments`.');
+    }
+    if (list.length > MAX_SITE_FILES) {
+        throw new Error(`Too many files (${list.length}); a site upload is at most ${MAX_SITE_FILES}.`);
+    }
+    // A zip of a folder: strip the single top-level directory so index.html sits at the root.
+    if (!list.some((f) => isRootIndex(f.path))) {
+        const first = list[0].path.split('/')[0];
+        if (list.every((f) => f.path.includes('/') && f.path.split('/')[0] === first)) {
+            list = list.map((f) => ({
+                ...f,
+                path: f.path.split('/').slice(1).join('/')
+            }));
+        }
+    }
+    // A single root HTML file is the homepage whatever its name — the drop endpoint's
+    // own rule (headless-business-setup renameToIndexHtml), applied here so the
+    // shape check below doesn't reject what the endpoint would accept.
+    const rootHtml = list.filter((f) => !f.path.includes('/') && /\.html?$/i.test(f.path));
+    if (!list.some((f) => isRootIndex(f.path)) && rootHtml.length === 1) {
+        list = list.map((f) => f === rootHtml[0] ? { ...f, path: 'index.html' } : f);
+    }
+    if (!list.some((f) => isRootIndex(f.path))) {
+        const shown = list
+            .slice(0, 8)
+            .map((f) => f.path)
+            .join(', ');
+        throw new Error(`The site needs an index.html at its root. Files received: ${shown}${list.length > 8 ? ', …' : ''}`);
+    }
+    return list;
+}
+export function guessContentType(path) {
+    const ext = (/\.([a-zA-Z0-9]+)$/.exec(path)?.[1] ?? '').toLowerCase();
+    const map = {
+        html: 'text/html',
+        htm: 'text/html',
+        css: 'text/css',
+        js: 'text/javascript',
+        mjs: 'text/javascript',
+        json: 'application/json',
+        svg: 'image/svg+xml',
+        txt: 'text/plain',
+        md: 'text/markdown',
+        xml: 'application/xml',
+        webmanifest: 'application/manifest+json',
+        ico: 'image/x-icon',
+        png: 'image/png',
+        jpg: 'image/jpeg',
+        jpeg: 'image/jpeg',
+        gif: 'image/gif',
+        webp: 'image/webp',
+        avif: 'image/avif',
+        woff: 'font/woff',
+        woff2: 'font/woff2',
+        ttf: 'font/ttf',
+        otf: 'font/otf',
+        pdf: 'application/pdf',
+        mp4: 'video/mp4',
+        webm: 'video/webm',
+        mp3: 'audio/mpeg'
+    };
+    return map[ext] ?? 'application/octet-stream';
+}
+/** The drop endpoint's body: one `files` part per file, the path as the filename. */
+export function buildFormData(files) {
+    const fd = new FormData();
+    for (const f of files) {
+        fd.append('files', new Blob([f.bytes], { type: guessContentType(f.path) }), f.path);
+    }
+    return fd;
+}
+//# sourceMappingURL=site-files.js.map