@bettercms-ai/mcp 0.66.3 → 0.66.6

package/dist/index.js

@@ -2692,7 +2692,9 @@ var NEW_TOOL_TEXT = {
   editor_setup: "Make the live build editable. A build imports only SEO/meta, media, brand and the models bcms-content.json declares; this derives the rest from the live release: pages, collections, forms, bindings, button and section components (when the authoring preference is components), Component Groups and the Content sidebar. Run it after an import or a rebuild, before the conversion brief. Idempotent: `ready` when it already ran for the live sha, else it starts (`running`; poll with `check: true` or get_deploy_status `editorSetup`). `state`: never or stale (run it), running, ready, failed. 409 = nothing is live yet: deploy first. Then get_next_steps.",
   transform_image: "Edit an existing Media Library image with an instruction (e.g. 'remove the background', 'make it dusk'); the result is saved as a NEW asset and the original is kept (5 AI credits). Returns the new asset (id, url, altText)."
 };
+var DELETE_PAGE_RUNTIME_BUNDLE = " Or, with no pageId, `runtimeBundle`: 'report' lists the duplicate pages derived from a server app's own bundle (`app/` folders); 'apply' retires them and their empty folders.";
 var PARAM_TEXT = {
+  runtimeBundle: "instead of pageId: the server-app bundle cleanup",
   editorSetupForce: "re-run a setup already ready for the live build",
   editorSetupCheck: "true = only report the state; starts nothing",
   pageDynamic: "a dynamic (collection template) page only",
@@ -2710,8 +2712,10 @@ var PARAM_TEXT = {
   sourceUrl: "instead of data: a public http(s) URL the server fetches and stores (private or internal addresses are refused)",
   focalX: "focal point, 0-1 across from the left edge; null resets to the centre",
   focalY: "focal point, 0-1 down from the top edge; null resets to the centre",
-  mergeHref: "pageId only: the link field paired with `path` (the label). Both become ONE `button` field keyed `key` (default: their stem, primaryCtaHref \u2192 primaryCta). Each entry's DRAFT gets {label, href} and keeps the old values; the live copy changes on publish. ifMatch is the page's version"
+  mergeHref: "pageId only: the link field paired with `path` (the label). Both become ONE `button` field keyed `key` (default: their stem, primaryCtaHref \u2192 primaryCta). Each entry's DRAFT gets {label, href} and keeps the old values; the live copy changes on publish. ifMatch is the page's version",
+  confirmedInput: "true only after the user explicitly approved adding this custom input (`ui.input`); else setting or changing one is refused input_needs_confirmation. Removing one needs no approval"
 };
+var INPUT_CONFIRMED_HEADER = "x-bcms-confirmed-input";
 var BUTTON_FIELD_NOTE = "'button' is ONE call to action, value {label, href, variant?, size?, arrow?, icon?, newTab?}: never a text field beside a link field.";
 var UPDATE_FIELD_DESCRIPTION = "Change ONE existing field of a content model (`modelId`) or of a page's schema (`pageId`), addressed by `path`: its key, or dot-separated keys through groups and repeaters ('hero.title'). Set its label, helpText, required, validation `config` (merged by key; null deletes one), showIf, ui or placement (null clears those). The rest of the schema is written back unchanged at the version read; a 409 means it changed since, so read again. `type` changes how every stored value is read and needs allowRetype: true. `key` renames it: stored values stay under the old key, so the route answers 409 with the entry count unless allowFieldRemoval: true discards them \u2014 migrate the values first. Ask the user before a retype or a rename. A page's label + link pair (primaryCtaText + primaryCtaHref) becomes one button with `mergeHref`.";
 var GET_SEO_DESCRIPTION = "Get the connected project's site-wide SEO settings \u2014 every key update_seo writes: seoDefaults (metaTitle, metaDescription, ogImage, twitterHandle, og, twitter, collectionSchemaTypes), siteSchema (the site's JSON-LD), robotsConfig, sitemapConfig, rssConfig, indexnowConfig and searchConfig.";
@@ -2892,7 +2896,7 @@ var fieldType = z.enum([
   "sections"
 ]);
 var slug = z.string().regex(/^[a-z0-9-]+$/, "lowercase letters, numbers, and hyphens only");
-var fieldKey = z.string().regex(/^[a-zA-Z0-9_]+$/, "letters, numbers, and underscores only");
+var fieldKey = z.string().regex(/^[a-zA-Z0-9_-]+$/, "letters, numbers, underscores, and hyphens only");
 var uiObject = z.strictObject({
   collapsed: z.boolean().optional().describe("start this panel collapsed. Use it for long optional sections."),
   preview: z.strictObject({
@@ -2914,7 +2918,13 @@ var uiObject = z.strictObject({
   // A refine, not an enum: 236 names inlined into every schema that carries `ui` would be paid on
   // every tools/list. The layoutIcon precedent; the server's z.enum is the guard.
   icon: z.string().min(1).max(40).refine((v) => DOCK_ICON_SET.has(v), `not a dock icon, see ${DOCK_ICONS_URI}`).optional().describe(`the branch row's icon, a name from ${DOCK_ICONS_URI}. Nesting fields only.`),
-  itemLabel: z.string().min(1).max(24).optional().describe("what ONE item is called ('Slide'): the add button, crumbs and empty state. Nesting fields only.")
+  itemLabel: z.string().min(1).max(24).optional().describe("what ONE item is called ('Slide'): the add button, crumbs and empty state. Nesting fields only."),
+  input: z.object({
+    name: z.string().regex(/^[a-z][a-z0-9-]{0,47}$/),
+    writes: z.array(z.string().min(1).max(64)).max(16).optional()
+  }).optional().describe(
+    "a custom dock input by NAME (the project's bettercms/inputs/<name>.tsx), a last resort after `control`, `preview` and groups. `writes`: sibling field keys it may also write, nothing else. Setting or changing it needs `confirmed: true`, sent only after the user approved it."
+  )
 });
 var propUiObject = uiObject.extend({
   group: z.strictObject({
@@ -2927,7 +2937,7 @@ var propUiObject = uiObject.extend({
 });
 var fieldShape = {
   key: fieldKey.describe(
-    "machine field key. \u{1F534} UNIQUE ACROSS THE WHOLE MODEL \u2014 API IDs share ONE FLAT NAMESPACE, so a field nested inside a group must NOT reuse a key used by another field or group. Every section's heading cannot be 'title'. Prefix with the section: 'hero_title', 'pricing_title', 'faq_title'. Reusing a key is refused, and if it slips through it leaves permanent errors in the editor and breaks conditional-visibility rules, which reference fields by bare key."
+    "machine field key. \u{1F534} UNIQUE ACROSS THE WHOLE MODEL \u2014 API IDs share ONE FLAT NAMESPACE, so a field nested inside a group must NOT reuse a key used by another field or group. Every section's heading cannot be 'title'. Prefix with the section: 'hero_title', 'pricing_title', 'faq_title'. Reusing a key is refused, and if it slips through it leaves permanent errors in the editor and breaks conditional-visibility rules, which reference fields by bare key. Keys derived from an imported site may contain hyphens ('hero-h1-welcome'): address them exactly as returned."
   ),
   label: z.string().min(1).describe("human label shown in the editor"),
   type: fieldType.describe(`field type. ${BUTTON_FIELD_NOTE}`),
@@ -3066,6 +3076,8 @@ function proseType(f) {
   if (f.type !== "text") return f.type;
   return f.richText === false ? "text" : "richtext";
 }
+var confirmedHeaders = (confirmed) => confirmed === true ? { [INPUT_CONFIRMED_HEADER]: "true" } : {};
+var withHeaders = (headers) => Object.keys(headers).length > 0 ? { headers } : {};
 function toField(f) {
   const base = {
     key: f.key,
@@ -3250,7 +3262,7 @@ function authPrompt(err) {
 var currentProject = new AsyncLocalStorage();
 var currentBranch = new AsyncLocalStorage();
 var projectIdArg = z.string().min(1).optional().describe(
-  "project id (list_projects); workspace-wide grants only"
+  "list_projects id; workspace-wide grants only"
 );
 var branchIdArg = z.string().min(1).optional().describe("content branch id (from list_branches); omit to work on main");
 var withProjectId = (def) => ({
@@ -3385,7 +3397,8 @@ function buildToolDefs(deps) {
     modelId: z.string().min(1).optional().describe("the content model to extend (from list_content_models); or send pageId"),
     pageId: z.string().min(1).optional().describe("instead of modelId: the page whose schema to extend (from list_pages / create_page)"),
     ...fieldShape,
-    after: afterArg
+    after: afterArg,
+    confirmed: z.boolean().optional().describe(PARAM_TEXT.confirmedInput)
   });
   const uploadAssetInput = z.object({
     localPath: z.string().min(1).optional().describe("absolute path to a local file (e.g. a repo image); provide this OR url"),
@@ -3457,7 +3470,8 @@ function buildToolDefs(deps) {
     translationOf: z.string().nullable().optional().describe(PARAM_TEXT.translationOf)
   });
   const deletePageInput = z.object({
-    pageId: z.string().min(1).describe("id of the page to delete (from list_pages)")
+    pageId: z.string().min(1).optional().describe("id of the page to delete (from list_pages)"),
+    runtimeBundle: z.enum(["report", "apply"]).optional().describe(PARAM_TEXT.runtimeBundle)
   });
   const deleteEntryInput = z.object({
     entryId: z.string().min(1).describe("id of the content entry to delete (from list_content_entries)")
@@ -3675,7 +3689,8 @@ function buildToolDefs(deps) {
     propLabel: z.record(z.string(), z.string().min(1).max(255)).optional().describe("prop key \u2192 label"),
     propHelpText: z.record(z.string(), z.string().max(200).nullable()).optional().describe("prop key \u2192 help text, null clears it"),
     override: z.boolean().optional().describe(OVERRIDE_NOTE),
-    ifMatch: z.number().int().min(0).optional().describe(COMPONENT_IF_MATCH_NOTE)
+    ifMatch: z.number().int().min(0).optional().describe(COMPONENT_IF_MATCH_NOTE),
+    confirmed: z.boolean().optional().describe(PARAM_TEXT.confirmedInput)
   });
   const setComponentSourceInput = z.object({
     componentId: z.string().min(1).describe("component id (from list_components)"),
@@ -3858,7 +3873,7 @@ ${d.outline}` : "Proposed Content structure.", d);
       def(
         "set_content_structure",
         "Replace the Content sidebar structure",
-        `Replace the whole Content sidebar document in one write. Follow the structure standard (read ${STRUCTURE_PLAYBOOK_URI} first; suggest_content_structure returns a ready doc). Send the complete \`doc\` and the \`version\` get_content_structure returned (0 when the project has none yet). Validated exactly like the dashboard: unique folder ids, every parentId/folderId a folder in the doc, no cycles, depth \u22644, names 1-80 chars, icons are kit names (bettercms://icons/dock; legacy lucide names still draw). A 412 VERSION_CONFLICT means someone changed it since you read it: read again and re-apply. Returns the new version and a diff. ${STRUCTURE_FENCE}`,
+        `Replace the whole Content sidebar document in one write. Follow the structure standard (read ${STRUCTURE_PLAYBOOK_URI} first; suggest_content_structure returns a ready doc). Send the complete \`doc\` and the \`version\` get_content_structure returned (0 when the project has none yet). Validated exactly like the dashboard: unique folder ids, every parentId/folderId a folder in the doc, no cycles, depth \u22644, names 1-80 chars, kit icons (bettercms://icons/dock). A 412 VERSION_CONFLICT means someone changed it since you read it: read again and re-apply. Returns the new version and a diff. ${STRUCTURE_FENCE}`,
         z.object({
           doc: z.object({
             schema: z.literal(1),
@@ -4256,7 +4271,8 @@ ${d.outline}` : "Proposed Content structure.", d);
           override: z.boolean().optional().describe(OVERRIDE_NOTE),
           ifMatch: z.number().int().min(0).optional().describe(MODEL_IF_MATCH_NOTE),
           removeFields: z.array(z.string().min(1)).min(1).max(100).optional().describe(FIELD_REMOVAL_NOTE),
-          allowFieldRemoval: z.boolean().optional().describe(ALLOW_FIELD_REMOVAL_NOTE)
+          allowFieldRemoval: z.boolean().optional().describe(ALLOW_FIELD_REMOVAL_NOTE),
+          confirmed: z.boolean().optional().describe(PARAM_TEXT.confirmedInput)
         }).shape,
         // `fields` is sent only by removeFields, rebuilt from the model just read: the PATCH
         // replaces `fields` wholesale when present.
@@ -4281,7 +4297,7 @@ ${d.outline}` : "Proposed Content structure.", d);
             (await c.fetchJSON(c.url(path), {
               method: "PATCH",
               body: JSON.stringify(body),
-              ...ifMatch !== void 0 ? { headers: { "if-match": `W/"${ifMatch}"` } } : {}
+              ...withHeaders({ ...ifMatch !== void 0 ? { "if-match": `W/"${ifMatch}"` } : {}, ...confirmedHeaders(a.confirmed) })
             })).data
           );
         }
@@ -4480,7 +4496,8 @@ ${res.warnings.join("\n")}` : summary, res.data);
           allowRetype: z.boolean().optional().describe("confirm a type change, once the user has agreed"),
           allowFieldRemoval: z.boolean().optional().describe("with a rename: discard the old key's stored values"),
           mergeHref: z.string().min(1).optional().describe(PARAM_TEXT.mergeHref),
-          ifMatch: z.number().int().min(0).optional().describe("the model's optimisticVersion; the version read when omitted")
+          ifMatch: z.number().int().min(0).optional().describe("the model's optimisticVersion; the version read when omitted"),
+          confirmed: z.boolean().optional().describe(PARAM_TEXT.confirmedInput)
         }).shape,
         // Read the model (a page's through its backingModel), patch ONE field with the helper the
         // hosted catalogue uses, and PATCH the whole list at the version read. `mergeHref` is the
@@ -4508,7 +4525,7 @@ ${res.warnings.join("\n")}` : summary, res.data);
           const updated = (await c.fetchJSON(c.url(path), {
             method: "PATCH",
             body: JSON.stringify({ fields: plan.fields, ...a.allowFieldRemoval === true ? { allowFieldRemoval: true } : {} }),
-            ...plan.ifMatch !== void 0 ? { headers: { "If-Match": `W/"${plan.ifMatch}"` } } : {}
+            ...withHeaders({ ...plan.ifMatch !== void 0 ? { "If-Match": `W/"${plan.ifMatch}"` } : {}, ...confirmedHeaders(a.confirmed) })
           })).data;
           return ok(plan.renamed ? `Renamed '${plan.renamed.from}' to '${plan.renamed.to}'.` : `Updated field '${s(a.path)}'.`, updated);
         }
@@ -4697,9 +4714,11 @@ ${res.warnings.join("\n")}` : summary, res.data);
         "get_next_steps",
         "Get what to do next",
         NEXT_STEPS_DESCRIPTION,
-        z.object({}).shape,
+        z.object({
+          importJunk: z.boolean().optional().describe("true = add rule import-junk: what an old import left, with removal calls")
+        }).shape,
         // The whole body: `receipt` rides beside `data`, and `data()` would drop it.
-        async (c) => ok("Next steps.", await c.fetchJSON(c.url(`/management/insights/next-steps`), { method: "GET" }))
+        async (c, a) => ok("Next steps.", await c.fetchJSON(c.url(`/management/insights/next-steps${a.importJunk === true ? "?importJunk=true" : ""}`), { method: "GET" }))
       ),
       def(
         "get_binding_report",
@@ -4975,7 +4994,7 @@ ${res.warnings.join("\n")}` : summary, res.data);
       def(
         "get_deploy_status",
         "Get deploy/build status",
-        "Get the connected project's deploy/build status: state (idle|queued|building|failed), whether it's publishing, the live commit sha, when it went live, and any build error. `editorSetup`: whether editing is set up for the live build (never or stale = call editor_setup). Poll this after deploy_project until state is idle with your sha live. `release` is the newest release (id, sha, status, phaseMarks, error, createdAt): while an uploaded build ingests or releases, state is `building`, `release.sha` the new sha and `lastLiveSha` still the old one; a failed deploy shows `release.status` failed with its `error`, and `held` state (`held.by`: staff, archived or no-subdomain) means the release waits until that is cleared. Also returns `canvas.lane` (the editor's live-preview lane for this site: `bridge` / `draft-route` / `none`) and `editorUrl`, the visual editor to hand the user.",
+        "Get the connected project's deploy/build status: state (idle|queued|building|failed), whether it's publishing, the live commit sha, when it went live, and any build error. `editorSetup`: whether editing is set up for the live build (never or stale = call editor_setup). Poll this after deploy_project until state is idle with your sha live. `release` is the newest release (id, sha, status, phaseMarks, error, createdAt): while an uploaded build ingests or releases, state is `building`, `release.sha` the new sha and `lastLiveSha` still the old one; a failed deploy shows `release.status` failed with its `error`, and `held` state (`held.by`: staff, archived or no-subdomain) means the release waits until that is cleared. `runtime` ({state: ok|crash-loop, restarts, oomKilled}) appears for a server app only: crash-loop means its container keeps restarting (often out of memory) though the build went live fine. Also returns `canvas.lane` (the editor's live-preview lane for this site: `bridge` / `draft-route` / `none`) and `editorUrl`, the visual editor to hand the user.",
         z.object({}).shape,
         // Flat body, no `data` envelope: `data()` read it as undefined.
         async (c) => ok("Deploy status.", await c.fetchJSON(c.url(`/management/projects/deploy-status`), { method: "GET" }))
@@ -5144,12 +5163,17 @@ ${notes.join("\n")}` : summary, created);
         async (args) => withClient(async (client) => {
           if (!args.modelId === !args.pageId) return fail("Pass exactly one of modelId (a content model) or pageId (a page).");
           if (args.pageId) {
-            const page = await client.addPageFields(args.pageId, {
+            const input2 = {
               // Cast: the SDK types `options` as string[], narrower than the API, which also takes
               // {label, value} (backend selectFieldSchema).
               addFields: [toField(args)],
               ...args.after !== void 0 ? { after: args.after } : {}
-            });
+            };
+            const page = args.confirmed === true ? (await client.fetchJSON(client.url(`/management/pages/${args.pageId}`), {
+              method: "PATCH",
+              body: JSON.stringify(input2),
+              headers: confirmedHeaders(true)
+            })).data : await client.addPageFields(args.pageId, input2);
             return ok(`Added field '${args.key}' to page '${page.title}'. Page now has ${page.fields.length} field(s).`, page);
           }
           const modelId = args.modelId;
@@ -5172,7 +5196,12 @@ ${notes.join("\n")}` : summary, created);
           const nextFields = [...existingFields];
           nextFields.splice(at, 0, toField(args));
           const input = { fields: nextFields };
-          const updated = model.optimisticVersion !== void 0 ? await client.updateModel(modelId, input, { ifMatch: model.optimisticVersion }) : await client.updateModel(modelId, input);
+          const opts = model.optimisticVersion !== void 0 ? { ifMatch: model.optimisticVersion } : void 0;
+          const updated = args.confirmed === true ? (await client.fetchJSON(client.url(`/management/content/models/${modelId}`), {
+            method: "PATCH",
+            body: JSON.stringify(input),
+            headers: { ...opts ? { "If-Match": `W/"${opts.ifMatch}"` } : {}, ...confirmedHeaders(true) }
+          })).data : opts ? await client.updateModel(modelId, input, opts) : await client.updateModel(modelId, input);
           return ok(
             `Added field '${args.key}' to '${updated.name}'${args.after ? ` after '${args.after}'` : ""}. Model now has ${updated.fields.length} field(s).`,
             updated
@@ -5310,11 +5339,19 @@ ${notes.join("\n")}` : summary, created);
       name: "delete_page",
       config: {
         title: "Delete a page",
-        description: "DELETE a page and its content. Destructive but REVERSIBLE \u2014 it soft-deletes (can be restored from the dashboard) and is audit-logged. Use it to remove a page you created by mistake. Confirm with the user before deleting content they may want.",
+        description: "DELETE a page and its content. Destructive but REVERSIBLE \u2014 it soft-deletes (can be restored from the dashboard) and is audit-logged. Use it to remove a page you created by mistake. Confirm with the user before deleting content they may want." + DELETE_PAGE_RUNTIME_BUNDLE,
         inputSchema: deletePageInput.shape
       },
       handler: guard(
         async (args) => withClient(async (client) => {
+          if (!args.pageId === !args.runtimeBundle) return fail("Pass exactly one of pageId or runtimeBundle.");
+          if (args.runtimeBundle) {
+            const res2 = await client.fetchJSON(client.url("/management/pages/retire-runtime-bundle"), {
+              method: "POST",
+              body: JSON.stringify({ dryRun: args.runtimeBundle !== "apply" })
+            });
+            return ok(args.runtimeBundle === "apply" ? "Bundle pages retired." : "Bundle pages (dry run, nothing written).", res2.data);
+          }
           const res = await client.deletePage(args.pageId);
           return ok(`Deleted page ${res.id} (soft-delete \u2014 restorable from the dashboard).`, res);
         })
@@ -5695,8 +5732,12 @@ ${lines.join("\n")}`, found);
       },
       handler: guard(
         async (args) => withClient(async (client) => {
-          const { componentId, ifMatch, ...input } = args;
-          const cmp = await client.updateComponent(componentId, input, { ifMatch });
+          const { componentId, ifMatch, confirmed, ...input } = args;
+          const cmp = confirmed === true ? (await client.fetchJSON(client.url(`/management/components/${componentId}`), {
+            method: "PATCH",
+            body: JSON.stringify(input),
+            headers: { ...ifMatch !== void 0 ? { "If-Match": `W/"${ifMatch}"` } : {}, ...confirmedHeaders(true) }
+          })).data : await client.updateComponent(componentId, input, { ifMatch });
           return ok(`Updated component '${cmp.name}' (id ${cmp.id}).`, cmp);
         })
       )
@@ -6136,7 +6177,9 @@ components \u2014 is \`editor_setup\`, run on demand against the live build. The
     ->  submit_conversion_receipt / submit_componentize_receipt  ->  deploy
 
 \`get_deploy_status\` \`editorSetup\` (and get_next_steps) say when it has not run for the live
-build: \`never\` or \`stale\` \u2192 run it before anything below.
+build: \`never\` or \`stale\` \u2192 run it before anything below. It also fills missing meta from the
+pages' own copy, merges components that are identical, and switches to declared bindings when the
+build proves every binding declared; get_next_steps lists only what it could not do.
 
 **Builds run \`build:bcms\` instead of \`build\`** when package.json declares one: the build alone,
 without CI checks (\`"build:bcms": "astro build"\` beside \`"build": "astro check && astro build"\`),
@@ -6614,7 +6657,8 @@ hand. THE ORDER, and every step of it matters:
    \`unmatched\` 0 and \`unaddressable\` under 2% of each route's visible text (\xA711). Fix what it
    names IN THE SOURCE and release again until \`coverage.pending\` is empty.
 7. \`set_binding_mode { declaredBindings: true }\` and release ONE MORE TIME \u2014 the mode applies to
-   the next release, not to the one already out.
+   the next release, not to the one already out. (editor_setup sets it itself when the build
+   already declares every binding; skip this step when get_binding_report reads \`declared\`.)
 
 **Or let BetterCMS propose the edit.** \`get_conversion_plan\` returns an APPROVED conversion \u2014 the
 exact new contents of each template file, reviewed by a human in the dashboard and already checked