@bettercms-ai/mcp 0.79.1 → 0.80.1

package/dist/index.js

@@ -2907,6 +2907,14 @@ var LISTING_TAIL = /* @__PURE__ */ new Set([
   "generate_image",
   "transform_image",
   "write_alt_text",
+  // Custom integrations: reached for once a site exists and its owner names a vendor.
+  "list_integrations",
+  "get_integration",
+  "create_integration",
+  "update_integration",
+  "delete_integration",
+  "test_integration_fetch",
+  "run_integration_sync",
   // The ABM campaign lane — also hidden from the default listing (ABM_TOOLS below).
   "research_account",
   "build_abm_page",
@@ -2990,7 +2998,14 @@ var NEW_TOOL_TEXT = {
   import_redirects: "Bulk-create redirects for a migration, from `rows` or from `text` in `format` (our CSV export, a Netlify `_redirects` file, or a vercel.json). Call it with `dryRun: true` FIRST: nothing is written and each row comes back `would-create`, `existing` or `skipped` with a reason. Rows get create_redirect's rules. Max 5000.",
   editor_setup: "Make the live build editable: derives pages, collections, forms, bindings and components from the live release (skill bindings). Run it after an import or a rebuild, before the conversion brief. Idempotent: `ready` when it already ran for the live sha, else it starts (`running`; poll with `check: true`). `state`: never or stale (run it), running, ready, failed. 409 = nothing is live yet: deploy first. Then get_next_steps.",
   transform_image: "Edit an existing Media Library image with an instruction (e.g. 'remove the background', 'make it dusk'); the result is saved as a NEW asset and the original is kept (5 AI credits). Returns the new asset (id, url, altText).",
-  write_alt_text: "Alt text for a Media Library image (mediaId) or an https image URL (url), written from its pixels (1 AI credit). A suggestion: save it with update_media."
+  write_alt_text: "Alt text for a Media Library image (mediaId) or an https image URL (url), written from its pixels (1 AI credit). A suggestion: save it with update_media.",
+  list_integrations: "List the project's custom integrations (any vendor with a public API: jobs boards, stores, CRMs, video). Each has its allowed hosts, secret NAMES with `secretsPresent` (is the env var set; never the value), `inject` (where the secrets go), syncs, panel and `approved`. Read bettercms://skill/integrations before building one.",
+  get_integration: "One integration (`integration`: id or slug) with its last 20 sync runs (status, counts, error).",
+  create_integration: "Declare a custom integration: `allowedHosts` (exact hostnames the server may call), `secrets` (template name -> project env var KEY), `inject` (the headers / query parameters that carry them on every request, e.g. {headers: {authorization: 'Bearer {{secret.TOKEN}}'}}), `allowPost` (GET only unless true), optional `auth` token exchange (inject {{token}}), `syncs` (vendor list -> collection) and `panel`. Secret VALUES never pass through here: the user sets them under Settings \u2192 Environment variables (production); list_env_vars shows the names. Until an admin approves it, vendor calls and syncs are refused: give the user `approval.approveUrl` and the `approval.changes` in plain words. You cannot approve it yourself.",
+  update_integration: "Change an integration (`integration`: id or slug); keys you leave out are kept, and `secrets`, `inject` and `syncs` replace the stored ones whole. Changing `allowedHosts`, `secrets`, `inject`, `allowPost` or `auth` withdraws its approval until an admin approves again (`approval.approveUrl`). Name, syncs, settings and panel never need approval.",
+  delete_integration: "Delete an integration and its sync runs. Entries it synced stay (their provenance still names it); the env vars stay.",
+  run_integration_sync: "Run one of an integration's syncs now (`integration`, `sync`: its key): every page of the vendor list is fetched and each item is created or updated as a DRAFT entry, matched on its externalKey, so a re-run only changes what changed (`unchanged` counts the rest); `publish: true` on the sync publishes what changed. Answers with the run: queued, running, done (counts: created, updated, unchanged, failed, pages, items) or failed (error). `waitSeconds` (\u2264 20) waits for it to finish; else follow it with get_integration. A sync with `schedule` 'hourly' or 'daily' also runs on its own.",
+  test_integration_fetch: "Call the vendor once through the server, as the integration: an approved host only, with the integration's `inject` secrets added server-side and every secret redacted from the answer. The request itself takes no {{...}} templates, and the token endpoint cannot be called. Use it to read the response shape before writing a sync: `items`, `externalKey` and `map` are JSON Pointers into it. Bodies over 1 MB come back truncated. 409 integration_not_approved: an admin must approve it first."
 };
 var DELETE_PAGE_RUNTIME_BUNDLE = " Or, with no pageId, `runtimeBundle`: 'report' lists the duplicate pages derived from a server app's own bundle (`app/` folders); 'apply' retires them and their empty folders.";
 var FIELD_LOCKED_NOTE = "A readOnly 'developer' field keeps its stored value: changing or omitting it without schema access is 403 FIELD_LOCKED.";
@@ -3041,6 +3056,23 @@ var PARAM_TEXT = {
   mergeHref: "pageId only: the link field paired with `path` (the label). Both become ONE `button` field keyed `key` (default: their stem, primaryCtaHref \u2192 primaryCta). Each entry's DRAFT gets {label, href} and keeps the old values; the live copy changes on publish. ifMatch is the page's version. 409 CODE_RENDERED_ROUTE: do its `next` recipe in code",
   confirmedInput: "true only after the user explicitly approved adding this custom input (`ui.input`); else setting or changing one is refused input_needs_confirmation. Removing one needs no approval"
 };
+var INTEGRATION_PARAM_TEXT = {
+  integration: "the integration's id or slug (from list_integrations)",
+  slug: "lowercase letters, digits, hyphens; at most 48",
+  allowedHosts: "exact hostnames the server may call, e.g. ['boards-api.greenhouse.io']; https only",
+  secrets: "template name (UPPER_SNAKE) -> project env var KEY, e.g. {TOKEN: 'SHOPIFY_ADMIN_TOKEN'}; never a value",
+  inject: "where the secrets go on every vendor request: {headers?: {name: template}, query?: {name: template}}, templates {{secret.NAME}} or {{token}}",
+  allowPost: "true lets requests other than GET through (vendor writes, POST search APIs such as Apollo's); GET only when omitted",
+  auth: "optional token exchange: {request:{method,url,headers?,query?,form?}, tokenPath, expiresInPath?, ttlSeconds?}; {{secret.NAME}} in its values; its result is {{token}}",
+  settings: "non-secret JSON the panel reads and writes (store id, toggles); at most 16 KB",
+  syncs: "[{key, contentModelId, request:{method,url,headers?,query?}, pagination?:{style:'none'|'page'|'cursor'|'link', param?, cursorPath?, maxPages?}, items, externalKey, slug?, map:{fieldKey: pointer | {path, transform?:'string'|'number'|'boolean'|'join'}}, publish?, schedule?:'hourly'|'daily'|null}]; pointers are JSON Pointers",
+  panel: "the custom panel's slug: bettercms/panels/<panel>.tsx in the site repo; null for the stock page",
+  url: "the full https URL on an allowed host (no templates in the URL)",
+  sync: "the sync's key (from the integration's syncs)",
+  headers: "header -> value (no templates: the integration's inject adds the secrets)",
+  query: "query parameter -> value (no templates)",
+  json: "a JSON body for POST"
+};
 var INPUT_CONFIRMED_HEADER = "x-bcms-confirmed-input";
 var BUTTON_FIELD_NOTE = "'button' is ONE call to action, value {label, href, variant? (a Button family look), size?, arrow?, icon?, newTab?, rel?, fullWidth?} (arrow:false, icon:null off): never a text field beside a link field.";
 var LINK_VALUE_NOTE = "A link or button href: a URL string or {type: url|page|entry|email|phone|anchor|file, href, title?, newTab?, rel?, section?, ref: page/entry id}.";
@@ -3511,6 +3543,16 @@ function proseType(f) {
 }
 var confirmedHeaders = (confirmed) => confirmed === true ? { [INPUT_CONFIRMED_HEADER]: "true" } : {};
 var withHeaders = (headers) => Object.keys(headers).length > 0 ? { headers } : {};
+var integrationShape = {
+  allowedHosts: z.array(z.string()).max(10).optional().describe(INTEGRATION_PARAM_TEXT.allowedHosts),
+  secrets: z.record(z.string(), z.string()).optional().describe(INTEGRATION_PARAM_TEXT.secrets),
+  inject: z.object({ headers: z.record(z.string(), z.string()).optional(), query: z.record(z.string(), z.string()).optional() }).optional().describe(INTEGRATION_PARAM_TEXT.inject),
+  allowPost: z.boolean().optional().describe(INTEGRATION_PARAM_TEXT.allowPost),
+  auth: z.record(z.string(), z.unknown()).nullable().optional().describe(INTEGRATION_PARAM_TEXT.auth),
+  settings: z.record(z.string(), z.unknown()).optional().describe(INTEGRATION_PARAM_TEXT.settings),
+  syncs: z.array(z.record(z.string(), z.unknown())).max(20).optional().describe(INTEGRATION_PARAM_TEXT.syncs),
+  panel: z.string().max(48).nullable().optional().describe(INTEGRATION_PARAM_TEXT.panel)
+};
 var DRY_RUN_SUMMARY = "Dry run: nothing was written.";
 var dryRunOf = async (client, method, path, body, headers = {}) => ok(DRY_RUN_SUMMARY, await client.fetchJSON(client.url(path), { method, body: JSON.stringify({ ...body, dryRun: true }), ...withHeaders(headers) }));
 function toField(f) {
@@ -5180,6 +5222,83 @@ ${d.outline}` : "Proposed Content structure.", d);
         // The whole body: a `test` delivery's outcome rides beside `data`.
         async (c, a) => ok("Webhook created. Store the `secret` now: it is never shown again.", await c.fetchJSON(c.url(`/management/webhooks`), { method: "POST", body: JSON.stringify({ name: a.name, url: a.url, events: a.events, isActive: a.isActive, test: a.test }) }))
       ),
+      def(
+        "list_integrations",
+        "List custom integrations",
+        NEW_TOOL_TEXT.list_integrations,
+        z.object({}).shape,
+        async (c) => ok("Integrations.", await data(c, "GET", `/management/integrations`))
+      ),
+      def(
+        "get_integration",
+        "Get a custom integration",
+        NEW_TOOL_TEXT.get_integration,
+        z.object({ integration: z.string().min(1).describe(INTEGRATION_PARAM_TEXT.integration) }).shape,
+        async (c, a) => ok("Integration.", await data(c, "GET", `/management/integrations/${s(a.integration)}`))
+      ),
+      def(
+        "create_integration",
+        "Create a custom integration",
+        NEW_TOOL_TEXT.create_integration,
+        z.object({
+          slug: z.string().min(1).max(48).describe(INTEGRATION_PARAM_TEXT.slug),
+          name: z.string().min(1).max(120).describe("a label, 1-120 chars"),
+          vendor: z.string().max(60).optional().describe("the vendor's name, e.g. 'Greenhouse'"),
+          ...integrationShape
+        }).shape,
+        // The whole body: `approval` rides beside `data`.
+        async (c, a) => ok("Integration created.", await c.fetchJSON(c.url(`/management/integrations`), { method: "POST", body: JSON.stringify(a) }))
+      ),
+      def(
+        "update_integration",
+        "Update a custom integration",
+        NEW_TOOL_TEXT.update_integration,
+        z.object({
+          integration: z.string().min(1).describe(INTEGRATION_PARAM_TEXT.integration),
+          name: z.string().min(1).max(120).optional().describe("a label, 1-120 chars"),
+          vendor: z.string().max(60).nullable().optional().describe("the vendor's name"),
+          ...integrationShape
+        }).shape,
+        async (c, a) => {
+          const { integration, ...body } = a;
+          return ok("Integration updated.", await c.fetchJSON(c.url(`/management/integrations/${s(integration)}`), { method: "PATCH", body: JSON.stringify(body) }));
+        }
+      ),
+      def(
+        "delete_integration",
+        "Delete a custom integration",
+        NEW_TOOL_TEXT.delete_integration,
+        z.object({ integration: z.string().min(1).describe(INTEGRATION_PARAM_TEXT.integration) }).shape,
+        async (c, a) => ok("Integration deleted.", await data(c, "DELETE", `/management/integrations/${s(a.integration)}`))
+      ),
+      def(
+        "run_integration_sync",
+        "Run an integration's sync",
+        NEW_TOOL_TEXT.run_integration_sync,
+        z.object({
+          integration: z.string().min(1).describe(INTEGRATION_PARAM_TEXT.integration),
+          sync: z.string().min(1).describe(INTEGRATION_PARAM_TEXT.sync),
+          waitSeconds: z.number().min(0).max(50).optional().describe(PARAM_TEXT.waitSeconds)
+        }).shape,
+        async (c, a) => ok("Sync run.", await data(c, "POST", withWait(`/management/integrations/${s(a.integration)}/syncs/${s(a.sync)}/run`, a.waitSeconds)))
+      ),
+      def(
+        "test_integration_fetch",
+        "Call a vendor through an integration",
+        NEW_TOOL_TEXT.test_integration_fetch,
+        z.object({
+          integration: z.string().min(1).describe(INTEGRATION_PARAM_TEXT.integration),
+          url: z.string().url().describe(INTEGRATION_PARAM_TEXT.url),
+          method: z.enum(["GET", "POST"]).optional().describe("GET when omitted"),
+          headers: z.record(z.string(), z.string()).optional().describe(INTEGRATION_PARAM_TEXT.headers),
+          query: z.record(z.string(), z.string()).optional().describe(INTEGRATION_PARAM_TEXT.query),
+          json: z.unknown().optional().describe(INTEGRATION_PARAM_TEXT.json)
+        }).shape,
+        async (c, a) => {
+          const { integration, ...req } = a;
+          return ok("Vendor response.", await data(c, "POST", `/management/integrations/${s(integration)}/fetch`, req));
+        }
+      ),
       def(
         "list_branches",
         "List content branches",