@bridge_gpt/mcp-server 0.2.65 → 0.2.67

package/build/sfcc/write-grants.js

@@ -13,6 +13,7 @@
  * where a caller can read it without parsing text and `result.isError === true`
  * still detects the failure.
  */
+import { OCAPI_SETTINGS_STRUCTURE_VERSION } from "./config.js";
 import { formatSfccWriteFailure } from "./sfcc-result.js";
 // ---------------------------------------------------------------------------
 // Write resource families
@@ -25,7 +26,7 @@ export const OCAPI_WRITE_RESOURCE_IDS = [
     "/system_object_definitions",
     "/system_object_definitions/**",
     "/custom_object_definitions/**",
-    "/site_preferences/**",
+    "/sites/*/site_preferences/**",
 ];
 /**
  * The exact HTTP methods each resource family needs, derived from the methods
@@ -50,27 +51,32 @@ export const OCAPI_WRITE_RESOURCE_IDS = [
  *                                    custom preference create.
  *   /custom_object_definitions/**    put, patch (+get for ETag) — attribute
  *                                    definition create/update.
- *   /site_preferences/**             patch (+get) — site_preference_values_set,
- *                                    a direct PATCH with no ETag round trip.
+ *   site-scoped site_preferences     patch (+get) — site_preference_values_set,
+ *                                    a direct PATCH with no ETag round trip on
+ *                                    the site-scoped resource (the org-level
+ *                                    /site_preferences/** is read/search only).
  */
 export const OCAPI_WRITE_RESOURCE_METHODS = {
     "/system_object_definitions": ["get"],
     "/system_object_definitions/**": ["get", "put", "patch"],
     "/custom_object_definitions/**": ["get", "put", "patch"],
-    "/site_preferences/**": ["get", "patch"],
+    "/sites/*/site_preferences/**": ["get", "patch"],
 };
 // ---------------------------------------------------------------------------
 // Grant JSON builders
 // ---------------------------------------------------------------------------
 /**
- * Build the OCAPI Settings write-grant object for the given version.
+ * Build the OCAPI Settings write-grant object.
+ *
+ * `_v` is the settings-structure version, never an OCAPI API version, so no
+ * caller can override it.
  *
  * The `clientIdPlaceholder` stays as `<YOUR_CLIENT_ID>` by default so the output
  * is safe to print and paste — the real resolved client_id is never substituted.
  */
-export function buildOcapiWriteGrantSettings(ocapiVersion, clientIdPlaceholder = "<YOUR_CLIENT_ID>") {
+export function buildOcapiWriteGrantSettings(clientIdPlaceholder = "<YOUR_CLIENT_ID>") {
     return {
-        _v: ocapiVersion,
+        _v: OCAPI_SETTINGS_STRUCTURE_VERSION,
         clients: [
             {
                 client_id: clientIdPlaceholder,
@@ -85,8 +91,8 @@ export function buildOcapiWriteGrantSettings(ocapiVersion, clientIdPlaceholder =
     };
 }
 /** Pretty-printed JSON string of the write-grant settings. */
-export function formatOcapiWriteGrantJson(ocapiVersion, clientIdPlaceholder = "<YOUR_CLIENT_ID>") {
-    return JSON.stringify(buildOcapiWriteGrantSettings(ocapiVersion, clientIdPlaceholder), null, 2);
+export function formatOcapiWriteGrantJson(clientIdPlaceholder = "<YOUR_CLIENT_ID>") {
+    return JSON.stringify(buildOcapiWriteGrantSettings(clientIdPlaceholder), null, 2);
 }
 // ---------------------------------------------------------------------------
 // 403 write-grant UX
@@ -115,7 +121,7 @@ export function ocapiWriteForbiddenMessage(operation, path) {
  * same way an OCAPI read fault body is preserved.
  */
 export function writeGrantForbiddenResult(params) {
-    const { operation, path, ocapiVersion, body } = params;
+    const { operation, path, body } = params;
     return formatSfccWriteFailure({
         code: "OCAPI_WRITE_ERROR",
         status: 403,
@@ -127,7 +133,7 @@ export function writeGrantForbiddenResult(params) {
             remediation: {
                 business_manager_path: OCAPI_WRITE_GRANT_BUSINESS_MANAGER_PATH,
                 instruction: OCAPI_WRITE_GRANT_CLIENT_ID_INSTRUCTION,
-                write_grant: buildOcapiWriteGrantSettings(ocapiVersion),
+                write_grant: buildOcapiWriteGrantSettings(),
             },
             ...(body === undefined ? {} : { body }),
         },

package/build/sfcc/write-result.js

@@ -16,7 +16,6 @@
  * pre-transport ones.
  */
 import { writeGrantForbiddenResult } from "./write-grants.js";
-import { DEFAULT_OCAPI_VERSION } from "./config.js";
 import { formatSfccWriteFailure } from "./sfcc-result.js";
 import { redactSfccBody } from "./read-body.js";
 /** Wrap text in the standard MCP text-result shape (success path only). */
@@ -72,12 +71,14 @@ function ocapiWriteFaultMessage(body, status) {
  * `Response.status` verbatim, so the reported status *is* the upstream status
  * and the shared formatter would rightly omit a duplicate.
  */
-export function formatOcapiWriteToolResult(result, operation, path, ocapiVersion = DEFAULT_OCAPI_VERSION) {
+export function formatOcapiWriteToolResult(result, operation, path, 
+// Kept for call compatibility. It no longer reaches the grant JSON: `_v` there
+// is the settings-structure version, which an API version must not override.
+_ocapiVersion) {
     if (result.status === 403) {
         return writeGrantForbiddenResult({
             operation,
             path,
-            ocapiVersion,
             body: result.body,
         });
     }

package/build/sfcc/writes-site-preference.js

@@ -2,9 +2,11 @@
  * SFCC site-preference value write tool (BAPI-584).
  *
  * Implements:
- *   site_preference_values_set — PATCH /site_preferences/preference_groups/{group}/sandbox
+ *   site_preference_values_set — PATCH /sites/{site_id}/site_preferences/preference_groups/{group}/sandbox
  *
- * Sets custom site-preference VALUES through the OCAPI Data API. Sandbox-only:
+ * Sets custom site-preference VALUES through the OCAPI Data API for ONE named
+ * site. `site_id` is required and is never derived from `dw.json`: a destructive
+ * write must not pick its target silently. Sandbox-only:
  * the value endpoint would otherwise accept `production`, so the `{instance}`
  * segment is forced to the `sandbox` literal AFTER the shared sandbox guard has
  * validated the requested instance. The body is a FLAT map of `c_`-prefixed
@@ -35,7 +37,17 @@ const INSTANCE_ENUM = z.enum(["staging", "development", "sandbox", "production"]
 // safeguard on the OCAPI route.
 const INSTANCE_DESCRIBE = "OCAPI instance context. v1 supports the 'sandbox' context only; any other " +
     "value is rejected before OCAPI is called.";
+// A site id is one URL path segment. This is a conservative single-segment
+// pattern (no separators, whitespace, or dots), not a claim about the full set
+// OCAPI allows; the exact constraint is confirmed by owner check OR-1.
+const SITE_ID_PATTERN = /^[A-Za-z0-9_-]+$/;
+const SITE_ID_DESCRIBE = "Site id to write to; required, never defaulted. Not 'instance'.";
 const sitePreferenceValuesSetInput = z.object({
+    site_id: z
+        .string()
+        .min(1)
+        .regex(SITE_ID_PATTERN, "site_id must contain only letters, digits, '_' or '-'.")
+        .describe(SITE_ID_DESCRIBE),
     group: z.string().describe("Custom site preference group id, e.g. 'LLMIntegration'."),
     instance: INSTANCE_ENUM.optional().default("sandbox").describe(INSTANCE_DESCRIBE),
     values: sitePreferenceValuesPatchBodySchema.describe("Flat map of c_-prefixed preference ids to values (string, number, boolean, or string[])."),
@@ -44,12 +56,12 @@ const sitePreferenceValuesSetInput = z.object({
 // Path builder
 // ---------------------------------------------------------------------------
 /**
- * Build the site-preference group PATCH path. The `{instance}` segment is the
+ * Build the site-scoped site-preference group PATCH path. The `{instance}` segment is the
  * `sandbox` literal — a non-sandbox instance is rejected by the guard before
  * this is called, so a non-sandbox value can never leak into transport.
  */
-export function sitePreferenceGroupPath(group) {
-    return `/site_preferences/preference_groups/${encodedSegment(group)}/sandbox`;
+export function sitePreferenceGroupPath(siteId, group) {
+    return `/sites/${encodedSegment(siteId)}/site_preferences/preference_groups/${encodedSegment(group)}/sandbox`;
 }
 // ---------------------------------------------------------------------------
 // Handler
@@ -66,7 +78,7 @@ export function buildSitePreferenceValuesSetHandler(gateDeps) {
         const guard = rejectIfNotSandboxForWrite(parsed.instance);
         if (guard)
             return guard;
-        const path = sitePreferenceGroupPath(parsed.group);
+        const path = sitePreferenceGroupPath(parsed.site_id, parsed.group);
         const body = buildSitePreferenceValuesPatchPayload(parsed.values);
         try {
             // Direct PATCH (no ETag round trip): the value endpoint does not gate on
@@ -92,10 +104,10 @@ export const SITE_PREFERENCE_WRITE_TOOL_NAMES = ["site_preference_values_set"];
 export function registerSitePreferenceWriteTools(registerTool, deps) {
     const { gateDeps } = deps;
     registerTool("site_preference_values_set", {
-        description: "Set site-preference VALUES via PATCH /site_preferences/preference_groups/{group}/sandbox. " +
+        description: "Set site-preference VALUES via PATCH /sites/{site_id}/site_preferences/preference_groups/{group}/sandbox. " +
             "Preference must already be defined via custom_preference_definition_create. Sandbox-only, " +
             "destructive; flat c_-prefixed id→value map (string/number/boolean/string[]). " +
-            "Bad group → 404 CustomPreferenceGroupNotFoundException. 403 → paste-ready grant JSON.",
+            "Bad group → 404. 403 → paste-ready grant JSON.",
         inputSchema: sitePreferenceValuesSetInput,
         annotations: WRITE_ANNOTATIONS,
     }, buildSitePreferenceValuesSetHandler(gateDeps));