@contentrain/skills 0.9.5 → 0.9.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contentrain/skills",
-  "version": "0.9.5",
+  "version": "0.9.6",
   "license": "MIT",
   "description": "AI agent skills for Contentrain — workflow procedures, framework integration guides",
   "type": "module",
@@ -61,9 +61,9 @@
     "tsdown": "^0.21.0",
     "typescript": "^5.7.0",
     "vitest": "^3.0.0",
-    "@contentrain/mcp": "3.9.0",
+    "@contentrain/mcp": "3.10.1",
     "@contentrain/rules": "0.7.3",
-    "@contentrain/wp-import": "0.9.4"
+    "@contentrain/wp-import": "0.13.0"
   },
   "scripts": {
     "build": "tsdown src/index.ts --format esm,cjs --dts",

package/skills/contentrain-migrate-wordpress/SKILL.md

@@ -36,9 +36,11 @@ REST returns more than WXR (rendered HTML, media metadata, per-type discovery);
 **Private or partial REST.** A site can answer `/wp-json` but hide drafts, private types and some fields. An Application Password lifts the run to `rest_auth`:
 
 ```bash
-npx contentrain import https://example.com --auth "user:xxxx xxxx xxxx xxxx"
+CONTENTRAIN_WP_APP_PASSWORD="xxxx xxxx xxxx xxxx" npx contentrain import https://example.com --auth user
 ```
 
+Ask the user to set the password in the environment (or run the command themselves for the hidden prompt). Never put `user:password` on the command line: it lands in shell history. A WXR import leaves author and commenter e-mail addresses out of the store; add `--include-emails` only when the user asks and the repository stays private.
+
 Check first, so you tell the user what they will get rather than discovering it after:
 
 ```bash
@@ -76,7 +78,7 @@ Open `import-report.json` and tell the user what it says. These fields decide wh
 | `title_fallback` | Entries that had no title | They exist but are unlabelled; worth a pass |
 | `acf_fields` / `meta_fields` | Custom fields found and their inferred types | Verify the types match intent before content is edited |
 
-**Known gap:** post bodies carry Gutenberg block comments and shortcodes verbatim. They render as-is in HTML but they are WordPress syntax, not portable content. Say so — do not present the import as clean markup when it is not.
+**Known gap:** post bodies carry shortcodes (`[gallery]`) verbatim: WordPress syntax, not portable content. Gutenberg block delimiters are stripped (the markup stays); self-closing server-rendered blocks (`wp:latest-posts`, `wp:block`) leave nothing and are counted in `blocks_dynamic_dropped`. Say so — do not present the import as clean markup when shortcodes remain.
 
 ### 4. Validate
 

package/skills/contentrain-migrate-wordpress/references/wordpress-mapping.md

@@ -76,7 +76,7 @@ Inferred types are a guess from one value. Check `meta_fields` and `acf_fields`
 
 ## What is not imported
 
-Post types matching `attachment|nav_menu_item|wp_*|jp_*|pattern|revision|oembed_cache|customize_changeset|user_request|custom_css` are skipped and listed in `report.skipped_types`, and so are theme / page-builder internals that store design rather than content: GeneratePress elements (`gp_elements`, `gp-elements`), GenerateBlocks styles (`gblocks_*`, `gblocks-*`), Elementor templates (`elementor_library`, `e-landing-page`) and form definitions (`wpcf7_contact_form`, `wpforms*`). Membership and other content-bearing CPTs stay; ACF field records stay too, since their cross-model parents are part of the lossless import. Attachments are not skipped content — they arrive as the `media` collection.
+Post types matching `attachment|nav_menu_item|wp_*|jp_*|pattern|revision|oembed_cache|customize_changeset|user_request|custom_css` are skipped and listed in `report.skipped_types`, and so are theme / page-builder internals that store design rather than content: GeneratePress elements (`gp_elements`, `gp-elements`), GenerateBlocks styles (`gblocks_*`, `gblocks-*`), Elementor templates (`elementor_library`) and form definitions (`wpcf7_contact_form`, `wpforms*`). Elementor landing pages (`e-landing-page`) are not internals: they are public pages at `/<slug>/`, so they import as `page` — into the `pages` model, with their slug, permalink (`link`) and meta, sharing the page address space (a clash gets the usual slug move). Over REST the type is listed only when it is `show_in_rest`; a site that hides it must be imported from a WXR export. Membership and other content-bearing CPTs stay; ACF field records stay too, since their cross-model parents are part of the lossless import. Attachments are not skipped content — they arrive as the `media` collection.
 
 Also outside the import: themes, widgets, plugin settings, users' passwords and roles, and the media **files** themselves (only their metadata and URLs come across).
 
@@ -90,6 +90,6 @@ A relation whose target was not part of the import (a comment on a skipped post
 
 ## Known gaps
 
-- **Gutenberg and shortcodes** stay verbatim in `body`. `<!-- wp:paragraph -->` and `[gallery]` render as-is in HTML but they are WordPress syntax; converting them is a separate pass.
+- **Gutenberg block delimiters** (`<!-- wp:… -->`, `<!-- /wp:… -->`) are stripped from `body`; the markup inside every block stays. Self-closing, server-rendered blocks (`wp:latest-posts`, `wp:block`, `wp:query`) hold no markup and disappear: `blocks_dynamic_dropped` in the report counts them by name. **Shortcodes** (`[gallery]`) stay verbatim in `body`; converting them is a separate pass.
 - **Media files** stay on the old host until moved.
 - **Redirects** are not generated. `slug_rewritten` + `slug_fallback` in the report say how many URLs changed.