@mokoconsulting/mcp-mokosuite 1.1.0-dev.372 → 1.1.0

package/.mokogit/workflows/pre-release.yml

@@ -7,8 +7,8 @@
 # INGROUP: MokoCLI.Release
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogit/workflows/pre-release.yml
-# VERSION: 06.01.00
-# BRIEF: Batched pre-release on nightly schedule + manual dispatch (rolling dev/rc asset, build-metadata version — #404); non-Joomla MokoGIT release + cosmetic release-notes are best-effort. npm publishing moved OUT of this universal workflow into Template-NPM's dedicated npm-publish.yml so it can't leak into non-npm repos via sync.
+# VERSION: 06.03.00
+# BRIEF: Batched pre-release on nightly schedule + manual dispatch (rolling dev/rc asset, build-metadata version — #404); non-Joomla MokoGIT release + cosmetic release-notes are best-effort. npm publishing moved OUT of this universal workflow into Template-NPM's dedicated npm-publish.yml so it can't leak into non-npm repos via sync. The dev push trigger now skips [skip ci]/[skip bump] commits (bump-on-dev: release_bump_dev.php's [skip ci] base-bump commit on dev must not spawn a redundant dev-channel build).
 
 name: "Universal: Pre-Release"
 
@@ -93,7 +93,11 @@ jobs:
     if: >-
       !startsWith(github.event.repository.name, 'Template-') &&
       (
-        github.event_name == 'push' ||
+        (
+          github.event_name == 'push' &&
+          !contains(github.event.head_commit.message, '[skip ci]') &&
+          !contains(github.event.head_commit.message, '[skip bump]')
+        ) ||
         github.event_name == 'schedule' ||
         (
           github.event_name == 'workflow_dispatch' &&
@@ -305,6 +309,19 @@ jobs:
             echo "::notice::Platform '$PLATFORM' eligible for pre-release (joomla_family=${IS_JOOMLA_FAMILY})"
           fi
 
+      - name: "Require Makefile (pre-release gate)"
+        if: steps.eligibility.outputs.proceed == 'true'
+        # Enforce the same Makefile requirement as auto-release, but only when the
+        # platform is eligible to build/release (pre-release legitimately no-ops for
+        # ineligible platforms). Post-checkout step: a job-level if: cannot see the workspace.
+        run: |
+          if [ ! -f Makefile ] && [ ! -f makefile ] && [ ! -f GNUmakefile ]; then
+            echo "::error::pre-release requires a Makefile at the repository root — none found. A release-bearing repo must ship a Makefile (build/package targets). Aborting."
+            echo "## Pre-release blocked: no Makefile at repo root" >> "$GITHUB_STEP_SUMMARY"
+            exit 1
+          fi
+          echo "Makefile present — pre-release may proceed."
+
       - name: Resolve metadata and bump version
         id: meta
         if: steps.eligibility.outputs.proceed == 'true'

package/.mokogit/workflows/rc-revert.yml

@@ -16,6 +16,9 @@ on:
   pull_request:
     types: [closed]
 
+permissions:
+  contents: write
+
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
@@ -34,7 +37,7 @@ jobs:
           BRANCH: ${{ github.event.pull_request.head.ref }}
           REPO: ${{ github.repository }}
           GIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
-          TOKEN: ${{ secrets.MOKOGIT_TOKEN || github.token }}
+          TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
           # BRANCH is attacker-controlled (PR head ref). Strict allowlist before ANY use.

package/CHANGELOG.md

@@ -4,23 +4,6 @@ All notable changes to this project are documented here, following [Keep a Chang
 
 ## [Unreleased]
 
-## [01.01.00] - 2026-08-15
-
-### Added
-- **Layer 1 (Extensions Store / MokoSuiteExtensions)** — 5 MCP tools against the
-  `/v1/mokosuiteextensions` base path:
-  - Reads: `store_catalog_list` (`GET /catalog`), `store_catalog_get`
-    (`GET /catalog/{id}`).
-  - Writes: `store_install` (`POST /catalog/{id}/install`), `store_update`
-    (`POST /catalog/{id}/update`), `store_uninstall`
-    (`POST /catalog/{id}/uninstall`, `confirm: true` guard — destructive).
-- Bumped the MCP server advertised version to `1.1.0`.
-
-### Note
-- The store write routes (`/install`, `/update`, `/uninstall`) are being added to
-  the store REST API in parallel and may not be live on a site until that ships and
-  deploys. The read routes exist. The tools are defined now regardless.
-
 ## [01.00.00] - 2026-07-26
 
 ### Added

package/Makefile

@@ -1,70 +1,94 @@
-# MCP Server Makefile
+# NPM / Node Project Makefile
 # Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
 # SPDX-License-Identifier: GPL-3.0-or-later
+#
+# Native build/test/lint/package logic for an npm package (incl. MCP servers). The
+# identity block below is the version source of truth — auto-filled per repo by the
+# mokocli workflow sync (--makefiles).
 
-PROJECT_NAME := mcp-mokosuite
-PROJECT_VERSION := 1.0.0
+# ==============================================================================
+# Identity (auto-filled by workflow sync — the Makefile is the version source of truth)
+# ==============================================================================
+PROJECT_NAME    := mcp-mokosuite
+PROJECT_VERSION := 1.1.0
+PLATFORM        := npm
 
-NPM := npm
+# ==============================================================================
+# Configuration
+# ==============================================================================
+SRC_DIR   := src/
+BUILD_DIR := build
+NPM       := npm
+NODE      := node
+# Prefer `npm ci` when a lockfile is present (reproducible), else `npm install`.
+NPM_INSTALL := $(shell [ -f package-lock.json ] && echo ci || echo install)
 
-COLOR_RESET := \033[0m
-COLOR_GREEN := \033[32m
-COLOR_BLUE := \033[34m
+COLOR_RESET  := \033[0m
+COLOR_GREEN  := \033[32m
+COLOR_YELLOW := \033[33m
+COLOR_BLUE   := \033[34m
+COLOR_RED    := \033[31m
 
+# ==============================================================================
+# Targets
+# ==============================================================================
 .PHONY: help
 help: ## Show this help message
-	@echo "$(COLOR_BLUE)$(PROJECT_NAME) v$(PROJECT_VERSION)$(COLOR_RESET)"
-	@echo ""
-	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "  $(COLOR_BLUE)%-20s$(COLOR_RESET) %s\n", $$1, $$2}'
+	@echo "$(COLOR_BLUE)$(PROJECT_NAME) v$(PROJECT_VERSION) — npm package$(COLOR_RESET)"
 	@echo ""
+	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "  $(COLOR_BLUE)%-16s$(COLOR_RESET) %s\n", $$1, $$2}'
 
 .PHONY: install-deps
-install-deps: ## Install dependencies
-	@$(NPM) install
-	@echo "$(COLOR_GREEN)✓ Dependencies installed$(COLOR_RESET)"
-
-MOKO_PLATFORM ?= $(or $(wildcard ../mokocli),$(wildcard $(HOME)/mokocli),$(wildcard /opt/mokocli))
-MINIFY_SCRIPT := $(MOKO_PLATFORM)/build/minify.js
+install-deps: ## Install dependencies (npm ci if lockfile present, else install)
+	@$(NPM) $(NPM_INSTALL)
+	@echo "$(COLOR_GREEN)✓ dependencies installed$(COLOR_RESET)"
 
-.PHONY: minify
-minify: ## Minify CSS/JS assets
-	@echo "Minifying assets..."
-	@if [ -f "$(MINIFY_SCRIPT)" ]; then \
-		node "$(MINIFY_SCRIPT)" $(SRC_DIR); \
-	elif [ -f "scripts/minify.js" ]; then \
-		node scripts/minify.js; \
-	else \
-		echo "No minify script found"; \
-	fi
+.PHONY: lint
+lint: ## Run the package lint script when defined
+	@if grep -q '"lint"' package.json 2>/dev/null; then $(NPM) run lint; \
+	  else echo "$(COLOR_YELLOW)⚠ no lint script — skipping$(COLOR_RESET)"; fi
 
-.PHONY: build
-build: minify ## Build TypeScript
-	@$(NPM) run build
-	@echo "$(COLOR_GREEN)✓ Build complete$(COLOR_RESET)"
+.PHONY: validate
+validate: lint ## Alias: static validation (lint)
 
-.PHONY: dev
-dev: ## Watch and rebuild on changes
-	@$(NPM) run dev
+.PHONY: test
+test: ## Run the package test script when defined
+	@if grep -q '"test"' package.json 2>/dev/null; then $(NPM) test; \
+	  else echo "$(COLOR_YELLOW)⚠ no test script — skipping$(COLOR_RESET)"; fi
 
 .PHONY: clean
-clean: ## Clean build artifacts
-	@rm -rf dist
-	@echo "$(COLOR_GREEN)✓ Cleaned$(COLOR_RESET)"
+clean: ## Remove build artifacts
+	@rm -rf $(BUILD_DIR)
+	@echo "$(COLOR_GREEN)✓ cleaned $(BUILD_DIR)/$(COLOR_RESET)"
 
-.PHONY: setup
-setup: ## Run interactive setup wizard
-	@$(NPM) run setup
+.PHONY: build
+build: ## Run the package build script when defined
+	@if grep -q '"build"' package.json 2>/dev/null; then $(NPM) run build; \
+	  echo "$(COLOR_GREEN)✓ built$(COLOR_RESET)"; \
+	  else echo "$(COLOR_YELLOW)⚠ no build script — nothing to build$(COLOR_RESET)"; fi
+
+.PHONY: minify
+minify: ## Minify assets under $(SRC_DIR) via the mokocli build agent when available
+	@MOKO=$(or $(wildcard ../mokocli),$(wildcard $(HOME)/mokocli),$(wildcard /opt/mokocli)); \
+	  if [ -n "$$MOKO" ] && [ -f "$$MOKO/build/minify.js" ]; then $(NODE) "$$MOKO/build/minify.js" $(SRC_DIR); \
+	  elif [ -f scripts/minify.js ]; then $(NODE) scripts/minify.js; \
+	  else echo "$(COLOR_YELLOW)⚠ no minify script found$(COLOR_RESET)"; fi
 
-.PHONY: start
-start: ## Start the MCP server
-	@$(NPM) run start
+.PHONY: package
+package: build ## Create the npm tarball (npm pack) + .sha256
+	@echo "$(COLOR_BLUE)Packaging $(PROJECT_NAME)-$(PROJECT_VERSION)...$(COLOR_RESET)"
+	@mkdir -p $(BUILD_DIR)
+	@$(NPM) pack --pack-destination $(BUILD_DIR) >/dev/null
+	@tgz=$$(ls -t $(BUILD_DIR)/*.tgz | head -1); \
+	  sha256sum "$$tgz" | awk '{print $$1}' > "$$tgz.sha256"; \
+	  echo "$(COLOR_GREEN)✓ packaged: $$tgz$(COLOR_RESET)"
 
-.PHONY: lint
-lint: ## Run linter
-	@$(NPM) run lint
+.PHONY: release
+release: validate test package ## Validate, test, and package for release
+	@echo "$(COLOR_GREEN)✓ release artifacts ready for $(PROJECT_NAME) v$(PROJECT_VERSION)$(COLOR_RESET)"
 
-.PHONY: ci
-ci: install-deps build ## Run CI pipeline
-	@echo "$(COLOR_GREEN)✓ CI pipeline complete$(COLOR_RESET)"
+.PHONY: version
+version: ## Print the resolved version (Makefile is the source of truth)
+	@echo "$(PROJECT_NAME) $(PROJECT_VERSION) ($(PLATFORM))"
 
 .DEFAULT_GOAL := help

package/dist/index.js

@@ -21,8 +21,6 @@ import { ApiClient } from './client.js';
 import { hasRemoteControl } from './signing.js';
 /** Base path for MokoSuiteClient Web Services (appended after /api/index.php). */
 const MSC = '/v1/mokosuiteclient';
-/** Base path for MokoSuiteExtensions (store) Web Services (appended after /api/index.php). */
-const MSE = '/v1/mokosuiteextensions';
 let config;
 function clientFor(connection) {
     return new ApiClient(getConnection(config, connection));
@@ -53,7 +51,7 @@ function requireConfirm(confirm) {
 // ── Server ──────────────────────────────────────────────────────────────
 const server = new McpServer({
     name: 'mcp-mokosuite',
-    version: '1.1.0',
+    version: '1.0.0',
 });
 // ════════════════════════════════════════════════════════════════════════
 // FOUNDATION — connectivity & generic access
@@ -170,31 +168,6 @@ server.tool('client_users_force_logout', 'Terminate ALL user sessions on a MokoS
         return guard;
     return formatResponse(await clientFor(connection).remoteControl('POST', `${MSC}/users/force-logout`));
 });
-// ════════════════════════════════════════════════════════════════════════
-// LAYER 1 — Extensions Store (MokoSuiteExtensions)
-// ════════════════════════════════════════════════════════════════════════
-server.tool('store_catalog_list', 'List the products available in the MokoSuite Extensions store catalog for a site.', { ...ConnectionParam }, async ({ connection }) => formatResponse(await clientFor(connection).get(`${MSE}/catalog`)));
-server.tool('store_catalog_get', 'Get a single MokoSuite Extensions store product by its catalog id.', {
-    id: z.number().describe('Catalog product id'),
-    ...ConnectionParam,
-}, async ({ id, connection }) => formatResponse(await clientFor(connection).get(`${MSE}/catalog/${id}`)));
-server.tool('store_install', 'Install a MokoSuite Extensions store product on a site by its catalog id.', {
-    id: z.number().describe('Catalog product id to install'),
-    ...ConnectionParam,
-}, async ({ id, connection }) => formatResponse(await clientFor(connection).post(`${MSE}/catalog/${id}/install`)));
-server.tool('store_update', 'Update an installed MokoSuite Extensions store product on a site by its catalog id.', {
-    id: z.number().describe('Catalog product id to update'),
-    ...ConnectionParam,
-}, async ({ id, connection }) => formatResponse(await clientFor(connection).post(`${MSE}/catalog/${id}/update`)));
-server.tool('store_uninstall', 'Uninstall a MokoSuite Extensions store product from a site by its catalog id. Destructive — requires `confirm: true`.', {
-    id: z.number().describe('Catalog product id to uninstall'),
-    confirm: z.boolean().describe('Must be true — uninstalling removes the product from the target site'),
-    ...ConnectionParam,
-}, async ({ id, confirm, connection }) => {
-    if (!confirm)
-        return text('Refused: set `confirm: true` to uninstall this store product.');
-    return formatResponse(await clientFor(connection).post(`${MSE}/catalog/${id}/uninstall`));
-});
 // ── Start Server ────────────────────────────────────────────────────────
 async function main() {
     config = await loadConfig();

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@mokoconsulting/mcp-mokosuite",
-	"version": "1.1.0-dev.372",
+	"version": "1.1.0",
 	"description": "MCP server for MokoSuite (Joomla) REST API v1 operations",
 	"type": "module",
 	"main": "dist/index.js",

package/src/index.ts

@@ -25,9 +25,6 @@ import type { ApiConfig, ApiResponse } from './types.js';
 /** Base path for MokoSuiteClient Web Services (appended after /api/index.php). */
 const MSC = '/v1/mokosuiteclient';
 
-/** Base path for MokoSuiteExtensions (store) Web Services (appended after /api/index.php). */
-const MSE = '/v1/mokosuiteextensions';
-
 let config: ApiConfig;
 
 function clientFor(connection?: string): ApiClient {
@@ -67,7 +64,7 @@ function requireConfirm(confirm: boolean): { content: Array<{ type: 'text'; text
 
 const server = new McpServer({
 	name: 'mcp-mokosuite',
-	version: '1.1.0',
+	version: '1.0.0',
 });
 
 // ════════════════════════════════════════════════════════════════════════
@@ -325,61 +322,6 @@ server.tool(
 	},
 );
 
-// ════════════════════════════════════════════════════════════════════════
-// LAYER 1 — Extensions Store (MokoSuiteExtensions)
-// ════════════════════════════════════════════════════════════════════════
-
-server.tool(
-	'store_catalog_list',
-	'List the products available in the MokoSuite Extensions store catalog for a site.',
-	{ ...ConnectionParam },
-	async ({ connection }) => formatResponse(await clientFor(connection).get(`${MSE}/catalog`)),
-);
-
-server.tool(
-	'store_catalog_get',
-	'Get a single MokoSuite Extensions store product by its catalog id.',
-	{
-		id: z.number().describe('Catalog product id'),
-		...ConnectionParam,
-	},
-	async ({ id, connection }) => formatResponse(await clientFor(connection).get(`${MSE}/catalog/${id}`)),
-);
-
-server.tool(
-	'store_install',
-	'Install a MokoSuite Extensions store product on a site by its catalog id.',
-	{
-		id: z.number().describe('Catalog product id to install'),
-		...ConnectionParam,
-	},
-	async ({ id, connection }) => formatResponse(await clientFor(connection).post(`${MSE}/catalog/${id}/install`)),
-);
-
-server.tool(
-	'store_update',
-	'Update an installed MokoSuite Extensions store product on a site by its catalog id.',
-	{
-		id: z.number().describe('Catalog product id to update'),
-		...ConnectionParam,
-	},
-	async ({ id, connection }) => formatResponse(await clientFor(connection).post(`${MSE}/catalog/${id}/update`)),
-);
-
-server.tool(
-	'store_uninstall',
-	'Uninstall a MokoSuite Extensions store product from a site by its catalog id. Destructive — requires `confirm: true`.',
-	{
-		id: z.number().describe('Catalog product id to uninstall'),
-		confirm: z.boolean().describe('Must be true — uninstalling removes the product from the target site'),
-		...ConnectionParam,
-	},
-	async ({ id, confirm, connection }) => {
-		if (!confirm) return text('Refused: set `confirm: true` to uninstall this store product.');
-		return formatResponse(await clientFor(connection).post(`${MSE}/catalog/${id}/uninstall`));
-	},
-);
-
 // ── Start Server ────────────────────────────────────────────────────────
 
 async function main(): Promise<void> {

package/.mokogit/workflows/cascade-dev.yml

@@ -1,266 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: MokoGIT.Workflow
-# INGROUP: MokoCLI.Cascade
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogit/workflows/cascade-dev.yml
-# VERSION: 02.04.00
-# BRIEF: Cascade main -> dev; branch-motivated (no schedule); skips dev-only repos (no main); auto-merge clean, auto-resolve routine conflicts INLINE (manifest version / .mokogit-.gitea-.github / docs-stamps) with no mokocli dependency, fall back to cascade_resolve.php then notify
-
-name: "Cascade Main -> Dev"
-
-on:
-  # Branch-motivated (no time-based schedule): any real push to main cascades to
-  # dev immediately. Sync commits from workflow_sync.php carry [skip ci] and are
-  # skipped by the platform (they fire no trigger at all), so workflow_sync.php
-  # dispatches this workflow directly (workflow_dispatch) after it changes a repo
-  # — that is what carries .mokogit drift down to dev, replacing the old daily cron.
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  pull-requests: write
-
-env:
-  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
-  # ntfy destination is configured via repo or org variables (org vars are inherited).
-  NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
-  NTFY_TOPIC: ${{ vars.CASCADE_NTFY_TOPIC || vars.NTFY_TOPIC || 'git-releases' }}
-
-jobs:
-  cascade:
-    name: Cascade main -> dev
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout (full history for merge/resolve)
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          token: ${{ github.token }}
-
-      - name: Cascade main -> dev (auto-resolve routine conflicts, else notify)
-        env:
-          TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
-        run: |
-          set -uo pipefail
-          API="${MOKOGIT_URL}/api/v1/repos/${REPO}"
-          AUTH="Authorization: token ${TOKEN}"
-          jqget() { python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('$1',''))" 2>/dev/null; }
-
-          # 0. dev must exist
-          if ! curl -sf -H "$AUTH" "${API}/branches/dev" >/dev/null 2>&1; then
-            echo "No dev branch - nothing to cascade."; exit 0
-          fi
-
-          # 0b. main must exist too. A dev-only repo (no main branch) has nothing to
-          # cascade FROM, so skip immediately instead of spinning up on the daily
-          # schedule / manual dispatch and no-op'ing later via a failed compare.
-          if ! curl -sf -H "$AUTH" "${API}/branches/main" >/dev/null 2>&1; then
-            echo "No main branch (dev-only repo) - nothing to cascade."; exit 0
-          fi
-
-          # 1. is main ahead of dev?
-          AHEAD=$(curl -sf -H "$AUTH" "${API}/compare/dev...main" \
-            | python3 -c "import sys,json; print(json.load(sys.stdin).get('total_commits',0))" 2>/dev/null || echo 0)
-          if [ "${AHEAD:-0}" -eq 0 ]; then
-            echo "dev already up to date with main."; exit 0
-          fi
-          echo "main is ${AHEAD} commit(s) ahead of dev."
-
-          # 2. reuse an open main->dev PR, else create one
-          PR=$(curl -sf -H "$AUTH" "${API}/pulls?state=open&base=dev" \
-            | python3 -c "import sys,json; d=json.load(sys.stdin); print(next((str(p['number']) for p in d if p.get('head',{}).get('ref')=='main'), ''))" 2>/dev/null || echo "")
-          if [ -z "$PR" ]; then
-            RESP=$(curl -s -H "$AUTH" -H "Content-Type: application/json" -X POST "${API}/pulls" \
-              -d '{"head":"main","base":"dev","title":"chore(sync): cascade main -> dev","body":"Automated cascade of main into dev. Auto-merges when conflict-free, auto-resolves VERSION-stamp-only conflicts, otherwise left open for manual resolution."}')
-            PR=$(printf '%s' "$RESP" | jqget number)
-            if [ -z "$PR" ]; then
-              echo "::warning::Could not open cascade PR: $RESP"; exit 0
-            fi
-            echo "Opened cascade PR #${PR}"
-          else
-            echo "Reusing open cascade PR #${PR}"
-          fi
-
-          notify() {
-            curl -sS \
-              -H "Title: ${REPO}: dev cascade needs manual merge" \
-              -H "Tags: warning,twisted_rightwards_arrows" \
-              -H "Priority: high" \
-              -H "Click: ${MOKOGIT_URL}/${REPO}/pulls/${PR}" \
-              -d "main -> dev cascade PR #${PR} $1 It was NOT auto-merged; resolve it manually." \
-              "${NTFY_URL}/${NTFY_TOPIC}" || true
-          }
-
-          # 3. wait for MokoGIT to compute mergeability (conflict detection)
-          MERGEABLE=""
-          for _ in 1 2 3 4 5 6; do
-            MERGEABLE=$(curl -sf -H "$AUTH" "${API}/pulls/${PR}" | jqget mergeable)
-            case "$MERGEABLE" in True|False) break ;; esac
-            sleep 3
-          done
-          echo "mergeable=${MERGEABLE}"
-
-          # 4a. conflict-free -> merge via API (existing behaviour)
-          if [ "$MERGEABLE" = "True" ]; then
-            CODE=$(curl -s -o /tmp/merge.json -w "%{http_code}" -H "$AUTH" -H "Content-Type: application/json" \
-              -X POST "${API}/pulls/${PR}/merge" -d '{"Do":"merge","merge_when_checks_succeed":true}')
-            if [ "$CODE" -ge 200 ] && [ "$CODE" -lt 300 ]; then
-              echo "Cascade PR #${PR} merged (or scheduled to merge when checks pass)."
-              exit 0
-            fi
-            echo "::warning::Auto-merge returned HTTP ${CODE}: $(cat /tmp/merge.json)"
-            notify "could not be auto-merged (HTTP ${CODE})."
-            exit 0
-          fi
-
-          # 4b. conflicts -> try to auto-resolve if they are ONLY VERSION-stamp lines.
-          echo "PR not cleanly mergeable; checking whether conflicts are VERSION-stamp-only..."
-          git config user.name  "MokoGIT Cascade"
-          git config user.email "actions@mokoconsulting.tech"
-          git fetch --quiet origin main dev
-          git checkout -B dev origin/dev
-
-          if git merge --no-ff --no-commit origin/main >/dev/null 2>&1; then
-            # Became clean at git level (e.g. mergeability was still computing) -> commit + push.
-            git commit -m "chore(sync): cascade main -> dev [skip ci]" >/dev/null
-            git push origin dev
-            echo "Cascade merged cleanly at git level and pushed to dev."
-            exit 0
-          fi
-
-          CONFLICTS=$(git diff --name-only --diff-filter=U)
-          echo "Conflicted files:"; echo "${CONFLICTS}"
-
-          # --- Inline resolver (pure bash/git, NO mokocli dependency) -------------
-          # The common cascade churn is routine and deterministic, so resolve it here
-          # BEFORE reaching for cascade_resolve.php. This is what keeps the version
-          # ladder moving even when mokocli is unreachable on an ephemeral runner
-          # (the failure mode this workflow was hardened against): a pure
-          # version-stamp conflict must never stall dev behind main.
-          #
-          #   * manifest <version> conflicts (*.xml containing <extension) ->
-          #       version = max(dev, main) via `sort -V`, rewriting the tag while
-          #       preserving the file's own indentation (repos MIX tab and 2-space).
-          #   * .mokogit/** .gitea/** .github/** -> take main/canonical (--theirs).
-          #   * docs / CHANGELOG / stamp files    -> keep dev            (--ours).
-          # Anything still conflicted afterwards falls through to cascade_resolve.php
-          # (if available) and finally to a human, exactly as before.
-          resolve_manifest_version() {
-            # $1 = path to a conflicted *.xml manifest. Resolves ONLY the <version>
-            # conflict to max(dev,main); returns 0 if fully resolved, 1 otherwise.
-            local f="$1"
-            # Bail if the conflict touches anything other than a single <version> line
-            # on each side (i.e. a real content conflict, not just the stamp).
-            local nonver
-            nonver=$(awk '
-              /^<<<<<<< /{c=1;next} /^=======$/{c=2;next} /^>>>>>>> /{c=0;next}
-              (c==1||c==2) && $0 !~ /<version>[^<]*<\/version>/ {print "X"}
-            ' "$f")
-            [ -n "$nonver" ] && return 1
-            # Collect the version value from each side of every conflict hunk.
-            local ours theirs maxv
-            ours=$(awk '
-              /^<<<<<<< /{c=1;next} /^=======$/{c=2;next} /^>>>>>>> /{c=0;next}
-              c==1' "$f" | sed -n 's/.*<version>\([^<]*\)<\/version>.*/\1/p' | head -n1)
-            theirs=$(awk '
-              /^<<<<<<< /{c=1;next} /^=======$/{c=2;next} /^>>>>>>> /{c=0;next}
-              c==2' "$f" | sed -n 's/.*<version>\([^<]*\)<\/version>.*/\1/p' | head -n1)
-            [ -z "$ours" ] && [ -z "$theirs" ] && return 1
-            maxv=$(printf '%s\n%s\n' "$ours" "$theirs" | grep -v '^$' | sort -V | tail -n1)
-            [ -z "$maxv" ] && return 1
-            # Rewrite: drop conflict markers, keep OUR side's <version> line but with
-            # the max value substituted (preserves this file's leading indentation,
-            # tab or spaces). Drop the theirs-side version line.
-            awk -v maxv="$maxv" '
-              /^<<<<<<< /{c=1;next}
-              /^=======$/{c=2;next}
-              /^>>>>>>> /{c=0;next}
-              {
-                if (c==2) next
-                if (($0 ~ /<version>[^<]*<\/version>/) && (c==1)) {
-                  sub(/<version>[^<]*<\/version>/, "<version>" maxv "</version>")
-                }
-                print
-              }' "$f" > "${f}.resolved" && mv "${f}.resolved" "$f"
-            # Fully resolved only if no markers remain.
-            ! grep -qE '^(<<<<<<< |=======$|>>>>>>> )' "$f"
-          }
-
-          for f in ${CONFLICTS}; do
-            case "$f" in
-              .mokogit/*|.gitea/*|.github/*)
-                git checkout --theirs -- "$f" && git add -- "$f" \
-                  && echo "resolved (theirs/main): $f" ;;
-              *CHANGELOG*|*/docs/*|docs/*|*.md|*VERSION*|*.stamp)
-                git checkout --ours -- "$f" && git add -- "$f" \
-                  && echo "resolved (ours/dev): $f" ;;
-              *.xml)
-                if grep -q '<extension' "$f" 2>/dev/null && resolve_manifest_version "$f"; then
-                  git add -- "$f"; echo "resolved (manifest version=max): $f"
-                else
-                  echo "unresolved (xml, not a simple version stamp): $f"
-                fi ;;
-              *)
-                echo "unresolved (needs deeper resolver): $f" ;;
-            esac
-          done
-
-          # If the inline pass cleared every conflict, commit + push and we are done —
-          # no mokocli needed.
-          if [ -z "$(git diff --name-only --diff-filter=U)" ]; then
-            git commit -m "chore(sync): cascade main -> dev (auto-resolved inline) [skip ci]" >/dev/null
-            git push origin dev
-            echo "Cascade auto-resolved inline (no mokocli) and pushed to dev."
-            curl -s -H "$AUTH" -H "Content-Type: application/json" -X POST "${API}/issues/${PR}/comments" \
-              -d '{"body":"Cascade auto-resolved inline (manifest version=max(dev,main), .mokogit/.gitea/.github -> main, docs/stamps -> dev) with no mokocli dependency, and pushed to dev. Closing."}' >/dev/null || true
-            curl -s -H "$AUTH" -H "Content-Type: application/json" -X PATCH "${API}/pulls/${PR}" \
-              -d '{"state":"closed"}' >/dev/null || true
-            exit 0
-          fi
-
-          echo "Inline pass left conflicts; falling back to cascade_resolve.php..."
-          echo "Still conflicted:"; git diff --name-only --diff-filter=U
-
-          # --- Fallback: cascade_resolve.php (existing behaviour) -----------------
-          # Handles the messier cases (modify/delete, plugin renames, etc.). It BAILS
-          # (exit 2) on real code conflicts, so those still get a human. ubuntu-latest
-          # has no /opt/mokocli, so clone mokocli on demand.
-          RESOLVER=/opt/mokocli/cli/cascade_resolve.php
-          if [ ! -f "$RESOLVER" ]; then
-            if git clone --depth 1 --quiet \
-                 "https://x-access-token:${MOKOGIT_TOKEN}@${MOKOGIT_URL#https://}/MokoConsulting/mokocli.git" \
-                 /tmp/mokocli 2>/dev/null \
-               || git clone --depth 1 --quiet "${MOKOGIT_URL}/MokoConsulting/mokocli.git" /tmp/mokocli 2>/dev/null; then
-              RESOLVER=/tmp/mokocli/cli/cascade_resolve.php
-            else
-              # Do NOT swallow this silently: a degraded run must be visible so the
-              # operator knows the fallback resolver was unavailable.
-              echo "::warning::On-demand mokocli clone failed; cascade_resolve.php is UNAVAILABLE. Inline resolver handled the routine classes; any remaining conflicts need a human."
-              RESOLVER=/tmp/mokocli/cli/cascade_resolve.php
-            fi
-          fi
-
-          if [ -f "$RESOLVER" ] && php "$RESOLVER" --path . --theirs-ref origin/main; then
-            git commit -m "chore(sync): cascade main -> dev (auto-resolved) [skip ci]" >/dev/null
-            git push origin dev
-            echo "Cascade auto-resolved and pushed to dev."
-            curl -s -H "$AUTH" -H "Content-Type: application/json" -X POST "${API}/issues/${PR}/comments" \
-              -d '{"body":"cascade_resolve auto-resolved the merge (manifests/workflows/docs/stamps, modify-delete) and pushed to dev. Closing."}' >/dev/null || true
-            curl -s -H "$AUTH" -H "Content-Type: application/json" -X PATCH "${API}/pulls/${PR}" \
-              -d '{"state":"closed"}' >/dev/null || true
-            exit 0
-          fi
-
-          # Resolver unavailable, or it bailed on a real (code) conflict -> human.
-          git merge --abort || true
-          notify "has code conflicts cascade_resolve could not safely auto-resolve."
-          exit 0