@neopress/mcp 1.0.0 → 1.1.1

package/dist/bin.cjs

@@ -3838,7 +3838,7 @@ var require_fast_uri = __commonJS({
         if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
           if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
             try {
-              parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
+              parsed.host = new URL("http://" + parsed.host).hostname;
             } catch (e) {
               parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
             }
@@ -51345,13 +51345,33 @@ function serializeTemplate(t) {
     id: t.id,
     name: t.name,
     description: t.description ?? null,
-    industry: t.industry,
     referenceUrl: t.reference_url,
     previewImgUrls: t.preview_img_urls,
     previewVideoUrl: t.preview_video_url ?? null,
     createdAt: t.created_at
   };
 }
+function serializeHeadshot(h) {
+  return {
+    id: h.id,
+    imageUrl: h.image_url,
+    width: h.width,
+    height: h.height,
+    aspectRatio: h.aspect_ratio,
+    mimeType: h.mime_type,
+    byteSize: h.byte_size,
+    ageBand: h.age_band,
+    gender: h.gender,
+    ethnicity: h.ethnicity,
+    attire: h.attire,
+    variationIndex: h.variation_index,
+    gptPrompt: h.gpt_prompt,
+    tags: h.tags ?? [],
+    isActive: h.is_active,
+    createdAt: h.created_at,
+    updatedAt: h.updated_at
+  };
+}
 function serializeSite(site) {
   return {
     id: site.id,
@@ -51405,7 +51425,8 @@ var PagesEndpoint = class {
   }
   async list(params) {
     const { page, limit, offset } = this.client.resolvePagination(params);
-    let query = this.client.db.from("pages").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null).order("path");
+    let query = this.client.db.from("pages").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("path");
     if (params?.status)
       query = query.eq("status", params.status);
     const { data, error: error48, count } = await query.range(offset, offset + limit - 1);
@@ -52691,8 +52712,10 @@ var CollectionsEndpoint = class {
   get basePath() {
     return `${this.client.siteBasePath}/collections`;
   }
-  async list() {
-    const { data, error: error48 } = await this.client.db.from("collections").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null).order("name");
+  async list(params) {
+    let query = this.client.db.from("collections").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("name");
+    const { data, error: error48 } = await query;
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return (data ?? []).map((r) => serializeCollection(r));
@@ -52765,7 +52788,7 @@ var EntriesEndpoint = class {
   }
   async list(collectionId, params) {
     const { page, limit, offset } = this.client.resolvePagination(params);
-    let query = this.client.db.from("entries").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).eq("collection_id", collectionId).is("deleted_at", null).order("created_at", { ascending: false });
+    let query = this.client.db.from("entries").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).eq("collection_id", collectionId).is("deleted_at", null).order("created_at", { ascending: params?.order === "asc" });
     if (params?.status)
       query = query.eq("status", params.status);
     if (params?.locale)
@@ -52856,8 +52879,10 @@ var FormsEndpoint = class {
   get basePath() {
     return `${this.client.siteBasePath}/forms`;
   }
-  async list() {
-    const { data, error: error48 } = await this.client.db.from("forms").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null).order("name");
+  async list(params) {
+    let query = this.client.db.from("forms").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("name");
+    const { data, error: error48 } = await query;
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     const rows = data ?? [];
@@ -52936,7 +52961,7 @@ var AssetsEndpoint = class {
   }
   async list(params) {
     const { page, limit, offset } = this.client.resolvePagination(params);
-    const { data, error: error48, count } = await this.client.db.from("assets").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).order("created_at", { ascending: false }).range(offset, offset + limit - 1);
+    const { data, error: error48, count } = await this.client.db.from("assets").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).order("created_at", { ascending: params?.order === "asc" }).range(offset, offset + limit - 1);
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     const rows = data ?? [];
@@ -53002,7 +53027,7 @@ var SiteEndpoint = class {
   constructor(client) {
     this.client = client;
   }
-  async list() {
+  async list(params) {
     const profileId = this.client.authUserId;
     if (!profileId) {
       throw new NeopressApiError("NO_AUTH", "site.list requires an authenticated access token", 0);
@@ -53010,10 +53035,15 @@ var SiteEndpoint = class {
     const { data, error: error48 } = await this.client.db.from("sites_profiles").select("role, sites!inner(*)").eq("profile_id", profileId).eq("status", "active");
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
-    return (data ?? []).map((m) => ({
+    const sites = (data ?? []).map((m) => ({
       ...serializeSite(m.sites),
       role: m.role
     }));
+    if (params?.order) {
+      const dir = params.order === "asc" ? 1 : -1;
+      sites.sort((a, b) => (a.createdAt ?? "") < (b.createdAt ?? "") ? -dir : (a.createdAt ?? "") > (b.createdAt ?? "") ? dir : 0);
+    }
+    return sites;
   }
   async get() {
     const { data, error: error48 } = await this.client.db.from("sites").select("*").eq("id", this.client.siteIdNumber).single();
@@ -53051,8 +53081,10 @@ var RedirectsEndpoint = class {
   constructor(client) {
     this.client = client;
   }
-  async list() {
-    const { data, error: error48 } = await this.client.db.from("redirect_rules").select("*").eq("site_id", this.client.siteIdNumber).order("priority", { ascending: true });
+  async list(params) {
+    let query = this.client.db.from("redirect_rules").select("*").eq("site_id", this.client.siteIdNumber);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("priority", { ascending: true });
+    const { data, error: error48 } = await query;
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return (data ?? []).map((r) => serializeRedirect(r));
@@ -53062,7 +53094,7 @@ var RedirectsEndpoint = class {
       site_id: this.client.siteIdNumber,
       source: data.source,
       destination: data.destination,
-      redirect_type: data.redirectType ?? 307,
+      redirect_type: data.redirectType ?? 308,
       include_children: data.includeChildren ?? false,
       preserve_path: data.preservePath ?? false,
       enabled: data.enabled !== false,
@@ -53129,7 +53161,7 @@ var EntryReferencesEndpoint = class {
       query = query.eq("from_entry_id", params.fromEntryId);
     if (params?.toEntryId)
       query = query.eq("to_entry_id", params.toEntryId);
-    const { data, error: error48 } = await query.order("created_at", { ascending: false });
+    const { data, error: error48 } = await query.order("created_at", { ascending: params?.order === "asc" });
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return (data ?? []).map((r) => serializeEntryReference(r));
@@ -53251,18 +53283,165 @@ var TemplatesEndpoint = class {
     const res = await this.client.delete(this.basePath);
     return res.data;
   }
+  /**
+   * List templates across the sites the caller can access.
+   *
+   * Direct-DB: `templates` is public-read and `sites` RLS scopes the visible set
+   * (own active memberships, or all sites for the super admin), so no server
+   * route is needed — the two RLS-scoped queries reproduce the old handler.
+   */
   async list(params) {
-    const qs = new URLSearchParams();
-    if (params?.namePrefix)
-      qs.set("namePrefix", params.namePrefix);
-    if (params?.industry)
-      qs.set("industry", params.industry);
-    if (params?.limit != null)
-      qs.set("limit", String(params.limit));
-    const query = qs.toString();
-    const path = query ? `/api/v1/templates?${query}` : "/api/v1/templates";
-    const res = await this.client.get(path);
-    return res.data;
+    const { data: sitesData, error: sitesError } = await this.client.db.from("sites").select("id, handle, name");
+    if (sitesError)
+      throw new NeopressApiError("DB_ERROR", sitesError.message, 0, sitesError);
+    const siteMeta = /* @__PURE__ */ new Map();
+    for (const site of sitesData ?? []) {
+      if (typeof site.id !== "number")
+        continue;
+      siteMeta.set(site.id, {
+        handle: site.handle ?? null,
+        name: site.name ?? null
+      });
+    }
+    const siteIds = [...siteMeta.keys()];
+    if (siteIds.length === 0)
+      return [];
+    const namePrefix = params?.namePrefix?.trim();
+    const limit = Math.min(Math.max(params?.limit ?? 100, 1), 500);
+    let query = this.client.db.from("templates").select("id, name, reference_url, preview_img_urls, description, created_at").in("id", siteIds);
+    if (namePrefix)
+      query = query.ilike("name", `${namePrefix}%`);
+    if (params?.order)
+      query = query.order("created_at", { ascending: params.order === "asc" });
+    query = query.limit(limit);
+    const { data, error: error48 } = await query;
+    if (error48)
+      throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
+    return (data ?? []).map((t) => {
+      const siteId2 = t.id;
+      return {
+        siteId: siteId2,
+        handle: siteMeta.get(siteId2)?.handle ?? null,
+        siteName: siteMeta.get(siteId2)?.name ?? null,
+        name: t.name,
+        referenceUrl: t.reference_url,
+        previewImgUrls: t.preview_img_urls ?? null,
+        description: t.description ?? null,
+        createdAt: t.created_at
+      };
+    });
+  }
+};
+
+// ../sdk/dist/endpoints/headshots.js
+var HeadshotsEndpoint = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async list(params) {
+    const { page, limit, offset } = this.client.resolvePagination(params);
+    let query = this.client.db.from("headshot_pool").select("*", { count: "exact" });
+    if (params?.ageBand)
+      query = query.eq("age_band", params.ageBand);
+    if (params?.gender)
+      query = query.eq("gender", params.gender);
+    if (params?.ethnicity)
+      query = query.eq("ethnicity", params.ethnicity);
+    if (params?.attire)
+      query = query.eq("attire", params.attire);
+    if (params?.isActive !== void 0)
+      query = query.eq("is_active", params.isActive);
+    if (params?.order) {
+      query = query.order("created_at", { ascending: params.order === "asc" });
+    } else {
+      query = query.order("age_band", { ascending: true }).order("gender", { ascending: true }).order("ethnicity", { ascending: true }).order("variation_index", { ascending: true });
+    }
+    const { data, error: error48, count } = await query.range(offset, offset + limit - 1);
+    if (error48)
+      throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
+    return {
+      data: (data ?? []).map((r) => serializeHeadshot(r)),
+      pagination: this.client.paginationMeta(page, limit, offset, count ?? 0)
+    };
+  }
+  async get(id) {
+    const { data, error: error48 } = await this.client.db.from("headshot_pool").select("*").eq("id", id).single();
+    if (error48)
+      throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
+    return serializeHeadshot(data);
+  }
+  async create(params) {
+    const values = {
+      image_url: params.imageUrl,
+      age_band: params.ageBand,
+      gender: params.gender,
+      ethnicity: params.ethnicity,
+      variation_index: params.variationIndex
+    };
+    if (params.attire !== void 0)
+      values.attire = params.attire;
+    if (params.width !== void 0)
+      values.width = params.width;
+    if (params.height !== void 0)
+      values.height = params.height;
+    if (params.aspectRatio !== void 0)
+      values.aspect_ratio = params.aspectRatio;
+    if (params.mimeType !== void 0)
+      values.mime_type = params.mimeType;
+    if (params.byteSize !== void 0)
+      values.byte_size = params.byteSize;
+    if (params.gptPrompt !== void 0)
+      values.gpt_prompt = params.gptPrompt;
+    if (params.tags !== void 0)
+      values.tags = params.tags;
+    if (params.isActive !== void 0)
+      values.is_active = params.isActive;
+    const { data, error: error48 } = await this.client.db.from("headshot_pool").insert(values).select().single();
+    if (error48)
+      throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
+    return serializeHeadshot(data);
+  }
+  async update(id, params) {
+    const values = {};
+    if (params.imageUrl !== void 0)
+      values.image_url = params.imageUrl;
+    if (params.ageBand !== void 0)
+      values.age_band = params.ageBand;
+    if (params.gender !== void 0)
+      values.gender = params.gender;
+    if (params.ethnicity !== void 0)
+      values.ethnicity = params.ethnicity;
+    if (params.attire !== void 0)
+      values.attire = params.attire;
+    if (params.variationIndex !== void 0)
+      values.variation_index = params.variationIndex;
+    if (params.width !== void 0)
+      values.width = params.width;
+    if (params.height !== void 0)
+      values.height = params.height;
+    if (params.aspectRatio !== void 0)
+      values.aspect_ratio = params.aspectRatio;
+    if (params.mimeType !== void 0)
+      values.mime_type = params.mimeType;
+    if (params.byteSize !== void 0)
+      values.byte_size = params.byteSize;
+    if (params.gptPrompt !== void 0)
+      values.gpt_prompt = params.gptPrompt;
+    if (params.tags !== void 0)
+      values.tags = params.tags;
+    if (params.isActive !== void 0)
+      values.is_active = params.isActive;
+    const { data, error: error48 } = await this.client.db.from("headshot_pool").update(values).eq("id", id).select().single();
+    if (error48)
+      throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
+    return serializeHeadshot(data);
+  }
+  async delete(id) {
+    const { error: error48 } = await this.client.db.from("headshot_pool").delete().eq("id", id);
+    if (error48)
+      throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
+    return { id, deleted: true };
   }
 };
 
@@ -53286,6 +53465,7 @@ var NeopressClient = class {
   entryReferences;
   analytics;
   templates;
+  headshots;
   constructor(options) {
     this.baseUrl = (options.baseUrl || "https://app.neopress.ai").replace(/\/$/, "");
     this.accessToken = options.accessToken || "";
@@ -53304,6 +53484,7 @@ var NeopressClient = class {
     this.entryReferences = new EntryReferencesEndpoint(this);
     this.analytics = new AnalyticsEndpoint(this);
     this.templates = new TemplatesEndpoint(this);
+    this.headshots = new HeadshotsEndpoint(this);
   }
   get siteBasePath() {
     return `/api/v1/sites/${this.siteId}`;
@@ -53584,14 +53765,15 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 
 - Layout owns header, footer, global CSS, and 404. Page TSX starts at page content.
 - Generated page TSX is sandboxed. Do not import Supabase, create API clients, read env vars, use filesystem/process APIs, or assume arbitrary npm packages.
-- Use allowed runtime packages only: React/Next basics, shadcn UI imports, lucide-react, date-fns, framer-motion, gsap (incl. \`gsap/ScrollTrigger\`, driven via \`@gsap/react\`'s \`useGSAP\`), @neopress/content, @neopress/routing, @neopress/i18n, and @neopress/forms.
+- Use allowed runtime packages only: React/Next basics, shadcn UI imports, lucide-react, @radix-ui/react-slot, @radix-ui/react-select, @neopress/youtube, @neopress/map, clsx, class-variance-authority, tailwind-merge, date-fns, framer-motion, gsap (including \`gsap/ScrollTrigger\`, driven via \`@gsap/react\`'s \`useGSAP\`), react-hook-form, zod, @hookform/resolvers, @hookform/resolvers/zod, @neopress/content, @neopress/routing, @neopress/i18n, and @neopress/forms.
+- @radix-ui/react-select is a single-value listbox/dropdown (replaces a native \`<select>\`, whose popup is unstyled OS chrome). Compose its parts directly in page TSX; every \`<Select.Item value>\` must be a non-empty string (an empty-string value throws at runtime and blanks the page \u2014 use a sentinel like \`"all"\`); use \`position="popper"\` with an explicit z-index and a non-transparent background on \`<Select.Content>\` (it portals to \`document.body\`).
 
 ## Templates
 
 - Reusable templates are normal Neopress sites marked by a \`templates\` metadata row.
 - \`templates.id\` equals \`sites.id\`.
 - Build layout, pages, collections, entries, forms, assets, compile, publish, and verify before marking a finished template.
-- Use \`neopress_template_mark\` to create or update the metadata row with \`name\`, \`industry\`, required \`referenceUrl\`, required \`previewImgUrls\` (at least one), and optional \`description\`.
+- Use \`neopress_template_mark\` to create or update the metadata row with \`name\`, required \`referenceUrl\`, required \`previewImgUrls\` (at least one), and optional \`description\`.
 - \`referenceUrl\` is a single http(s) provenance URL. \`description\` is an optional summary of the template (max 150 characters).
 - Template metadata does not replace page TSX, CMS content, forms, or publish state.
 - Use \`neopress_template_delete\` only for explicit template-site hard deletion. It removes the metadata row and connected site.
@@ -53601,6 +53783,7 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 - Dynamic pages require a collection, a page path like \`/blog/[slug]\`, a numeric \`collectionId\`, matching entries, entry publish, page compile, and site publish.
 - \`queryConfig\` is stored in page \`draftMeta.queryConfig\`.
 - Query labels become React props. Entry query results are flattened, so use \`post.body\` instead of \`post.data.body\`.
+- Initial CMS data arrives through those injected query props. \`entryClient\`, when injected in reader/preview for a site handle, is only a client-side auxiliary for load-more/filter/get/create interactions after the initial render; do not use it for initial render or server data loading.
 - Use numeric \`collection_id\` filters. Runtime controls site, status, locale, deleted state, and published snapshots.
 
 ## Collections and entries
@@ -53614,11 +53797,13 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 
 - Reference fields require a schema field with \`type: "references"\` and target \`collection_id\`.
 - Links live in \`entry_references\`, not only in raw entry \`data\`.
+- \`includeReferences\` fetches arrays keyed by the includeReferences alias or field key, and parent entry \`id\` must be selected. With an alias, the alias prop remains an array of referenced entries. Without an alias, if the field key matches a raw numeric reference field in \`entry.data\`, flattening unwraps that array to one flattened object or null.
 - After changing references, publish the source entry again.
 
 ## Forms
 
 - Render forms with \`NeopressForm\` from \`@neopress/forms\` and the injected \`formClient\` prop.
+- In page TSX, \`formId\` may be a numeric literal or numeric string so schemas can be injected before compile.
 - Do not manually submit form data with \`fetch\` or \`FormData\`.
 - Create/update the form, publish the form, compile the page, then publish the site.
 
@@ -53936,7 +54121,6 @@ var toolDefinitions = [
       ...siteIdShape,
       name: external_exports.string(),
       description: external_exports.string().max(150).optional(),
-      industry: external_exports.string(),
       referenceUrl: httpUrlSchema,
       previewImgUrls: external_exports.array(external_exports.string()).min(1)
     },
@@ -53945,7 +54129,6 @@ var toolDefinitions = [
       return client.templates.mark({
         name: asString(input, "name"),
         description: asOptionalString(input, "description"),
-        industry: asString(input, "industry"),
         referenceUrl: asString(input, "referenceUrl"),
         previewImgUrls: input.previewImgUrls
       });

package/dist/http-bin.cjs

@@ -3838,7 +3838,7 @@ var require_fast_uri = __commonJS({
         if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
           if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
             try {
-              parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
+              parsed.host = new URL("http://" + parsed.host).hostname;
             } catch (e) {
               parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
             }
@@ -52583,13 +52583,33 @@ function serializeTemplate(t) {
     id: t.id,
     name: t.name,
     description: t.description ?? null,
-    industry: t.industry,
     referenceUrl: t.reference_url,
     previewImgUrls: t.preview_img_urls,
     previewVideoUrl: t.preview_video_url ?? null,
     createdAt: t.created_at
   };
 }
+function serializeHeadshot(h) {
+  return {
+    id: h.id,
+    imageUrl: h.image_url,
+    width: h.width,
+    height: h.height,
+    aspectRatio: h.aspect_ratio,
+    mimeType: h.mime_type,
+    byteSize: h.byte_size,
+    ageBand: h.age_band,
+    gender: h.gender,
+    ethnicity: h.ethnicity,
+    attire: h.attire,
+    variationIndex: h.variation_index,
+    gptPrompt: h.gpt_prompt,
+    tags: h.tags ?? [],
+    isActive: h.is_active,
+    createdAt: h.created_at,
+    updatedAt: h.updated_at
+  };
+}
 function serializeSite(site) {
   return {
     id: site.id,
@@ -52643,7 +52663,8 @@ var PagesEndpoint = class {
   }
   async list(params) {
     const { page, limit, offset } = this.client.resolvePagination(params);
-    let query = this.client.db.from("pages").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null).order("path");
+    let query = this.client.db.from("pages").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("path");
     if (params?.status)
       query = query.eq("status", params.status);
     const { data, error: error48, count } = await query.range(offset, offset + limit - 1);
@@ -53929,8 +53950,10 @@ var CollectionsEndpoint = class {
   get basePath() {
     return `${this.client.siteBasePath}/collections`;
   }
-  async list() {
-    const { data, error: error48 } = await this.client.db.from("collections").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null).order("name");
+  async list(params) {
+    let query = this.client.db.from("collections").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("name");
+    const { data, error: error48 } = await query;
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return (data ?? []).map((r) => serializeCollection(r));
@@ -54003,7 +54026,7 @@ var EntriesEndpoint = class {
   }
   async list(collectionId, params) {
     const { page, limit, offset } = this.client.resolvePagination(params);
-    let query = this.client.db.from("entries").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).eq("collection_id", collectionId).is("deleted_at", null).order("created_at", { ascending: false });
+    let query = this.client.db.from("entries").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).eq("collection_id", collectionId).is("deleted_at", null).order("created_at", { ascending: params?.order === "asc" });
     if (params?.status)
       query = query.eq("status", params.status);
     if (params?.locale)
@@ -54094,8 +54117,10 @@ var FormsEndpoint = class {
   get basePath() {
     return `${this.client.siteBasePath}/forms`;
   }
-  async list() {
-    const { data, error: error48 } = await this.client.db.from("forms").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null).order("name");
+  async list(params) {
+    let query = this.client.db.from("forms").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("name");
+    const { data, error: error48 } = await query;
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     const rows = data ?? [];
@@ -54174,7 +54199,7 @@ var AssetsEndpoint = class {
   }
   async list(params) {
     const { page, limit, offset } = this.client.resolvePagination(params);
-    const { data, error: error48, count } = await this.client.db.from("assets").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).order("created_at", { ascending: false }).range(offset, offset + limit - 1);
+    const { data, error: error48, count } = await this.client.db.from("assets").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).order("created_at", { ascending: params?.order === "asc" }).range(offset, offset + limit - 1);
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     const rows = data ?? [];
@@ -54240,7 +54265,7 @@ var SiteEndpoint = class {
   constructor(client) {
     this.client = client;
   }
-  async list() {
+  async list(params) {
     const profileId = this.client.authUserId;
     if (!profileId) {
       throw new NeopressApiError("NO_AUTH", "site.list requires an authenticated access token", 0);
@@ -54248,10 +54273,15 @@ var SiteEndpoint = class {
     const { data, error: error48 } = await this.client.db.from("sites_profiles").select("role, sites!inner(*)").eq("profile_id", profileId).eq("status", "active");
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
-    return (data ?? []).map((m) => ({
+    const sites = (data ?? []).map((m) => ({
       ...serializeSite(m.sites),
       role: m.role
     }));
+    if (params?.order) {
+      const dir = params.order === "asc" ? 1 : -1;
+      sites.sort((a, b) => (a.createdAt ?? "") < (b.createdAt ?? "") ? -dir : (a.createdAt ?? "") > (b.createdAt ?? "") ? dir : 0);
+    }
+    return sites;
   }
   async get() {
     const { data, error: error48 } = await this.client.db.from("sites").select("*").eq("id", this.client.siteIdNumber).single();
@@ -54289,8 +54319,10 @@ var RedirectsEndpoint = class {
   constructor(client) {
     this.client = client;
   }
-  async list() {
-    const { data, error: error48 } = await this.client.db.from("redirect_rules").select("*").eq("site_id", this.client.siteIdNumber).order("priority", { ascending: true });
+  async list(params) {
+    let query = this.client.db.from("redirect_rules").select("*").eq("site_id", this.client.siteIdNumber);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("priority", { ascending: true });
+    const { data, error: error48 } = await query;
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return (data ?? []).map((r) => serializeRedirect(r));
@@ -54300,7 +54332,7 @@ var RedirectsEndpoint = class {
       site_id: this.client.siteIdNumber,
       source: data.source,
       destination: data.destination,
-      redirect_type: data.redirectType ?? 307,
+      redirect_type: data.redirectType ?? 308,
       include_children: data.includeChildren ?? false,
       preserve_path: data.preservePath ?? false,
       enabled: data.enabled !== false,
@@ -54367,7 +54399,7 @@ var EntryReferencesEndpoint = class {
       query = query.eq("from_entry_id", params.fromEntryId);
     if (params?.toEntryId)
       query = query.eq("to_entry_id", params.toEntryId);
-    const { data, error: error48 } = await query.order("created_at", { ascending: false });
+    const { data, error: error48 } = await query.order("created_at", { ascending: params?.order === "asc" });
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return (data ?? []).map((r) => serializeEntryReference(r));
@@ -54489,18 +54521,165 @@ var TemplatesEndpoint = class {
     const res = await this.client.delete(this.basePath);
     return res.data;
   }
+  /**
+   * List templates across the sites the caller can access.
+   *
+   * Direct-DB: `templates` is public-read and `sites` RLS scopes the visible set
+   * (own active memberships, or all sites for the super admin), so no server
+   * route is needed — the two RLS-scoped queries reproduce the old handler.
+   */
   async list(params) {
-    const qs = new URLSearchParams();
-    if (params?.namePrefix)
-      qs.set("namePrefix", params.namePrefix);
-    if (params?.industry)
-      qs.set("industry", params.industry);
-    if (params?.limit != null)
-      qs.set("limit", String(params.limit));
-    const query = qs.toString();
-    const path = query ? `/api/v1/templates?${query}` : "/api/v1/templates";
-    const res = await this.client.get(path);
-    return res.data;
+    const { data: sitesData, error: sitesError } = await this.client.db.from("sites").select("id, handle, name");
+    if (sitesError)
+      throw new NeopressApiError("DB_ERROR", sitesError.message, 0, sitesError);
+    const siteMeta = /* @__PURE__ */ new Map();
+    for (const site of sitesData ?? []) {
+      if (typeof site.id !== "number")
+        continue;
+      siteMeta.set(site.id, {
+        handle: site.handle ?? null,
+        name: site.name ?? null
+      });
+    }
+    const siteIds = [...siteMeta.keys()];
+    if (siteIds.length === 0)
+      return [];
+    const namePrefix = params?.namePrefix?.trim();
+    const limit = Math.min(Math.max(params?.limit ?? 100, 1), 500);
+    let query = this.client.db.from("templates").select("id, name, reference_url, preview_img_urls, description, created_at").in("id", siteIds);
+    if (namePrefix)
+      query = query.ilike("name", `${namePrefix}%`);
+    if (params?.order)
+      query = query.order("created_at", { ascending: params.order === "asc" });
+    query = query.limit(limit);
+    const { data, error: error48 } = await query;
+    if (error48)
+      throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
+    return (data ?? []).map((t) => {
+      const siteId2 = t.id;
+      return {
+        siteId: siteId2,
+        handle: siteMeta.get(siteId2)?.handle ?? null,
+        siteName: siteMeta.get(siteId2)?.name ?? null,
+        name: t.name,
+        referenceUrl: t.reference_url,
+        previewImgUrls: t.preview_img_urls ?? null,
+        description: t.description ?? null,
+        createdAt: t.created_at
+      };
+    });
+  }
+};
+
+// ../sdk/dist/endpoints/headshots.js
+var HeadshotsEndpoint = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async list(params) {
+    const { page, limit, offset } = this.client.resolvePagination(params);
+    let query = this.client.db.from("headshot_pool").select("*", { count: "exact" });
+    if (params?.ageBand)
+      query = query.eq("age_band", params.ageBand);
+    if (params?.gender)
+      query = query.eq("gender", params.gender);
+    if (params?.ethnicity)
+      query = query.eq("ethnicity", params.ethnicity);
+    if (params?.attire)
+      query = query.eq("attire", params.attire);
+    if (params?.isActive !== void 0)
+      query = query.eq("is_active", params.isActive);
+    if (params?.order) {
+      query = query.order("created_at", { ascending: params.order === "asc" });
+    } else {
+      query = query.order("age_band", { ascending: true }).order("gender", { ascending: true }).order("ethnicity", { ascending: true }).order("variation_index", { ascending: true });
+    }
+    const { data, error: error48, count } = await query.range(offset, offset + limit - 1);
+    if (error48)
+      throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
+    return {
+      data: (data ?? []).map((r) => serializeHeadshot(r)),
+      pagination: this.client.paginationMeta(page, limit, offset, count ?? 0)
+    };
+  }
+  async get(id) {
+    const { data, error: error48 } = await this.client.db.from("headshot_pool").select("*").eq("id", id).single();
+    if (error48)
+      throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
+    return serializeHeadshot(data);
+  }
+  async create(params) {
+    const values = {
+      image_url: params.imageUrl,
+      age_band: params.ageBand,
+      gender: params.gender,
+      ethnicity: params.ethnicity,
+      variation_index: params.variationIndex
+    };
+    if (params.attire !== void 0)
+      values.attire = params.attire;
+    if (params.width !== void 0)
+      values.width = params.width;
+    if (params.height !== void 0)
+      values.height = params.height;
+    if (params.aspectRatio !== void 0)
+      values.aspect_ratio = params.aspectRatio;
+    if (params.mimeType !== void 0)
+      values.mime_type = params.mimeType;
+    if (params.byteSize !== void 0)
+      values.byte_size = params.byteSize;
+    if (params.gptPrompt !== void 0)
+      values.gpt_prompt = params.gptPrompt;
+    if (params.tags !== void 0)
+      values.tags = params.tags;
+    if (params.isActive !== void 0)
+      values.is_active = params.isActive;
+    const { data, error: error48 } = await this.client.db.from("headshot_pool").insert(values).select().single();
+    if (error48)
+      throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
+    return serializeHeadshot(data);
+  }
+  async update(id, params) {
+    const values = {};
+    if (params.imageUrl !== void 0)
+      values.image_url = params.imageUrl;
+    if (params.ageBand !== void 0)
+      values.age_band = params.ageBand;
+    if (params.gender !== void 0)
+      values.gender = params.gender;
+    if (params.ethnicity !== void 0)
+      values.ethnicity = params.ethnicity;
+    if (params.attire !== void 0)
+      values.attire = params.attire;
+    if (params.variationIndex !== void 0)
+      values.variation_index = params.variationIndex;
+    if (params.width !== void 0)
+      values.width = params.width;
+    if (params.height !== void 0)
+      values.height = params.height;
+    if (params.aspectRatio !== void 0)
+      values.aspect_ratio = params.aspectRatio;
+    if (params.mimeType !== void 0)
+      values.mime_type = params.mimeType;
+    if (params.byteSize !== void 0)
+      values.byte_size = params.byteSize;
+    if (params.gptPrompt !== void 0)
+      values.gpt_prompt = params.gptPrompt;
+    if (params.tags !== void 0)
+      values.tags = params.tags;
+    if (params.isActive !== void 0)
+      values.is_active = params.isActive;
+    const { data, error: error48 } = await this.client.db.from("headshot_pool").update(values).eq("id", id).select().single();
+    if (error48)
+      throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
+    return serializeHeadshot(data);
+  }
+  async delete(id) {
+    const { error: error48 } = await this.client.db.from("headshot_pool").delete().eq("id", id);
+    if (error48)
+      throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
+    return { id, deleted: true };
   }
 };
 
@@ -54524,6 +54703,7 @@ var NeopressClient = class {
   entryReferences;
   analytics;
   templates;
+  headshots;
   constructor(options) {
     this.baseUrl = (options.baseUrl || "https://app.neopress.ai").replace(/\/$/, "");
     this.accessToken = options.accessToken || "";
@@ -54542,6 +54722,7 @@ var NeopressClient = class {
     this.entryReferences = new EntryReferencesEndpoint(this);
     this.analytics = new AnalyticsEndpoint(this);
     this.templates = new TemplatesEndpoint(this);
+    this.headshots = new HeadshotsEndpoint(this);
   }
   get siteBasePath() {
     return `/api/v1/sites/${this.siteId}`;
@@ -54822,14 +55003,15 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 
 - Layout owns header, footer, global CSS, and 404. Page TSX starts at page content.
 - Generated page TSX is sandboxed. Do not import Supabase, create API clients, read env vars, use filesystem/process APIs, or assume arbitrary npm packages.
-- Use allowed runtime packages only: React/Next basics, shadcn UI imports, lucide-react, date-fns, framer-motion, gsap (incl. \`gsap/ScrollTrigger\`, driven via \`@gsap/react\`'s \`useGSAP\`), @neopress/content, @neopress/routing, @neopress/i18n, and @neopress/forms.
+- Use allowed runtime packages only: React/Next basics, shadcn UI imports, lucide-react, @radix-ui/react-slot, @radix-ui/react-select, @neopress/youtube, @neopress/map, clsx, class-variance-authority, tailwind-merge, date-fns, framer-motion, gsap (including \`gsap/ScrollTrigger\`, driven via \`@gsap/react\`'s \`useGSAP\`), react-hook-form, zod, @hookform/resolvers, @hookform/resolvers/zod, @neopress/content, @neopress/routing, @neopress/i18n, and @neopress/forms.
+- @radix-ui/react-select is a single-value listbox/dropdown (replaces a native \`<select>\`, whose popup is unstyled OS chrome). Compose its parts directly in page TSX; every \`<Select.Item value>\` must be a non-empty string (an empty-string value throws at runtime and blanks the page \u2014 use a sentinel like \`"all"\`); use \`position="popper"\` with an explicit z-index and a non-transparent background on \`<Select.Content>\` (it portals to \`document.body\`).
 
 ## Templates
 
 - Reusable templates are normal Neopress sites marked by a \`templates\` metadata row.
 - \`templates.id\` equals \`sites.id\`.
 - Build layout, pages, collections, entries, forms, assets, compile, publish, and verify before marking a finished template.
-- Use \`neopress_template_mark\` to create or update the metadata row with \`name\`, \`industry\`, required \`referenceUrl\`, required \`previewImgUrls\` (at least one), and optional \`description\`.
+- Use \`neopress_template_mark\` to create or update the metadata row with \`name\`, required \`referenceUrl\`, required \`previewImgUrls\` (at least one), and optional \`description\`.
 - \`referenceUrl\` is a single http(s) provenance URL. \`description\` is an optional summary of the template (max 150 characters).
 - Template metadata does not replace page TSX, CMS content, forms, or publish state.
 - Use \`neopress_template_delete\` only for explicit template-site hard deletion. It removes the metadata row and connected site.
@@ -54839,6 +55021,7 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 - Dynamic pages require a collection, a page path like \`/blog/[slug]\`, a numeric \`collectionId\`, matching entries, entry publish, page compile, and site publish.
 - \`queryConfig\` is stored in page \`draftMeta.queryConfig\`.
 - Query labels become React props. Entry query results are flattened, so use \`post.body\` instead of \`post.data.body\`.
+- Initial CMS data arrives through those injected query props. \`entryClient\`, when injected in reader/preview for a site handle, is only a client-side auxiliary for load-more/filter/get/create interactions after the initial render; do not use it for initial render or server data loading.
 - Use numeric \`collection_id\` filters. Runtime controls site, status, locale, deleted state, and published snapshots.
 
 ## Collections and entries
@@ -54852,11 +55035,13 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 
 - Reference fields require a schema field with \`type: "references"\` and target \`collection_id\`.
 - Links live in \`entry_references\`, not only in raw entry \`data\`.
+- \`includeReferences\` fetches arrays keyed by the includeReferences alias or field key, and parent entry \`id\` must be selected. With an alias, the alias prop remains an array of referenced entries. Without an alias, if the field key matches a raw numeric reference field in \`entry.data\`, flattening unwraps that array to one flattened object or null.
 - After changing references, publish the source entry again.
 
 ## Forms
 
 - Render forms with \`NeopressForm\` from \`@neopress/forms\` and the injected \`formClient\` prop.
+- In page TSX, \`formId\` may be a numeric literal or numeric string so schemas can be injected before compile.
 - Do not manually submit form data with \`fetch\` or \`FormData\`.
 - Create/update the form, publish the form, compile the page, then publish the site.
 
@@ -55174,7 +55359,6 @@ var toolDefinitions = [
       ...siteIdShape,
       name: external_exports.string(),
       description: external_exports.string().max(150).optional(),
-      industry: external_exports.string(),
       referenceUrl: httpUrlSchema,
       previewImgUrls: external_exports.array(external_exports.string()).min(1)
     },
@@ -55183,7 +55367,6 @@ var toolDefinitions = [
       return client.templates.mark({
         name: asString(input, "name"),
         description: asOptionalString(input, "description"),
-        industry: asString(input, "industry"),
         referenceUrl: asString(input, "referenceUrl"),
         previewImgUrls: input.previewImgUrls
       });

package/dist/index.js

@@ -3836,7 +3836,7 @@ var require_fast_uri = __commonJS({
         if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
           if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
             try {
-              parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
+              parsed.host = new URL("http://" + parsed.host).hostname;
             } catch (e) {
               parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
             }
@@ -51253,13 +51253,33 @@ function serializeTemplate(t) {
     id: t.id,
     name: t.name,
     description: t.description ?? null,
-    industry: t.industry,
     referenceUrl: t.reference_url,
     previewImgUrls: t.preview_img_urls,
     previewVideoUrl: t.preview_video_url ?? null,
     createdAt: t.created_at
   };
 }
+function serializeHeadshot(h) {
+  return {
+    id: h.id,
+    imageUrl: h.image_url,
+    width: h.width,
+    height: h.height,
+    aspectRatio: h.aspect_ratio,
+    mimeType: h.mime_type,
+    byteSize: h.byte_size,
+    ageBand: h.age_band,
+    gender: h.gender,
+    ethnicity: h.ethnicity,
+    attire: h.attire,
+    variationIndex: h.variation_index,
+    gptPrompt: h.gpt_prompt,
+    tags: h.tags ?? [],
+    isActive: h.is_active,
+    createdAt: h.created_at,
+    updatedAt: h.updated_at
+  };
+}
 function serializeSite(site) {
   return {
     id: site.id,
@@ -51313,7 +51333,8 @@ var PagesEndpoint = class {
   }
   async list(params) {
     const { page, limit, offset } = this.client.resolvePagination(params);
-    let query = this.client.db.from("pages").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null).order("path");
+    let query = this.client.db.from("pages").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("path");
     if (params?.status)
       query = query.eq("status", params.status);
     const { data, error: error48, count } = await query.range(offset, offset + limit - 1);
@@ -52599,8 +52620,10 @@ var CollectionsEndpoint = class {
   get basePath() {
     return `${this.client.siteBasePath}/collections`;
   }
-  async list() {
-    const { data, error: error48 } = await this.client.db.from("collections").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null).order("name");
+  async list(params) {
+    let query = this.client.db.from("collections").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("name");
+    const { data, error: error48 } = await query;
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return (data ?? []).map((r) => serializeCollection(r));
@@ -52673,7 +52696,7 @@ var EntriesEndpoint = class {
   }
   async list(collectionId, params) {
     const { page, limit, offset } = this.client.resolvePagination(params);
-    let query = this.client.db.from("entries").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).eq("collection_id", collectionId).is("deleted_at", null).order("created_at", { ascending: false });
+    let query = this.client.db.from("entries").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).eq("collection_id", collectionId).is("deleted_at", null).order("created_at", { ascending: params?.order === "asc" });
     if (params?.status)
       query = query.eq("status", params.status);
     if (params?.locale)
@@ -52764,8 +52787,10 @@ var FormsEndpoint = class {
   get basePath() {
     return `${this.client.siteBasePath}/forms`;
   }
-  async list() {
-    const { data, error: error48 } = await this.client.db.from("forms").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null).order("name");
+  async list(params) {
+    let query = this.client.db.from("forms").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("name");
+    const { data, error: error48 } = await query;
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     const rows = data ?? [];
@@ -52844,7 +52869,7 @@ var AssetsEndpoint = class {
   }
   async list(params) {
     const { page, limit, offset } = this.client.resolvePagination(params);
-    const { data, error: error48, count } = await this.client.db.from("assets").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).order("created_at", { ascending: false }).range(offset, offset + limit - 1);
+    const { data, error: error48, count } = await this.client.db.from("assets").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).order("created_at", { ascending: params?.order === "asc" }).range(offset, offset + limit - 1);
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     const rows = data ?? [];
@@ -52910,7 +52935,7 @@ var SiteEndpoint = class {
   constructor(client) {
     this.client = client;
   }
-  async list() {
+  async list(params) {
     const profileId = this.client.authUserId;
     if (!profileId) {
       throw new NeopressApiError("NO_AUTH", "site.list requires an authenticated access token", 0);
@@ -52918,10 +52943,15 @@ var SiteEndpoint = class {
     const { data, error: error48 } = await this.client.db.from("sites_profiles").select("role, sites!inner(*)").eq("profile_id", profileId).eq("status", "active");
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
-    return (data ?? []).map((m) => ({
+    const sites = (data ?? []).map((m) => ({
       ...serializeSite(m.sites),
       role: m.role
     }));
+    if (params?.order) {
+      const dir = params.order === "asc" ? 1 : -1;
+      sites.sort((a, b) => (a.createdAt ?? "") < (b.createdAt ?? "") ? -dir : (a.createdAt ?? "") > (b.createdAt ?? "") ? dir : 0);
+    }
+    return sites;
   }
   async get() {
     const { data, error: error48 } = await this.client.db.from("sites").select("*").eq("id", this.client.siteIdNumber).single();
@@ -52959,8 +52989,10 @@ var RedirectsEndpoint = class {
   constructor(client) {
     this.client = client;
   }
-  async list() {
-    const { data, error: error48 } = await this.client.db.from("redirect_rules").select("*").eq("site_id", this.client.siteIdNumber).order("priority", { ascending: true });
+  async list(params) {
+    let query = this.client.db.from("redirect_rules").select("*").eq("site_id", this.client.siteIdNumber);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("priority", { ascending: true });
+    const { data, error: error48 } = await query;
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return (data ?? []).map((r) => serializeRedirect(r));
@@ -52970,7 +53002,7 @@ var RedirectsEndpoint = class {
       site_id: this.client.siteIdNumber,
       source: data.source,
       destination: data.destination,
-      redirect_type: data.redirectType ?? 307,
+      redirect_type: data.redirectType ?? 308,
       include_children: data.includeChildren ?? false,
       preserve_path: data.preservePath ?? false,
       enabled: data.enabled !== false,
@@ -53037,7 +53069,7 @@ var EntryReferencesEndpoint = class {
       query = query.eq("from_entry_id", params.fromEntryId);
     if (params?.toEntryId)
       query = query.eq("to_entry_id", params.toEntryId);
-    const { data, error: error48 } = await query.order("created_at", { ascending: false });
+    const { data, error: error48 } = await query.order("created_at", { ascending: params?.order === "asc" });
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return (data ?? []).map((r) => serializeEntryReference(r));
@@ -53159,18 +53191,165 @@ var TemplatesEndpoint = class {
     const res = await this.client.delete(this.basePath);
     return res.data;
   }
+  /**
+   * List templates across the sites the caller can access.
+   *
+   * Direct-DB: `templates` is public-read and `sites` RLS scopes the visible set
+   * (own active memberships, or all sites for the super admin), so no server
+   * route is needed — the two RLS-scoped queries reproduce the old handler.
+   */
   async list(params) {
-    const qs = new URLSearchParams();
-    if (params?.namePrefix)
-      qs.set("namePrefix", params.namePrefix);
-    if (params?.industry)
-      qs.set("industry", params.industry);
-    if (params?.limit != null)
-      qs.set("limit", String(params.limit));
-    const query = qs.toString();
-    const path = query ? `/api/v1/templates?${query}` : "/api/v1/templates";
-    const res = await this.client.get(path);
-    return res.data;
+    const { data: sitesData, error: sitesError } = await this.client.db.from("sites").select("id, handle, name");
+    if (sitesError)
+      throw new NeopressApiError("DB_ERROR", sitesError.message, 0, sitesError);
+    const siteMeta = /* @__PURE__ */ new Map();
+    for (const site of sitesData ?? []) {
+      if (typeof site.id !== "number")
+        continue;
+      siteMeta.set(site.id, {
+        handle: site.handle ?? null,
+        name: site.name ?? null
+      });
+    }
+    const siteIds = [...siteMeta.keys()];
+    if (siteIds.length === 0)
+      return [];
+    const namePrefix = params?.namePrefix?.trim();
+    const limit = Math.min(Math.max(params?.limit ?? 100, 1), 500);
+    let query = this.client.db.from("templates").select("id, name, reference_url, preview_img_urls, description, created_at").in("id", siteIds);
+    if (namePrefix)
+      query = query.ilike("name", `${namePrefix}%`);
+    if (params?.order)
+      query = query.order("created_at", { ascending: params.order === "asc" });
+    query = query.limit(limit);
+    const { data, error: error48 } = await query;
+    if (error48)
+      throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
+    return (data ?? []).map((t) => {
+      const siteId2 = t.id;
+      return {
+        siteId: siteId2,
+        handle: siteMeta.get(siteId2)?.handle ?? null,
+        siteName: siteMeta.get(siteId2)?.name ?? null,
+        name: t.name,
+        referenceUrl: t.reference_url,
+        previewImgUrls: t.preview_img_urls ?? null,
+        description: t.description ?? null,
+        createdAt: t.created_at
+      };
+    });
+  }
+};
+
+// ../sdk/dist/endpoints/headshots.js
+var HeadshotsEndpoint = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async list(params) {
+    const { page, limit, offset } = this.client.resolvePagination(params);
+    let query = this.client.db.from("headshot_pool").select("*", { count: "exact" });
+    if (params?.ageBand)
+      query = query.eq("age_band", params.ageBand);
+    if (params?.gender)
+      query = query.eq("gender", params.gender);
+    if (params?.ethnicity)
+      query = query.eq("ethnicity", params.ethnicity);
+    if (params?.attire)
+      query = query.eq("attire", params.attire);
+    if (params?.isActive !== void 0)
+      query = query.eq("is_active", params.isActive);
+    if (params?.order) {
+      query = query.order("created_at", { ascending: params.order === "asc" });
+    } else {
+      query = query.order("age_band", { ascending: true }).order("gender", { ascending: true }).order("ethnicity", { ascending: true }).order("variation_index", { ascending: true });
+    }
+    const { data, error: error48, count } = await query.range(offset, offset + limit - 1);
+    if (error48)
+      throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
+    return {
+      data: (data ?? []).map((r) => serializeHeadshot(r)),
+      pagination: this.client.paginationMeta(page, limit, offset, count ?? 0)
+    };
+  }
+  async get(id) {
+    const { data, error: error48 } = await this.client.db.from("headshot_pool").select("*").eq("id", id).single();
+    if (error48)
+      throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
+    return serializeHeadshot(data);
+  }
+  async create(params) {
+    const values = {
+      image_url: params.imageUrl,
+      age_band: params.ageBand,
+      gender: params.gender,
+      ethnicity: params.ethnicity,
+      variation_index: params.variationIndex
+    };
+    if (params.attire !== void 0)
+      values.attire = params.attire;
+    if (params.width !== void 0)
+      values.width = params.width;
+    if (params.height !== void 0)
+      values.height = params.height;
+    if (params.aspectRatio !== void 0)
+      values.aspect_ratio = params.aspectRatio;
+    if (params.mimeType !== void 0)
+      values.mime_type = params.mimeType;
+    if (params.byteSize !== void 0)
+      values.byte_size = params.byteSize;
+    if (params.gptPrompt !== void 0)
+      values.gpt_prompt = params.gptPrompt;
+    if (params.tags !== void 0)
+      values.tags = params.tags;
+    if (params.isActive !== void 0)
+      values.is_active = params.isActive;
+    const { data, error: error48 } = await this.client.db.from("headshot_pool").insert(values).select().single();
+    if (error48)
+      throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
+    return serializeHeadshot(data);
+  }
+  async update(id, params) {
+    const values = {};
+    if (params.imageUrl !== void 0)
+      values.image_url = params.imageUrl;
+    if (params.ageBand !== void 0)
+      values.age_band = params.ageBand;
+    if (params.gender !== void 0)
+      values.gender = params.gender;
+    if (params.ethnicity !== void 0)
+      values.ethnicity = params.ethnicity;
+    if (params.attire !== void 0)
+      values.attire = params.attire;
+    if (params.variationIndex !== void 0)
+      values.variation_index = params.variationIndex;
+    if (params.width !== void 0)
+      values.width = params.width;
+    if (params.height !== void 0)
+      values.height = params.height;
+    if (params.aspectRatio !== void 0)
+      values.aspect_ratio = params.aspectRatio;
+    if (params.mimeType !== void 0)
+      values.mime_type = params.mimeType;
+    if (params.byteSize !== void 0)
+      values.byte_size = params.byteSize;
+    if (params.gptPrompt !== void 0)
+      values.gpt_prompt = params.gptPrompt;
+    if (params.tags !== void 0)
+      values.tags = params.tags;
+    if (params.isActive !== void 0)
+      values.is_active = params.isActive;
+    const { data, error: error48 } = await this.client.db.from("headshot_pool").update(values).eq("id", id).select().single();
+    if (error48)
+      throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
+    return serializeHeadshot(data);
+  }
+  async delete(id) {
+    const { error: error48 } = await this.client.db.from("headshot_pool").delete().eq("id", id);
+    if (error48)
+      throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
+    return { id, deleted: true };
   }
 };
 
@@ -53194,6 +53373,7 @@ var NeopressClient = class {
   entryReferences;
   analytics;
   templates;
+  headshots;
   constructor(options) {
     this.baseUrl = (options.baseUrl || "https://app.neopress.ai").replace(/\/$/, "");
     this.accessToken = options.accessToken || "";
@@ -53212,6 +53392,7 @@ var NeopressClient = class {
     this.entryReferences = new EntryReferencesEndpoint(this);
     this.analytics = new AnalyticsEndpoint(this);
     this.templates = new TemplatesEndpoint(this);
+    this.headshots = new HeadshotsEndpoint(this);
   }
   get siteBasePath() {
     return `/api/v1/sites/${this.siteId}`;
@@ -53492,14 +53673,15 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 
 - Layout owns header, footer, global CSS, and 404. Page TSX starts at page content.
 - Generated page TSX is sandboxed. Do not import Supabase, create API clients, read env vars, use filesystem/process APIs, or assume arbitrary npm packages.
-- Use allowed runtime packages only: React/Next basics, shadcn UI imports, lucide-react, date-fns, framer-motion, gsap (incl. \`gsap/ScrollTrigger\`, driven via \`@gsap/react\`'s \`useGSAP\`), @neopress/content, @neopress/routing, @neopress/i18n, and @neopress/forms.
+- Use allowed runtime packages only: React/Next basics, shadcn UI imports, lucide-react, @radix-ui/react-slot, @radix-ui/react-select, @neopress/youtube, @neopress/map, clsx, class-variance-authority, tailwind-merge, date-fns, framer-motion, gsap (including \`gsap/ScrollTrigger\`, driven via \`@gsap/react\`'s \`useGSAP\`), react-hook-form, zod, @hookform/resolvers, @hookform/resolvers/zod, @neopress/content, @neopress/routing, @neopress/i18n, and @neopress/forms.
+- @radix-ui/react-select is a single-value listbox/dropdown (replaces a native \`<select>\`, whose popup is unstyled OS chrome). Compose its parts directly in page TSX; every \`<Select.Item value>\` must be a non-empty string (an empty-string value throws at runtime and blanks the page \u2014 use a sentinel like \`"all"\`); use \`position="popper"\` with an explicit z-index and a non-transparent background on \`<Select.Content>\` (it portals to \`document.body\`).
 
 ## Templates
 
 - Reusable templates are normal Neopress sites marked by a \`templates\` metadata row.
 - \`templates.id\` equals \`sites.id\`.
 - Build layout, pages, collections, entries, forms, assets, compile, publish, and verify before marking a finished template.
-- Use \`neopress_template_mark\` to create or update the metadata row with \`name\`, \`industry\`, required \`referenceUrl\`, required \`previewImgUrls\` (at least one), and optional \`description\`.
+- Use \`neopress_template_mark\` to create or update the metadata row with \`name\`, required \`referenceUrl\`, required \`previewImgUrls\` (at least one), and optional \`description\`.
 - \`referenceUrl\` is a single http(s) provenance URL. \`description\` is an optional summary of the template (max 150 characters).
 - Template metadata does not replace page TSX, CMS content, forms, or publish state.
 - Use \`neopress_template_delete\` only for explicit template-site hard deletion. It removes the metadata row and connected site.
@@ -53509,6 +53691,7 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 - Dynamic pages require a collection, a page path like \`/blog/[slug]\`, a numeric \`collectionId\`, matching entries, entry publish, page compile, and site publish.
 - \`queryConfig\` is stored in page \`draftMeta.queryConfig\`.
 - Query labels become React props. Entry query results are flattened, so use \`post.body\` instead of \`post.data.body\`.
+- Initial CMS data arrives through those injected query props. \`entryClient\`, when injected in reader/preview for a site handle, is only a client-side auxiliary for load-more/filter/get/create interactions after the initial render; do not use it for initial render or server data loading.
 - Use numeric \`collection_id\` filters. Runtime controls site, status, locale, deleted state, and published snapshots.
 
 ## Collections and entries
@@ -53522,11 +53705,13 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 
 - Reference fields require a schema field with \`type: "references"\` and target \`collection_id\`.
 - Links live in \`entry_references\`, not only in raw entry \`data\`.
+- \`includeReferences\` fetches arrays keyed by the includeReferences alias or field key, and parent entry \`id\` must be selected. With an alias, the alias prop remains an array of referenced entries. Without an alias, if the field key matches a raw numeric reference field in \`entry.data\`, flattening unwraps that array to one flattened object or null.
 - After changing references, publish the source entry again.
 
 ## Forms
 
 - Render forms with \`NeopressForm\` from \`@neopress/forms\` and the injected \`formClient\` prop.
+- In page TSX, \`formId\` may be a numeric literal or numeric string so schemas can be injected before compile.
 - Do not manually submit form data with \`fetch\` or \`FormData\`.
 - Create/update the form, publish the form, compile the page, then publish the site.
 
@@ -53844,7 +54029,6 @@ var toolDefinitions = [
       ...siteIdShape,
       name: external_exports3.string(),
       description: external_exports3.string().max(150).optional(),
-      industry: external_exports3.string(),
       referenceUrl: httpUrlSchema,
       previewImgUrls: external_exports3.array(external_exports3.string()).min(1)
     },
@@ -53853,7 +54037,6 @@ var toolDefinitions = [
       return client.templates.mark({
         name: asString(input, "name"),
         description: asOptionalString(input, "description"),
-        industry: asString(input, "industry"),
         referenceUrl: asString(input, "referenceUrl"),
         previewImgUrls: input.previewImgUrls
       });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neopress/mcp",
-  "version": "1.0.0",
+  "version": "1.1.1",
   "description": "Neopress MCP server for first-party AI agents",
   "type": "module",
   "bin": {