@neopress/mcp 1.6.0 → 1.6.1

package/dist/bin.cjs

@@ -20421,9 +20421,8 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 
 ## Operating boundary
 
-- Authentication is OAuth bearer token based. Use \`NEOPRESS_ACCESS_TOKEN\` or the OAuth session created by \`neopress login\`.
-- API keys and API-key based public integrations are not part of this surface.
-- MCP is available as local stdio and remote Streamable HTTP over the first-party SDK/API.
+- Connect the remote MCP server and sign in with your Neopress account through OAuth.
+- MCP is available on Launch and above. Your site role controls which actions you can perform.
 - MCP is a Neopress contract adapter, not a reference crawler or managed page generator.
 - The host coding agent should perform \`r.jina.ai\` markdown fetches, browser screenshots, DOM/CSS/SVG/background-image extraction, reference analysis, and TSX authoring with its own tools and tokens.
 - Use MCP to read/write Neopress resources, upload or register assets, compile, publish, and verify. Do not expect MCP to spend Neopress server-side LLM tokens for reference analysis or page generation.
@@ -20437,9 +20436,9 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 
 ## Cache
 
-- Site publish invalidates site/layout/collection reader cache tags in the API environment that handled the request.
+- Site publish invalidates site/layout/collection reader cache tags in the environment connected to MCP.
 - Entry publish/unpublish invalidates entry reader cache when production visibility changes.
-- A localhost publish does not invalidate production reader cache. For production validation, publish through the production API and verify the live URL.
+- A localhost publish does not invalidate production reader cache. For production validation, publish through the production MCP server and verify the live URL.
 
 ## Analytics and autopilot
 
@@ -20452,7 +20451,7 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 
 - Layout owns header, footer, global CSS, and 404. Page TSX starts at page content.
 - Generated page TSX is sandboxed. Do not import Supabase, create API clients, read env vars, use filesystem/process APIs, or assume arbitrary npm packages.
-- Use allowed runtime packages only: React/Next basics, react-dom (createPortal), shadcn UI imports, lucide-react, @base-ui/react/drawer, @base-ui/react/dialog, @base-ui/react/accordion, @base-ui/react/switch, @base-ui/react/tabs, @base-ui/react/select, @neopress/youtube, @neopress/map, clsx, class-variance-authority, tailwind-merge, motion/react (never \`framer-motion\` — old package name, not on the allowlist), motion-plus/react (Motion+ premium components: Ticker, Carousel, Cursor, AnimateNumber, AnimateText, Typewriter, ScrambleText, Curtains), @paper-design/shaders-react, gsap (including \`gsap/ScrollTrigger\`, driven via \`@gsap/react\`'s \`useGSAP\`), react-hook-form, zod, @hookform/resolvers, @hookform/resolvers/zod, @neopress/content, @neopress/routing, @neopress/i18n, and @neopress/forms.
+- Use allowed runtime packages only: React/Next basics, react-dom (createPortal), shadcn UI imports, lucide-react, @base-ui/react/drawer, @base-ui/react/dialog, @base-ui/react/accordion, @base-ui/react/switch, @base-ui/react/tabs, @base-ui/react/select, @neopress/youtube, @neopress/map, clsx, class-variance-authority, tailwind-merge, motion/react (never \`framer-motion\` — old package name, not on the allowlist), motion-plus/react (Motion+ premium components: Ticker, Carousel, Cursor, AnimateNumber, AnimateText, Typewriter, ScrambleText, Curtains), @paper-design/shaders-react, gsap (including \`gsap/ScrollTrigger\`, driven via \`@gsap/react\`'s \`useGSAP\`), react-hook-form, zod, @hookform/resolvers, @hookform/resolvers/zod, @neopress/content, @neopress/routing, @neopress/i18n, @neopress/responsive (MobileOnly with deferred desktop/mobile callbacks), and @neopress/forms.
 - For dates, render an existing \`displayDate\` field directly when available. For raw timestamps, use \`Intl.DateTimeFormat\` or \`Date#toLocaleDateString\` with an explicit locale and \`timeZone\` so server rendering and hydration agree; use the site's required zone, or \`UTC\` when none is specified.
 - @base-ui/react/select is an accessible listbox/dropdown (replaces a native \`<select>\`, whose popup is unstyled OS chrome). Compose its parts directly in page TSX; a \`<Select.Item value>\` is a string or the documented \`null\` sentinel (unlike Radix, an empty string is not banned); the \`Select.Popup\` portals to \`document.body\`, so give it an explicit z-index and an opaque background; match the trigger width with \`min-w-[var(--anchor-width)]\` (from \`Select.Positioner\`), cap the list with \`max-h-[var(--available-height)]\`, and set \`alignItemWithTrigger={false}\` for standard below-trigger placement. @base-ui/react/drawer is the gesture mobile sheet; @base-ui/react/dialog the non-gesture modal — both portal to \`document.body\`, need an opaque Popup background + z-index, and take \`modal\` for focus-trap.
 - react-dom is for \`createPortal\` — portal full-viewport overlays (mobile drawer, modal) to \`document.body\` so a \`backdrop-filter\`/\`transform\` ancestor can't trap their \`position: fixed\` inside its box. ALWAYS render the portal behind an open-state guard (\`{open && createPortal(…, document.body)}\`): an unguarded \`document\` reference throws during SSR.
@@ -20474,7 +20473,9 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 - \`queryConfig\` is stored in page \`draftMeta.queryConfig\`.
 - Query labels become React props. Entry query results are flattened, so use \`post.body\` instead of \`post.data.body\`.
 - A query may include \`collectionWindow\` on an \`entries\` query for a dynamic detail route. Its label receives \`{ before, after, items }\`; each is a flattened-entry array around the current entry, and \`items\` combines both directions. Windows use \`published_at DESC, id DESC\`, allow 0–20 entries per direction, and may only declare that exact order. Use the exact configured label, never a guessed prop name. Optional \`matchFields\` compare raw anchor-snapshot fields only when the source field has a value.
-- Initial CMS data arrives through those injected query props. \`entryClient\`, when injected in reader/preview for a site handle, is only a client-side auxiliary for load-more/filter/get/create interactions after the initial render; do not use it for initial render or server data loading.
+- Initial CMS data arrives through those injected query props. \`entryClient\`, when injected in reader/preview for a site handle, is only a client-side auxiliary for load-more/filter/get/create interactions after the initial render; do not use it for initial render or server data loading. Its entries come back flattened like injected props, ordered \`published_at DESC, id DESC\`.
+- Server-side binding is the default because injected props are server-rendered and crawlable; \`entryClient\` is for after-hydration needs only (large-collection load-more, a read that depends on visitor input such as search text or a chosen filter, or an explicit client-side request).
+- Load-more pagination: give the list query a \`limit\` (first page injected server-side), then append \`entryClient.more(propLabel, { offset: shown.length, filters? })\` — the server re-runs that page's stored binding query from the offset, so the page restates nothing; \`filters\` is equality on scalar schema fields (\`{ category: "TECH" }\`), applied to the same published data. \`entryClient.list({ collectionId, offset, limit, filters? })\` is only for reads whose query depends on visitor input or that are too large to inject; a light, fixed set revealed on click is a bound query instead. Judge "light" by what the query injects into the page, not by how much the UI shows: a query without a \`limit\` ships every entry with every field. Without a \`limit\` a list query injects every entry, so paginate by slicing the prop instead.
 - Use numeric \`collection_id\` filters. Runtime controls site, status, locale, deleted state, and published snapshots.
 
 ## Collections and entries
@@ -20488,7 +20489,7 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 
 - Reference fields require a schema field with \`type: "references"\` and target \`collection_id\`.
 - Links live in \`entry_references\`, not only in raw entry \`data\`.
-- \`includeReferences\` fetches arrays keyed by the includeReferences alias or field key, and parent entry \`id\` must be selected. With an alias, the alias prop remains an array of referenced entries. Without an alias, if the field key matches a raw numeric reference field in \`entry.data\`, flattening unwraps that array to one flattened object or null.
+- \`includeReferences\` fetches arrays keyed by the includeReferences alias or field key, and parent entry \`id\` must be selected. With an alias, the alias prop remains an array of referenced entries. Without an alias, if the field key matches a raw numeric reference field in \`entry.data\`, flattening unwraps that array to one object or null; references linked only through \`entry_references\` stay arrays. Every referenced entry is flattened like the parent (\`ref.<fieldId>\`; \`ref.data\` kept for backward compatibility), one level deep.
 - After changing references, publish the source entry again.
 
 ## Forms
@@ -20501,7 +20502,7 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 ## Unsupported visitor features
 
 Generated Neopress pages do not support visitor login/accounts, member areas, carts, checkout, payments, subscriptions, or order management.`;
-const SERVER_INSTRUCTIONS = `Use Neopress MCP tools to manage a selected Neopress site through the first-party OAuth API.
+const SERVER_INSTRUCTIONS = `Use Neopress MCP tools to manage a selected Neopress site through an authenticated MCP connection.
 
 Before generating TSX or schema-backed pages, call neopress_get_runtime_contract or read neopress://runtime-contract.
 Use numeric IDs returned by tools. Publish entries separately from site publish. Use read-only analytics tools before autopilot recommendations. Verify production URLs after production publish.
@@ -20924,7 +20925,7 @@ const toolDefinitions = [
 	{
 		name: "neopress_site_select",
 		title: "Select Active Site",
-		description: "Verify access to a site and store it as the active site for future MCP/CLI operations.",
+		description: "Verify access to a site and store it as the active site for future MCP operations.",
 		inputSchema: { siteId: number().int().positive() },
 		handler: async (input, context, extra) => {
 			const selectedSiteId = asNumber(input, "siteId");
@@ -21588,7 +21589,7 @@ const toolDefinitions = [
 	{
 		name: "neopress_analytics_event_create",
 		title: "Create Analytics Event",
-		description: "Create a saved analytics event definition. Discover pages/forms with neopress_analytics_targets_list. Click/visibility require an existing stable [data-np-track=\"...\"] selector; page views reuse PAGE_VIEW. Optional id is a client UUID: reuse the same id and payload after an uncertain response.",
+		description: "Create a saved analytics event definition over raw analytics signals. Discover page and form IDs with neopress_analytics_targets_list. Click targets use an observed href:<absolute-url> or selector:<fingerprint> key; outbound counts external-link clicks site-wide. Built-in events start collecting without editing or republishing page TSX. Optional id is a client UUID: reuse the same id and payload after an uncertain response.",
 		inputSchema: {
 			...siteIdShape,
 			id: string().uuid().optional(),
@@ -21599,8 +21600,8 @@ const toolDefinitions = [
 				"click",
 				"form",
 				"scroll",
-				"visibility",
-				"dwell"
+				"dwell",
+				"outbound"
 			]),
 			eventName: string().optional(),
 			path: string().optional(),
@@ -21637,8 +21638,8 @@ const toolDefinitions = [
 				"click",
 				"form",
 				"scroll",
-				"visibility",
-				"dwell"
+				"dwell",
+				"outbound"
 			]).optional(),
 			eventName: string().optional(),
 			path: string().optional(),

package/dist/http-bin.cjs

@@ -21804,9 +21804,8 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 
 ## Operating boundary
 
-- Authentication is OAuth bearer token based. Use \`NEOPRESS_ACCESS_TOKEN\` or the OAuth session created by \`neopress login\`.
-- API keys and API-key based public integrations are not part of this surface.
-- MCP is available as local stdio and remote Streamable HTTP over the first-party SDK/API.
+- Connect the remote MCP server and sign in with your Neopress account through OAuth.
+- MCP is available on Launch and above. Your site role controls which actions you can perform.
 - MCP is a Neopress contract adapter, not a reference crawler or managed page generator.
 - The host coding agent should perform \`r.jina.ai\` markdown fetches, browser screenshots, DOM/CSS/SVG/background-image extraction, reference analysis, and TSX authoring with its own tools and tokens.
 - Use MCP to read/write Neopress resources, upload or register assets, compile, publish, and verify. Do not expect MCP to spend Neopress server-side LLM tokens for reference analysis or page generation.
@@ -21820,9 +21819,9 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 
 ## Cache
 
-- Site publish invalidates site/layout/collection reader cache tags in the API environment that handled the request.
+- Site publish invalidates site/layout/collection reader cache tags in the environment connected to MCP.
 - Entry publish/unpublish invalidates entry reader cache when production visibility changes.
-- A localhost publish does not invalidate production reader cache. For production validation, publish through the production API and verify the live URL.
+- A localhost publish does not invalidate production reader cache. For production validation, publish through the production MCP server and verify the live URL.
 
 ## Analytics and autopilot
 
@@ -21835,7 +21834,7 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 
 - Layout owns header, footer, global CSS, and 404. Page TSX starts at page content.
 - Generated page TSX is sandboxed. Do not import Supabase, create API clients, read env vars, use filesystem/process APIs, or assume arbitrary npm packages.
-- Use allowed runtime packages only: React/Next basics, react-dom (createPortal), shadcn UI imports, lucide-react, @base-ui/react/drawer, @base-ui/react/dialog, @base-ui/react/accordion, @base-ui/react/switch, @base-ui/react/tabs, @base-ui/react/select, @neopress/youtube, @neopress/map, clsx, class-variance-authority, tailwind-merge, motion/react (never \`framer-motion\` — old package name, not on the allowlist), motion-plus/react (Motion+ premium components: Ticker, Carousel, Cursor, AnimateNumber, AnimateText, Typewriter, ScrambleText, Curtains), @paper-design/shaders-react, gsap (including \`gsap/ScrollTrigger\`, driven via \`@gsap/react\`'s \`useGSAP\`), react-hook-form, zod, @hookform/resolvers, @hookform/resolvers/zod, @neopress/content, @neopress/routing, @neopress/i18n, and @neopress/forms.
+- Use allowed runtime packages only: React/Next basics, react-dom (createPortal), shadcn UI imports, lucide-react, @base-ui/react/drawer, @base-ui/react/dialog, @base-ui/react/accordion, @base-ui/react/switch, @base-ui/react/tabs, @base-ui/react/select, @neopress/youtube, @neopress/map, clsx, class-variance-authority, tailwind-merge, motion/react (never \`framer-motion\` — old package name, not on the allowlist), motion-plus/react (Motion+ premium components: Ticker, Carousel, Cursor, AnimateNumber, AnimateText, Typewriter, ScrambleText, Curtains), @paper-design/shaders-react, gsap (including \`gsap/ScrollTrigger\`, driven via \`@gsap/react\`'s \`useGSAP\`), react-hook-form, zod, @hookform/resolvers, @hookform/resolvers/zod, @neopress/content, @neopress/routing, @neopress/i18n, @neopress/responsive (MobileOnly with deferred desktop/mobile callbacks), and @neopress/forms.
 - For dates, render an existing \`displayDate\` field directly when available. For raw timestamps, use \`Intl.DateTimeFormat\` or \`Date#toLocaleDateString\` with an explicit locale and \`timeZone\` so server rendering and hydration agree; use the site's required zone, or \`UTC\` when none is specified.
 - @base-ui/react/select is an accessible listbox/dropdown (replaces a native \`<select>\`, whose popup is unstyled OS chrome). Compose its parts directly in page TSX; a \`<Select.Item value>\` is a string or the documented \`null\` sentinel (unlike Radix, an empty string is not banned); the \`Select.Popup\` portals to \`document.body\`, so give it an explicit z-index and an opaque background; match the trigger width with \`min-w-[var(--anchor-width)]\` (from \`Select.Positioner\`), cap the list with \`max-h-[var(--available-height)]\`, and set \`alignItemWithTrigger={false}\` for standard below-trigger placement. @base-ui/react/drawer is the gesture mobile sheet; @base-ui/react/dialog the non-gesture modal — both portal to \`document.body\`, need an opaque Popup background + z-index, and take \`modal\` for focus-trap.
 - react-dom is for \`createPortal\` — portal full-viewport overlays (mobile drawer, modal) to \`document.body\` so a \`backdrop-filter\`/\`transform\` ancestor can't trap their \`position: fixed\` inside its box. ALWAYS render the portal behind an open-state guard (\`{open && createPortal(…, document.body)}\`): an unguarded \`document\` reference throws during SSR.
@@ -21857,7 +21856,9 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 - \`queryConfig\` is stored in page \`draftMeta.queryConfig\`.
 - Query labels become React props. Entry query results are flattened, so use \`post.body\` instead of \`post.data.body\`.
 - A query may include \`collectionWindow\` on an \`entries\` query for a dynamic detail route. Its label receives \`{ before, after, items }\`; each is a flattened-entry array around the current entry, and \`items\` combines both directions. Windows use \`published_at DESC, id DESC\`, allow 0–20 entries per direction, and may only declare that exact order. Use the exact configured label, never a guessed prop name. Optional \`matchFields\` compare raw anchor-snapshot fields only when the source field has a value.
-- Initial CMS data arrives through those injected query props. \`entryClient\`, when injected in reader/preview for a site handle, is only a client-side auxiliary for load-more/filter/get/create interactions after the initial render; do not use it for initial render or server data loading.
+- Initial CMS data arrives through those injected query props. \`entryClient\`, when injected in reader/preview for a site handle, is only a client-side auxiliary for load-more/filter/get/create interactions after the initial render; do not use it for initial render or server data loading. Its entries come back flattened like injected props, ordered \`published_at DESC, id DESC\`.
+- Server-side binding is the default because injected props are server-rendered and crawlable; \`entryClient\` is for after-hydration needs only (large-collection load-more, a read that depends on visitor input such as search text or a chosen filter, or an explicit client-side request).
+- Load-more pagination: give the list query a \`limit\` (first page injected server-side), then append \`entryClient.more(propLabel, { offset: shown.length, filters? })\` — the server re-runs that page's stored binding query from the offset, so the page restates nothing; \`filters\` is equality on scalar schema fields (\`{ category: "TECH" }\`), applied to the same published data. \`entryClient.list({ collectionId, offset, limit, filters? })\` is only for reads whose query depends on visitor input or that are too large to inject; a light, fixed set revealed on click is a bound query instead. Judge "light" by what the query injects into the page, not by how much the UI shows: a query without a \`limit\` ships every entry with every field. Without a \`limit\` a list query injects every entry, so paginate by slicing the prop instead.
 - Use numeric \`collection_id\` filters. Runtime controls site, status, locale, deleted state, and published snapshots.
 
 ## Collections and entries
@@ -21871,7 +21872,7 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 
 - Reference fields require a schema field with \`type: "references"\` and target \`collection_id\`.
 - Links live in \`entry_references\`, not only in raw entry \`data\`.
-- \`includeReferences\` fetches arrays keyed by the includeReferences alias or field key, and parent entry \`id\` must be selected. With an alias, the alias prop remains an array of referenced entries. Without an alias, if the field key matches a raw numeric reference field in \`entry.data\`, flattening unwraps that array to one flattened object or null.
+- \`includeReferences\` fetches arrays keyed by the includeReferences alias or field key, and parent entry \`id\` must be selected. With an alias, the alias prop remains an array of referenced entries. Without an alias, if the field key matches a raw numeric reference field in \`entry.data\`, flattening unwraps that array to one object or null; references linked only through \`entry_references\` stay arrays. Every referenced entry is flattened like the parent (\`ref.<fieldId>\`; \`ref.data\` kept for backward compatibility), one level deep.
 - After changing references, publish the source entry again.
 
 ## Forms
@@ -21884,7 +21885,7 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 ## Unsupported visitor features
 
 Generated Neopress pages do not support visitor login/accounts, member areas, carts, checkout, payments, subscriptions, or order management.`;
-const SERVER_INSTRUCTIONS = `Use Neopress MCP tools to manage a selected Neopress site through the first-party OAuth API.
+const SERVER_INSTRUCTIONS = `Use Neopress MCP tools to manage a selected Neopress site through an authenticated MCP connection.
 
 Before generating TSX or schema-backed pages, call neopress_get_runtime_contract or read neopress://runtime-contract.
 Use numeric IDs returned by tools. Publish entries separately from site publish. Use read-only analytics tools before autopilot recommendations. Verify production URLs after production publish.
@@ -22307,7 +22308,7 @@ const toolDefinitions = [
 	{
 		name: "neopress_site_select",
 		title: "Select Active Site",
-		description: "Verify access to a site and store it as the active site for future MCP/CLI operations.",
+		description: "Verify access to a site and store it as the active site for future MCP operations.",
 		inputSchema: { siteId: number().int().positive() },
 		handler: async (input, context, extra) => {
 			const selectedSiteId = asNumber(input, "siteId");
@@ -22971,7 +22972,7 @@ const toolDefinitions = [
 	{
 		name: "neopress_analytics_event_create",
 		title: "Create Analytics Event",
-		description: "Create a saved analytics event definition. Discover pages/forms with neopress_analytics_targets_list. Click/visibility require an existing stable [data-np-track=\"...\"] selector; page views reuse PAGE_VIEW. Optional id is a client UUID: reuse the same id and payload after an uncertain response.",
+		description: "Create a saved analytics event definition over raw analytics signals. Discover page and form IDs with neopress_analytics_targets_list. Click targets use an observed href:<absolute-url> or selector:<fingerprint> key; outbound counts external-link clicks site-wide. Built-in events start collecting without editing or republishing page TSX. Optional id is a client UUID: reuse the same id and payload after an uncertain response.",
 		inputSchema: {
 			...siteIdShape,
 			id: string().uuid().optional(),
@@ -22982,8 +22983,8 @@ const toolDefinitions = [
 				"click",
 				"form",
 				"scroll",
-				"visibility",
-				"dwell"
+				"dwell",
+				"outbound"
 			]),
 			eventName: string().optional(),
 			path: string().optional(),
@@ -23020,8 +23021,8 @@ const toolDefinitions = [
 				"click",
 				"form",
 				"scroll",
-				"visibility",
-				"dwell"
+				"dwell",
+				"outbound"
 			]).optional(),
 			eventName: string().optional(),
 			path: string().optional(),

package/dist/index.d.ts

@@ -198,11 +198,13 @@ interface SiteLayout {
   draftTsx: string | null;
   draftGlobalCss: string | null;
   draftNotFoundTsx: string | null;
+  draftI18n: unknown;
   prodTsx: string | null;
   prodJs: string | null;
   prodGlobalCss: string | null;
   prodNotFoundTsx: string | null;
   prodNotFoundJs: string | null;
+  prodI18n: unknown;
 }
 interface Headshot {
   id: number;
@@ -289,7 +291,9 @@ interface SearchConsoleQueryResult {
   };
   error?: string;
 }
-type AnalyticsEventType = "custom" | "page" | "click" | "form" | "scroll" | "visibility" | "dwell";
+type AnalyticsEventType = "custom" | "page" | "click" | "form" | "scroll" | "visibility" | "dwell" | "outbound";
+/** `visibility` remains readable for historical definitions but cannot be created. */
+type AnalyticsEventCreateType = Exclude<AnalyticsEventType, "visibility">;
 type FunnelFilterField = "event.path" | "event.url" | "event.referrer" | "event.referrer_source" | "event.property" | "session.referrer" | "session.referrer_source" | "session.traffic_category" | "session.utm_source" | "session.utm_medium" | "session.utm_campaign" | "session.utm_content" | "session.utm_term";
 type FunnelFilterOperator = "eq" | "neq" | "contains" | "not_contains" | "starts_with" | "ends_with" | "exists" | "not_exists" | "gt" | "gte" | "lt" | "lte";
 type AnalyticsFunnelFilterCondition = {
@@ -315,6 +319,7 @@ interface AnalyticsEventDefinition {
   name: string;
   chart_visible: boolean;
   is_pinned: boolean;
+  sort_order?: number | null;
   event_type: AnalyticsEventType;
   event_name: string;
   path: string;
@@ -330,7 +335,7 @@ interface AnalyticsEventDefinitionInput {
   /** Optional client UUID; reuse it with the same payload after an uncertain create response. */
   id?: string;
   name: string;
-  eventType: AnalyticsEventType;
+  eventType: AnalyticsEventCreateType;
   eventName?: string;
   path?: string;
   selector?: string;
@@ -647,6 +652,8 @@ declare class SiteEndpoint {
     draftTsx?: string;
     draftNotFoundTsx?: string;
     draftGlobalCss?: string;
+    /** Replaces draft translations; null clears them, omission preserves them. */
+    draftI18n?: unknown;
   }): Promise<SiteLayout>;
   delete(): Promise<{
     siteId: number;

package/dist/index.js

@@ -923,9 +923,8 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 
 ## Operating boundary
 
-- Authentication is OAuth bearer token based. Use \`NEOPRESS_ACCESS_TOKEN\` or the OAuth session created by \`neopress login\`.
-- API keys and API-key based public integrations are not part of this surface.
-- MCP is available as local stdio and remote Streamable HTTP over the first-party SDK/API.
+- Connect the remote MCP server and sign in with your Neopress account through OAuth.
+- MCP is available on Launch and above. Your site role controls which actions you can perform.
 - MCP is a Neopress contract adapter, not a reference crawler or managed page generator.
 - The host coding agent should perform \`r.jina.ai\` markdown fetches, browser screenshots, DOM/CSS/SVG/background-image extraction, reference analysis, and TSX authoring with its own tools and tokens.
 - Use MCP to read/write Neopress resources, upload or register assets, compile, publish, and verify. Do not expect MCP to spend Neopress server-side LLM tokens for reference analysis or page generation.
@@ -939,9 +938,9 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 
 ## Cache
 
-- Site publish invalidates site/layout/collection reader cache tags in the API environment that handled the request.
+- Site publish invalidates site/layout/collection reader cache tags in the environment connected to MCP.
 - Entry publish/unpublish invalidates entry reader cache when production visibility changes.
-- A localhost publish does not invalidate production reader cache. For production validation, publish through the production API and verify the live URL.
+- A localhost publish does not invalidate production reader cache. For production validation, publish through the production MCP server and verify the live URL.
 
 ## Analytics and autopilot
 
@@ -954,7 +953,7 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 
 - Layout owns header, footer, global CSS, and 404. Page TSX starts at page content.
 - Generated page TSX is sandboxed. Do not import Supabase, create API clients, read env vars, use filesystem/process APIs, or assume arbitrary npm packages.
-- Use allowed runtime packages only: React/Next basics, react-dom (createPortal), shadcn UI imports, lucide-react, @base-ui/react/drawer, @base-ui/react/dialog, @base-ui/react/accordion, @base-ui/react/switch, @base-ui/react/tabs, @base-ui/react/select, @neopress/youtube, @neopress/map, clsx, class-variance-authority, tailwind-merge, motion/react (never \`framer-motion\` — old package name, not on the allowlist), motion-plus/react (Motion+ premium components: Ticker, Carousel, Cursor, AnimateNumber, AnimateText, Typewriter, ScrambleText, Curtains), @paper-design/shaders-react, gsap (including \`gsap/ScrollTrigger\`, driven via \`@gsap/react\`'s \`useGSAP\`), react-hook-form, zod, @hookform/resolvers, @hookform/resolvers/zod, @neopress/content, @neopress/routing, @neopress/i18n, and @neopress/forms.
+- Use allowed runtime packages only: React/Next basics, react-dom (createPortal), shadcn UI imports, lucide-react, @base-ui/react/drawer, @base-ui/react/dialog, @base-ui/react/accordion, @base-ui/react/switch, @base-ui/react/tabs, @base-ui/react/select, @neopress/youtube, @neopress/map, clsx, class-variance-authority, tailwind-merge, motion/react (never \`framer-motion\` — old package name, not on the allowlist), motion-plus/react (Motion+ premium components: Ticker, Carousel, Cursor, AnimateNumber, AnimateText, Typewriter, ScrambleText, Curtains), @paper-design/shaders-react, gsap (including \`gsap/ScrollTrigger\`, driven via \`@gsap/react\`'s \`useGSAP\`), react-hook-form, zod, @hookform/resolvers, @hookform/resolvers/zod, @neopress/content, @neopress/routing, @neopress/i18n, @neopress/responsive (MobileOnly with deferred desktop/mobile callbacks), and @neopress/forms.
 - For dates, render an existing \`displayDate\` field directly when available. For raw timestamps, use \`Intl.DateTimeFormat\` or \`Date#toLocaleDateString\` with an explicit locale and \`timeZone\` so server rendering and hydration agree; use the site's required zone, or \`UTC\` when none is specified.
 - @base-ui/react/select is an accessible listbox/dropdown (replaces a native \`<select>\`, whose popup is unstyled OS chrome). Compose its parts directly in page TSX; a \`<Select.Item value>\` is a string or the documented \`null\` sentinel (unlike Radix, an empty string is not banned); the \`Select.Popup\` portals to \`document.body\`, so give it an explicit z-index and an opaque background; match the trigger width with \`min-w-[var(--anchor-width)]\` (from \`Select.Positioner\`), cap the list with \`max-h-[var(--available-height)]\`, and set \`alignItemWithTrigger={false}\` for standard below-trigger placement. @base-ui/react/drawer is the gesture mobile sheet; @base-ui/react/dialog the non-gesture modal — both portal to \`document.body\`, need an opaque Popup background + z-index, and take \`modal\` for focus-trap.
 - react-dom is for \`createPortal\` — portal full-viewport overlays (mobile drawer, modal) to \`document.body\` so a \`backdrop-filter\`/\`transform\` ancestor can't trap their \`position: fixed\` inside its box. ALWAYS render the portal behind an open-state guard (\`{open && createPortal(…, document.body)}\`): an unguarded \`document\` reference throws during SSR.
@@ -976,7 +975,9 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 - \`queryConfig\` is stored in page \`draftMeta.queryConfig\`.
 - Query labels become React props. Entry query results are flattened, so use \`post.body\` instead of \`post.data.body\`.
 - A query may include \`collectionWindow\` on an \`entries\` query for a dynamic detail route. Its label receives \`{ before, after, items }\`; each is a flattened-entry array around the current entry, and \`items\` combines both directions. Windows use \`published_at DESC, id DESC\`, allow 0–20 entries per direction, and may only declare that exact order. Use the exact configured label, never a guessed prop name. Optional \`matchFields\` compare raw anchor-snapshot fields only when the source field has a value.
-- Initial CMS data arrives through those injected query props. \`entryClient\`, when injected in reader/preview for a site handle, is only a client-side auxiliary for load-more/filter/get/create interactions after the initial render; do not use it for initial render or server data loading.
+- Initial CMS data arrives through those injected query props. \`entryClient\`, when injected in reader/preview for a site handle, is only a client-side auxiliary for load-more/filter/get/create interactions after the initial render; do not use it for initial render or server data loading. Its entries come back flattened like injected props, ordered \`published_at DESC, id DESC\`.
+- Server-side binding is the default because injected props are server-rendered and crawlable; \`entryClient\` is for after-hydration needs only (large-collection load-more, a read that depends on visitor input such as search text or a chosen filter, or an explicit client-side request).
+- Load-more pagination: give the list query a \`limit\` (first page injected server-side), then append \`entryClient.more(propLabel, { offset: shown.length, filters? })\` — the server re-runs that page's stored binding query from the offset, so the page restates nothing; \`filters\` is equality on scalar schema fields (\`{ category: "TECH" }\`), applied to the same published data. \`entryClient.list({ collectionId, offset, limit, filters? })\` is only for reads whose query depends on visitor input or that are too large to inject; a light, fixed set revealed on click is a bound query instead. Judge "light" by what the query injects into the page, not by how much the UI shows: a query without a \`limit\` ships every entry with every field. Without a \`limit\` a list query injects every entry, so paginate by slicing the prop instead.
 - Use numeric \`collection_id\` filters. Runtime controls site, status, locale, deleted state, and published snapshots.
 
 ## Collections and entries
@@ -990,7 +991,7 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 
 - Reference fields require a schema field with \`type: "references"\` and target \`collection_id\`.
 - Links live in \`entry_references\`, not only in raw entry \`data\`.
-- \`includeReferences\` fetches arrays keyed by the includeReferences alias or field key, and parent entry \`id\` must be selected. With an alias, the alias prop remains an array of referenced entries. Without an alias, if the field key matches a raw numeric reference field in \`entry.data\`, flattening unwraps that array to one flattened object or null.
+- \`includeReferences\` fetches arrays keyed by the includeReferences alias or field key, and parent entry \`id\` must be selected. With an alias, the alias prop remains an array of referenced entries. Without an alias, if the field key matches a raw numeric reference field in \`entry.data\`, flattening unwraps that array to one object or null; references linked only through \`entry_references\` stay arrays. Every referenced entry is flattened like the parent (\`ref.<fieldId>\`; \`ref.data\` kept for backward compatibility), one level deep.
 - After changing references, publish the source entry again.
 
 ## Forms
@@ -1003,7 +1004,7 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 ## Unsupported visitor features
 
 Generated Neopress pages do not support visitor login/accounts, member areas, carts, checkout, payments, subscriptions, or order management.`;
-const SERVER_INSTRUCTIONS = `Use Neopress MCP tools to manage a selected Neopress site through the first-party OAuth API.
+const SERVER_INSTRUCTIONS = `Use Neopress MCP tools to manage a selected Neopress site through an authenticated MCP connection.
 
 Before generating TSX or schema-backed pages, call neopress_get_runtime_contract or read neopress://runtime-contract.
 Use numeric IDs returned by tools. Publish entries separately from site publish. Use read-only analytics tools before autopilot recommendations. Verify production URLs after production publish.
@@ -1426,7 +1427,7 @@ const toolDefinitions = [
 	{
 		name: "neopress_site_select",
 		title: "Select Active Site",
-		description: "Verify access to a site and store it as the active site for future MCP/CLI operations.",
+		description: "Verify access to a site and store it as the active site for future MCP operations.",
 		inputSchema: { siteId: z.number().int().positive() },
 		handler: async (input, context, extra) => {
 			const selectedSiteId = asNumber(input, "siteId");
@@ -2090,7 +2091,7 @@ const toolDefinitions = [
 	{
 		name: "neopress_analytics_event_create",
 		title: "Create Analytics Event",
-		description: "Create a saved analytics event definition. Discover pages/forms with neopress_analytics_targets_list. Click/visibility require an existing stable [data-np-track=\"...\"] selector; page views reuse PAGE_VIEW. Optional id is a client UUID: reuse the same id and payload after an uncertain response.",
+		description: "Create a saved analytics event definition over raw analytics signals. Discover page and form IDs with neopress_analytics_targets_list. Click targets use an observed href:<absolute-url> or selector:<fingerprint> key; outbound counts external-link clicks site-wide. Built-in events start collecting without editing or republishing page TSX. Optional id is a client UUID: reuse the same id and payload after an uncertain response.",
 		inputSchema: {
 			...siteIdShape,
 			id: z.string().uuid().optional(),
@@ -2101,8 +2102,8 @@ const toolDefinitions = [
 				"click",
 				"form",
 				"scroll",
-				"visibility",
-				"dwell"
+				"dwell",
+				"outbound"
 			]),
 			eventName: z.string().optional(),
 			path: z.string().optional(),
@@ -2139,8 +2140,8 @@ const toolDefinitions = [
 				"click",
 				"form",
 				"scroll",
-				"visibility",
-				"dwell"
+				"dwell",
+				"outbound"
 			]).optional(),
 			eventName: z.string().optional(),
 			path: z.string().optional(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neopress/mcp",
-  "version": "1.6.0",
+  "version": "1.6.1",
   "description": "Neopress MCP server for first-party AI agents",
   "type": "module",
   "bin": {