@patronage/mcp-wordpress 0.1.0 → 0.2.0

package/README.md

@@ -4,7 +4,9 @@ The WordPress connector for [`@patronage/mcp-core`](../mcp-core). In the gateway
 
 - `wp.graphql({ query, variables? })` runs WPGraphQL queries, never mutations.
 - `wp.get({ path, query? })` reads the REST API under `/wp-json/`, and refuses method overrides.
-- `wp.apply({ intent, operations })` stages `update_post` operations (core and ACF fields, with an optional `expected_modified_gmt` check) for approval.
+- `wp.apply({ intent, operations })` stages operations for approval:
+  - `update_post` changes core fields, ACF fields and registered post meta (`meta`), with an optional `expected_modified_gmt` check.
+  - `upsert_redirect` creates or updates one plain-URL rule in the Redirection plugin: `{ source: "/old-page", target: "/new-page", code?: 301 | 302 | 307 | 308 }`.
 
 It also gives `describe_site` the site's post types and GraphQL types.
 
@@ -13,3 +15,22 @@ Requests go out as the signed-in person: the gateway forwards the Access JWT wit
 ```ts
 import { wordpressConnector } from "@patronage/mcp-wordpress";
 ```
+
+## Post meta
+
+WordPress only accepts meta keys a site registers for REST, so the site decides what is writable. A key that isn't registered is dropped, and the receipt reports it as not stored. For example, to let editors change Yoast's meta description and noindex setting on pages:
+
+```php
+foreach ( [ '_yoast_wpseo_metadesc', '_yoast_wpseo_meta-robots-noindex' ] as $key ) {
+	register_post_meta( 'page', $key, [
+		'single'        => true,
+		'type'          => 'string',
+		'show_in_rest'  => true,
+		'auth_callback' => fn ( $allowed, $meta_key, $post_id ) => current_user_can( 'edit_post', $post_id ),
+	] );
+}
+```
+
+## Redirects
+
+`upsert_redirect` uses Redirection's REST API (`/wp-json/redirection/v1/`). It owns the one rule with the same source, a plain URL match and no regex. It updates that rule in place, keeping its group and title, or creates one in Redirection's default group (else the first enabled WordPress group). The preview shows the current target and code against the new ones, and apply refuses to write if that rule changed after the preview. A disabled rule, or two rules for the same source, stop the operation for an editor to sort out in Redirection. The approver needs Redirection's capability: `manage_options`, unless the site filters `redirection_role`.

package/dist/index.d.ts

@@ -50,13 +50,21 @@ declare const updatePostOperationSchema: z.ZodObject<{
   }, z.core.$strict>>;
   id: z.ZodNumber;
   kind: z.ZodLiteral<"update_post">;
+  meta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodJSONSchema>>;
   rest_base: z.ZodString;
 }, z.core.$strict>;
 type UpdatePostOperation = z.infer<typeof updatePostOperationSchema>;
-type WriteOperation = UpdatePostOperation;
+declare const upsertRedirectOperationSchema: z.ZodObject<{
+  code: z.ZodDefault<z.ZodLiteral<301 | 302 | 307 | 308>>;
+  kind: z.ZodLiteral<"upsert_redirect">;
+  source: z.ZodString;
+  target: z.ZodString;
+}, z.core.$strict>;
+type UpsertRedirectOperation = z.infer<typeof upsertRedirectOperationSchema>;
+type WriteOperation = UpdatePostOperation | UpsertRedirectOperation;
 export declare const applyInputSchema: z.ZodObject<{
   intent: z.ZodString;
-  operations: z.ZodArray<z.ZodObject<{
+  operations: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
     acf: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodJSONSchema>>;
     expected_modified_gmt: z.ZodOptional<z.ZodString>;
     fields: z.ZodOptional<z.ZodObject<{
@@ -73,8 +81,14 @@ export declare const applyInputSchema: z.ZodObject<{
     }, z.core.$strict>>;
     id: z.ZodNumber;
     kind: z.ZodLiteral<"update_post">;
+    meta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodJSONSchema>>;
     rest_base: z.ZodString;
-  }, z.core.$strict>>;
+  }, z.core.$strict>, z.ZodObject<{
+    code: z.ZodDefault<z.ZodLiteral<301 | 302 | 307 | 308>>;
+    kind: z.ZodLiteral<"upsert_redirect">;
+    source: z.ZodString;
+    target: z.ZodString;
+  }, z.core.$strict>], "kind">>;
 }, z.core.$strip>;
 type ApplyInput = z.infer<typeof applyInputSchema>;
 export declare const parseApplyInput: <T>(input: T) => ApplyInput;
@@ -144,4 +158,4 @@ export declare const createWordPressTools: (deps: ConnectorDeps<WordPressEnv>) =
     };
   };
 };
-export type { ApplyInput, WordPressDescription, WordPressEnv, WriteOperation };
+export type { ApplyInput, UpdatePostOperation, UpsertRedirectOperation, WordPressDescription, WordPressEnv, WriteOperation };

package/dist/index.js

@@ -244,14 +244,30 @@ const updatePostOperationSchema = z.strictObject({
 	fields: updatePostFieldsSchema.optional(),
 	id: z.number().int().positive(),
 	kind: z.literal("update_post"),
+	meta: z.record(z.string().min(1).max(255), z.json()).optional(),
 	rest_base: restBaseSchema
-}).refine((operation) => changedFieldKeys(operation.fields).length > 0 || Object.keys(operation.acf ?? {}).length > 0, { message: "operation must change at least one field or acf key" });
-const operationTarget = (operation) => `${operation.rest_base}/${operation.id}`;
+}).refine((operation) => changedFieldKeys(operation.fields).length > 0 || Object.keys(operation.acf ?? {}).length > 0 || Object.keys(operation.meta ?? {}).length > 0, { message: "operation must change at least one field, acf key or meta key" });
+const redirectSourceSchema = z.string().trim().min(2).max(2e3).regex(/^\/(?!\/)[^\s#]*$/u, "source must be a site path such as /old-page");
+const redirectTargetSchema = z.string().trim().min(1).max(2e3).refine((value) => /^\/(?!\/)\S*$/u.test(value) || /^https?:\/\/[^\s/]+\S*$/iu.test(value), { message: "target must be a site path or an http(s) URL" });
+const upsertRedirectOperationSchema = z.strictObject({
+	code: z.literal([
+		301,
+		302,
+		307,
+		308
+	]).default(301),
+	kind: z.literal("upsert_redirect"),
+	source: redirectSourceSchema,
+	target: redirectTargetSchema
+}).refine((operation) => operation.source !== operation.target, { message: "a redirect cannot point at its own source" });
+const writeOperationSchema = z.discriminatedUnion("kind", [updatePostOperationSchema, upsertRedirectOperationSchema]);
+const isRedirectOperation = (operation) => operation.kind === "upsert_redirect";
+const operationTarget = (operation) => isRedirectOperation(operation) ? `redirect ${operation.source}` : `${operation.rest_base}/${operation.id}`;
 const DUPLICATE_TARGET_CODE = "duplicate_target";
 const duplicateTargetIssueSchema = z.object({ params: z.object({ code: z.literal(DUPLICATE_TARGET_CODE) }) });
 const applyInputSchema = z.object({
 	intent: z.string().trim().min(1).max(500),
-	operations: z.array(updatePostOperationSchema).min(1).max(MAX_OPERATIONS)
+	operations: z.array(writeOperationSchema).min(1).max(MAX_OPERATIONS)
 }).superRefine((input, ctx) => {
 	const seen = /* @__PURE__ */ new Set();
 	for (const [index, operation] of input.operations.entries()) {
@@ -272,33 +288,264 @@ const parseApplyInput = (input) => {
 	const duplicate = parsed.error.issues.some((issue) => duplicateTargetIssueSchema.safeParse(issue).success);
 	throw new ApplyValidationError(duplicate ? DUPLICATE_TARGET_CODE : "invalid_operations", detail);
 };
+const REDIRECT_PATHS = ["target", "code"];
 const changedPaths = (operation) => {
+	if (isRedirectOperation(operation)) return [...REDIRECT_PATHS];
 	const paths = changedFieldKeys(operation.fields);
 	for (const key of Object.keys(operation.acf ?? {}).toSorted()) paths.push(`acf.${key}`);
+	for (const key of Object.keys(operation.meta ?? {}).toSorted()) paths.push(`meta.${key}`);
 	return paths;
 };
 const operationSentence = (operation) => {
+	if (isRedirectOperation(operation)) return `Redirect ${operation.source} to ${operation.target} (${operation.code})`;
 	return `Update ${joinPhrase(changedPaths(operation))} on ${operation.rest_base} ${operation.id}`;
 };
-// src/wp-apply.ts
+// src/wp-receipts.ts
 const MISSED_PATH_LIMIT = 5;
+const toReceiptError = (error) => {
+	if (error instanceof ApplyConflictError) return {
+		code: error.code,
+		message: error.message
+	};
+	if (error instanceof UpstreamRequestError) return {
+		code: "wordpress_request_failed",
+		message: error.message
+	};
+	return {
+		code: "unexpected_error",
+		message: "The operation failed"
+	};
+};
+const missedPathsMessage = (missed) => {
+	const listed = missed.slice(0, MISSED_PATH_LIMIT);
+	const extra = missed.length - listed.length;
+	const suffix = extra > 0 ? ` and ${extra} more` : "";
+	return `WordPress did not store ${listed.join(", ")}${suffix}`;
+};
+// src/wp-redirects.ts
+const REDIRECTS_PATH = "/wp-json/redirection/v1/redirect";
+const GROUPS_PATH = "/wp-json/redirection/v1/group";
+const WORDPRESS_MODULE = 1;
+const PAGE_SIZE = 200;
+const MAX_PAGES = 10;
+const REDIRECTION_EDITOR = "Redirection";
+const redirectItemSchema = z.object({
+	action_code: z.coerce.number().int(),
+	action_data: z.unknown().optional(),
+	action_type: z.string().optional(),
+	enabled: z.boolean().optional(),
+	group_id: z.coerce.number().int(),
+	id: z.coerce.number().int().positive(),
+	match_type: z.string().optional(),
+	regex: z.coerce.boolean().optional(),
+	status: z.string().optional(),
+	title: z.string().nullish(),
+	url: z.string()
+});
+const listSchema = z.object({
+	items: z.array(z.unknown()),
+	total: z.coerce.number().int().nonnegative().optional()
+});
+const actionUrlSchema = z.object({ url: z.string() });
+const groupSchema = z.object({
+	default: z.boolean().optional(),
+	enabled: z.boolean().optional(),
+	id: z.coerce.number().int().positive(),
+	module_id: z.coerce.number().int()
+});
+const isEnabled = (item) => item.enabled ?? item.status !== "disabled";
+const actionUrl = (item) => {
+	const parsed = actionUrlSchema.safeParse(item.action_data);
+	return parsed.success ? parsed.data.url : null;
+};
+const toRule = (item) => ({
+	code: item.action_code,
+	enabled: isEnabled(item),
+	groupId: item.group_id,
+	id: item.id,
+	target: actionUrl(item),
+	title: item.title ?? ""
+});
+const redirectionError = (result, fallback) => {
+	if (result.status === 404 && result.errorCode === "rest_no_route") return new ApplyConflictError("redirection_unavailable", "The Redirection plugin's REST API is not available on this site");
+	return new ApplyConflictError(result.errorCode ?? "read_failed", wordPressErrorMessage(result.status, result.errorCode) ?? fallback);
+};
+const listPath = (base, query) => `${base}?${new URLSearchParams(query).toString()}`;
+const readPage = async (client, source, page, telemetry) => {
+	const result = await wpFetch(client, listPath(REDIRECTS_PATH, {
+		"filterBy[url]": source,
+		page: String(page),
+		per_page: String(PAGE_SIZE)
+	}), telemetry);
+	const parsed = listSchema.safeParse(result.json);
+	if (result.status < 200 || result.status >= 300 || !parsed.success) throw redirectionError(result, "Could not read Redirection rules");
+	const items = parsed.data.items.flatMap((item) => {
+		const rule = redirectItemSchema.safeParse(item);
+		return rule.success ? [rule.data] : [];
+	});
+	const seen = (page + 1) * PAGE_SIZE;
+	return {
+		items,
+		more: parsed.data.items.length === PAGE_SIZE && (parsed.data.total === void 0 || seen < parsed.data.total)
+	};
+};
+const collectPages = async (client, source, telemetry, page, collected) => {
+	const { items, more } = await readPage(client, source, page, telemetry);
+	collected.push(...items);
+	if (!more) return collected;
+	if (page + 1 >= MAX_PAGES) throw new ApplyConflictError("too_many_redirect_matches", `Too many Redirection rules contain ${source} to check it safely`);
+	return collectPages(client, source, telemetry, page + 1, collected);
+};
+const findRule = async (client, source, telemetry) => {
+	const exact = (await collectPages(client, source, telemetry, 0, [])).filter((item) => item.url === source && item.regex !== true && (item.match_type ?? "url") === "url" && (item.action_type ?? "url") === "url");
+	if (exact.length > 1) throw new ApplyConflictError("ambiguous_redirect", `Redirection has ${exact.length} rules for ${source}; merge them in Redirection first`);
+	const [only] = exact;
+	return only === void 0 ? void 0 : toRule(only);
+};
+const defaultGroup = async (client, telemetry) => {
+	const result = await wpFetch(client, listPath(GROUPS_PATH, { per_page: String(PAGE_SIZE) }), telemetry);
+	const parsed = listSchema.safeParse(result.json);
+	if (result.status < 200 || result.status >= 300 || !parsed.success) throw redirectionError(result, "Could not read Redirection groups");
+	const usable = parsed.data.items.flatMap((item) => {
+		const group = groupSchema.safeParse(item);
+		return group.success && group.data.module_id === WORDPRESS_MODULE && group.data.enabled !== false ? [group.data] : [];
+	});
+	const chosen = usable.find((group) => group.default === true) ?? usable[0];
+	if (chosen === void 0) throw new ApplyConflictError("no_redirect_group", "Redirection has no enabled WordPress group to add the rule to");
+	return chosen.id;
+};
+const ruleStamp = (rule) => rule === void 0 ? "redirect:none" : `redirect:${JSON.stringify([
+	rule.id,
+	rule.target,
+	rule.code,
+	rule.enabled
+])}`;
+const ruleValue = (rule, path) => {
+	if (rule === void 0) return null;
+	return path === "code" ? rule.code : rule.target;
+};
+const requestedRuleValue = (operation, path) => path === "code" ? operation.code : operation.target;
+const redirectionAdminUrl = (apiUrl) => new URL("/wp-admin/tools.php?page=redirection.php", apiUrl).toString();
+const assertWritable = (operation, rule) => {
+	if (rule !== void 0 && !rule.enabled) throw new ApplyConflictError("redirect_disabled", `The Redirection rule for ${operation.source} is disabled; enable or delete it in Redirection first`);
+};
+const preflightRedirect = async (client, operation, telemetry, index) => {
+	const rule = await findRule(client, operation.source, telemetry);
+	assertWritable(operation, rule);
+	if (rule === void 0) await defaultGroup(client, telemetry);
+	return {
+		editUrl: redirectionAdminUrl(client.apiUrl),
+		editor: REDIRECTION_EDITOR,
+		fields: REDIRECT_PATHS.map((path) => {
+			const before = ruleValue(rule, path);
+			const after = requestedRuleValue(operation, path);
+			return {
+				after: previewValue(after),
+				before: previewValue(before),
+				changed: !deepEqual(before, after),
+				path
+			};
+		}),
+		modifiedGmt: ruleStamp(rule),
+		operationIndex: index,
+		sentence: operationSentence(operation),
+		slug: operation.source,
+		target: operationTarget(operation)
+	};
+};
+const ruleBody = (operation, groupId, title) => ({
+	action_code: operation.code,
+	action_data: { url: operation.target },
+	action_type: "url",
+	group_id: groupId,
+	match_type: "url",
+	regex: false,
+	title,
+	url: operation.source
+});
+const writeRule = async (client, operation, rule, telemetry) => {
+	const body = rule === void 0 ? ruleBody(operation, await defaultGroup(client, telemetry), "") : ruleBody(operation, rule.groupId, rule.title);
+	return await wpFetch(client, rule === void 0 ? REDIRECTS_PATH : `${REDIRECTS_PATH}/${rule.id}`, telemetry, {
+		body: JSON.stringify(body),
+		headers: { "Content-Type": "application/json" },
+		method: "POST"
+	});
+};
+const applyRedirect = async (client, operation, snapshot, telemetry) => {
+	const target = operationTarget(operation);
+	const result = (status, changed, error) => {
+		const receipt = {
+			changed_paths: changed,
+			kind: operation.kind,
+			normalized_paths: [],
+			operation_index: snapshot.operationIndex,
+			status,
+			target
+		};
+		if (error !== void 0) receipt.error = error;
+		return receipt;
+	};
+	if (snapshot.target !== target) return result("failed", [], {
+		code: "preflight_mismatch",
+		message: "The approval preview describes a different target"
+	});
+	let before;
+	try {
+		before = await findRule(client, operation.source, telemetry);
+	} catch (error) {
+		return result("failed", [], toReceiptError(error));
+	}
+	if (ruleStamp(before) !== snapshot.modifiedGmt) return result("conflict", [], {
+		code: "modified_since_preflight",
+		message: `${target} changed after the approval preview`
+	});
+	const changed = REDIRECT_PATHS.filter((path) => !deepEqual(ruleValue(before, path), requestedRuleValue(operation, path)));
+	if (changed.length === 0) return result("unchanged", []);
+	let write;
+	try {
+		write = await writeRule(client, operation, before, telemetry);
+	} catch (error) {
+		return result("failed", [], toReceiptError(error));
+	}
+	if (write.status < 200 || write.status >= 300) return result("failed", [], {
+		code: write.errorCode ?? "write_failed",
+		message: wordPressErrorMessage(write.status, write.errorCode) ?? `Redirection rejected the rule for ${operation.source}`
+	});
+	let after;
+	try {
+		after = await findRule(client, operation.source, telemetry);
+	} catch (error) {
+		return result("failed", [], toReceiptError(error));
+	}
+	const missed = changed.filter((path) => !deepEqual(ruleValue(after, path), requestedRuleValue(operation, path)));
+	if (missed.length > 0) return result("failed", changed.filter((path) => !missed.includes(path)), {
+		code: "readback_mismatch",
+		message: missedPathsMessage(missed)
+	});
+	return result("changed", changed);
+};
+// src/wp-apply.ts
 const ACF_PREFIX = "acf.";
+const META_PREFIX = "meta.";
 const UNREADABLE_MODIFIED_GMT_CODE = "unreadable_modified_gmt";
 const UNREADABLE_MODIFIED_GMT_MESSAGE = "WordPress did not report when this post was last modified, so the change cannot be checked against the approval preview";
 const recordSchema = z.record(z.string(), z.json());
 const stringSchema = z.string();
 const editableFieldSchema = z.object({ raw: z.json() });
+const nestedValue = (container, key) => {
+	const parsed = recordSchema.safeParse(container);
+	return parsed.success ? parsed.data[key] : void 0;
+};
 const readPath = (record, path) => {
-	if (path.startsWith(ACF_PREFIX)) {
-		const acf = recordSchema.safeParse(record.acf);
-		return acf.success ? acf.data[path.slice(4)] : void 0;
-	}
+	if (path.startsWith(ACF_PREFIX)) return nestedValue(record.acf, path.slice(4));
+	if (path.startsWith(META_PREFIX)) return nestedValue(record.meta, path.slice(5));
 	const value = record[path];
 	const editable = editableFieldSchema.safeParse(value);
 	return editable.success ? editable.data.raw : value;
 };
 const requestedValue = (operation, path) => {
 	if (path.startsWith(ACF_PREFIX)) return operation.acf?.[path.slice(4)];
+	if (path.startsWith(META_PREFIX)) return operation.meta?.[path.slice(5)];
 	const { fields } = operation;
 	if (fields === void 0) return;
 	return Object.entries(fields).find(([key]) => key === path)?.[1];
@@ -319,23 +566,7 @@ const readRecord = async (client, operation, telemetry) => {
 	if (result.status < 200 || result.status >= 300 || !parsed.success) throw new ApplyConflictError(result.errorCode ?? "read_failed", wordPressErrorMessage(result.status, result.errorCode) ?? `Could not read ${operationTarget(operation)}`);
 	return parsed.data;
 };
-const toReceiptError = (error) => {
-	if (error instanceof ApplyConflictError) return {
-		code: error.code,
-		message: error.message
-	};
-	if (error instanceof UpstreamRequestError) return {
-		code: "wordpress_request_failed",
-		message: error.message
-	};
-	return {
-		code: "unexpected_error",
-		message: "The operation failed"
-	};
-};
-const preflightRemaining = async (client, operations, telemetry, index, collected) => {
-	const operation = operations.at(index);
-	if (operation === void 0) return collected;
+const preflightPost = async (client, operation, telemetry, index) => {
 	const record = await readRecord(client, operation, telemetry);
 	const current = modifiedGmt(record);
 	if (current === void 0) throw new ApplyConflictError(UNREADABLE_MODIFIED_GMT_CODE, UNREADABLE_MODIFIED_GMT_MESSAGE);
@@ -350,7 +581,7 @@ const preflightRemaining = async (client, operations, telemetry, index, collecte
 			path
 		};
 	});
-	collected.push({
+	return {
 		editUrl: adminEditUrl(client.apiUrl, operation.id),
 		fields,
 		modifiedGmt: current,
@@ -358,7 +589,12 @@ const preflightRemaining = async (client, operations, telemetry, index, collecte
 		sentence: operationSentence(operation),
 		slug: postSlug(record),
 		target: operationTarget(operation)
-	});
+	};
+};
+const preflightRemaining = async (client, operations, telemetry, index, collected) => {
+	const operation = operations.at(index);
+	if (operation === void 0) return collected;
+	collected.push(isRedirectOperation(operation) ? await preflightRedirect(client, operation, telemetry, index) : await preflightPost(client, operation, telemetry, index));
 	return preflightRemaining(client, operations, telemetry, index + 1, collected);
 };
 const preflightOperations = async (client, intent, operations, telemetry) => {
@@ -374,6 +610,7 @@ const writeBody = (operation) => {
 		for (const [key, value] of Object.entries(fields)) if (value !== void 0) body[key] = value;
 	}
 	if (operation.acf !== void 0) body.acf = operation.acf;
+	if (operation.meta !== void 0) body.meta = operation.meta;
 	return body;
 };
 const classifyReadback = (operation, before, after) => {
@@ -398,13 +635,7 @@ const classifyReadback = (operation, before, after) => {
 		normalized
 	};
 };
-const missedPathsMessage = (missed) => {
-	const listed = missed.slice(0, MISSED_PATH_LIMIT);
-	const extra = missed.length - listed.length;
-	const suffix = extra > 0 ? ` and ${extra} more` : "";
-	return `WordPress did not store ${listed.join(", ")}${suffix}`;
-};
-const applyOne = async (client, operation, snapshot, telemetry) => {
+const applyPost = async (client, operation, snapshot, telemetry) => {
 	const base = {
 		kind: "update_post",
 		operation_index: snapshot.operationIndex,
@@ -520,13 +751,13 @@ const applyRemaining = async (client, operations, preflight, telemetry, index, c
 			code: "missing_preflight",
 			message: "No approval preview exists for this operation"
 		},
-		kind: "update_post",
+		kind: operation.kind,
 		normalized_paths: [],
 		operation_index: index,
 		status: "failed",
 		target: operationTarget(operation)
 	});
-	else collected.push(await applyOne(client, operation, snapshot, telemetry));
+	else collected.push(isRedirectOperation(operation) ? await applyRedirect(client, operation, snapshot, telemetry) : await applyPost(client, operation, snapshot, telemetry));
 	return applyRemaining(client, operations, preflight, telemetry, index + 1, collected);
 };
 const applyOperations = async (options) => {
@@ -545,7 +776,7 @@ const WP_CONNECTOR_INSTRUCTIONS = [
 	"Reads: wp.graphql({query, variables?}) runs WPGraphQL (introspection allowed);",
 	"wp.get({path, query?}) GETs any /wp-json/ path and throws on a non-2xx response.",
 	"Writes: wp.apply({intent, operations}) is the only write path and pauses for human approval.",
-	`Send 1-${MAX_OPERATIONS} update_post operations per call and set expected_modified_gmt when you read the post first.`
+	`Send 1-${MAX_OPERATIONS} update_post or upsert_redirect operations per call and set expected_modified_gmt when you read the post first.`
 ].join(" ");
 const assertQueryOnly = (query) => {
 	let document;
@@ -584,7 +815,7 @@ const queryString = (query) => {
 };
 const createWordPressTools = (deps) => ({
 	apply: {
-		description: `Apply 1-${MAX_OPERATIONS} update_post operations to WordPress. Give the work a concise, one-sentence intent for the human approval card. Pauses for human approval; returns one receipt per operation.`,
+		description: `Apply 1-${MAX_OPERATIONS} update_post or upsert_redirect operations to WordPress. Give the work a concise, one-sentence intent for the human approval card. Pauses for human approval; returns one receipt per operation.`,
 		execute: async (args, ctx) => {
 			const input = parseApplyInput(args);
 			const caller = deps.scope.require();
@@ -664,7 +895,8 @@ const wordpressConnector = {
 	executeDescription: [
 		"The wp global reaches WordPress.",
 		"Reads: await wp.graphql({ query, variables? }); or await wp.get({ path, query? }), where path starts /wp-json/, contains no ?, and query values are scalars.",
-		"Writes: await wp.apply({ intent, operations }), with 1-20 operations shaped { kind: \"update_post\", rest_base, id, expected_modified_gmt?, fields?, acf? }; fields may contain title, content, excerpt, slug, or status. Put all changes for one post in one operation. Read with context: \"edit\" first and copy modified_gmt to expected_modified_gmt.",
+		"Writes: await wp.apply({ intent, operations }), with 1-20 operations shaped { kind: \"update_post\", rest_base, id, expected_modified_gmt?, fields?, acf?, meta? } or { kind: \"upsert_redirect\", source, target, code? }. fields may contain title, content, excerpt, slug, or status; meta holds registered post meta as the post's context: \"edit\" read shows it under meta (keys missing there are not writable). Put all changes for one post in one operation. Read with context: \"edit\" first and copy modified_gmt to expected_modified_gmt.",
+		"upsert_redirect creates or updates the Redirection plugin rule for one site path (source, such as /old-page) to a site path or URL (target), with code 301 (default), 302, 307 or 308. Read existing rules with wp.get({ path: \"/wp-json/redirection/v1/redirect\", query: { \"filterBy[url]\": source } }).",
 		"Read example: async () => await wp.get({ path: \"/wp-json/wp/v2/posts/123\", query: { context: \"edit\" } }).",
 		"Write example: async () => { const post = await wp.get({ path: \"/wp-json/wp/v2/posts/123\", query: { context: \"edit\" } }); return await wp.apply({ intent: \"Fix the title.\", operations: [{ kind: \"update_post\", rest_base: \"posts\", id: post.id, expected_modified_gmt: post.modified_gmt, fields: { title: \"Correct title\" } }] }); }"
 	].join(" "),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patronage/mcp-wordpress",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "The WordPress connector for @patronage/mcp-core: WPGraphQL and REST reads, and post updates through the approval step.",
   "license": "MIT",
   "repository": {