@prenta/mcp-server 0.23.0

package/dist/client.js

@@ -0,0 +1,1019 @@
+/**
+ * Thrown by `PrentaClient` on non-2xx responses. Carries the HTTP
+ * `status` so callers (e.g. `list_collections`'s OpenAPI fallback) can
+ * branch on the status code rather than pattern-matching the error
+ * message — pattern matching was rejected by review on PR #155 because
+ * a real 404 might omit the literal substring "not found" and an
+ * unrelated 5xx response might include it.
+ */
+export class PrentaClientError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.name = 'PrentaClientError';
+        this.status = status;
+    }
+}
+export class PrentaClient {
+    baseUrl;
+    apiKey;
+    fetchImpl;
+    constructor(opts) {
+        if (!opts.baseUrl)
+            throw new Error('baseUrl is required');
+        if (!opts.apiKey)
+            throw new Error('apiKey is required');
+        // Trim trailing slash so we can concatenate `/api/cms/...` predictably.
+        this.baseUrl = opts.baseUrl.replace(/\/+$/, '');
+        this.apiKey = opts.apiKey;
+        this.fetchImpl = opts.fetchImpl ?? fetch;
+    }
+    headers(extra) {
+        return {
+            Authorization: `Bearer ${this.apiKey}`,
+            Accept: 'application/json',
+            ...extra,
+        };
+    }
+    async request(method, path, body, query) {
+        let url = `${this.baseUrl}/api/cms${path}`;
+        if (query) {
+            const params = new URLSearchParams();
+            for (const [k, v] of Object.entries(query)) {
+                if (v !== undefined)
+                    params.set(k, String(v));
+            }
+            const q = params.toString();
+            if (q)
+                url += `?${q}`;
+        }
+        const init = { method, headers: this.headers() };
+        if (body !== undefined) {
+            init.body = JSON.stringify(body);
+            init.headers['Content-Type'] = 'application/json';
+        }
+        const res = await this.fetchImpl(url, init);
+        const text = await res.text();
+        let parsed = null;
+        if (text) {
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch {
+                // non-JSON response body — surface as message for the tool caller.
+            }
+        }
+        if (!res.ok) {
+            const msg = parsed?.error ?? `Prenta API ${method} ${path} failed: ${res.status}`;
+            throw new PrentaClientError(msg, res.status);
+        }
+        return parsed;
+    }
+    /**
+     * POST a `multipart/form-data` body. Distinct from `request()` because:
+     *
+     *  - we MUST NOT set `Content-Type` (the fetch implementation appends the
+     *    multipart boundary; if we override it the server can't parse the body),
+     *  - we MUST NOT `JSON.stringify(form)` — a `FormData` is sent verbatim,
+     *  - the upload handler in `cms-core` rejects requests without a valid
+     *    `Content-Length` header, and Node 20+ / undici populate that header
+     *    automatically when the body is a `FormData`.
+     *
+     * Used exclusively by `uploadMedia` today. Kept as a thin private helper so
+     * the failure mode (multipart parse error vs JSON parse error vs HTTP
+     * error) stays observable to the caller.
+     */
+    async requestMultipart(path, form) {
+        const url = `${this.baseUrl}/api/cms${path}`;
+        const init = {
+            method: 'POST',
+            headers: this.headers(),
+            body: form,
+        };
+        const res = await this.fetchImpl(url, init);
+        const text = await res.text();
+        let parsed = null;
+        if (text) {
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch {
+                /* non-JSON body */
+            }
+        }
+        if (!res.ok) {
+            const msg = parsed?.error ?? `Prenta API POST ${path} failed: ${res.status}`;
+            throw new PrentaClientError(msg, res.status);
+        }
+        return parsed;
+    }
+    // ---- Collections ----
+    listDocuments(collection, query) {
+        return this.request('GET', `/collections/${encodeURIComponent(collection)}`, undefined, query);
+    }
+    getDocument(collection, id) {
+        return this.request('GET', `/collections/${encodeURIComponent(collection)}/${encodeURIComponent(id)}`);
+    }
+    createDocument(collection, data) {
+        return this.request('POST', `/collections/${encodeURIComponent(collection)}`, data);
+    }
+    updateDocument(collection, id, data) {
+        return this.request('PUT', `/collections/${encodeURIComponent(collection)}/${encodeURIComponent(id)}`, data);
+    }
+    deleteDocument(collection, id) {
+        return this.request('DELETE', `/collections/${encodeURIComponent(collection)}/${encodeURIComponent(id)}`);
+    }
+    // ---- Globals ----
+    getGlobal(slug) {
+        return this.request('GET', `/globals/${encodeURIComponent(slug)}`);
+    }
+    updateGlobal(slug, data) {
+        return this.request('PUT', `/globals/${encodeURIComponent(slug)}`, data);
+    }
+    // ---- Media ----
+    /**
+     * List media assets. The `GET /media` endpoint returns the asset array under
+     * `items`/`data` (and pagination fields), never `docs`. We normalize it into
+     * the same `{ data: { docs, total, page, pageSize, totalPages } }` envelope
+     * as `listDocuments` so the `list_media` MCP tool output is consistent with
+     * `list_documents` and an agent can read `docs` uniformly.
+     */
+    async listMedia(query) {
+        const res = await this.request('GET', '/media', undefined, query);
+        const envelope = res?.data ?? {};
+        const docs = envelope.items ?? envelope.data ?? [];
+        const total = envelope.total ?? docs.length;
+        const page = envelope.page ?? query?.page ?? 1;
+        const pageSize = envelope.pageSize ?? query?.pageSize ?? docs.length;
+        const totalPages = envelope.totalPages ?? (pageSize > 0 ? Math.ceil(total / pageSize) : 1);
+        return { data: { docs, total, page, pageSize, totalPages } };
+    }
+    /**
+     * Upload a binary asset to the CMS media library. Bytes are accepted as a
+     * `Uint8Array` / `Buffer` (the MCP tool wrapper handles base64 decoding
+     * from the JSON-RPC layer, but the client surface stays binary).
+     *
+     * The server enforces a 50 MB hard cap and validates magic bytes against
+     * the declared `mimeType` — uploading a `.exe` with `image/png` will be
+     * rejected with HTTP 415. SVGs are sanitised server-side. Pass
+     * `skipOptimize: true` to keep the original bytes; by default JPEG / PNG
+     * are recompressed to WebP.
+     */
+    uploadMedia(input) {
+        const form = new FormData();
+        // Copy bytes into a freshly-allocated ArrayBuffer. `Buffer` (and a
+        // `Uint8Array` constructed from an externally-provided ArrayBufferLike)
+        // can be backed by a SharedArrayBuffer in some runtimes, which the
+        // strict `Blob` constructor signature refuses (`Uint8Array<ArrayBuffer>`
+        // only). The copy is O(n) and negligible compared to the network upload.
+        const ab = new ArrayBuffer(input.bytes.byteLength);
+        new Uint8Array(ab).set(input.bytes);
+        const blob = new Blob([ab], { type: input.mimeType });
+        form.append('file', blob, input.filename);
+        if (input.skipOptimize)
+            form.append('skipOptimize', 'true');
+        if (input.forceUpload)
+            form.append('forceUpload', 'true');
+        return this.requestMultipart('/media/upload', form);
+    }
+    /**
+     * Update media metadata. Only the supplied fields are touched. `alt` maps
+     * to the DB column `altText`; `focalX` / `focalY` (range 0..1) drive
+     * smart-crop on the front end. `caption`, `description`, and `focusKeyword`
+     * round out the fields `calculateMediaSeoScore` reads, so an agent can take
+     * an asset all the way to a passing media SEO grade.
+     */
+    updateMedia(id, body) {
+        return this.request('PUT', `/media/${encodeURIComponent(id)}`, body);
+    }
+    /**
+     * Vision-backed alt text for a media library image. Requires the AI plugin,
+     * a vision-capable provider, and `ai.features.mediaAltText` enabled.
+     * Returns a suggestion — call `update_media({ alt })` to publish it.
+     */
+    generateMediaAlt(body) {
+        return this.request('POST', '/ai/media-metadata', body);
+    }
+    /** Delete a media item AND its underlying blob storage object (best-effort). */
+    deleteMedia(id) {
+        return this.request('DELETE', `/media/${encodeURIComponent(id)}`);
+    }
+    /**
+     * Bulk-update media metadata. Per-item patches (not a shared patch). Returns
+     * per-id success/failure so a large backfill can land partial results (#717).
+     */
+    bulkUpdateMedia(items) {
+        return this.request('POST', '/media/bulk-update', { items });
+    }
+    /**
+     * Bulk-delete media items and their blobs (best-effort). Requires
+     * `confirm: true` at the MCP tool layer; the API also requires it.
+     */
+    bulkDeleteMedia(ids, confirm) {
+        return this.request('POST', '/media/bulk-delete', { ids, confirm });
+    }
+    /**
+     * Recompress an existing image to WebP. Returns the updated media row plus
+     * an `optimization` summary (`{ originalSize, optimizedSize, savings, ... }`).
+     * Already-WebP files and non-images short-circuit with `alreadyOptimized: true`.
+     */
+    optimizeMedia(id) {
+        return this.request('POST', `/media/${encodeURIComponent(id)}/optimize`);
+    }
+    /**
+     * Move a media item into a folder, or out of every folder by passing
+     * `folderId: null`. The server validates that the target folder lives in
+     * the `media` scope.
+     */
+    moveMediaToFolder(id, folderId) {
+        return this.request('PUT', `/media/${encodeURIComponent(id)}/folder`, { folderId });
+    }
+    // ---- Folders ----
+    /**
+     * List folders in a given scope as a nested tree (`{ ...folder, children: [...] }`).
+     * Scopes today: `'media'` for the media library, `'documents'` / `'collections'`
+     * for document folders. The `scope` query param is required by the server.
+     */
+    listFolders(scope) {
+        return this.request('GET', '/folders', undefined, { scope });
+    }
+    /**
+     * Create a folder. If `parentId` is supplied, it must already exist AND live
+     * in the same scope — the server refuses cross-scope reparenting.
+     */
+    createFolder(body) {
+        return this.request('POST', '/folders', body);
+    }
+    /**
+     * Update a folder: rename (`name`), reparent (`parentId`; pass `null` to
+     * promote to root), or reorder (`position`). The server prevents self-
+     * parenting and cross-scope reparenting.
+     */
+    updateFolder(id, body) {
+        return this.request('PUT', `/folders/${encodeURIComponent(id)}`, body);
+    }
+    /**
+     * Delete a folder. Refuses with HTTP 409 if the folder still contains
+     * documents, media, or sub-folders — the caller must move or delete the
+     * contents first.
+     */
+    deleteFolder(id) {
+        return this.request('DELETE', `/folders/${encodeURIComponent(id)}`);
+    }
+    /**
+     * Move a document into a folder, or remove it from every folder by passing
+     * `folderId: null`. Server validates that the target folder is in the
+     * documents / collections scope.
+     */
+    moveDocumentToFolder(id, folderId) {
+        return this.request('PUT', `/documents/${encodeURIComponent(id)}/folder`, { folderId });
+    }
+    // ---- Version history ----
+    /**
+     * List immutable snapshots of a document, newest first. Each `Version`
+     * carries the full `data` payload at the time of write plus the user who
+     * made the change (joined via `relationLoadStrategy: 'join'` server-side).
+     */
+    listVersions(collection, documentId, query) {
+        return this.request('GET', `/collections/${encodeURIComponent(collection)}/${encodeURIComponent(documentId)}/versions`, undefined, query);
+    }
+    /**
+     * Roll a document back to a prior version. The restore goes through the
+     * normal `updateDocument` path so it: (a) runs validation hooks, (b)
+     * creates a NEW version row capturing the restore (i.e. it never rewrites
+     * history), and (c) emits a `version_restored` event to `prenta_audit_logs`.
+     */
+    restoreVersion(collection, documentId, versionId) {
+        return this.request('POST', `/collections/${encodeURIComponent(collection)}/${encodeURIComponent(documentId)}/versions/${encodeURIComponent(versionId)}/restore`);
+    }
+    // ---- Scheduling ----
+    /**
+     * Schedule a document to publish and/or unpublish at a future timestamp.
+     * `scheduledAt` (publish) forces `status` → `SCHEDULED` so the cron picks
+     * it up; `scheduledUnpublishAt` leaves the current status alone. The
+     * server requires at least one of the two, both must be ISO 8601 strings
+     * AND in the future, and `scheduledUnpublishAt` must be after
+     * `scheduledAt` when both are provided.
+     */
+    schedulePublish(collection, documentId, body) {
+        return this.request('POST', `/collections/${encodeURIComponent(collection)}/${encodeURIComponent(documentId)}/schedule`, body);
+    }
+    /**
+     * Cancel any pending publish + unpublish schedule for the document. If
+     * the document was in `SCHEDULED` (not yet published) the server drops
+     * its status back to `DRAFT`. Already-published documents stay live.
+     */
+    unschedulePublish(collection, documentId) {
+        return this.request('DELETE', `/collections/${encodeURIComponent(collection)}/${encodeURIComponent(documentId)}/schedule`);
+    }
+    // ---- Editorial workflow ----
+    /**
+     * Read the workflow state of a document. Returns the current stage
+     * (`DRAFT` | `IN_REVIEW` | `APPROVED` | `PUBLISHED` | `ARCHIVED`), the
+     * stages the *current* user is allowed to transition to next (derived
+     * from their role), plus the reviewer ID + note if set.
+     */
+    getWorkflowState(collection, documentId) {
+        return this.request('GET', `/collections/${encodeURIComponent(collection)}/${encodeURIComponent(documentId)}/workflow`);
+    }
+    /**
+     * Move a document to a new workflow stage. The server validates that the
+     * transition is allowed from the current stage AND that the caller's
+     * role permits it; if either check fails it returns HTTP 400 with the
+     * reason in the error body.
+     */
+    transitionWorkflow(collection, documentId, body) {
+        return this.request('POST', `/collections/${encodeURIComponent(collection)}/${encodeURIComponent(documentId)}/workflow`, body);
+    }
+    // ---- Comments ----
+    /**
+     * List the comment thread attached to a document. By default returns only
+     * unresolved, non-deleted comments. `includeResolved` widens that to
+     * include resolved threads; `includeDeleted` is admin-only and surfaces
+     * soft-deleted moderation history (returns HTTP 403 for non-admin keys).
+     */
+    listComments(documentId, query) {
+        // Server returns `{ data: CommentDTO[] }` — a plain array, NOT an
+        // envelope like `{ data: { comments, total, hasMore } }`. Encoding
+        // the array shape in the TS return type protects against future
+        // engineers / AI assistants accidentally re-wrapping it on either
+        // side of the wire.
+        return this.request('GET', `/documents/${encodeURIComponent(documentId)}/comments`, undefined, 
+        // The server reads these as URL query strings. Booleans become
+        // 'true'/'false' via String(); the handler matches exactly
+        // `=== 'true'` so other truthy values are ignored.
+        query);
+    }
+    /**
+     * Create a comment on a document. `anchor` is optional and lets the
+     * caller pin the comment to a specific text range (used by the
+     * Prosemirror selection UI in the admin). `parentId` is set for thread
+     * replies. The server emits a `comment_created` event to
+     * `prenta_audit_logs` and fires a fire-and-forget notification dispatch.
+     */
+    createComment(documentId, body) {
+        return this.request('POST', `/documents/${encodeURIComponent(documentId)}/comments`, body);
+    }
+    // ---- Page builder accessibility ----
+    /**
+     * Run a deterministic accessibility audit over a page-builder tree.
+     * Detects missing alt text, heading-level skips, missing form labels,
+     * missing ARIA attributes, and undersized touch targets. Returns an
+     * array of `A11yIssue` entries — each carries `autoFixable: boolean`
+     * so the caller can pair this with `fixPageA11y` for one-click cleanup.
+     *
+     * Pass the tree exactly as returned by a document's `data.tree` field;
+     * no normalisation needed.
+     */
+    auditPageA11y(tree) {
+        return this.request('POST', '/page-builder/audit-a11y', { tree });
+    }
+    /**
+     * Auto-fix the accessibility issues marked `autoFixable: true` from
+     * `audit_page_a11y` and return the mutated tree plus a report
+     * (`fixedCount` / `remainingCount`). Non-auto-fixable issues are
+     * returned in `report.issues` for human follow-up. The handler emits a
+     * `settings_changed` audit event with the fix counts.
+     */
+    fixPageA11y(tree) {
+        return this.request('POST', '/page-builder/fix-a11y', { tree });
+    }
+    // ---- Comment thread management (PR E) ----
+    /**
+     * Edit a comment body. Only the author can edit; the server returns a
+     * `forbidden` error otherwise. Resolved threads remain editable so a
+     * moderator can append context.
+     */
+    editComment(id, body) {
+        return this.request('PATCH', `/comments/${encodeURIComponent(id)}`, {
+            body,
+        });
+    }
+    /** Mark a comment thread resolved. Requires write-role; emits `comment_resolved` audit event. */
+    resolveComment(id) {
+        return this.request('POST', `/comments/${encodeURIComponent(id)}/resolve`);
+    }
+    /** Re-open a previously resolved comment thread. Requires write-role. */
+    reopenComment(id) {
+        return this.request('POST', `/comments/${encodeURIComponent(id)}/reopen`);
+    }
+    /**
+     * Soft-delete a comment. Server returns `forbidden` unless the caller is
+     * the author OR an admin. Soft-deleted comments are admin-only viewable
+     * via `list_comments({ includeDeleted: true })`.
+     */
+    deleteComment(id) {
+        return this.request('DELETE', `/comments/${encodeURIComponent(id)}`);
+    }
+    // ---- Redirects (PR E) ----
+    /** List all redirects, newest first. */
+    listRedirects() {
+        return this.request('GET', '/redirects');
+    }
+    /**
+     * Create a redirect. Admin-only. The server enforces an open-redirect
+     * defence — absolute destinations must point at a host that's either
+     * the configured `NEXT_PUBLIC_SITE_URL` or listed in
+     * `redirects.allowedExternalHosts`. Relative destinations (`/foo`) are
+     * always allowed. `statusCode` accepts 301 / 302 / 307 / 308 only and
+     * defaults to 301 on the server.
+     */
+    createRedirect(body) {
+        return this.request('POST', '/redirects', body);
+    }
+    /** Delete a redirect by ID. Admin-only. */
+    deleteRedirect(id) {
+        return this.request('DELETE', `/redirects/${encodeURIComponent(id)}`);
+    }
+    // ---- Page templates + saved sections (PR E) ----
+    /**
+     * List page templates. Admin-only. Optional `category` filter narrows
+     * to a single template category. `collection` reorders the result so
+     * the suggested templates for that collection bubble to the top
+     * (driven by collection presets) and annotates each row with
+     * `suggested` / `suggestionRank`. When `collection` is supplied the
+     * response also carries a top-level `suggestion` summary.
+     */
+    listPageTemplates(query) {
+        return this.request('GET', '/page-templates', undefined, query);
+    }
+    /** Fetch a single page template by ID. Admin-only. */
+    getPageTemplate(id) {
+        return this.request('GET', `/page-templates/${encodeURIComponent(id)}`);
+    }
+    /** List saved page-builder sections. Admin-only. Optional `category` filter. */
+    listSavedSections(query) {
+        return this.request('GET', '/saved-sections', undefined, query);
+    }
+    // ---- SEO aggregate (PR E) ----
+    /**
+     * Run a site-wide SEO scan over every published document. **Expensive**
+     * — touches every published row. Returns
+     * `{ total, pagesWithIssues, totalProblems, issues[] }` where each
+     * issue carries `{ documentId, title, slug, problems[] }`. The audit
+     * recommended gating this behind an explicit confirmation arg; the
+     * tool wrapper enforces that, the client is intentionally a thin
+     * pass-through.
+     */
+    seoScanRun() {
+        return this.request('POST', '/seo/scan');
+    }
+    /**
+     * Aggregate SEO health for the dashboard — counts of missing meta
+     * descriptions / alt text plus a `topContent` array of recent
+     * published docs with light SEO scores. Cheap; safe to call on
+     * dashboard refresh.
+     */
+    seoSummary() {
+        return this.request('GET', '/seo/summary');
+    }
+    // ---- SEO Operations Center (audit runs + issues + redirects) ----
+    /**
+     * Aggregated Overview-tab payload: site score + grade + delta, four
+     * headline metrics, open-issue summary, priority-ranked quick wins, and
+     * (gated) search-performance rows. Cheap read; derived from the last
+     * completed audit run.
+     */
+    seoOverview() {
+        return this.request('GET', '/seo/overview');
+    }
+    /**
+     * Kick off a persistent SEO audit run. `scope` controls breadth:
+     * `full` (everything), `content`, `technical`, or `redirect`. Returns the
+     * created `SEOAuditRun` (status, issue counts, before/after site score).
+     * Heavier than `seoSummary` — persists issues for the Audit tab.
+     */
+    runSeoAudit(scope = 'full') {
+        return this.request('POST', '/seo/audit', { scope });
+    }
+    /** List persisted SEO audit runs, newest first. */
+    listSeoAuditRuns() {
+        return this.request('GET', '/seo/audits');
+    }
+    /**
+     * List SEO issues with optional filters. `severity` (critical/warning/info),
+     * `category` (content/technical/redirects/...), `status`
+     * (open/ignored/resolved/recurring), and `auditRunId` narrow the result.
+     */
+    listSeoIssues(query) {
+        return this.request('GET', '/seo/issues', undefined, query);
+    }
+    /** Fetch a single SEO issue by ID. */
+    getSeoIssue(id) {
+        return this.request('GET', `/seo/issues/${encodeURIComponent(id)}`);
+    }
+    /** Mark an SEO issue resolved / ignored / reopened. */
+    setSeoIssueStatus(id, action) {
+        return this.request('POST', `/seo/issues/${encodeURIComponent(id)}/${action}`);
+    }
+    /**
+     * Export a markdown SEO fix brief for dev-team handoff. Embeds cached AI
+     * content briefs and topic research when available.
+     */
+    exportSeoFixBrief(query) {
+        const params = {};
+        if (query?.severity)
+            params.severity = query.severity;
+        if (query?.status)
+            params.status = query.status;
+        if (query?.auditRunId)
+            params.auditRunId = query.auditRunId;
+        if (query?.manualOnly === false)
+            params.manualOnly = 'false';
+        if (query?.includeContentBriefs === false)
+            params.includeContentBriefs = 'false';
+        if (query?.includeContentResearch === false)
+            params.includeContentResearch = 'false';
+        return this.request('GET', '/seo/issues/export-brief', undefined, params);
+    }
+    /** Preview a deterministic or AI-assisted inline metadata/schema fix. */
+    suggestSeoIssueFix(id) {
+        return this.request('POST', `/seo/issues/${encodeURIComponent(id)}/suggest-fix`);
+    }
+    /** Apply a previously suggested inline fix (requires matching fingerprint). */
+    applySeoIssueFix(id, fingerprint) {
+        return this.request('POST', `/seo/issues/${encodeURIComponent(id)}/apply-fix`, {
+            fingerprint,
+        });
+    }
+    /** Load a cached AI content brief for a content/heading issue. */
+    getSeoIssueContentBrief(id) {
+        return this.request('GET', `/seo/issues/${encodeURIComponent(id)}/content-brief`);
+    }
+    /** Generate (or regenerate) an AI content brief for manual content fixes. */
+    generateSeoIssueContentBrief(id) {
+        return this.request('POST', `/seo/issues/${encodeURIComponent(id)}/content-brief`);
+    }
+    /**
+     * Run topic research (thin-content) then generate a content brief in one step.
+     * Optional competitor URLs are fetched SSRF-safe (max 3).
+     */
+    researchAndBriefSeoIssue(id, competitorUrls) {
+        return this.request('POST', `/seo/issues/${encodeURIComponent(id)}/research-and-brief`, { competitorUrls: competitorUrls?.filter(Boolean) });
+    }
+    /** Batch-generate content briefs for open issues (skips fresh cached briefs). */
+    batchGenerateSeoContentBriefs(body) {
+        return this.request('POST', '/seo/issues/batch-content-briefs', body ?? {});
+    }
+    /** List redirect rules with hit counts + stale flags. */
+    listRedirectRules() {
+        return this.request('GET', '/seo/redirects');
+    }
+    /** Redirect overview counts (active / stale / 404s / chains). */
+    redirectOverview() {
+        return this.request('GET', '/seo/redirects/overview');
+    }
+    /** Detected redirect chains and loops with safe-flatten suggestions. */
+    redirectChains() {
+        return this.request('GET', '/seo/redirects/chains');
+    }
+    /** Flatten a redirect chain to a single hop (updates the first rule's destination). */
+    flattenRedirectChain(chainId) {
+        return this.request('POST', '/seo/redirects/flatten', { chainId });
+    }
+    /** AI-generated 404 recovery suggestions awaiting review. */
+    listRedirectSuggestions() {
+        return this.request('GET', '/seo/redirects/suggestions');
+    }
+    getRedirectRecoverySettings() {
+        return this.request('GET', '/seo/redirects/recovery-settings');
+    }
+    updateRedirectRecoverySettings(body) {
+        return this.request('PUT', '/seo/redirects/recovery-settings', body);
+    }
+    /** Scan tracked 404s and generate recovery redirect suggestions. */
+    generateRedirectRecoverySuggestions() {
+        return this.request('POST', '/seo/redirects/suggest');
+    }
+    acceptRedirectSuggestion(id) {
+        return this.request('POST', `/seo/redirects/suggestions/${encodeURIComponent(id)}/accept`);
+    }
+    dismissRedirectSuggestion(id) {
+        return this.request('POST', `/seo/redirects/suggestions/${encodeURIComponent(id)}/dismiss`);
+    }
+    exportRedirectsCsv() {
+        return this.request('GET', '/seo/redirects/export');
+    }
+    importRedirectsCsv(csv) {
+        return this.request('POST', '/seo/redirects/import', { csv });
+    }
+    updateRedirectRule(id, body) {
+        return this.request('PUT', `/seo/redirects/${encodeURIComponent(id)}`, body);
+    }
+    /** Site-wide internal/external link graph snapshot (Links tab). */
+    seoLinkSnapshot() {
+        return this.request('GET', '/seo/links/snapshot');
+    }
+    /** Broken / suspicious outbound link scan (bounded batch). */
+    seoLinkHealth() {
+        return this.request('GET', '/seo/link-health');
+    }
+    seoLinkSuggest(body) {
+        return this.request('POST', '/seo/links/suggest', body);
+    }
+    /** Build or refresh the AI link index used for contextual suggestions. */
+    seoLinkAiIndex() {
+        return this.request('POST', '/seo/links/ai-index');
+    }
+    getCrawlSettings() {
+        return this.request('GET', '/seo/crawl-settings');
+    }
+    updateCrawlSettings(body) {
+        return this.request('PUT', '/seo/crawl-settings', body);
+    }
+    getRobotsTxt() {
+        return this.request('GET', '/seo/robots');
+    }
+    updateRobotsTxt(body) {
+        return this.request('PUT', '/seo/robots', { body });
+    }
+    getSitemapStatus() {
+        return this.request('GET', '/seo/sitemap/status');
+    }
+    regenerateSitemap() {
+        return this.request('POST', '/seo/sitemap/regenerate');
+    }
+    listSeoContentRecords() {
+        return this.request('GET', '/seo/content');
+    }
+    getSeoContentRecord(entityType, entityId) {
+        return this.request('GET', `/seo/content/${encodeURIComponent(entityType)}/${encodeURIComponent(entityId)}`);
+    }
+    updateSeoContentFields(entityType, entityId, body) {
+        return this.request('PUT', `/seo/content/${encodeURIComponent(entityType)}/${encodeURIComponent(entityId)}`, body);
+    }
+    aiSeoGenerateField(body) {
+        return this.request('POST', '/ai/seo/generate-field', body);
+    }
+    aiSeoExplainIssue(issueId) {
+        return this.request('POST', '/ai/seo/explain-issue', { issueId });
+    }
+    aiSeoGenerateSchema(body) {
+        return this.request('POST', '/ai/seo/generate-schema', body);
+    }
+    aiSeoSummarize() {
+        return this.request('POST', '/ai/seo/summarize');
+    }
+    // ---- Forms + health (PR E) ----
+    /**
+     * List submissions for a form. **PII-sensitive** — form submissions
+     * typically contain names, emails, free-form messages, and any other
+     * fields the form collects. Requires write-role on the API key AND
+     * an explicit `formId` (no enumeration). Paged.
+     */
+    listFormSubmissions(formId, query) {
+        return this.request('GET', `/forms/${encodeURIComponent(formId)}/submissions`, undefined, query);
+    }
+    /**
+     * List entries from the submissions inbox (decrypted PII, attribution,
+     * read/star/archive state). `formId` is required at the tool boundary to
+     * prevent accidental cross-form enumeration. Returns
+     * `{ data: { entries, total, page, pageSize } }`.
+     */
+    listFormEntries(query) {
+        const params = {
+            formId: query.formId,
+            page: query.page,
+            pageSize: query.pageSize,
+            spamStatus: query.spamStatus,
+            unread: query.unread === undefined ? undefined : String(query.unread),
+            starred: query.starred === undefined ? undefined : String(query.starred),
+            archived: query.archived === undefined ? undefined : String(query.archived),
+        };
+        return this.request('GET', '/forms/entries', undefined, params);
+    }
+    /**
+     * Read a single entry plus the schema version it was captured against.
+     * Returns `{ data: { entry, fields } }`. The server audits this read as
+     * `form.entry.viewed` because it exposes decrypted PII.
+     */
+    getFormEntry(entryId) {
+        return this.request('GET', `/forms/entries/${encodeURIComponent(entryId)}`);
+    }
+    // ---- Form authoring (WS-C C1) ----
+    //
+    // The read-only form tools above (submissions / entries) let an agent
+    // INSPECT a form's data. These let it AUTHOR the form itself: create the
+    // definition, edit its metadata, version its field schema, manage the
+    // inbox state, and export. All map to the `/forms/*` admin endpoints,
+    // which require a write-role API key server-side.
+    /**
+     * List form definitions (NOT submissions). Returns
+     * `{ data: Form[], total, page, pageSize }` where each form carries its
+     * field schema plus the legacy `fieldCount` / `submissions` aliases. Use
+     * this to discover form IDs before reading entries or editing a schema.
+     */
+    listForms(query) {
+        return this.request('GET', '/forms', undefined, query);
+    }
+    /** Fetch a single form definition by ID (metadata + field schema). */
+    getForm(id) {
+        return this.request('GET', `/forms/${encodeURIComponent(id)}`);
+    }
+    /**
+     * Create a form. Only `name` is required server-side; the slug is derived
+     * from `name` when omitted. `fields` is the initial field schema (see
+     * `saveFormSchema` for the field shape) — omit to start with an empty
+     * form and add the schema in a second call.
+     */
+    createForm(body) {
+        return this.request('POST', '/forms', body);
+    }
+    /**
+     * Update a form's metadata. Only the supplied fields change. Note the
+     * field SCHEMA is NOT editable here — use `saveFormSchema` so each schema
+     * change is versioned.
+     */
+    updateForm(id, body) {
+        return this.request('PATCH', `/forms/${encodeURIComponent(id)}`, body);
+    }
+    /**
+     * Delete a form. By default the server refuses (HTTP 409) when the form
+     * has submissions; pass `force: true` to delete it and its entries.
+     */
+    deleteForm(id, force) {
+        return this.request('DELETE', `/forms/${encodeURIComponent(id)}`, undefined, force ? { force: 'true' } : undefined);
+    }
+    /** Duplicate a form (new draft copy with a fresh slug). Returns the new form. */
+    duplicateForm(id) {
+        return this.request('POST', `/forms/${encodeURIComponent(id)}/duplicate`);
+    }
+    /**
+     * Read a form's field schema plus its version history:
+     * `{ fields, activeVersionId, versions }`. Call before `saveFormSchema`
+     * to avoid clobbering the live schema.
+     */
+    getFormSchema(id) {
+        return this.request('GET', `/forms/${encodeURIComponent(id)}/schema`);
+    }
+    /**
+     * Replace a form's field schema. Creates a NEW schema version (history is
+     * never rewritten) and points the form at it. `fields` is the full
+     * ordered field list — partial patches are not supported (read with
+     * `getFormSchema`, mutate, write back the whole array).
+     */
+    saveFormSchema(id, fields, notes) {
+        const body = { fields };
+        if (notes !== undefined)
+            body.notes = notes;
+        return this.request('PUT', `/forms/${encodeURIComponent(id)}/schema`, body);
+    }
+    /**
+     * Update inbox state on a single submission entry (mark read/unread,
+     * star, archive). Does not touch the captured field values.
+     */
+    updateFormEntry(entryId, patch) {
+        return this.request('PATCH', `/forms/entries/${encodeURIComponent(entryId)}`, patch);
+    }
+    /** Apply the same inbox-state patch to many entries at once. Returns `{ updated }`. */
+    bulkUpdateFormEntries(ids, patch) {
+        return this.request('POST', '/forms/entries/bulk', {
+            ids,
+            patch,
+        });
+    }
+    /** Permanently delete a submission entry (and its decrypted PII). Destructive. */
+    deleteFormEntry(entryId) {
+        return this.request('DELETE', `/forms/entries/${encodeURIComponent(entryId)}`);
+    }
+    /**
+     * Export every submission for a form as CSV. The endpoint returns a raw
+     * `text/csv` body (NOT a JSON envelope), so we read it as text rather
+     * than via `request()`. **Bulk PII egress** — the server records a
+     * `form.entries.exported` audit event. Returns the CSV text plus the
+     * server-suggested filename.
+     */
+    async exportFormEntries(formId) {
+        const url = `${this.baseUrl}/api/cms/forms/entries/export?formId=${encodeURIComponent(formId)}`;
+        const res = await this.fetchImpl(url, { method: 'GET', headers: this.headers() });
+        const text = await res.text();
+        if (!res.ok) {
+            // Error bodies ARE JSON even though the success body is CSV.
+            let msg = `Prenta API GET /forms/entries/export failed: ${res.status}`;
+            try {
+                const parsed = JSON.parse(text);
+                if (parsed?.error)
+                    msg = parsed.error;
+            }
+            catch {
+                /* non-JSON error body — keep the status-based message */
+            }
+            throw new PrentaClientError(msg, res.status);
+        }
+        const disposition = res.headers.get('content-disposition') ?? '';
+        const match = /filename="?([^"]+)"?/i.exec(disposition);
+        return { filename: match?.[1] ?? `${formId}-entries.csv`, csv: text };
+    }
+    /**
+     * Read the deployment health of the CMS. Unauthenticated on the server
+     * side (still safe to call — exposes only operational status, no
+     * tenant data). Returns `{ status, version, env, models,
+     * databaseConnected, secretConfigured }`.
+     *
+     * Recommended as an agent's first call: a `degraded` / `unhealthy`
+     * status surfaces operator-level config problems early instead of
+     * surfacing as cryptic errors deep in a workflow.
+     */
+    healthCheck() {
+        return this.request('GET', '/health');
+    }
+    // ---- Page builder ----
+    generatePage(input) {
+        return this.request('POST', '/page-builder/generate', input);
+    }
+    generateBlock(input) {
+        return this.request('POST', '/page-builder/generate-block', input);
+    }
+    /** One-shot: generate AI page AND persist as a draft (or published) document. */
+    createPageFromPrompt(input) {
+        return this.request('POST', '/page-builder/create', input);
+    }
+    /**
+     * Generic AI content authoring for any non-page collection. Used by the
+     * per-type MCP tools (create_blog_post, create_case_study, etc.) and by the
+     * generic create_in_collection tool.
+     */
+    createDocumentFromPrompt(collection, input) {
+        return this.request('POST', `/collections/${encodeURIComponent(collection)}/ai-create`, input);
+    }
+    // ---- AI quality (Slice F) ----
+    /**
+     * Run the composite content audit (SEO + readability + a11y + freshness)
+     * against a stored document or ad-hoc content. Deterministic — no LLM call,
+     * safe to invoke on every save.
+     */
+    auditDocument(input) {
+        return this.request('POST', '/ai/audit-document', input);
+    }
+    /**
+     * Inline AI co-author. Wraps the plugin-ai writing assistant
+     * (rewrite/expand/compress/proofread) behind a single HTTP surface.
+     */
+    coauthor(input) {
+        return this.request('POST', '/ai/coauthor', input);
+    }
+    /**
+     * Suggest internal links from a body of text against the published CMS
+     * documents the API key can read. Optionally scope to a single collection.
+     */
+    suggestInternalLinks(input) {
+        return this.request('POST', '/ai/suggest-internal-links', input);
+    }
+    // ---- Schema discovery ----
+    /** Fetch the auto-generated OpenAPI spec, useful for tools listing collections + fields. */
+    getOpenApi() {
+        return this.request('GET', '/openapi.json');
+    }
+    /**
+     * List configured collections via the dedicated `/collections`
+     * discovery endpoint. Returns `{ data: CollectionMeta[] }` with one
+     * entry per configured collection (`slug`, `labels`, `type`, `fields`,
+     * `fieldCount`, `hidden`). Sourced directly from `getPrentaConfig()`
+     * server-side, so it stays accurate even when OpenAPI spec generation
+     * is missing routes. Newer endpoint — older CMS servers may return
+     * 404; `list_collections` falls back to OpenAPI in that case.
+     */
+    listCollections() {
+        return this.request('GET', '/collections');
+    }
+    /**
+     * Lightweight user directory lookup used by the comment mention
+     * picker. Returns up to 10 active users whose name OR email matches
+     * `query` (case-insensitive `contains`). Empty / whitespace
+     * queries return an empty array — the endpoint deliberately won't
+     * dump the whole user table.
+     *
+     * Exposed via the `search_users` MCP tool so AI agents can resolve
+     * `@<userId>` mentions when drafting comments.
+     */
+    searchUsers(query) {
+        return this.request('GET', '/users/search', undefined, { q: query });
+    }
+    /** Resolve a public URL path to its document. */
+    resolveUrl(path) {
+        return this.request('GET', '/resolve', undefined, { path });
+    }
+    /**
+     * Soft-check navigation item URLs against published documents + redirects.
+     * Returns warnings only — never blocks save. Requires cms-core with
+     * `POST /navigations/validate-targets`.
+     */
+    validateNavigationTargets(items) {
+        return this.request('POST', '/navigations/validate-targets', { items });
+    }
+    // ---- SEO analysis (per-document) ----
+    //
+    // These mirror the five GET /seo/<scope>/:documentId endpoints in
+    // `packages/cms-core/src/api/handlers.ts`. Unlike most other CMS endpoints,
+    // these return the raw analysis object directly (no `{ data: ... }`
+    // envelope) — we keep that shape so MCP tools forward the API response as-is.
+    /** Run the deterministic SEO content analysis against a stored document. */
+    seoAnalyzeDocument(documentId) {
+        return this.request('GET', `/seo/analysis/${encodeURIComponent(documentId)}`);
+    }
+    /** Compute a Flesch-Kincaid / grade-level readability score for a document body. */
+    seoReadability(documentId) {
+        return this.request('GET', `/seo/readability/${encodeURIComponent(documentId)}`);
+    }
+    /**
+     * Suggest internal-link targets for a document. Title-keyword-based (extracts
+     * up to 5 keywords > 3 chars from the doc title, matches them against
+     * other PUBLISHED documents). Returns up to 10 suggestions. Distinct from
+     * `suggestInternalLinks` above, which is content-based and freeform.
+     *
+     * `title` and `slug` are typed nullable because the underlying Prisma
+     * `Document` schema makes them optional (`String?`) — the API forwards
+     * the raw column values, so callers must handle nulls before rendering
+     * anchor text or building target URLs.
+     */
+    seoInternalLinks(documentId) {
+        return this.request('GET', `/seo/internal-links/${encodeURIComponent(documentId)}`);
+    }
+    /** Build the OG / Twitter / canonical meta-tag preview for a document. */
+    seoMetaPreview(documentId) {
+        return this.request('GET', `/seo/meta/${encodeURIComponent(documentId)}`);
+    }
+    /** Build the Schema.org JSON-LD graph for a document. */
+    seoSchemaGraph(documentId) {
+        return this.request('GET', `/seo/schema/${encodeURIComponent(documentId)}`);
+    }
+    // ---- Page sections (flat Page Editor model) ----
+    //
+    // These wrap the `/page-sections/*` endpoints. A page is a document in a
+    // collection that declares a `sections` JSON field; sections are an
+    // ordered list the visual Page Editor and these endpoints both read/write.
+    // Mutations go through the audited document update path server-side.
+    /**
+     * Discover the registered section types + their content/field schemas.
+     * Each entry carries `id`, `name`, `description`, `category`, `scope`,
+     * `fields` (the inspector schema), and `defaultContent` / `defaultSettings`.
+     *
+     * Pass `scope: 'page'` or `scope: 'post'` to list only the types usable on
+     * that surface (so an agent building a post template doesn't pick a
+     * page-only type, and vice versa).
+     */
+    listSectionTypes(scope) {
+        return this.request('GET', '/page-sections/types', undefined, scope ? { scope } : undefined);
+    }
+    /**
+     * Validate section content against its type schema. Deterministic (no
+     * LLM). Returns `{ valid, errors, warnings }` where each issue is
+     * `{ sectionType, field?, message }`. An unknown `sectionType` is a hard
+     * error (no registered renderer).
+     */
+    validateSection(input) {
+        return this.request('POST', '/page-sections/validate', input);
+    }
+    /** List a page's ordered sections (`data.sections`). */
+    listPageSections(collection, id) {
+        return this.request('GET', `/page-sections/${encodeURIComponent(collection)}/${encodeURIComponent(id)}`);
+    }
+    /**
+     * Add a section to a page. The server seeds registry defaults for
+     * `sectionType`, shallow-merges the supplied `content` / `settings`,
+     * generates an id, inserts at `position` (default end), and persists.
+     * Returns `{ section, sections, validation }`.
+     */
+    addPageSection(collection, id, body) {
+        return this.request('POST', `/page-sections/${encodeURIComponent(collection)}/${encodeURIComponent(id)}`, body);
+    }
+    /**
+     * Update a section in place. Only supplied fields change; `content` /
+     * `settings` are shallow-merged. Returns `{ section, sections, validation }`.
+     */
+    updatePageSection(collection, id, sectionId, body) {
+        return this.request('PATCH', `/page-sections/${encodeURIComponent(collection)}/${encodeURIComponent(id)}/${encodeURIComponent(sectionId)}`, body);
+    }
+    /** Reorder a page's sections to an explicit id order. Returns the new array. */
+    reorderPageSections(collection, id, orderedIds) {
+        return this.request('POST', `/page-sections/${encodeURIComponent(collection)}/${encodeURIComponent(id)}/reorder`, { orderedIds });
+    }
+    /** Remove a section from a page. Returns the remaining sections. */
+    removePageSection(collection, id, sectionId) {
+        return this.request('DELETE', `/page-sections/${encodeURIComponent(collection)}/${encodeURIComponent(id)}/${encodeURIComponent(sectionId)}`);
+    }
+    // ---- Post templates ----
+    //
+    // A post type's template (one per type) stores the design-driven header
+    // layout + the default section list new posts inherit. Build a template
+    // from `scope: 'post'` section types, then authors/agents create posts
+    // that start from it.
+    /**
+     * Read a post type's template: `{ postType, docId, header, sections }`.
+     * Returns an unsaved default (centered header, empty section list) when
+     * the type has no saved template yet (`docId: null`).
+     */
+    getPostTemplate(postType) {
+        return this.request('GET', `/post-templates/${encodeURIComponent(postType)}`);
+    }
+    /**
+     * Create or replace a post type's template. `header` is coerced to a full
+     * header config (missing keys filled with defaults) and `sections` are
+     * coerced (unknown section types dropped) so the stored template always
+     * renders. Use only `scope: 'post'` section types in `sections`.
+     */
+    savePostTemplate(postType, body) {
+        return this.request('PUT', `/post-templates/${encodeURIComponent(postType)}`, body);
+    }
+}
+//# sourceMappingURL=client.js.map