@respira/wordpress-mcp-server 8.0.4 → 8.0.6

package/dist/__tests__/acf-site-id-routing.test.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Regression test for bug a3f65cf5: the ACF options-page tool family
+ * (`respira_acf_update_options`, `respira_acf_update_option`,
+ * `respira_acf_get_option`, `respira_acf_get_options`, and every other
+ * respira_acf_* tool) ignored a per-call `site_id` override and silently
+ * operated on the globally active site instead, while the response envelope
+ * still named the pinned site — a customer running a population pass pinned
+ * to site B had it silently land on site A instead (reported by
+ * john@localmarketingpros.com, 17-site DSO rollout).
+ *
+ * Root cause: same bug class as the mcp-v8.0.3 Bricks/Elementor fix. The
+ * dynamic-dispatch `default:` case in `dispatchToolCall` resolves a
+ * site_id-aware `client` at the top of the function (via `resolveClient`),
+ * but the ACF branch called `this.currentSite!.dispatchAcfTool(...)` — the
+ * globally active site — instead of `client.dispatchAcfTool(...)`.
+ *
+ * This test proves the actual outbound HTTP call lands on the pinned site's
+ * host, not the active site's, by installing a mock axios adapter (same
+ * pattern as rest-route-fallback.test.ts) and inspecting which baseURL
+ * serviced the ACF options request.
+ */
+export {};
+//# sourceMappingURL=acf-site-id-routing.test.d.ts.map

package/dist/__tests__/acf-site-id-routing.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acf-site-id-routing.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/acf-site-id-routing.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG"}

package/dist/__tests__/acf-site-id-routing.test.js

@@ -0,0 +1,165 @@
+/**
+ * Regression test for bug a3f65cf5: the ACF options-page tool family
+ * (`respira_acf_update_options`, `respira_acf_update_option`,
+ * `respira_acf_get_option`, `respira_acf_get_options`, and every other
+ * respira_acf_* tool) ignored a per-call `site_id` override and silently
+ * operated on the globally active site instead, while the response envelope
+ * still named the pinned site — a customer running a population pass pinned
+ * to site B had it silently land on site A instead (reported by
+ * john@localmarketingpros.com, 17-site DSO rollout).
+ *
+ * Root cause: same bug class as the mcp-v8.0.3 Bricks/Elementor fix. The
+ * dynamic-dispatch `default:` case in `dispatchToolCall` resolves a
+ * site_id-aware `client` at the top of the function (via `resolveClient`),
+ * but the ACF branch called `this.currentSite!.dispatchAcfTool(...)` — the
+ * globally active site — instead of `client.dispatchAcfTool(...)`.
+ *
+ * This test proves the actual outbound HTTP call lands on the pinned site's
+ * host, not the active site's, by installing a mock axios adapter (same
+ * pattern as rest-route-fallback.test.ts) and inspecting which baseURL
+ * serviced the ACF options request.
+ */
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import axios from 'axios';
+import { RespiraWordPressServer } from '../server.js';
+const callLog = [];
+let currentHandler = null;
+const originalAdapter = axios.defaults.adapter;
+function installMockAdapter() {
+    callLog.length = 0;
+    axios.defaults.adapter = ((config) => {
+        callLog.push({
+            method: (config.method || 'get').toLowerCase(),
+            url: config.url,
+            baseURL: config.baseURL,
+        });
+        if (!currentHandler) {
+            return Promise.reject(new Error('no mock handler installed'));
+        }
+        const result = currentHandler(config);
+        return Promise.resolve(result).then((r) => ({
+            status: r.status,
+            statusText: 'OK',
+            headers: r.headers || { 'content-type': 'application/json' },
+            config,
+            data: r.data,
+            request: {},
+        }));
+    });
+}
+function restoreAdapter() {
+    axios.defaults.adapter = originalAdapter;
+    currentHandler = null;
+}
+function setHandler(h) {
+    currentHandler = h;
+}
+function fullUrl(c) {
+    return c.url.startsWith('http') ? c.url : `${c.baseURL || ''}${c.url}`;
+}
+const SITE_A = {
+    id: 'site-a',
+    name: 'Site A (active/default)',
+    url: 'https://site-a.example.com',
+    apiKey: 'respira_token_a',
+    default: true,
+};
+const SITE_B = {
+    id: 'site-b',
+    name: 'Site B (pinned)',
+    url: 'https://site-b.example.com',
+    apiKey: 'respira_token_b',
+};
+// Generic handler: ACF availability check (/context/site-info) always says
+// ACF is installed, regardless of which site is asked. ACF options calls
+// return a small JSON payload so dispatchAcfTool doesn't throw.
+function genericHandler(config) {
+    const url = config.url || '';
+    if (/\/context\/site-info/.test(url)) {
+        return { status: 200, data: { addons: { acf: { installed: true } } } };
+    }
+    if (/\/acf\/options\//.test(url)) {
+        return { status: 200, data: { value: 'mock-value', field_key: 'hero_title' } };
+    }
+    // Any other probe (compatibility check, etc.) — respond harmlessly.
+    return { status: 200, data: {} };
+}
+test('respira_acf_get_option with site_id override hits the pinned site, not the active site', async () => {
+    installMockAdapter();
+    try {
+        setHandler(genericHandler);
+        const server = new RespiraWordPressServer([SITE_A, SITE_B]);
+        await server.dispatchToolCall('respira_acf_get_option', {
+            site_id: 'site-b',
+            page_id: 'general',
+            field_key: 'hero_title',
+        });
+        const acfCalls = callLog.filter((c) => /\/acf\/options\//.test(c.url));
+        assert.ok(acfCalls.length > 0, 'expected at least one /acf/options/ call');
+        for (const c of acfCalls) {
+            assert.match(fullUrl(c), /site-b\.example\.com/, `ACF call should hit site-b (pinned), got: ${fullUrl(c)}`);
+        }
+        // Site A (the active/default site) must never see this call.
+        assert.ok(!acfCalls.some((c) => /site-a\.example\.com/.test(fullUrl(c))), 'site-a (active site) must not receive the pinned ACF call');
+    }
+    finally {
+        restoreAdapter();
+    }
+});
+test('respira_acf_update_option with site_id override writes to the pinned site, not the active site', async () => {
+    installMockAdapter();
+    try {
+        setHandler(genericHandler);
+        const server = new RespiraWordPressServer([SITE_A, SITE_B]);
+        await server.dispatchToolCall('respira_acf_update_option', {
+            site_id: 'site-b',
+            page_id: 'general',
+            field_key: 'hero_title',
+            value: 'New Title',
+        });
+        const acfWrites = callLog.filter((c) => /\/acf\/options\//.test(c.url) && c.method === 'put');
+        assert.ok(acfWrites.length > 0, 'expected at least one PUT /acf/options/ call');
+        for (const c of acfWrites) {
+            assert.match(fullUrl(c), /site-b\.example\.com/, `ACF write should land on site-b (pinned), got: ${fullUrl(c)}`);
+        }
+        assert.ok(!acfWrites.some((c) => /site-a\.example\.com/.test(fullUrl(c))), 'site-a (active site) must never receive the pinned ACF write');
+    }
+    finally {
+        restoreAdapter();
+    }
+});
+test('the "wordpress_acf_*" alias (post normalizeToolName) also routes to the pinned site', async () => {
+    installMockAdapter();
+    try {
+        setHandler(genericHandler);
+        const server = new RespiraWordPressServer([SITE_A, SITE_B]);
+        // dispatchToolCall receives the already-normalized name in production,
+        // exactly as normalizeToolName() would rewrite respira_acf_get_options.
+        await server.dispatchToolCall('wordpress_acf_get_options', {
+            site_id: 'site-b',
+            page_id: 'general',
+        });
+        const acfCalls = callLog.filter((c) => /\/acf\/options\//.test(c.url));
+        assert.ok(acfCalls.length > 0, 'expected at least one /acf/options/ call');
+        for (const c of acfCalls) {
+            assert.match(fullUrl(c), /site-b\.example\.com/);
+        }
+    }
+    finally {
+        restoreAdapter();
+    }
+});
+// The response envelope's `site` block is built from getActiveSiteSummary(args),
+// which already resolves args.site_id to the matching connected site regardless
+// of which client actually serviced the call (see the v6.19.0 N6 fix). That means
+// once the dispatch bug above is fixed so the HTTP call truly lands on the pinned
+// site, the envelope and the actual write agree. This test locks in that
+// agreement for the ACF family specifically.
+test('getActiveSiteSummary(args) names the pinned site for an ACF call, matching where the write actually landed', () => {
+    const server = new RespiraWordPressServer([SITE_A, SITE_B]);
+    const summary = server.getActiveSiteSummary({ site_id: 'site-b', page_id: 'general', field_key: 'x' });
+    assert.ok(summary, 'expected a site summary');
+    assert.equal(summary.id ?? summary.site_id, 'site-b');
+});
+//# sourceMappingURL=acf-site-id-routing.test.js.map

package/dist/__tests__/acf-site-id-routing.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acf-site-id-routing.test.js","sourceRoot":"","sources":["../../src/__tests__/acf-site-id-routing.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAMtD,MAAM,OAAO,GAAwE,EAAE,CAAC;AACxF,IAAI,cAAc,GAAuB,IAAI,CAAC;AAC9C,MAAM,eAAe,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;AAE/C,SAAS,kBAAkB;IACzB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IACnB,KAAK,CAAC,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC,MAAW,EAAE,EAAE;QACxC,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE;YAC9C,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1C,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC5D,MAAM;YACN,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC,CAAC;IACN,CAAC,CAAQ,CAAC;AACZ,CAAC;AAED,SAAS,cAAc;IACrB,KAAK,CAAC,QAAQ,CAAC,OAAO,GAAG,eAAe,CAAC;IACzC,cAAc,GAAG,IAAI,CAAC;AACxB,CAAC;AAED,SAAS,UAAU,CAAC,CAAc;IAChC,cAAc,GAAG,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,OAAO,CAAC,CAA+C;IAC9D,OAAO,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,MAAM,GAAwB;IAClC,EAAE,EAAE,QAAQ;IACZ,IAAI,EAAE,yBAAyB;IAC/B,GAAG,EAAE,4BAA4B;IACjC,MAAM,EAAE,iBAAiB;IACzB,OAAO,EAAE,IAAI;CACd,CAAC;AAEF,MAAM,MAAM,GAAwB;IAClC,EAAE,EAAE,QAAQ;IACZ,IAAI,EAAE,iBAAiB;IACvB,GAAG,EAAE,4BAA4B;IACjC,MAAM,EAAE,iBAAiB;CAC1B,CAAC;AAEF,2EAA2E;AAC3E,yEAAyE;AACzE,gEAAgE;AAChE,SAAS,cAAc,CAAC,MAAW;IACjC,MAAM,GAAG,GAAW,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;IACrC,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;IACjF,CAAC;IACD,oEAAoE;IACpE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AACnC,CAAC;AAED,IAAI,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;IACxG,kBAAkB,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,UAAU,CAAC,cAAc,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAI,sBAAsB,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAE5D,MAAO,MAAc,CAAC,gBAAgB,CAAC,wBAAwB,EAAE;YAC/D,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,YAAY;SACxB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,0CAA0C,CAAC,CAAC;QAC3E,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,KAAK,CACV,OAAO,CAAC,CAAC,CAAC,EACV,sBAAsB,EACtB,6CAA6C,OAAO,CAAC,CAAC,CAAC,EAAE,CAC1D,CAAC;QACJ,CAAC;QACD,6DAA6D;QAC7D,MAAM,CAAC,EAAE,CACP,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAC9D,2DAA2D,CAC5D,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,cAAc,EAAE,CAAC;IACnB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gGAAgG,EAAE,KAAK,IAAI,EAAE;IAChH,kBAAkB,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,UAAU,CAAC,cAAc,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAI,sBAAsB,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAE5D,MAAO,MAAc,CAAC,gBAAgB,CAAC,2BAA2B,EAAE;YAClE,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,YAAY;YACvB,KAAK,EAAE,WAAW;SACnB,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC;QAC9F,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,8CAA8C,CAAC,CAAC;QAChF,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,KAAK,CACV,OAAO,CAAC,CAAC,CAAC,EACV,sBAAsB,EACtB,kDAAkD,OAAO,CAAC,CAAC,CAAC,EAAE,CAC/D,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,EAAE,CACP,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAC/D,8DAA8D,CAC/D,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,cAAc,EAAE,CAAC;IACnB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;IACrG,kBAAkB,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,UAAU,CAAC,cAAc,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAI,sBAAsB,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAE5D,uEAAuE;QACvE,wEAAwE;QACxE,MAAO,MAAc,CAAC,gBAAgB,CAAC,2BAA2B,EAAE;YAClE,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,0CAA0C,CAAC,CAAC;QAC3E,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;YAAS,CAAC;QACT,cAAc,EAAE,CAAC;IACnB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iFAAiF;AACjF,gFAAgF;AAChF,kFAAkF;AAClF,kFAAkF;AAClF,yEAAyE;AACzE,6CAA6C;AAC7C,IAAI,CAAC,4GAA4G,EAAE,GAAG,EAAE;IACtH,MAAM,MAAM,GAAG,IAAI,sBAAsB,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAI,MAAc,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAChH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC"}

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAqBH,OAAO,KAAK,EAAE,mBAAmB,EAAe,MAAM,kBAAkB,CAAC;AAsQzE,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAAgC;IACnD,OAAO,CAAC,KAAK,CAA2C;IACxD,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB,CAAS;IACpC,iFAAiF;IACjF,OAAO,CAAC,iBAAiB,CAAK;IAC9B,iFAAiF;IACjF,OAAO,CAAC,mBAAmB,CAAgC;IAE3D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;IAEhE;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;gBA4Bb,WAAW,EAAE,mBAAmB,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE;IAiVvE,OAAO,CAAC,cAAc;IAItB;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IA4BrB,gEAAgE;IAChE,OAAO,CAAC,aAAa;IAUrB;;;;;;OAMG;YACW,UAAU;IA2CxB;;;;;;;;;;;;;;OAcG;YACW,WAAW;IAiJzB;;;;;;;;;OASG;YACW,kBAAkB;IA6KhC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,qBAAqB;YAiBrB,kBAAkB;IA6FhC,yFAAyF;IACzF,OAAO,CAAC,gBAAgB;IASxB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,6BAA6B;IA0BrC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yBAAyB;IA+BjC,OAAO,CAAC,eAAe;IAmBvB,OAAO,CAAC,aAAa;YAmQP,kBAAkB;YA6BlB,yBAAyB;IASvC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;YAyBd,QAAQ;IAuvGtB;;;;;;OAMG;IACH;;;;;;;;;;;;;oDAagD;IAChD,OAAO,CAAC,mBAAmB,CAAoD;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAU;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAC1D;;mDAE+C;IAC/C,OAAO,CAAC,0BAA0B,CAAoC;IAEtE;;;;;;;;OAQG;YACW,0BAA0B;YAyC1B,oBAAoB;YA6CpB,2BAA2B;IAQzC;;;;OAIG;YACW,cAAc;IAQ5B,OAAO,CAAC,mBAAmB;IAo7C3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAe3C;IAEF;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;YAmCpB,cAAc;IA4G5B,oEAAoE;IACpE,OAAO,CAAC,iBAAiB;IAoBzB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,eAAe;YAuCT,gBAAgB;IAo0C9B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA8YzB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IA6UxB,GAAG;CAyCV"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAqBH,OAAO,KAAK,EAAE,mBAAmB,EAAe,MAAM,kBAAkB,CAAC;AAsQzE,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAAgC;IACnD,OAAO,CAAC,KAAK,CAA2C;IACxD,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB,CAAS;IACpC,iFAAiF;IACjF,OAAO,CAAC,iBAAiB,CAAK;IAC9B,iFAAiF;IACjF,OAAO,CAAC,mBAAmB,CAAgC;IAE3D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;IAEhE;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;gBA4Bb,WAAW,EAAE,mBAAmB,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE;IAiVvE,OAAO,CAAC,cAAc;IAItB;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IA4BrB,gEAAgE;IAChE,OAAO,CAAC,aAAa;IAUrB;;;;;;OAMG;YACW,UAAU;IA2CxB;;;;;;;;;;;;;;OAcG;YACW,WAAW;IAiJzB;;;;;;;;;OASG;YACW,kBAAkB;IA6KhC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,qBAAqB;YAiBrB,kBAAkB;IA6FhC,yFAAyF;IACzF,OAAO,CAAC,gBAAgB;IASxB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,6BAA6B;IA0BrC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yBAAyB;IA+BjC,OAAO,CAAC,eAAe;IAmBvB,OAAO,CAAC,aAAa;YAmQP,kBAAkB;YA6BlB,yBAAyB;IASvC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;YAyBd,QAAQ;IA+xGtB;;;;;;OAMG;IACH;;;;;;;;;;;;;oDAagD;IAChD,OAAO,CAAC,mBAAmB,CAAoD;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAU;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAC1D;;mDAE+C;IAC/C,OAAO,CAAC,0BAA0B,CAAoC;IAEtE;;;;;;;;OAQG;YACW,0BAA0B;YAyC1B,oBAAoB;YA6CpB,2BAA2B;IAQzC;;;;OAIG;YACW,cAAc;IAQ5B,OAAO,CAAC,mBAAmB;IAo7C3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAe3C;IAEF;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;YAmCpB,cAAc;IA4G5B,oEAAoE;IACpE,OAAO,CAAC,iBAAiB;IAoBzB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,eAAe;YAuCT,gBAAgB;IA+0C9B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAkZzB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IA6UxB,GAAG;CAyCV"}

package/dist/server.js

@@ -2209,7 +2209,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_delete_post',
-                description: 'Delete a post. IMPORTANT: By default, this only works on Respira-created duplicates. The force parameter only works if "Allow Direct Editing" is enabled in Respira settings (disabled by default for safety).',
+                description: 'Delete a post. IMPORTANT: By default, this only works on Respira-created duplicates. The force parameter only works if "Allow Direct Editing" is enabled in Respira settings (disabled by default for safety).\n\nApproval flow: destructive — the first call may return `code: respira_approval_required` with `data.approval_request.approval_token`. Pass that token back via the `approval_token` param on the next call to complete the delete.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -2221,6 +2221,10 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                             type: 'boolean',
                             description: 'Force delete even if not a duplicate',
                         },
+                        approval_token: {
+                            type: 'string',
+                            description: 'One-time token from a prior respira_approval_required response. Omit on the first call; the tool will reject with a token if approval is required, then re-call with this parameter set to that token to confirm and execute.',
+                        },
                     },
                     required: ['id'],
                 },
@@ -2738,7 +2742,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_create_site_pattern',
-                description: 'Stage creation of a native synced or unsynced user pattern. The write is approval-first, snapshot-backed, read-back verified, and server-render verified.',
+                description: 'Stage creation of a native synced or unsynced user pattern. The write is approval-first, snapshot-backed, read-back verified, and server-render verified.\n\nApproval flow: the first call may return `code: respira_approval_required` with `data.approval_request.approval_token`. Pass that token back via the `approval_token` param on the next call to complete the create.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -2750,13 +2754,17 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                         verification_marker: { type: 'string' },
                         dry_run: { type: 'boolean' },
                         edit_target: { type: 'string', enum: ['approval', 'live'] },
+                        approval_token: {
+                            type: 'string',
+                            description: 'One-time token from a prior respira_approval_required response. Omit on the first call; the tool will reject with a token if approval is required, then re-call with this parameter set to that token to confirm and execute.',
+                        },
                     },
                     required: ['title'],
                 },
             },
             {
                 name: 'wordpress_update_site_pattern',
-                description: 'Stage targeted path-addressed operations on an editable user pattern with stale-write, wrong-target, snapshot, and render protection.',
+                description: 'Stage targeted path-addressed operations on an editable user pattern with stale-write, wrong-target, snapshot, and render protection.\n\nApproval flow: the first call may return `code: respira_approval_required` with `data.approval_request.approval_token`. Pass that token back via the `approval_token` param on the next call to complete the update.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -2766,13 +2774,17 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                         verification_marker: { type: 'string' },
                         dry_run: { type: 'boolean' },
                         edit_target: { type: 'string', enum: ['approval', 'live'] },
+                        approval_token: {
+                            type: 'string',
+                            description: 'One-time token from a prior respira_approval_required response. Omit on the first call; the tool will reject with a token if approval is required, then re-call with this parameter set to that token to confirm and execute.',
+                        },
                     },
                     required: ['id', 'expected_fingerprint', 'operations'],
                 },
             },
             {
                 name: 'wordpress_delete_site_pattern',
-                description: 'Stage deletion of an editable user pattern. Referenced patterns are refused unless allow_referenced_delete is explicitly approved; a rollback snapshot is retained.',
+                description: 'Stage deletion of an editable user pattern. Referenced patterns are refused unless allow_referenced_delete is explicitly approved; a rollback snapshot is retained.\n\nApproval flow: destructive — the first call may return `code: respira_approval_required` with `data.approval_request.approval_token`. Pass that token back via the `approval_token` param on the next call to complete the delete.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -2781,6 +2793,10 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                         allow_referenced_delete: { type: 'boolean' },
                         dry_run: { type: 'boolean' },
                         edit_target: { type: 'string', enum: ['approval', 'live'] },
+                        approval_token: {
+                            type: 'string',
+                            description: 'One-time token from a prior respira_approval_required response. Omit on the first call; the tool will reject with a token if approval is required, then re-call with this parameter set to that token to confirm and execute.',
+                        },
                     },
                     required: ['id', 'expected_fingerprint'],
                 },
@@ -2811,7 +2827,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_create_site_navigation',
-                description: 'Stage creation of a native block navigation entity. The write is approval-first, snapshot-backed, read-back verified, and server-render verified.',
+                description: 'Stage creation of a native block navigation entity. The write is approval-first, snapshot-backed, read-back verified, and server-render verified.\n\nApproval flow: the first call may return `code: respira_approval_required` with `data.approval_request.approval_token`. Pass that token back via the `approval_token` param on the next call to complete the create.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -2822,13 +2838,17 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                         verification_marker: { type: 'string' },
                         dry_run: { type: 'boolean' },
                         edit_target: { type: 'string', enum: ['approval', 'live'] },
+                        approval_token: {
+                            type: 'string',
+                            description: 'One-time token from a prior respira_approval_required response. Omit on the first call; the tool will reject with a token if approval is required, then re-call with this parameter set to that token to confirm and execute.',
+                        },
                     },
                     required: ['title'],
                 },
             },
             {
                 name: 'wordpress_update_site_navigation',
-                description: 'Stage exact path-addressed operations on a native block navigation entity while preserving unknown extension blocks and rejecting stale or wrong targets.',
+                description: 'Stage exact path-addressed operations on a native block navigation entity while preserving unknown extension blocks and rejecting stale or wrong targets.\n\nApproval flow: the first call may return `code: respira_approval_required` with `data.approval_request.approval_token`. Pass that token back via the `approval_token` param on the next call to complete the update.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -2838,13 +2858,17 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                         verification_marker: { type: 'string' },
                         dry_run: { type: 'boolean' },
                         edit_target: { type: 'string', enum: ['approval', 'live'] },
+                        approval_token: {
+                            type: 'string',
+                            description: 'One-time token from a prior respira_approval_required response. Omit on the first call; the tool will reject with a token if approval is required, then re-call with this parameter set to that token to confirm and execute.',
+                        },
                     },
                     required: ['id', 'expected_fingerprint', 'operations'],
                 },
             },
             {
                 name: 'wordpress_delete_site_navigation',
-                description: 'Stage deletion of a native block navigation entity. Referenced navigation is refused unless allow_referenced_delete is explicitly approved; a rollback snapshot is retained.',
+                description: 'Stage deletion of a native block navigation entity. Referenced navigation is refused unless allow_referenced_delete is explicitly approved; a rollback snapshot is retained.\n\nApproval flow: destructive — the first call may return `code: respira_approval_required` with `data.approval_request.approval_token`. Pass that token back via the `approval_token` param on the next call to complete the delete.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -2853,6 +2877,10 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                         allow_referenced_delete: { type: 'boolean' },
                         dry_run: { type: 'boolean' },
                         edit_target: { type: 'string', enum: ['approval', 'live'] },
+                        approval_token: {
+                            type: 'string',
+                            description: 'One-time token from a prior respira_approval_required response. Omit on the first call; the tool will reject with a token if approval is required, then re-call with this parameter set to that token to confirm and execute.',
+                        },
                     },
                     required: ['id', 'expected_fingerprint'],
                 },
@@ -3780,7 +3808,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_delete_comment',
-                description: 'Delete a comment.',
+                description: 'Delete a comment.\n\nApproval flow: destructive — the first call may return `code: respira_approval_required` with `data.approval_request.approval_token`. Pass that token back via the `approval_token` param on the next call to complete the delete.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -3788,6 +3816,10 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                             type: 'number',
                             description: 'Comment ID',
                         },
+                        approval_token: {
+                            type: 'string',
+                            description: 'One-time token from a prior respira_approval_required response. Omit on the first call; the tool will reject with a token if approval is required, then re-call with this parameter set to that token to confirm and execute.',
+                        },
                     },
                     required: ['id'],
                 },
@@ -3931,7 +3963,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_delete_term',
-                description: 'Delete a term.',
+                description: 'Delete a term.\n\nApproval flow: destructive — the first call may return `code: respira_approval_required` with `data.approval_request.approval_token`. Pass that token back via the `approval_token` param on the next call to complete the delete.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -3943,6 +3975,10 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                             type: 'number',
                             description: 'Term ID',
                         },
+                        approval_token: {
+                            type: 'string',
+                            description: 'One-time token from a prior respira_approval_required response. Omit on the first call; the tool will reject with a token if approval is required, then re-call with this parameter set to that token to confirm and execute.',
+                        },
                     },
                     required: ['taxonomy', 'id'],
                 },
@@ -4535,7 +4571,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_delete_option',
-                description: 'Delete an option.',
+                description: 'Delete an option.\n\nApproval flow: destructive — the first call may return `code: respira_approval_required` with `data.approval_request.approval_token`. Pass that token back via the `approval_token` param on the next call to complete the delete.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -4543,6 +4579,10 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                             type: 'string',
                             description: 'Option name',
                         },
+                        approval_token: {
+                            type: 'string',
+                            description: 'One-time token from a prior respira_approval_required response. Omit on the first call; the tool will reject with a token if approval is required, then re-call with this parameter set to that token to confirm and execute.',
+                        },
                     },
                     required: ['option'],
                 },
@@ -6923,7 +6963,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                 };
             }
             case 'wordpress_delete_post':
-                return await client.deletePost(args.id, args.force);
+                return await client.deletePost(args.id, args.force, args.approval_token);
             case 'wordpress_list_media':
                 return await client.listMedia(args);
             case 'wordpress_upload_media': {
@@ -7154,7 +7194,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             case 'wordpress_update_comment':
                 return await client.updateComment(args.id, args);
             case 'wordpress_delete_comment':
-                return await client.deleteComment(args.id);
+                return await client.deleteComment(args.id, args.approval_token);
             // Taxonomies
             case 'wordpress_list_taxonomies':
                 return await client.listTaxonomies();
@@ -7169,7 +7209,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             case 'wordpress_update_term':
                 return await client.updateTerm(args.taxonomy, args.id, args);
             case 'wordpress_delete_term':
-                return await client.deleteTerm(args.taxonomy, args.id);
+                return await client.deleteTerm(args.taxonomy, args.id, args.approval_token);
             // Custom Post Types
             case 'wordpress_list_post_types':
                 return await client.listPostTypes();
@@ -7244,7 +7284,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             case 'wordpress_update_option':
                 return await client.updateOption(args.option, args.value);
             case 'wordpress_delete_option':
-                return await client.deleteOption(args.option);
+                return await client.deleteOption(args.option, args.approval_token);
             // Media enhancements
             case 'wordpress_get_media':
                 return await client.getMedia(args.id);
@@ -7763,7 +7803,18 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                             hint: 'Install Advanced Custom Fields on the target site, then retry. ACF Pro is required for repeaters, flexible content, galleries, and options pages.'
                         };
                     }
-                    return await this.currentSite.dispatchAcfTool(acfName, args);
+                    // Same class of bug as the mcp-v8.0.3 Bricks/Elementor fix: `client`
+                    // (resolved above via resolveClient(args), site_id-aware) is the
+                    // correct target — NOT `this.currentSite`, which is only the
+                    // globally active site. This ACF branch used `this.currentSite!`,
+                    // so respira_acf_update_option(s)/get_option(s) and every other ACF
+                    // tool silently read/wrote the active site while the response
+                    // envelope (built from args.site_id in getActiveSiteSummary/
+                    // withSiteContext) still named the pinned site_id, making the
+                    // wrong-site write invisible. Reported by john@localmarketingpros.com
+                    // (17-site DSO rollout): a population pass pinned to site B landed
+                    // on site A instead.
+                    return await client.dispatchAcfTool(acfName, args);
                 }
                 // Check if this is a widget shortcut (wordpress_add_*).
                 if (name.startsWith('wordpress_add_')) {
@@ -8089,7 +8140,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_bulk_pages_operation',
-                description: 'Apply an operation across up to 100 pages. Supports strip_inline_styles, find_and_replace, and custom operations. Each page gets a snapshot for rollback. Rate limited to 3/hr.',
+                description: 'Apply an operation across up to 100 pages. Supports strip_inline_styles, find_and_replace, and custom operations. Each page gets a snapshot for rollback. Rate limited to 3/hr.\n\nApproval flow: destructive — the first call may return `code: respira_approval_required` with `data.approval_request.approval_token`. Pass that token back via the `approval_token` param on the next call to complete the operation.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -8106,6 +8157,10 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                             type: 'object',
                             description: 'Execution options: {dry_run: boolean}',
                         },
+                        approval_token: {
+                            type: 'string',
+                            description: 'One-time token from a prior respira_approval_required response. Omit on the first call; the tool will reject with a token if approval is required, then re-call with this parameter set to that token to confirm and execute.',
+                        },
                     },
                     required: ['page_ids', 'operation'],
                 },