@respira/wordpress-mcp-server 8.1.4 → 8.1.6

package/CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to Respira WordPress MCP Server will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [8.1.6] - 2026-08-02
+
+### Fixed
+
+- **An authentication failure was reported as "respira/v2 is not available on this site".** The version probe swallowed its own error and fell back to v1, so every failure mode reached you as the same message followed by four suggested causes: a security plugin, Plain permalinks, a WAF or CDN, an outdated plugin. For M.O. all four were false. Permalinks were `/%postname%/`, there was no CDN, the plugin was already current, and `/wp-json/respira/v2/status` was answering `401` rather than `404`, which proves the opposite of what the message said: the route existed, WordPress routed to it, and it ran far enough to reach its auth check. That cost most of a day chasing firewall rules for a deactivated key. The probe now keeps the reason and reports it. A `401` or `403` says the key was rejected and points at reconnecting, a `5xx` reports the status and sends you to the debug log, a connection failure says so, and the original text is kept only for a real `404`, which is the one case it was ever true for.
+
+### Added
+
+- **`excerpt` on `update_page`, `update_post` and `update_custom_post`.** There was no way to ask for it, so callers put it in `meta`, where it became a post meta row that reads back perfectly and renders nowhere. The description says as much. Requires plugin 8.2.1 for the write to land in the native field. Reported by P.F.
+
+## [8.1.5] - 2026-08-01
+
+### Fixed
+
+- **Updates now succeed on hosts that block PUT at the edge.** Managed hosts and WAFs commonly allow `GET` and `POST` but reject `PUT`, `PATCH` and `DELETE` before the request ever reaches WordPress. The result was every update failing with "403 Forbidden from the web server (not WordPress)" while creating pages and reading them worked perfectly, which sends you looking at plugin whitelists, permalink settings, CDN exceptions and User-Agent rules when the only thing that actually mattered was the HTTP verb. Respira already shipped the fallback that fixes this, retrying the write as a `POST`, but it only fired on `404` (the old-plugin case), so it never ran for the hosts that needed it. It now also fires on `403` and `405`, at all five write paths. Reported, root-caused and verified live against a real write by O.Q., who also identified the exact shape of the fix.
+
 ## [8.1.4] - 2026-07-30
 
 ### Fixed

package/README.md

@@ -7,7 +7,7 @@
 <h1 align="center">Respira WordPress MCP Server</h1>
 
 <p align="center">
-  <strong>198 MCP tools, 303 with the WooCommerce add-on. 16 page builders and the native Site Editor. MCP 2026-07-28 with legacy-client support.</strong><br>
+  <strong>198 MCP tools, 303 with the WooCommerce add-on. 17 page builders and the native Site Editor. MCP 2026-07-28 with legacy-client support.</strong><br>
   Element-level editing, full page creation, HTML-to-builder conversion with rendering fidelity validation, per-site tool governance, storefront design intelligence, stock images, bulk operations — all through one MCP server.
 </p>
 
@@ -15,7 +15,7 @@
   <a href="https://www.npmjs.com/package/@respira/wordpress-mcp-server"><img src="https://img.shields.io/npm/v/@respira/wordpress-mcp-server.svg?style=flat-square&color=10b981" alt="npm version"></a>
   <a href="https://www.npmjs.com/package/@respira/wordpress-mcp-server"><img src="https://img.shields.io/npm/dm/@respira/wordpress-mcp-server.svg?style=flat-square" alt="npm downloads"></a>
   <img src="https://img.shields.io/badge/tools-303-10b981?style=flat-square" alt="303 Tools with WooCommerce">
-  <img src="https://img.shields.io/badge/builders-16-10b981?style=flat-square" alt="16 Page Builders">
+  <img src="https://img.shields.io/badge/builders-17-10b981?style=flat-square" alt="16 Page Builders">
   <img src="https://img.shields.io/badge/TypeScript-100%25-blue?style=flat-square&logo=typescript&logoColor=white" alt="TypeScript">
 </p>
 
@@ -33,7 +33,7 @@
 
 Other WordPress MCP servers wrap the REST API. They can create posts and pages, but **they can't touch your page builder content**.
 
-Respira includes a WordPress plugin that gives AI **native access** to 16 page builders, plus element-level precision, full page creation from structure, HTML-to-builder conversion, storefront design intelligence, stock image search, and bulk operations across hundreds of pages.
+Respira includes a WordPress plugin that gives AI **native access** to 17 page builders, plus element-level precision, full page creation from structure, HTML-to-builder conversion, storefront design intelligence, stock image search, and bulk operations across hundreds of pages.
 
 ### New in 8.1: MCP 2026-07-28, without breaking existing clients
 
@@ -129,7 +129,7 @@ The MCP server exposes 198 core tools and 103 WooCommerce add-on tools. It autom
 
 | Capability | Respira | Typical WordPress MCP servers |
 |---|---|---|
-| Page builder support | **16 builders** (incl. Spectra, Kadence, GenerateBlocks) | None, or a single builder |
+| Page builder support | **17 builders** (incl. Spectra, Kadence, GenerateBlocks) | None, or a single builder |
 | Element-level find/update/move/remove | **Yes** | No |
 | Build full pages from structure | **Yes** | No |
 | Convert HTML to native builder | **Yes** | No |
@@ -817,6 +817,6 @@ MIT © [Respira](https://respira.press)
 ---
 
 <p align="center">
-  <strong>198 core tools, 303 with WooCommerce. 16 builders. The AI infrastructure layer for WordPress.</strong><br>
+  <strong>198 core tools, 303 with WooCommerce. 17 builders. The AI infrastructure layer for WordPress.</strong><br>
   <a href="https://respira.press">respira.press</a>
 </p>

package/dist/__tests__/oq-put-fallback-403.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=oq-put-fallback-403.test.d.ts.map

package/dist/__tests__/oq-put-fallback-403.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oq-put-fallback-403.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/oq-put-fallback-403.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/oq-put-fallback-403.test.js

@@ -0,0 +1,59 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { isRetryableAsPost } from '../wordpress-client.js';
+/**
+ * O.Q. field report, 2026-07-31.
+ *
+ * Managed hosts and WAFs allow GET and POST but block PUT, PATCH and DELETE at
+ * the edge, before WordPress sees the request. Every update failed with
+ * "403 Forbidden from the web server (not WordPress)" while creation and reads
+ * worked, which sends the customer chasing plugin whitelists and CDN rules when
+ * the only thing that mattered was the HTTP verb.
+ *
+ * The client already had a PUT-to-POST fallback. It only fired on 404.
+ *
+ * THE PART THIS TEST EXISTS FOR: widening the status check alone does NOT fix
+ * it, and a build plus the existing suite passed while the bug was still live.
+ * The response interceptor rewrites a non-WordPress 403 into a coded Error via
+ * codedError(), which sets `name` and does NOT carry `response` across. So a
+ * predicate that only looks at `error.response.status` never fires on the exact
+ * case the fallback exists for. Proven against a real site with a shim
+ * returning 403 on PUT: the status-only version still failed the write, the
+ * shape-aware version completed it.
+ */
+describe('isRetryableAsPost', () => {
+    it('fires on the transformed non-WordPress 403, which has no response object', () => {
+        // Exactly what codedError() produces for a host-level block.
+        const coded = new Error('Site blocked: ... 403 Forbidden from the web server (not WordPress).');
+        coded.name = 'http_403_non_wordpress';
+        assert.equal(isRetryableAsPost(coded), true);
+    });
+    it('a status-only check would have missed that error', () => {
+        const coded = new Error('Site blocked');
+        coded.name = 'http_403_non_wordpress';
+        // Documents why the first attempt at this fix did nothing.
+        assert.equal(coded.response, undefined);
+    });
+    it('still fires on the original raw 404 case (old plugin, no v2 route)', () => {
+        assert.equal(isRetryableAsPost({ response: { status: 404 } }), true);
+    });
+    it('fires on a raw 403 and 405', () => {
+        assert.equal(isRetryableAsPost({ response: { status: 403 } }), true);
+        assert.equal(isRetryableAsPost({ response: { status: 405 } }), true);
+    });
+    it('does NOT retry a 403 raised by WordPress itself', () => {
+        // A real permission decision. Retrying as POST just fails again, slower,
+        // and would muddy the error the user needs to see.
+        const wpDenied = new Error('Sorry, you are not allowed to edit this post.');
+        wpDenied.name = 'rest_cannot_edit';
+        assert.equal(isRetryableAsPost(wpDenied), false);
+    });
+    it('does not retry unrelated failures', () => {
+        assert.equal(isRetryableAsPost({ response: { status: 500 } }), false);
+        assert.equal(isRetryableAsPost({ response: { status: 401 } }), false);
+        assert.equal(isRetryableAsPost(new Error('network down')), false);
+        assert.equal(isRetryableAsPost(undefined), false);
+        assert.equal(isRetryableAsPost(null), false);
+    });
+});
+//# sourceMappingURL=oq-put-fallback-403.test.js.map

package/dist/__tests__/oq-put-fallback-403.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oq-put-fallback-403.test.js","sourceRoot":"","sources":["../../src/__tests__/oq-put-fallback-403.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,6DAA6D;QAC7D,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAChG,KAAK,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QACxC,KAAK,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACtC,2DAA2D;QAC3D,MAAM,CAAC,KAAK,CAAE,KAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QACrE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,yEAAyE;QACzE,mDAAmD;QACnD,MAAM,QAAQ,GAAG,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC5E,QAAQ,CAAC,IAAI,GAAG,kBAAkB,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAClE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/v2-negotiation-failure.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=v2-negotiation-failure.test.d.ts.map

package/dist/__tests__/v2-negotiation-failure.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v2-negotiation-failure.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/v2-negotiation-failure.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/v2-negotiation-failure.test.js

@@ -0,0 +1,104 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { classifyV2Failure, describeV2Failure } from '../wordpress-client.js';
+/**
+ * The v2 probe used to swallow its own error:
+ *
+ *   try { ...get('/wp-json/respira/v2/status')... } catch { }
+ *   return 'v1'
+ *
+ * so every failure mode reached the user as one message: "respira/v2 is not
+ * available on this site", followed by four suggested causes (security plugin,
+ * Plain permalinks, WAF/CDN, outdated plugin).
+ *
+ * M.O. hit this with a 401. All four suggestions were false: permalinks were
+ * /%postname%/, there was no CDN, the plugin was on the newest version, and
+ * /wp-json/respira/v2/status answered 401 rather than 404 — meaning the route
+ * existed, WordPress routed to it, and it ran far enough to reach its auth
+ * check. The message described the one situation that provably was not
+ * happening, and cost most of a day.
+ */
+const SITE = 'https://example.com';
+const err = (status, data) => ({ response: { status, data } });
+describe('classifyV2Failure', () => {
+    it('401 is auth, not a missing namespace', () => {
+        const f = classifyV2Failure(err(401, { code: 'respira_invalid_site_token', message: 'token out of date' }));
+        assert.equal(f.kind, 'auth');
+        assert.equal(f.status, 401);
+        assert.equal(f.code, 'respira_invalid_site_token');
+    });
+    it('403 is auth too', () => {
+        assert.equal(classifyV2Failure(err(403)).kind, 'auth');
+    });
+    it('404 is the one case that really means unavailable', () => {
+        assert.equal(classifyV2Failure(err(404)).kind, 'missing');
+    });
+    it('500 is a server fault, distinct from both', () => {
+        assert.equal(classifyV2Failure(err(500)).kind, 'server');
+    });
+    it('no response at all is a network failure', () => {
+        assert.equal(classifyV2Failure({ message: 'ECONNREFUSED' }).kind, 'network');
+    });
+    it('an undefined error does not throw', () => {
+        assert.equal(classifyV2Failure(undefined).kind, 'network');
+    });
+});
+describe('describeV2Failure', () => {
+    it("the auth message does NOT repeat the four causes that misled the reporter", () => {
+        const msg = describeV2Failure(classifyV2Failure(err(401)), SITE);
+        assert.ok(!/Wordfence/.test(msg), msg);
+        assert.ok(!/permalinks/i.test(msg), msg);
+        assert.ok(!/Cloudflare/.test(msg), msg);
+        assert.ok(!/outdated/i.test(msg), msg);
+    });
+    it('the auth message states what a 401 actually proves', () => {
+        const msg = describeV2Failure(classifyV2Failure(err(401)), SITE);
+        assert.ok(/routes exist and are reachable/.test(msg), msg);
+        assert.ok(/authentication result, not a missing namespace/.test(msg), msg);
+    });
+    it('it names the deactivated-key cause, which is the one that actually happened', () => {
+        const msg = describeV2Failure(classifyV2Failure(err(401)), SITE);
+        assert.ok(/lapsed licence disables API keys/.test(msg), msg);
+        assert.ok(/reconnect the site/i.test(msg), msg);
+    });
+    it("it quotes the site's own words when they were given", () => {
+        const msg = describeV2Failure(classifyV2Failure(err(401, { message: 'The saved connection token for this site is out of date.' })), SITE);
+        assert.ok(msg.includes('The saved connection token for this site is out of date.'), msg);
+    });
+    it('a real 404 keeps the original guidance, which is correct for a 404', () => {
+        const msg = describeV2Failure(classifyV2Failure(err(404)), SITE);
+        assert.ok(/is not available on this site/.test(msg), msg);
+        assert.ok(/Wordfence/.test(msg), msg);
+    });
+    it('a null failure falls back to the 404 text rather than inventing a cause', () => {
+        const msg = describeV2Failure(null, SITE);
+        assert.ok(/is not available on this site/.test(msg), msg);
+    });
+    it('the server branch reports the status instead of blaming the namespace', () => {
+        const msg = describeV2Failure(classifyV2Failure(err(500, { message: 'Fatal error' })), SITE);
+        assert.ok(/HTTP 500/.test(msg), msg);
+        assert.ok(/debug\.log/.test(msg), msg);
+        assert.ok(!/Wordfence/.test(msg), msg);
+    });
+    it('the network branch says connectivity, not configuration', () => {
+        const msg = describeV2Failure(classifyV2Failure({ message: 'ETIMEDOUT' }), SITE);
+        assert.ok(/connectivity failure, not a plugin problem/.test(msg), msg);
+        assert.ok(msg.includes('ETIMEDOUT'), msg);
+    });
+    it('branches where probing helps point at the probe URL for the specific site', () => {
+        // Not the auth branch: /v2/status answers 401 to an unauthenticated browser
+        // whether or not the key is the problem, so sending someone there proves
+        // nothing. Its next step is reconnecting, asserted above.
+        for (const e of [err(404), err(500), { message: 'x' }]) {
+            const msg = describeV2Failure(classifyV2Failure(e), SITE);
+            assert.ok(msg.includes(`${SITE}/wp-json/respira/v2/status`), msg);
+        }
+    });
+    it('no branch ever tells the reader the namespace is missing when it is not', () => {
+        for (const e of [err(401), err(403), err(500), { message: 'x' }]) {
+            const msg = describeV2Failure(classifyV2Failure(e), SITE);
+            assert.ok(!/is not available on this site/.test(msg), msg);
+        }
+    });
+});
+//# sourceMappingURL=v2-negotiation-failure.test.js.map

package/dist/__tests__/v2-negotiation-failure.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v2-negotiation-failure.test.js","sourceRoot":"","sources":["../../src/__tests__/v2-negotiation-failure.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE9E;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,IAAI,GAAG,qBAAqB,CAAC;AACnC,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,IAAU,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AAE7E,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;QAC5G,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAE,CAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAE,CAAS,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE;QACzB,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACnF,MAAM,GAAG,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACjE,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACvC,MAAM,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACzC,MAAM,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,GAAG,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACjE,MAAM,CAAC,EAAE,CAAC,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,CAAC,EAAE,CAAC,gDAAgD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,GAAG,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACjE,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,GAAG,GAAG,iBAAiB,CAC3B,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC,CAAC,EACpG,IAAI,CACL,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,0DAA0D,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,GAAG,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACjE,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1D,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,GAAG,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC7F,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACvC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,GAAG,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QACjF,MAAM,CAAC,EAAE,CAAC,4CAA4C,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACvE,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACnF,4EAA4E;QAC5E,yEAAyE;QACzE,0DAA0D;QAC1D,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;YACvD,MAAM,GAAG,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAC1D,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,4BAA4B,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;YACjE,MAAM,GAAG,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAC1D,MAAM,CAAC,EAAE,CAAC,CAAC,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/v2-negotiation-through-real-client.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=v2-negotiation-through-real-client.test.d.ts.map

package/dist/__tests__/v2-negotiation-through-real-client.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v2-negotiation-through-real-client.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/v2-negotiation-through-real-client.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/v2-negotiation-through-real-client.test.js

@@ -0,0 +1,104 @@
+import { describe, it, after } from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import { WordPressClient } from '../wordpress-client.js';
+/**
+ * The check the pure-unit tests structurally cannot make.
+ *
+ * v2-negotiation-failure.test.ts feeds classifyV2Failure a hand-built
+ * `{response:{status:401}}`. In production no such object ever reaches it: the
+ * shared axios error interceptor funnels every non-2xx through handleError ->
+ * codedError, which returns `new Error(message)` with the status recorded only
+ * in `.name`. `.response` is gone.
+ *
+ * So an implementation that reads `error.response.status` passes every unit
+ * test and misclassifies *every real failure* as a network problem — telling a
+ * customer with a deactivated key that the site could not be reached. That is
+ * the same trap that made the first PUT->POST fallback fix a no-op (it needed
+ * isRetryableAsPost() matching on `.name` for exactly this reason).
+ *
+ * These tests run a real HTTP server, a real WordPressClient with its real
+ * interceptors, and assert on the message a user would actually see.
+ */
+const servers = [];
+after(() => {
+    for (const s of servers)
+        s.close();
+});
+/** Start a server that answers the v2 status probe with a fixed status. */
+async function clientAnswering(status, body) {
+    const server = http.createServer((_req, res) => {
+        res.writeHead(status, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(body));
+    });
+    servers.push(server);
+    await new Promise((resolve) => server.listen(0, resolve));
+    const { port } = server.address();
+    return new WordPressClient({
+        id: 'probe',
+        name: 'probe',
+        url: `http://127.0.0.1:${port}`,
+        apiKey: 'respira_test_key',
+    });
+}
+/** Drive a v2-gated call and return the message the user would see. */
+async function v2FailureMessage(client) {
+    try {
+        await client.listSnapshots({ post_id: 1 });
+        return '(no error thrown)';
+    }
+    catch (err) {
+        return String(err?.message ?? err);
+    }
+}
+describe('v2 negotiation through the real client', () => {
+    it('a real 401 is reported as an auth rejection, not a missing namespace', async () => {
+        const client = await clientAnswering(401, {
+            code: 'respira_invalid_site_token',
+            message: 'The saved connection token for this site is out of date.',
+        });
+        const msg = await v2FailureMessage(client);
+        assert.match(msg, /rejected this API key \(HTTP 401/);
+        assert.doesNotMatch(msg, /is not available on this site/);
+        // The four causes that sent the reporter chasing firewall rules for a day.
+        assert.doesNotMatch(msg, /Wordfence/);
+        assert.doesNotMatch(msg, /permalinks/i);
+        assert.doesNotMatch(msg, /Cloudflare/);
+    });
+    it("and quotes the site's own explanation", async () => {
+        const client = await clientAnswering(401, {
+            code: 'respira_invalid_site_token',
+            message: 'The saved connection token for this site is out of date.',
+        });
+        const msg = await v2FailureMessage(client);
+        assert.match(msg, /The saved connection token for this site is out of date\./);
+        assert.match(msg, /respira_invalid_site_token/);
+    });
+    it('a 403 is auth too', async () => {
+        const client = await clientAnswering(403, { code: 'respira_scope_denied', message: 'nope' });
+        const msg = await v2FailureMessage(client);
+        assert.match(msg, /rejected this API key \(HTTP 403/);
+    });
+    it('a real 404 keeps the original guidance, which is correct only for a 404', async () => {
+        const client = await clientAnswering(404, { code: 'rest_no_route', message: 'No route' });
+        const msg = await v2FailureMessage(client);
+        assert.match(msg, /is not available on this site/);
+        assert.match(msg, /Wordfence/);
+    });
+    it('a 500 names the status instead of blaming the namespace', async () => {
+        const client = await clientAnswering(500, { code: 'fatal', message: 'Fatal error' });
+        const msg = await v2FailureMessage(client);
+        assert.match(msg, /returned HTTP 500 on this site/);
+        assert.doesNotMatch(msg, /is not available on this site/);
+    });
+    it('a dead host is reported as connectivity, not configuration', async () => {
+        // Nothing listening: a genuine transport failure, where there IS no status.
+        const client = new WordPressClient({
+            id: 'probe', name: 'probe', url: 'http://127.0.0.1:1', apiKey: 'respira_test_key',
+        });
+        const msg = await v2FailureMessage(client);
+        assert.match(msg, /Could not reach respira\/v2|connectivity failure/);
+        assert.doesNotMatch(msg, /Wordfence/);
+    });
+});
+//# sourceMappingURL=v2-negotiation-through-real-client.test.js.map

package/dist/__tests__/v2-negotiation-through-real-client.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v2-negotiation-through-real-client.test.js","sourceRoot":"","sources":["../../src/__tests__/v2-negotiation-through-real-client.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,OAAO,GAAkB,EAAE,CAAC;AAElC,KAAK,CAAC,GAAG,EAAE;IACT,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,CAAC,CAAC,KAAK,EAAE,CAAC;AACrC,CAAC,CAAC,CAAC;AAEH,2EAA2E;AAC3E,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,IAA6B;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7C,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IAEjD,OAAO,IAAI,eAAe,CAAC;QACzB,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,OAAO;QACb,GAAG,EAAE,oBAAoB,IAAI,EAAE;QAC/B,MAAM,EAAE,kBAAkB;KACpB,CAAC,CAAC;AACZ,CAAC;AAED,uEAAuE;AACvE,KAAK,UAAU,gBAAgB,CAAC,MAAuB;IACrD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3C,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE;YACxC,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,0DAA0D;SACpE,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAE3C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,kCAAkC,CAAC,CAAC;QACtD,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;QAC1D,2EAA2E;QAC3E,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACtC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QACxC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE;YACxC,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,0DAA0D;SACpE,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,2DAA2D,CAAC,CAAC;QAC/E,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE;QACjC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7F,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,kCAAkC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1F,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;QACrF,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;QACpD,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,4EAA4E;QAC5E,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,oBAAoB,EAAE,MAAM,EAAE,kBAAkB;SAC3E,CAAC,CAAC;QACV,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,kDAAkD,CAAC,CAAC;QACtE,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgBH,OAAO,KAAK,EAAE,mBAAmB,EAAe,MAAM,kBAAkB,CAAC;AAsQzE,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAAgC;IACnD,OAAO,CAAC,KAAK,CAA2C;IACxD,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB,CAAS;IACpC,iFAAiF;IACjF,OAAO,CAAC,iBAAiB,CAAK;IAC9B,iFAAiF;IACjF,OAAO,CAAC,mBAAmB,CAAgC;IAE3D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;IAEhE;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;gBA4Bb,WAAW,EAAE,mBAAmB,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE;IAiVvE,OAAO,CAAC,cAAc;IAItB;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IA4BrB,gEAAgE;IAChE,OAAO,CAAC,aAAa;IAUrB;;;;;;OAMG;YACW,UAAU;IA2CxB;;;;;;;;;;;;;;OAcG;YACW,WAAW;IAiJzB;;;;;;;;;OASG;YACW,kBAAkB;IA6KhC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,qBAAqB;YAiBrB,kBAAkB;IA6FhC,yFAAyF;IACzF,OAAO,CAAC,gBAAgB;IASxB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,6BAA6B;IA0BrC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yBAAyB;IA+BjC,OAAO,CAAC,eAAe;IAmBvB,OAAO,CAAC,aAAa;YAmQP,kBAAkB;YA6BlB,yBAAyB;IASvC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;YAyBd,QAAQ;IA+xGtB;;;;;;OAMG;IACH;;;;;;;;;;;;;oDAagD;IAChD,OAAO,CAAC,mBAAmB,CAAoD;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAU;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAC1D;;mDAE+C;IAC/C,OAAO,CAAC,0BAA0B,CAAoC;IAEtE;;;;;;;;OAQG;YACW,0BAA0B;YAyC1B,oBAAoB;YA6CpB,2BAA2B;IAQzC;;;;OAIG;YACW,cAAc;IAQ5B,OAAO,CAAC,mBAAmB;IAo7C3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAe3C;IAEF;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;YAmCpB,cAAc;IA4G5B,oEAAoE;IACpE,OAAO,CAAC,iBAAiB;IAoBzB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,eAAe;YAuCT,gBAAgB;IA+0C9B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAkZzB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IA6UxB,GAAG;CA+CV"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgBH,OAAO,KAAK,EAAE,mBAAmB,EAAe,MAAM,kBAAkB,CAAC;AAsQzE,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAAgC;IACnD,OAAO,CAAC,KAAK,CAA2C;IACxD,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB,CAAS;IACpC,iFAAiF;IACjF,OAAO,CAAC,iBAAiB,CAAK;IAC9B,iFAAiF;IACjF,OAAO,CAAC,mBAAmB,CAAgC;IAE3D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;IAEhE;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;gBA4Bb,WAAW,EAAE,mBAAmB,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE;IAiVvE,OAAO,CAAC,cAAc;IAItB;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IA4BrB,gEAAgE;IAChE,OAAO,CAAC,aAAa;IAUrB;;;;;;OAMG;YACW,UAAU;IA2CxB;;;;;;;;;;;;;;OAcG;YACW,WAAW;IAiJzB;;;;;;;;;OASG;YACW,kBAAkB;IA6KhC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,qBAAqB;YAiBrB,kBAAkB;IA6FhC,yFAAyF;IACzF,OAAO,CAAC,gBAAgB;IASxB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,6BAA6B;IA0BrC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yBAAyB;IA+BjC,OAAO,CAAC,eAAe;IAmBvB,OAAO,CAAC,aAAa;YAmQP,kBAAkB;YA6BlB,yBAAyB;IASvC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;YAyBd,QAAQ;IA2yGtB;;;;;;OAMG;IACH;;;;;;;;;;;;;oDAagD;IAChD,OAAO,CAAC,mBAAmB,CAAoD;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAU;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAC1D;;mDAE+C;IAC/C,OAAO,CAAC,0BAA0B,CAAoC;IAEtE;;;;;;;;OAQG;YACW,0BAA0B;YAyC1B,oBAAoB;YA6CpB,2BAA2B;IAQzC;;;;OAIG;YACW,cAAc;IAQ5B,OAAO,CAAC,mBAAmB;IAo7C3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAe3C;IAEF;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;YAmCpB,cAAc;IA4G5B,oEAAoE;IACpE,OAAO,CAAC,iBAAiB;IAoBzB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,eAAe;YAuCT,gBAAgB;IA+0C9B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAkZzB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IA6UxB,GAAG;CA+CV"}

package/dist/server.js

@@ -1836,7 +1836,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_update_page',
-                description: 'Update PAGE-LEVEL fields (title, status, slug, full HTML content replacement, custom CSS). For editing SPECIFIC elements WITHIN a page (text widgets, images, buttons, headings), use respira_update_element instead — it is element-aware, builder-aware, snapshot-safe, and works across all 12 page builders. Use respira_update_page only when you need to replace the entire content body, change the page title/slug/status, or set page-level metadata. When direct editing is enabled and you target an original page, Respira returns a confirmation_required preflight by default so you can choose live/original or duplicate.',
+                description: 'Update PAGE-LEVEL fields (title, status, slug, full HTML content replacement, custom CSS). For editing SPECIFIC elements WITHIN a page (text widgets, images, buttons, headings), use respira_update_element instead — it is element-aware, builder-aware, snapshot-safe, and works across all 17 page builders. Use respira_update_page only when you need to replace the entire content body, change the page title/slug/status, or set page-level metadata. When direct editing is enabled and you target an original page, Respira returns a confirmation_required preflight by default so you can choose live/original or duplicate.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -1860,6 +1860,10 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                             type: 'string',
                             description: 'URL slug (post_name). Example: "about-us" produces /about-us/.',
                         },
+                        excerpt: {
+                            type: 'string',
+                            description: 'Post excerpt (wp_posts.post_excerpt) — the "Excerpt"/"Zajawka" panel, RSS summaries and archive teasers. Do NOT pass this inside meta: an excerpt written as post meta reads back fine and renders nowhere.',
+                        },
                         custom_css: {
                             type: 'string',
                             description: 'Custom CSS for the page. Auto-detects builder: Divi → _et_pb_custom_css, Elementor → _elementor_page_settings.custom_css.',
@@ -2137,6 +2141,10 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                             type: 'string',
                             description: 'URL slug (post_name). Example: "my-post" produces /my-post/.',
                         },
+                        excerpt: {
+                            type: 'string',
+                            description: 'Post excerpt (wp_posts.post_excerpt) — the "Excerpt"/"Zajawka" panel, RSS summaries and archive teasers. Do NOT pass this inside meta: an excerpt written as post meta reads back fine and renders nowhere.',
+                        },
                         author: {
                             description: 'Author (user id or user login). Requires edit_others_posts capability when different from the acting user.',
                             oneOf: [
@@ -2293,7 +2301,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                     properties: {
                         builder: {
                             type: 'string',
-                            description: 'Optional. Builder name. Use exactly: gutenberg, divi, elementor, bricks, beaver, oxygen, breakdance, brizy, thrive, visual-composer, wpbakery. Omit to auto-detect the active site builder.',
+                            description: 'Optional. Builder name. Use exactly: gutenberg, divi, elementor, bricks, beaver, oxygen, breakdance, brizy, thrive, visual-composer, wpbakery, flatsome, spectra, kadence, generateblocks, greenshift. Omit to auto-detect the active site builder.',
                         },
                         page_id: {
                             type: 'number',
@@ -2312,7 +2320,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                     properties: {
                         builder: {
                             type: 'string',
-                            description: 'Builder name. Use exactly: gutenberg, divi, elementor, bricks, beaver, oxygen, breakdance, brizy, thrive, visual-composer, wpbakery. Use get_builder_info to discover the active builder first.',
+                            description: 'Builder name. Use exactly: gutenberg, divi, elementor, bricks, beaver, oxygen, breakdance, brizy, thrive, visual-composer, wpbakery, flatsome, spectra, kadence, generateblocks, greenshift. Use get_builder_info to discover the active builder first.',
                         },
                         page_id: {
                             type: 'number',
@@ -2376,13 +2384,13 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_inject_builder_content',
-                description: 'REPLACE (or append to) the entire page builder layout. WARNING: By default this REPLACES all existing content (use mode:"append" to add content without destroying existing elements). For editing a single module, use wordpress_update_module instead. Use exactly: gutenberg, divi, elementor, bricks, beaver, oxygen, breakdance, brizy, thrive, visual-composer, wpbakery. For Divi, divi_version is required ("4" or "5"). Replacing a page that already has content with mode="replace" requires confirm_replace=true, else returns 409 respira_replace_confirmation_required. Alternatives: mode="append" to add to existing content, or edit_target="live" to overwrite the live page directly. The gate prevents silent data loss.\n\nCanonical Divi 5 nested shape: `content: [{ type: "section", children: [{ type: "row", children: [{ type: "column", children: [{ type: "heading", settings: {...} }] }] }] }]` (rows/cols/columns/modules/elements/innerBlocks also accepted as `children` aliases). Each Divi module needs its render-critical attr in `settings` (e.g. heading→title, text→content, button→button_text); the plugin names any missing one via `respira_divi_required_attrs_missing`.',
+                description: 'REPLACE (or append to) the entire page builder layout. WARNING: By default this REPLACES all existing content (use mode:"append" to add content without destroying existing elements). For editing a single module, use wordpress_update_module instead. Use exactly: gutenberg, divi, elementor, bricks, beaver, oxygen, breakdance, brizy, thrive, visual-composer, wpbakery, flatsome, spectra, kadence, generateblocks, greenshift. For Divi, divi_version is required ("4" or "5"). Replacing a page that already has content with mode="replace" requires confirm_replace=true, else returns 409 respira_replace_confirmation_required. Alternatives: mode="append" to add to existing content, or edit_target="live" to overwrite the live page directly. The gate prevents silent data loss.\n\nCanonical Divi 5 nested shape: `content: [{ type: "section", children: [{ type: "row", children: [{ type: "column", children: [{ type: "heading", settings: {...} }] }] }] }]` (rows/cols/columns/modules/elements/innerBlocks also accepted as `children` aliases). Each Divi module needs its render-critical attr in `settings` (e.g. heading→title, text→content, button→button_text); the plugin names any missing one via `respira_divi_required_attrs_missing`.',
                 inputSchema: {
                     type: 'object',
                     properties: {
                         builder: {
                             type: 'string',
-                            description: 'Builder identifier. Use exactly: gutenberg, divi, elementor, bricks, beaver, oxygen, breakdance, brizy, thrive, visual-composer, wpbakery.',
+                            description: 'Builder identifier. Use exactly: gutenberg, divi, elementor, bricks, beaver, oxygen, breakdance, brizy, thrive, visual-composer, wpbakery, flatsome, spectra, kadence, generateblocks, greenshift.',
                         },
                         page_id: {
                             type: 'number',
@@ -2442,7 +2450,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                     properties: {
                         builder: {
                             type: 'string',
-                            description: 'Builder name. Use exactly: gutenberg, divi, elementor, bricks, beaver, oxygen, breakdance, brizy, thrive, visual-composer, wpbakery.',
+                            description: 'Builder name. Use exactly: gutenberg, divi, elementor, bricks, beaver, oxygen, breakdance, brizy, thrive, visual-composer, wpbakery, flatsome, spectra, kadence, generateblocks, greenshift.',
                         },
                         page_id: {
                             type: 'number',
@@ -4424,6 +4432,10 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                             type: 'string',
                             description: 'URL slug (post_name).',
                         },
+                        excerpt: {
+                            type: 'string',
+                            description: 'Post excerpt (wp_posts.post_excerpt) — the "Excerpt"/"Zajawka" panel, RSS summaries and archive teasers. Do NOT pass this inside meta: an excerpt written as post meta reads back fine and renders nowhere.',
+                        },
                         author: {
                             description: 'Author (user id or user login). Requires edit_others_posts capability when different from the acting user.',
                             oneOf: [
@@ -7843,7 +7855,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             // --- Element Operations ---
             {
                 name: 'wordpress_find_element',
-                description: 'Find an element in a page by ID, type, CSS class, text content, or uncode_shortcode_id. This is the PRIMARY tool for locating content to edit — use it instead of searching the database or reading PHP files. Works with all 12 page builders. Use identifier_type "content" to search by visible text (e.g. find a heading containing "2025" to update a year). On WPBakery + Uncode pages, prefer identifier_type "uncode_shortcode_id" — the id is stable across saves and theme updates while class lists and admin labels drift. Returns matching element(s) with their position, settings, and element ID for use with update_element.',
+                description: 'Find an element in a page by ID, type, CSS class, text content, or uncode_shortcode_id. This is the PRIMARY tool for locating content to edit — use it instead of searching the database or reading PHP files. Works with all 17 page builders. Use identifier_type "content" to search by visible text (e.g. find a heading containing "2025" to update a year). On WPBakery + Uncode pages, prefer identifier_type "uncode_shortcode_id" — the id is stable across saves and theme updates while class lists and admin labels drift. Returns matching element(s) with their position, settings, and element ID for use with update_element.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -7865,7 +7877,7 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             },
             {
                 name: 'wordpress_update_element',
-                description: 'Update settings or content on a specific element in a page. This is the PRIMARY tool for making content changes (text edits, style changes, image swaps, link updates, etc.). Works with all 12 page builders. First use find_element to locate the element, then pass the same identifier here with the updates object containing the new values. On WPBakery + Uncode pages, prefer identifier_type "uncode_shortcode_id" for stable round-trip matching. Response includes target_id, original_id, edit_target ("live" or "duplicate"), is_duplicate, duplicate_created and post_status so the caller can never mistake a duplicate-routed write for a live-page change.\n\nLive-edit confirmation: when respira_allow_direct_edit=1 AND the post is a published original, the first call returns `status: "confirmation_required"` with a `next_call_examples` payload. Re-call with the suggested `edit_target` (and `confirm_live_edit: true` for the live path) to acknowledge. Both params are exposed at the top level here so autonomous flows can complete the handshake through MCP without polluting the `updates` object.',
+                description: 'Update settings or content on a specific element in a page. This is the PRIMARY tool for making content changes (text edits, style changes, image swaps, link updates, etc.). Works with all 17 page builders. First use find_element to locate the element, then pass the same identifier here with the updates object containing the new values. On WPBakery + Uncode pages, prefer identifier_type "uncode_shortcode_id" for stable round-trip matching. Response includes target_id, original_id, edit_target ("live" or "duplicate"), is_duplicate, duplicate_created and post_status so the caller can never mistake a duplicate-routed write for a live-page change.\n\nLive-edit confirmation: when respira_allow_direct_edit=1 AND the post is a published original, the first call returns `status: "confirmation_required"` with a `next_call_examples` payload. Re-call with the suggested `edit_target` (and `confirm_live_edit: true` for the live path) to acknowledge. Both params are exposed at the top level here so autonomous flows can complete the handshake through MCP without polluting the `updates` object.',
                 inputSchema: {
                     type: 'object',
                     properties: {