@typeroll/mcp-server 0.45.105 → 0.45.107

package/dist/compact-tools.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { fail, ok } from './tools/helpers.js';
-export const COMPACT_INSTRUCTIONS = `Typeroll CMS. Use search_tools to find a task's tools, describe_tool to read one exact schema, then call_read_tool, call_write_tool or call_admin_tool. Discover before you write: identify Site/Version, capabilities and enabled app documentation. Read only the relevant skill or guide section; do not load the full manual by default. Larger changes: create_branch and keep the same version. Working copy, saved content and live output differ. Publishing and other external effects require the user's authorization; tool access alone is not approval.`;
+export const COMPACT_INSTRUCTIONS = `Typeroll CMS. Use search_tools to find a task's tools, describe_tool to read one exact schema, then call_read_tool, call_write_tool or call_admin_tool. Discover before you write: identify Site/Version, capabilities and enabled app documentation. Read only the relevant skill or guide section; do not load the full manual by default. Larger changes: create_branch and keep the same version. Working copy, saved content and live output differ. Publishing and other external effects require the user's authorization; tool access alone is not approval. After cutover a deploy reaches the live domain: it needs the owner's approval and confirm_live_domains: true.`;
 /** Stable discovery surface: no dynamic registration or client list-change support needed. */
 export function compactTools(catalog) {
     const byName = new Map(catalog.map(tool => [tool.name, tool]));

package/dist/server.js

@@ -190,6 +190,11 @@ The full playbook ships with this server — use it:
    schema_markup, create_site_and_plan) need the Organization's portal AI
    key for the Site. On ai_not_enabled don't retry: do the work yourself
    with the recipe named in start_workflow and tell the user you did.
+10. Publishing to the temporary address ends at cutover. Once a site serves
+   its live custom domain, every trigger_deploy is a production release: get
+   the owner's approval and pass confirm_live_domains: true
+   (get_publication_impact reports production and targets). Review with
+   get_preview_link include_working_copy instead of deploying.
 
 If anything here conflicts with what a tool returns, trust the tool. Every
 tool's own description carries its specifics.

package/dist/tools/deploy.js

@@ -6,15 +6,16 @@ function v(version) {
 export const deployTools = [
     {
         name: 'get_publication_impact',
-        description: 'Read provisional net saved public-source changes against the selected version’s last verified publication. Reports additions, removals, shared inputs, metadata-only changes and unavailable baselines. Does not build or deploy. execution is automatic and reuse_verified is false before the build; inspect job.render_report afterwards for actual rendered/reused counts; source-level classification does not prove output reuse or cost savings.',
+        description: 'Read where a deploy lands and provisional net saved public-source changes against the selected version’s last verified publication. targets lists every public URL the publication serves (live domains first, then the temporary address); production: true means the site is cut over and a deploy publishes to live_domains. Reports additions, removals, shared inputs, metadata-only changes and unavailable baselines. Does not build or deploy. execution is automatic and reuse_verified is false before the build; inspect job.render_report afterwards for actual rendered/reused counts; source-level classification does not prove output reuse or cost savings.',
         inputSchema: { version: versionParam },
         handler: withErrorBoundary(async (args, { client, siteId }) => ok(await client.get(siteId, 'publishing/impact', v(args.version)))),
     },
     {
         name: 'trigger_deploy',
-        description: "Enqueue a deploy (static-page build → hosting) of the currently active version. Returns a job_id immediately; poll get_deploy_status until the status leaves queued/running. NOT for previewing iterative design/content edits — that's what get_preview_link is for (it renders live from the DB with no build). Reserve trigger_deploy for publishing, a stakeholder link to the compiled site, or pre-merge validation. Deploys build SAVED content only — unsaved drafts (working copies) are excluded, so commit_working_copy (or save:true on your writes) before deploying, or your changes won't ship. Customer publishing freezes a consistent saved source, then resumes source/Git/build-dispatch checkpoints without recapturing later edits. GitHub or Cloudflare performs rendering and media work. With dry_run:true, customer publishing validates frozen source without a Git push or external build; it does not prove an Astro build succeeds. Other self-hosted adapters may build locally without upload. Check the reported phase. All sites in an organization share one build engine: publish one site at a time, starting the next only when the previous job has finished and read_organization_build_engine shows no active_jobs. A domain switch waiting for DNS approval (awaiting_approval) does not block other sites.",
+        description: "Enqueue a deploy (static-page build → hosting) of the currently active version. Returns a job_id immediately; poll get_deploy_status until the status leaves queued/running. NOT for previewing iterative design/content edits — that's what get_preview_link is for (it renders live from the DB with no build). Reserve trigger_deploy for publishing, a stakeholder link to the compiled site, or pre-merge validation. Publishing to the temporary address ends at cutover: once a site serves its live custom domain, the same publication serves both, so every deploy of main is a production release. Then get the owner's approval and pass confirm_live_domains: true; without it a real deploy is refused with live_domain_confirmation_required, naming the live URLs and targets. Review changes on a cut-over site with get_preview_link (include_working_copy) or dry_run:true, which need no confirmation. The result reports production, live_domains and targets (live domains first, then the temporary address). Deploys build SAVED content only — unsaved drafts (working copies) are excluded, so commit_working_copy (or save:true on your writes) before deploying, or your changes won't ship. Customer publishing freezes a consistent saved source, then resumes source/Git/build-dispatch checkpoints without recapturing later edits. GitHub or Cloudflare performs rendering and media work. With dry_run:true, customer publishing validates frozen source without a Git push or external build; it does not prove an Astro build succeeds. Other self-hosted adapters may build locally without upload. Check the reported phase. All sites in an organization share one build engine: publish one site at a time, starting the next only when the previous job has finished and read_organization_build_engine shows no active_jobs. A domain switch waiting for DNS approval (awaiting_approval) does not block other sites.",
         inputSchema: {
             environment: z.enum(['production', 'staging']).optional(),
+            confirm_live_domains: z.boolean().optional().describe('Required (true) for a real deploy of a cut-over site: acknowledges that the deploy publishes to the live domains named by get_publication_impact or the live_domain_confirmation_required error. Only after the site owner approved this production release. Not needed for dry_run or sites that are not cut over.'),
             allow_unsaved: z.boolean().optional().describe('Explicitly publish saved content while leaving the reported unsaved Pages/partials untouched. Only after owner confirmation.'),
             dry_run: z.boolean().optional().describe('Validate without publishing. Customer publishing checks frozen source only, including image links without an accessible name (publication_validation_failed); other adapters may build locally without upload.'),
             version: versionParam,
@@ -41,7 +42,7 @@ export const deployTools = [
     },
     {
         name: 'get_deploy_status',
-        description: "Status of a single deploy job. Optional top-level build_progress reports the exact task status, attempt, step and completed/total files; not an overall percentage or ETA. Returns { job, queued_for_seconds, queue_timeout_seconds }. job.status is one of queued | running | succeeded | failed. On a failed build, job.error names the failed step and the cause the step printed, job.failure.code is the reported code (e.g. media_build_process_exit_1) and job.failure.diagnostic holds { cause, lines } (the last 40 lines that step printed, credentials removed). On the Cloudflare build engine job.failure.provider_log also holds { step, build_id, summary, lines } from the provider's build log (last 60 lines). Read them before retrying; retrying does not fix a cause that is in the content or the build engine. job.warnings, when present, lists non-blocking findings of a deploy that still ran, for example a media file left out of the publication because it could not be published safely (an SVG that could not be sanitized); report them to the user. Polling cadence: ~5s for queued/running. job.render_report, when present, reports actual HTML mode (full/partial), rendered, reused, total and removed route counts plus a fallback reason. From Core 0.2.17, custom blocks and consumed image metadata are tracked per route; older caches require one full build. It does not measure media or provider startup savings. job.coordinator, when present, reports the last completed CMS phase and duration_ms for that attempt; external build waiting is excluded. Keep observing the same job across checkpoints; do not trigger duplicate deploys. A job stuck in 'queued' for longer than queue_timeout_seconds (default 300s) auto-flips to failed with phase='queue_timeout' — so a single poll past that timestamp returns the terminal state and you can stop polling.",
+        description: "Status of a single deploy job. Optional top-level build_progress reports the exact task status, attempt, step and completed/total files; not an overall percentage or ETA. Returns { job, queued_for_seconds, queue_timeout_seconds }. job.targets and job.production, when present, record where the publication was admitted to publish and whether that included a live domain. job.status is one of queued | running | succeeded | failed. On a failed build, job.error names the failed step and the cause the step printed, job.failure.code is the reported code (e.g. media_build_process_exit_1) and job.failure.diagnostic holds { cause, lines } (the last 40 lines that step printed, credentials removed). On the Cloudflare build engine job.failure.provider_log also holds { step, build_id, summary, lines } from the provider's build log (last 60 lines). Read them before retrying; retrying does not fix a cause that is in the content or the build engine. job.warnings, when present, lists non-blocking findings of a deploy that still ran, for example a media file left out of the publication because it could not be published safely (an SVG that could not be sanitized); report them to the user. Polling cadence: ~5s for queued/running. job.render_report, when present, reports actual HTML mode (full/partial), rendered, reused, total and removed route counts plus a fallback reason. From Core 0.2.17, custom blocks and consumed image metadata are tracked per route; older caches require one full build. It does not measure media or provider startup savings. job.coordinator, when present, reports the last completed CMS phase and duration_ms for that attempt; external build waiting is excluded. Keep observing the same job across checkpoints; do not trigger duplicate deploys. A job stuck in 'queued' for longer than queue_timeout_seconds (default 300s) auto-flips to failed with phase='queue_timeout' — so a single poll past that timestamp returns the terminal state and you can stop polling.",
         inputSchema: { job_id: z.string(), include_provider: z.boolean().optional().describe('Also read the exact Git commit and Cloudflare build stages for a customer Git publication. Does not return build secrets.') },
         handler: withErrorBoundary(async (args, { client, siteId }) => {
             const res = await client.get(siteId, `deploys/${encodeURIComponent(args.job_id)}`);

package/dist/tools/workflows.js

@@ -25,7 +25,7 @@ export const workflowTools = [
     },
     {
         name: 'start_workflow',
-        description: 'Start a server-side workflow on this Site; it runs in the background and returns workflow_id. Poll get_workflow. Config per type (same fields as the portal form): migration { wp_url, helper_api_key? } (needs verified organization import storage); site_planning { business_description }; content_generation { topic, tone?, audience? }; content_improvement { limit? }; url_parity { target_origin?, source_origin?, check_source?, statuses? }; rebuild_deploy { environment: staging | production }; seo_audit, link_check, performance_audit and schema_markup take none. Needs write permission; rebuild_deploy publishes and needs admin. Workflows that change content write to the given version (default main) — get the user\'s agreement first. ' + AI_WORKFLOWS,
+        description: 'Start a server-side workflow on this Site; it runs in the background and returns workflow_id. Poll get_workflow. Config per type (same fields as the portal form): migration { wp_url, helper_api_key? } (needs verified organization import storage); site_planning { business_description }; content_generation { topic, tone?, audience? }; content_improvement { limit? }; url_parity { target_origin?, source_origin?, check_source?, statuses? }; rebuild_deploy { environment: staging | production, confirm_live_domains? } (production on a cut-over site publishes to its live domain and needs confirm_live_domains: true after owner approval); seo_audit, link_check, performance_audit and schema_markup take none. Needs write permission; rebuild_deploy publishes and needs admin. Workflows that change content write to the given version (default main) — get the user\'s agreement first. ' + AI_WORKFLOWS,
         inputSchema: {
             type: z.enum(WORKFLOW_TYPES),
             config: z.record(z.string(), z.unknown()).optional(),

package/dist/version.js

@@ -8,4 +8,4 @@
 //
 // Keep it in lockstep with package.json: tests/version.test.ts asserts
 // VERSION === package.json.version, so a bump that forgets this line fails CI.
-export const VERSION = '0.45.105';
+export const VERSION = '0.45.107';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@typeroll/mcp-server",
   "mcpName": "io.github.Typeroll/typeroll",
-  "version": "0.45.105",
+  "version": "0.45.107",
   "description": "Typeroll CMS MCP server \u2013 connect AI agents to the REST API to manage content and publish static websites.",
   "license": "MIT",
   "repository": {

package/skills/tr-edit-site.md

@@ -67,6 +67,10 @@ section. A Page template is `update_page` `template` (an allowed ID, or null
 for the content type default). `discard_working_copy` throws an unsaved draft
 away. Publishing means saving the draft, `update_page` `status: "published"`
 (applies immediately) and, when the user wants it live now, `trigger_deploy`.
+On a site that serves its live custom domain (`get_publication_impact`
+reports `production: true`), every deploy is a production release: get the
+owner's approval and pass `confirm_live_domains: true`. Review with
+`get_preview_link` `include_working_copy: true` instead of deploying.
 
 **Publishing and failed deploys.** Poll `get_deploy_status` until the job is
 `succeeded` or `failed`. Every site in an organization shares one build

package/skills/tr-header-footer.md

@@ -129,6 +129,12 @@ names the list for screen readers and takes the site's Eyebrow style (or
 or style them with site CSS. Read `read_site_settings` → `render.version`
 first; below 13, raise it with `tr-upgrade-rendering`.
 
+A header or menu partial renders before every Page's H1, so a label in it that
+is not a navigation group title, such as "Get a quote:" above contact links,
+must not be a `core/heading`. Use `core/prose` with `html: "<p>Get a quote:</p>"`
+and its own `font_size_px`, `font_weight` and `color` (a palette token such as
+`on_secondary` on a secondary panel). `core/text` takes the same `color`.
+
 Each entry in `links` (`core/navigation_links` and `core/navigation`) may set
 `link_rel`, for example `nofollow sponsored` on an affiliate or partner link.
 A `core/tabs` choice with a direct `href` accepts `link_rel` and `new_tab` too,

package/skills/tr-migrate-multisite.md

@@ -308,6 +308,14 @@ new canonical build and is not an inventory-only operation):
 6. Rerun the complete, unfiltered URL check and SEO review, then require
    `get_migration_launch_report` to return `launch_ready: true`
 
+Publishing to the temporary address ends at each site's cutover. From then on
+one publication serves both the live domain and the old fallback address, so
+every `trigger_deploy` of that site is a production release: review with
+`get_preview_link` (`include_working_copy: true`) or `dry_run: true`, get the
+owner's approval, and pass `confirm_live_domains: true`. Without it the deploy
+is refused with `live_domain_confirmation_required`, naming the live URLs.
+`get_publication_impact` reports `production` and `targets` per site.
+
 ## Phase 8 — Launch (required)
 
 A site is not finished until this step has run. Call `read_site_readiness`

package/skills/tr-migrate-wp.md

@@ -394,6 +394,22 @@ is not visible to Typeroll. The
 [launch checklist](https://typeroll.com/docs/guides/launch-checklist/)
 explains every item.
 
+## After cutover: every deploy is production
+
+Publishing to the temporary address ends at cutover. Once the real domain
+serves the site, one publication serves both the live domain and the old
+`site-*.sites` address, so a deploy you think of as "temporary" changes the
+live website.
+
+- Review changes with `get_preview_link` (`include_working_copy: true`) or
+  `trigger_deploy dry_run=true`. Neither publishes or needs confirmation.
+- Treat every real `trigger_deploy` as a production release: get the owner's
+  approval for it, then pass `confirm_live_domains: true`.
+- `get_publication_impact` and the deploy result report `production` and
+  `targets` (live domains first, then the temporary address). Without the
+  acknowledgement a deploy is refused with `live_domain_confirmation_required`,
+  naming the live URLs. Show them to the owner; never add the flag on your own.
+
 ## Pitfalls
 
 - **Don't publish during migration.** Always import as `draft`. Even