@typeroll/mcp-server 0.45.109 → 0.45.111

package/AGENTS.md

@@ -1346,6 +1346,7 @@ preview.
 | **Redirects** | `list_redirects`, `create_redirect`, `delete_redirect`. `from_path` may be a PATTERN: a trailing `*` (with `:splat` in the target) or `:name` for one segment — one rule retires a whole family of dead URLs (`/category/*` → `/blogg/:splat`). Mid-path splats and query strings are refused, as is any rule that would hide a live page. |
 | **Migration inventory + launch gate** | `get_migration_readiness` (preflight — CALL FIRST), `list_migration_urls`, `add_migration_urls`, `update_migration_url`, `update_migration_urls`, `delete_migration_url`, `import_sitemap`, `import_gsc_performance`, `repair_migration_plain_text`, `verify_migration_urls`, `record_migration_seo_acceptance`, `get_migration_launch_report`. Sitemap indexes are recursive. GSC supports direct Search Console access or CSV and aggregates fragment variants. Plain-text repair is allowlisted and dry-run-first. A complete unfiltered URL check and reviewed SEO evidence are bound to the latest hosted deploy; the launch report fails closed when either is stale or incomplete. |
 | **Forms** | `list_forms`, `read_form`, `create_form`, `update_form`, `delete_form`, `get_form_capabilities`, `list_form_submissions`, `read_form_submission`, `delete_form_submission` (removes one submission — e.g. cleaning up a test entry; `delete_form` with `delete_submissions` is the bulk path). **Steps (form/* block trees) are the ONLY stored model**: pass `steps` for funnels, or `fields` for simple forms — the server converts a flat field list to a single static step. Place with a `core/form` block on block-mode pages or `<x-form id="…" />` in HTML mode. Both expand server-side to the same complete signed shell and initial state. `read_form` shows the form's actions (email notifications, webhooks; secrets masked) and `create_form`/`update_form` set them with `actions`, with admin permission as in the portal; `get_form_capabilities` lists the action types (including app-provided ones) and their config fields. |
+| **Form spam protection (admin)** | `get_form_spam_protection`, `set_form_spam_protection`, `delete_form_spam_protection` — Cloudflare Turnstile for every form on the site: the site owner creates a Managed widget in their Cloudflare dashboard, you store its site key and secret (write-only), then publish. Each form requires Turnstile after its republished pages send the first verified answer (`enforced_forms`). App and Extension forms are not covered. |
 | **Email (admin)** | `get_email_settings`, `set_email_settings`, `delete_email_settings`, `send_test_email` — the outgoing provider (Postmark, SMTP, SES) that form notifications send through, as in Settings → Email & notifications; secrets are write-only (reads show `{ set: true }`; omit a secret to keep it). Without a provider, form email actions are skipped. `get_incoming_email_settings`, `set_incoming_email_forwarding` (enable/disable a host-approved route by `route_id` + current `revision`; cannot create aliases or change targets), `read_incoming_email_receipt`. |
 | **Settings** | `update_site_settings` (admin; every field the portal Settings form accepts, including `sitewide_noindex`, `default_og_image`, `twitter_handle`, `organization`, `staging_url` and shallow-merged native `cookie_consent`), `check_site_indexing` (live fallback/production headers, meta robots, and robots.txt diagnostics) |
 | **Core modules** | `list_apps`, `read_app`, `update_app` (legacy API name; admin; schema-driven config, masked secrets, redeploy when `affects_build` is true); `list_organization_analytics`, `set_organization_analytics` (Analytics for chosen Sites; organization key) |
@@ -1476,3 +1477,13 @@ with `read_site_instructions` and enabled App guides with
 `read_app_documentation`. Use `tr-edit-site` for the editor workflow.
 Organization administration requires an explicit `organization_id` and a
 current owner/admin membership. Manual API keys keep their existing scope.
+
+## REST parity
+
+Every tool must call the REST API through `TyperollClient`; a tool must not do
+work the API cannot. The published REST reference
+(`packages/docs-site/src/content/docs/technical/rest-api-reference.md`) is
+generated from the tools by `npm run gen:rest` (also part of `npm run gen`), and
+`tests/rest-reference.test.ts` fails when it is stale or a tool makes no REST
+call. Tools that only read bundled documentation are listed in `LOCAL_TOOLS`.
+

package/README.md

@@ -52,7 +52,7 @@ release. See the [model guide](https://typeroll.com/docs/tools/content-types/) a
   personal access with any role. No API key copying is needed. Confirm a site
   and version, use `select_site`, and carry its `site_context` on site calls.
   Revoke access in Account → AI connections. Permissions are checked live;
-  the connection expires after 30 days. Legacy OAuth grants remain scoped
+  the connection lasts until revoked. Legacy OAuth grants remain scoped
   as before until reconnecting. Manual bearer keys remain supported.
 - **Local stdio — launch the npm package.** Use a client that can run a local
   command with environment variables. Instructions below.