@typeroll/mcp-server 0.45.20 → 0.45.21

package/dist/server.js

@@ -9,6 +9,7 @@
 // safety-critical when one connector can touch many sites.
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { z } from 'zod';
+import { ownerReviewTools } from './tools/owner-review.js';
 import { pageTools } from './tools/pages.js';
 import { partialTools } from './tools/partials.js';
 import { contentTypeTools } from './tools/content-types.js';
@@ -126,6 +127,7 @@ export function buildServer(options) {
         ...skillTools,
         ...siteTools,
         ...pageTools,
+        ...ownerReviewTools,
         ...partialTools,
         ...blockTypeTools,
         ...pageBlockTools,

package/dist/tools/extensions.js

@@ -1,6 +1,19 @@
 import { z } from 'zod';
 import { ok, withErrorBoundary } from './helpers.js';
 export const extensionTools = [
+    {
+        name: 'call_extension_admin',
+        description: 'Call an enabled app’s approved admin API using the current site administrator identity. Read that installed app’s guide first for supported paths and effects. GET reads; POST can change app settings. No deployment is queued by Core. Ordinary admin credentials only; installation credentials cannot delegate. Tokens stay server-side.',
+        inputSchema: {
+            installation_id: z.string().min(1), page_id: z.string().min(1),
+            path: z.string().describe('Relative operation below the approved native API base, from the installed app guide.'),
+            method: z.enum(['GET', 'POST']), query: z.record(z.string()).optional(), body: z.record(z.unknown()).optional(),
+        },
+        handler: withErrorBoundary(async (args, { client, siteId }) => {
+            const { installation_id, ...operation } = args;
+            return ok(await client.post(siteId, `extensions/${encodeURIComponent(installation_id)}/admin-request`, operation));
+        }),
+    },
     {
         name: 'list_extension_installations',
         description: 'List the site\'s installed Extensions, including installation ids, manifests, config schemas, and masked current config. Read this before updating installation config. Admin permission required.',

package/dist/tools/forms.js

@@ -9,7 +9,7 @@ const fieldSchema = z.object({
     name: z.string().regex(/^[a-z][a-z0-9_-]{0,62}$/),
     type: z.enum([
         'text', 'email', 'tel', 'url', 'number', 'textarea',
-        'select', 'checkbox', 'radio', 'hidden', 'gdpr_consent',
+        'select', 'checkbox', 'boolean', 'radio', 'hidden', 'gdpr_consent',
     ]),
     label: z.string(),
     required: z.boolean().optional(),
@@ -30,6 +30,7 @@ const stepSchema = z.object({
     blocks: z.array(z.record(z.string(), z.unknown())).optional(),
 });
 const targetSchema = z.object({
+    context_params: z.array(z.string()).max(8).optional().describe('Explicit URL query keys forwarded to the app hydration endpoint; reserved security keys are rejected.'),
     installation_id: z.string(), path: z.string(), hydrate: z.boolean().optional(), session_param: z.string().optional(),
 }).optional().describe('Admin-only: bind to a declared POST route of an enabled app installation. Read its authenticated guide first.');
 export const formTools = [
@@ -52,7 +53,7 @@ export const formTools = [
     },
     {
         name: 'create_form',
-        description: 'Create a form. Steps are the ONLY stored model — a Block[] tree of form/* field blocks per step. Simple forms: pass `fields`, each { name, type, label, required?, placeholder?, options? } (allowed types: text, email, tel, url, number, textarea, select, checkbox, radio, hidden, gdpr_consent) — the server converts them to a single static step; read_form returns the resulting steps. Multi-step funnels: pass `steps` directly (steps swap client-side, partial submissions persist per step). PLACING THE FORM: add a `core/form` block with data.form_id on block-mode pages, or `<x-form id="…" />` to HTML-mode page content. Both expand server-side to the same complete signed shell; never hand-write the form or add inline submit scripts.',
+        description: 'Create a form. Steps are the ONLY stored model — a Block[] tree of form/* field blocks per step. Simple forms: pass `fields`, each { name, type, label, required?, placeholder?, options? } (allowed types: text, email, tel, url, number, textarea, select, checkbox, boolean (Yes/No/unanswered), radio, hidden, gdpr_consent) — the server converts them to a single static step; read_form returns the resulting steps. Multi-step funnels: pass `steps` directly (steps swap client-side, partial submissions persist per step). PLACING THE FORM: add a `core/form` block with data.form_id on block-mode pages, or `<x-form id="…" />` to HTML-mode page content. Both expand server-side to the same complete signed shell; never hand-write the form or add inline submit scripts.',
         inputSchema: {
             id: z.string().regex(/^[a-z][a-z0-9_-]{0,62}$/),
             name: z.string().min(1),

package/dist/tools/owner-review.js

@@ -0,0 +1,59 @@
+import { z } from 'zod';
+import { ok, withErrorBoundary, versionParam } from './helpers.js';
+const versionQuery = (version) => version ? { version } : undefined;
+export const ownerReviewTools = [
+    {
+        name: 'read_owner_answers',
+        description: 'Site administrator: read typed owner-writable answers and their current revision. Returns safe source kinds/times, never private actor identifiers.',
+        inputSchema: { page_id: z.string(), version: versionParam },
+        handler: withErrorBoundary(async ({ version, ...input }, { client, siteId }) => ok(await client.post(siteId, 'owner-review', { ...input, action: 'answers' }, versionQuery(version)))),
+    },
+    {
+        name: 'override_owner_answers',
+        description: 'Explicit administrator correction of protected answers. Supply the current revision from read_owner_answers, changed fields, and the factual reason. Does not publish. Never use this tool to bypass an import or scraping conflict without explicit authorization.',
+        inputSchema: { page_id: z.string(), base_revision: z.string(), fields: z.record(z.unknown()), reason: z.string().min(1), version: versionParam },
+        handler: withErrorBoundary(async ({ version, ...input }, { client, siteId }) => ok(await client.post(siteId, 'owner-review', { ...input, action: 'override' }, versionQuery(version)))),
+    },
+    {
+        name: 'list_owner_proposals',
+        description: 'Site administrators: list isolated owner proposals and reviewer settings. Pending proposals are excluded from Pages, drafts and publication. Never exposes review tokens or owner identities.',
+        inputSchema: { cursor: z.string().optional(), version: versionParam },
+        handler: withErrorBoundary(async (args, { client, siteId }) => ok(await client.get(siteId, 'owner-review', { cursor: args.cursor, ...versionQuery(args.version) }))),
+    },
+    {
+        name: 'read_owner_proposal',
+        description: 'Read the original before/after answers and review outcome. No changes or notifications are triggered.',
+        inputSchema: { proposal_id: z.string(), version: versionParam },
+        handler: withErrorBoundary(async (args, { client, siteId }) => ok(await client.post(siteId, 'owner-review', { action: 'view', proposal_id: args.proposal_id }, versionQuery(args.version)))),
+    },
+    {
+        name: 'configure_owner_review',
+        description: 'Site administrators: configure the reviewer recipient, enabled state and token lifetime. A separately configured site email connector sends notifications. This action does not send email or publish.',
+        inputSchema: { recipient: z.string().email(), enabled: z.boolean(), link_ttl_hours: z.number().int().min(1).max(168), version: versionParam },
+        handler: withErrorBoundary(async ({ version, ...settings }, { client, siteId }) => ok(await client.post(siteId, 'owner-review', { action: 'settings', settings }, versionQuery(version)))),
+    },
+    {
+        name: 'decide_owner_proposal',
+        description: 'Explicit site-administrator editorial decision: approve, reject, or approve with adjustments. Requires current content/schema and a stable request_id for retries. First decision wins. Approval updates accepted CMS content, never deploys; reviewer adjustments retain separate provenance.',
+        inputSchema: { proposal_id: z.string(), action: z.enum(['approve', 'reject']), request_id: z.string().min(16).max(100), adjustments: z.record(z.unknown()).optional(), version: versionParam },
+        handler: withErrorBoundary(async ({ version, ...input }, { client, siteId }) => ok(await client.post(siteId, 'owner-review', input, versionQuery(version)))),
+    },
+    {
+        name: 'retry_owner_review_notification',
+        description: 'Explicitly send or retry the proposal notification. Maximum three attempts. Never retries an ambiguous in-flight delivery; an administrator must first record a recovery reason. Requires authorization to send this transactional notification.',
+        inputSchema: { proposal_id: z.string(), version: versionParam },
+        handler: withErrorBoundary(async (args, { client, siteId }) => ok(await client.post(siteId, 'owner-review', { action: 'notify', proposal_id: args.proposal_id }, versionQuery(args.version)))),
+    },
+    {
+        name: 'recover_owner_review_notification',
+        description: 'Administrator recovery after investigating an interrupted notification. Record why retry is safe. Does not send email and does not reset the three-attempt bound.',
+        inputSchema: { proposal_id: z.string(), reason: z.string().min(1), version: versionParam },
+        handler: withErrorBoundary(async ({ version, ...input }, { client, siteId }) => ok(await client.post(siteId, 'owner-review', { ...input, action: 'recover-notification' }, versionQuery(version)))),
+    },
+    {
+        name: 'revoke_owner_proposal',
+        description: 'Revoke a pending proposal and its private review link. Accepted Page content remains unchanged.',
+        inputSchema: { proposal_id: z.string(), version: versionParam },
+        handler: withErrorBoundary(async (args, { client, siteId }) => ok(await client.post(siteId, 'owner-review', { action: 'revoke', proposal_id: args.proposal_id }, versionQuery(args.version)))),
+    },
+];

package/dist/tools/pages.js

@@ -1,6 +1,7 @@
 // Pages tools. Read + write + batch + blocks-view + preview.
 import { z } from 'zod';
 import { ok, withErrorBoundary, versionParam } from './helpers.js';
+const answerSources = z.record(z.object({ source_url: z.string().url().optional(), import_run_id: z.string().max(200).optional() }).strict()).optional().describe('Evidence per schema leaf path. Actor and timestamp are always assigned by the server; unchanged answers are not confirmed.');
 function v(version) {
     return version ? { version } : undefined;
 }
@@ -164,11 +165,12 @@ export const pageTools = [
                 template: z.string().nullable().optional().describe('Allowed template ID; null restores the content type default.'),
             })
                 .passthrough(),
+            answer_sources: answerSources,
             save: z.boolean().optional().describe('Also SAVE (commit) the draft in the same call — use for pre-approved or batch changes. Without it, changes stay in the unsaved draft until commit_working_copy.'),
             version: versionParam,
         },
         handler: withErrorBoundary(async (args, { client, siteId }) => {
-            const res = await client.patch(siteId, `pages/${encodeURIComponent(args.page_id)}`, { ...args.patch, ...(args.save ? { save: true } : {}) }, v(args.version));
+            const res = await client.patch(siteId, `pages/${encodeURIComponent(args.page_id)}`, { ...args.patch, ...(args.answer_sources ? { answer_sources: args.answer_sources } : {}), ...(args.save ? { save: true } : {}) }, v(args.version));
             return ok(res);
         }),
     },
@@ -178,11 +180,12 @@ export const pageTools = [
         inputSchema: {
             page_id: z.string(),
             page: z.object({ title: z.string().min(1) }).passthrough(),
+            answer_sources: answerSources,
             save: z.boolean().optional().describe('Also SAVE (commit) the draft in the same call — use for pre-approved or batch changes. Without it, changes stay in the unsaved draft until commit_working_copy.'),
             version: versionParam,
         },
         handler: withErrorBoundary(async (args, { client, siteId }) => {
-            const res = await client.put(siteId, `pages/${encodeURIComponent(args.page_id)}`, { ...args.page, ...(args.save ? { save: true } : {}) }, v(args.version));
+            const res = await client.put(siteId, `pages/${encodeURIComponent(args.page_id)}`, { ...args.page, ...(args.answer_sources ? { answer_sources: args.answer_sources } : {}), ...(args.save ? { save: true } : {}) }, v(args.version));
             return ok(res);
         }),
     },

package/dist/version.js

@@ -8,4 +8,4 @@
 //
 // Keep it in lockstep with package.json: tests/version.test.ts asserts
 // VERSION === package.json.version, so a bump that forgets this line fails CI.
-export const VERSION = '0.45.20';
+export const VERSION = '0.45.21';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@typeroll/mcp-server",
-  "version": "0.45.20",
+  "version": "0.45.21",
   "description": "Typeroll CMS MCP server \u2013 connect AI agents to the REST API to manage content and publish static websites.",
   "license": "MIT",
   "repository": {

package/skills/README.md

@@ -1,4 +1,4 @@
-# Typeroll skills for Claude Code
+# Typeroll CMS skills for AI agents
 
 Boilerplate skills that pair with [`@typeroll/mcp-server`](../packages/mcp-server/README.md).
 Each one is a self-contained markdown file the agent reads when its
@@ -55,8 +55,9 @@ ln -s "$PWD/skills/tr-migrate-wp.md" ~/.claude/skills/
 
 | File | When it triggers | What it does |
 |---|---|---|
-| `tr-migrate-wp.md`     | "migrate from WordPress", a wp-json URL is mentioned     | Walks the WP REST, rebuilds each page in the target's design, transfers media, sets redirects, leaves everything as drafts for review. |
-| `tr-migrate-multisite.md` | "multisite", "our .se/.de/.co.uk sites", migrating several sites at once | One site per domain; per-site URL inventory, design replicated via `.tcblocks`, path preservation, hreflang clusters, and a parity check against the deployed site before DNS moves. |
+| `tr-migration-evidence.md` | Before any bulk migration | Source baseline, supported-field round-trip, prototypes and separate technical/visual evidence. |
+| `tr-migrate-wp.md`     | "migrate from WordPress", a wp-json URL is mentioned     | Walks the WP REST, preserves source design through verified native prototypes, transfers media, sets redirects, leaves everything as drafts for review. |
+| `tr-migrate-multisite.md` | "multisite", "our .se/.de/.co.uk sites", migrating several sites at once | One site per domain; per-site URL inventory, source-validated native recipes replicated, path preservation, hreflang clusters, and a parity check against the deployed site before DNS moves. |
 | `tr-migrate-astro.md`  | "migrate an Astro site", "import from src/content"       | Lifts Astro Content Collections (`src/content/*`) into Typeroll content types — zod schema → field list, frontmatter → field values, Markdown body → Page blocks. Translates standalone `src/pages/*` into Typeroll pages, maps `src/layouts` chunks into partials. |
 | `tr-import-url.md`     | "import from Squarespace/Wix/Webflow", any non-WP URL    | Fetch → clean → adapt to target design → media transfer → draft pages → redirects → deploy. |
 

package/skills/tr-import-url.md

@@ -5,6 +5,12 @@ description: Use when the user wants to import or migrate content from a non-Wor
 
 # Import content from a non-WordPress site
 
+**Before bulk conversion:** read `tr-migration-evidence` with `read_skill`.
+Complete its source baseline and one verified prototype per active template.
+Read target content to protect edits, not to justify accidental target defaults.
+Its shared evidence record is required for visual acceptance.
+
+
 > **The buffer model (draft writes).** Every content write in this recipe
 > (pages, blocks and partials) lands in an unsaved per-doc
 > DRAFT — deploys and plain previews only see SAVED content. For recipe-style
@@ -45,9 +51,10 @@ Parse `<a href>` links to discover internal pages. Build a list:
 - Top-level pages (About, Services, Contact, etc.)
 - Any sub-pages that look important
 
-Avoid: pagination URLs, session URLs, `/wp-admin`, `/cdn-cgi/`, query strings.
+Exclude private/session/admin URLs deliberately. Inventory public pagination and
+query routes; decide preservation or retirement from their actual purpose.
 
-### 2. Learn the target's design
+### 2. Measure the source and protect existing target work
 
 ```
 read_site_settings
@@ -55,8 +62,8 @@ read_partial partial_id="header"
 list_pages limit=5
 ```
 
-The goal is to understand what CSS variables, class names, and structural
-conventions the target site uses so the imported content looks native.
+Read existing target data to avoid overwriting work. Establish source geometry
+and validate native prototypes using `tr-migration-evidence` before mass writes.
 
 ### 3. Fetch and clean each source page
 
@@ -73,7 +80,9 @@ Can you provide the page source or an HTML export?"
 
 **b. Extract the main content.**
 
-Discard: nav, header, footer, cookie banners, chat widgets, scripts.
+Inventory shared navigation/header/footer, consent and runtime features first;
+map them to reusable partials or supported runtimes before excluding them from
+individual Page bodies.
 Keep: `<main>`, `<article>`, the largest content region.
 
 Clean the HTML:
@@ -89,13 +98,13 @@ Clean the HTML:
 ```
 upload_media_from_url url="<source-img-url>" alt="..."
 ```
-Replace the src with the returned CDN URL. Skip tracking pixels
-(1×1 images), decorative SVGs that are just icons, and anything
-that 404s.
+Replace the src with the returned CDN URL. Classify tracking pixels separately. Preserve meaningful decorative images and
+icons. A required file that fails transfer blocks acceptance; do not silently
+omit it. Inventory PDFs, download hrefs, srcsets and backgrounds as well.
 
 **d. Adapt to the target's design.**
-Replace source-specific CSS classes with target conventions.
-Use `var(--color-*)` for colors, `var(--font-*)` for type.
+Use verified native fields from the source capability map. Preserve appearance
+by default; do not substitute target defaults or corrective tenant CSS.
 
 ### 4. Create pages as drafts
 

package/skills/tr-migrate-astro.md

@@ -5,6 +5,12 @@ description: Migrate an existing Astro site, including Astro Content Collections
 
 # Migrate an Astro site
 
+**Before bulk conversion:** read `tr-migration-evidence` with `read_skill`.
+Complete its source baseline and one verified prototype per active template.
+Read target content to protect edits, not to justify accidental target defaults.
+Its shared evidence record is required for visual acceptance.
+
+
 Astro Content Collections are source data. In Typeroll, each source record
 becomes a Page, and each source schema becomes a Content type. Static Astro
 pages use that same Page model. Shared Astro layouts become Page templates,

package/skills/tr-migrate-multisite.md

@@ -5,6 +5,12 @@ description: Use when migrating SEVERAL sites at once — a WordPress multisite
 
 # Migrate a multisite / multi-domain family to Typeroll
 
+**Before bulk conversion:** read `tr-migration-evidence` with `read_skill`.
+Complete its source baseline and one verified prototype per active template.
+Read target content to protect edits, not to justify accidental target defaults.
+Its shared evidence record is required for visual acceptance.
+
+
 > **The buffer model (draft writes).** Every content write in this recipe
 > (pages, blocks and partials) lands in an unsaved per-doc
 > DRAFT — deploys and plain previews only see SAVED content. For recipe-style
@@ -63,8 +69,8 @@ Ask explicitly:
 - Are the sites **translations of each other** (same page structure) or
   independent? This decides whether hreflang clusters are mechanical or
   hand-mapped.
-- Any domains being **retired or merged**? Those need redirects at the DNS
-  level, not just inside a site.
+- Any domains being **retired or merged**? Those need HTTP redirects served by the old hostname; DNS itself is not
+  a redirect. Plan that hosting separately.
 
 ## Phase 1 — Inventory EVERY old site, before building anything
 
@@ -76,7 +82,7 @@ For each source site, create the target site first (the inventory lives on
 it):
 
 ```
-create_site name="Example DE" domain="example.de"
+create_site name="Example DE"
 ```
 
 Then walk the source and post what you find:
@@ -128,12 +134,10 @@ N times as much.
 
 ## Phase 3 — Replicate the design to the other sites
 
-Design travels as a block-type package, not by hand:
-
-```
-export_block_types site_id=<reference>                 # → .tcblocks JSON
-import_block_types site_id=<other> package=<that JSON>
-```
+Replicate only source-validated native recipes and brand settings. Confirm each
+market's template overrides and business workflows independently. Export/import
+custom block types only for specifically reviewed source-specific exceptions,
+not generic corrective blocks or copied tenant CSS.
 
 Then per site:
 - `read_site_settings` on the reference → `update_site_settings` on the
@@ -149,71 +153,15 @@ alt-text generation:
 update_site site_id=<de-site> language="de"
 ```
 
-## Phase 4 — Migrate content, preserving paths
-
-Per site, per URL, follow `tr-migrate-wp` §3. Two rules that matter more here
-than in a single-site migration:
-
-1. **Preserve the path verbatim** unless there's a reason not to. Use
-   `path` for anything nested: `create_page title="Über uns" slug="ueber-uns"
-   path="/ueber-uns"`. A preserved path needs no redirect and loses nothing.
-2. **Rewrite internal links to the NEW paths.** Imported HTML is full of
-   absolute links to the old domain. Sweep them per site:
-
-```
-bulk_replace_text site_id=<de-site> find="https://example.de/" replace="/" dry_run=true
-```
-
-Check the dry-run count against what you expect before running it for real.
-Cross-domain links between sister sites stay absolute — only the site's own
-domain becomes relative.
-
-### Media: per site, not shared
-
-Every Typeroll site has its own media library, so a shared asset (the group
-logo, a product shot used in all markets) is uploaded once **per site** and
-gets a different CDN URL in each. That's correct — the sites are independent
-and one market's deploy must not depend on another's assets — but it means:
-
-- Don't try to reuse a `cdn_url` from site A inside site B's HTML. It will
-  render, and it will break the day site A is deleted or moved.
-- Do write alt text per market, in that market's language:
-  `update_media media_id=… alt_text="…"`. The alt text is content, not
-  metadata, and a Swedish alt on a German page is a real accessibility defect.
-
-Images referenced only from a stylesheet or from unrendered page-builder JSON
-are NOT found by an HTML scan. Spot-check the hero/background images of the
-top pages in the preview before you call a site done.
-
-### Forms are NOT migrated — plan to rebuild them
-
-The HTML cleaner strips `<form>`, `<input>`, `<select>` and `<button>`
-entirely, on purpose: a Contact Form 7 / Gravity / Elementor form posts to
-WordPress endpoints that no longer exist, so importing the markup would give
-you a form that looks alive and silently drops every submission.
-
-So, per site:
-
-```
-create_form name="Kontakt" fields=[…]         # or steps=[…] for a funnel
-add_block target={kind:'page', id:'kontakt'} block={type:'core/form', data:{form_id:'<id>'}}
-```
-
-Then, still per site:
-
-- **Recipient address per market** — the German enquiries rarely go to the
-  Swedish inbox. Check this explicitly; it is the single most common thing
-  to get wrong in a batch of ten.
-- **Email delivery is configured per site** by an admin in the portal
-  (Settings → Integrations), not through this API. Flag it to the user as a
-  manual step — a form that saves submissions but sends no notification looks
-  fine in testing and loses leads in production.
-- **Submit a real test through every form** after deploy, and confirm both the
-  stored submission and the notification email.
+## Phase 4 — Preserve each market's business functions
 
-Count the old site's forms during Phase 1 and put them in the plan table.
-Ten sites × three forms is thirty forms, and it is the part of the job that
-never shows up in a URL inventory.
+Use the business-function inventory from `tr-migration-evidence`. Some markets
+use native Forms, others an owned lead flow, affiliate destination or partner
+iframe. Do not replace them all with a new contact form. Configure a Form only
+where it is the approved equivalent. Verify each market's recipient, destination,
+language and attribution. Use authorized synthetic tests with a safe recipient;
+record delivery UNVERIFIED when it cannot be tested safely. Never create real
+leads or send mail to third parties as a routine migration test.
 
 ## Phase 5 — Redirects for everything you didn't preserve
 
@@ -232,23 +180,10 @@ For each entry, one of three outcomes — no fourth option:
 Re-read the list. `unhandled` reaching zero is the exit condition for this
 phase.
 
-**Clear the URL families with one rule each**, per site — a WP network
-multiplies the same dead shapes across every market:
-
-```
-create_redirect site_id=<de-site> from_path="/category/*" to_path="/blogg/:splat"
-create_redirect site_id=<de-site> from_path="/tag/*"      to_path="/blogg"
-create_redirect site_id=<de-site> from_path="/2019/*"     to_path="/blogg/:splat"
-```
-
-Only a TRAILING `*` is supported (`:splat` replays the remainder); `:name`
-matches one segment. Pattern-covered inventory URLs count as `redirected`, so
-the work list actually empties. A pattern that would hide a live page is
-refused, naming the pages — narrow the prefix rather than working around it.
-
-Watch the per-market prefixes: the German site's archive base is `/kategorie/`,
-not `/category/`. Write the rules from each site's own inventory, never by
-copying the reference site's.
+Pattern redirects require verified source-to-destination content mappings.
+A category/tag/year shape alone is not proof of equivalent destinations. Check
+expanded artifact size and provider limits, actual slash/query variants and
+that no rule hides a preserved Page. A 200 at the wrong content fails.
 
 ## Phase 6 — Wire the hreflang cluster
 
@@ -301,8 +236,8 @@ is possible at all. Verdicts:
 | `error` | 5xx / timeout | inconclusive, re-run |
 
 `check_source=true` also requests the OLD site, so a URL that already 404s
-upstream shows up as noise in the inventory rather than as a migration
-failure — mark those `excluded`.
+upstream needs a reviewed retention/retirement decision, including traffic and
+backlinks. Never automatically mark source 404s `excluded`.
 
 Slash-equivalent source URLs are one inventory decision but remain separate
 verification requests through `observed_paths`. Therefore `checked` can exceed
@@ -316,7 +251,8 @@ parity, then record the exact dataset and result with
 `record_migration_seo_acceptance`.
 
 Iterate until `missing` and `broken_redirect` are both zero **on every site**.
-Then, per site:
+Only after explicit cutover authorization, per site (`add_domain` prepares a
+new canonical build and is not an inventory-only operation):
 
 1. `add_domain` with the intended apex/www canonical; leave `auto_deploy` on
 2. Wait for that canonical/sitemap deploy to succeed, then point DNS
@@ -338,9 +274,9 @@ Then, per site:
 - [ ] hreflang cluster written on both/all sides, absolute, final domains
 - [ ] `language` set on the site; `<html lang>` correct in the deployed HTML
 - [ ] Internal links rewritten (no lingering absolute links to the old domain)
-- [ ] Forms rebuilt, recipient address correct for THIS market, test submission sent and received
+- [ ] Market-specific business functions mapped; authorized synthetic interaction/delivery verified or explicitly UNVERIFIED
 - [ ] Media uploaded to this site's own library (no cross-site `cdn_url`), alt text in this market's language
-- [ ] Domain declared, canonical deploy succeeded, DNS verified; sitemap submitted
+- [ ] If cutover is authorized: domain declared, canonical deploy succeeded, DNS verified; sitemap submitted. Otherwise report pre-cutover complete separately.
 
 ## Pitfalls specific to this job
 

package/skills/tr-migrate-wp.md

@@ -5,6 +5,12 @@ description: Use when the user asks to migrate a WordPress site to Typeroll, men
 
 # Migrate from WordPress to Typeroll
 
+**Before bulk conversion:** read `tr-migration-evidence` with `read_skill`.
+Complete its source baseline and one verified prototype per active template.
+Read target content to protect edits, not to justify accidental target defaults.
+Its shared evidence record is required for visual acceptance.
+
+
 > **The buffer model (draft writes).** Every content write in this recipe
 > (pages, blocks and partials) lands in an unsaved per-doc
 > DRAFT — deploys and plain previews only see SAVED content. For recipe-style
@@ -58,10 +64,9 @@ Then the ordinary preconditions:
 - `@typeroll/mcp-server` configured with a valid `TYPEROLL_API_KEY`.
 - The source WP site has `/wp-json` reachable (Google for "wordpress
   REST API disabled" if not — common for hardened hosts).
-- The Typeroll target site exists **and already carries the design** —
-  settings, header/footer, one or two example pages. Import preserves content; shared templates define presentation. Agree whether
-  to preserve the original appearance or redesign it. Do not silently restyle
-  or rewrite imported text.
+- The target exists. Establish the source design baseline first, then prove
+  representative target templates using `tr-migration-evidence`. Preserve
+  appearance unless a redesign is explicitly requested.
 - If the target already has content, you must NOT clobber it — always
   `list_pages` first and only write to slugs that don't already exist.
 
@@ -78,7 +83,7 @@ Build a list of every URL you intend to migrate. WP custom post types
 need their REST endpoint (e.g. `/wp-json/wp/v2/news?per_page=100`),
 walking `X-WP-TotalPages` to paginate.
 
-### 2. Learn the target's design
+### 2. Measure the source and protect existing target work
 
 ```
 get_site
@@ -169,19 +174,12 @@ path? If yes, no redirect. If renamed, `create_redirect`. If
 intentionally dropped, mark it `excluded` via `update_migration_url` (the
 customer should sign off on every dropped URL).
 
-**Use wildcards for WordPress's URL families.** A WP site's dead URLs come in
-shapes, not as individuals — and the inventory only knows the ones it found,
-while the old site had more (paginated archives, feeds, attachment pages). One
-pattern rule retires the whole family:
-
-| WordPress shape | Rule |
-|---|---|
-| Intentionally retired category archives | `from_path="/category/*"` → `to_path="/blogg/:splat"` (or a single landing page) |
-| Intentionally retired tag archives | `from_path="/tag/*"` → `to_path="/blogg"` |
-| Author archives | `from_path="/author/*"` → `to_path="/om-oss"` |
-| Date-based permalinks | `from_path="/2019/*"` → `to_path="/blogg/:splat"` — one rule per year |
-| Old post prefix → new | `from_path="/blog/:slug"` → `to_path="/artiklar/:slug"` |
-| Feeds | `from_path="/feed/*"` → `to_path="/blogg"` |
+Use a pattern only after verifying every affected source-to-destination mapping.
+For an explicitly approved prefix change, `/old-blog/:slug` → `/articles/:slug`
+can preserve intent if each destination contains the corresponding article.
+Do not blanket-redirect category/tag/author/feed/year families to a home or blog
+page. Date paths need actual route mappings; stripping a year is not enough.
+Review source 404s rather than automatically excluding them.
 
 Rules:
 
@@ -194,7 +192,9 @@ Rules:
   `/blogg/*` would make every real article under `/blogg/` unreachable. Narrow
   the prefix instead.
 - **Query-string URLs can't be matched.** WP's `/?p=123` has no path to key on;
-  those need handling at the source (or accept the loss and mark them excluded).
+  these require an explicit query-routing solution on the future host or a
+  reviewed retirement decision. The old host cannot handle requests after its
+  hostname moves.
 - Rules are emitted most-specific-first, so a narrow rule always beats a broad
   one — you can safely have `/blogg/recept/*` alongside `/blogg/*`.