@typeroll/mcp-server 0.45.63 → 0.45.65

package/dist/server.js

@@ -94,6 +94,9 @@ function effectFor(name) {
         || name === 'revoke_site_share'
         || name === 'revoke_organization_api_key'
         || name === 'create_organization_invite'
+        || name === 'set_organization_ai_key'
+        || name === 'remove_organization_ai_key'
+        || name === 'set_organization_ai_site_access'
         || name === 'disconnect_organization_publishing_provider'
         || name === 'connect_organization_cloudflare'
         || name === 'prepare_organization_media_storage'

package/dist/tools/access.js

@@ -1,7 +1,8 @@
-// Access tools — API keys, cross-organization site sharing and organization
-// invites. Each wraps the authenticated public API with the same permission
-// checks as the portal: a key never mints a key or a grant that reaches
-// further than it does.
+// Access tools — API keys, cross-organization site sharing, organization
+// invites and the Organization's own AI key for the portal assistant. Each
+// wraps the authenticated public API with the same permission checks as the
+// portal: a key never mints a key or a grant that reaches further than it
+// does.
 import { z } from 'zod';
 import { ok, withErrorBoundary } from './helpers.js';
 const keyId = z.string().regex(/^[a-f0-9]{12}$/).describe('Key id (the 12-hex prefix) from list_api_keys / list_organization_api_keys.');
@@ -72,4 +73,35 @@ export const accessTools = [
         inputSchema: { ttl_days: z.number().int().min(1).max(30).optional() },
         handler: withErrorBoundary(async (args, { client }) => ok(await client.rootPost('organization/invites', args))),
     },
+    {
+        name: 'read_organization_ai_settings',
+        noSite: true,
+        description: 'Read the Organization\'s built-in AI assistant settings: whether its own Anthropic API key is set (last four characters, verified_at, who set it and when — never the key), site_access ({ mode: "all" | "selected", site_ids }) and every Site of the Organization with ai_enabled. The portal AI chat appears only on Sites with ai_enabled. This setting never limits MCP or the API: you can edit every Site you have access to. Requires an organization API key, or a personal connection in an Organization where the person is an owner or admin.',
+        inputSchema: {},
+        handler: withErrorBoundary(async (_args, { client }) => ok(await client.rootGet('organization/ai'))),
+    },
+    {
+        name: 'set_organization_ai_key',
+        noSite: true,
+        description: 'Add or replace the Organization\'s own Anthropic API key for the portal\'s built-in AI assistant. Typeroll checks the key with Anthropic before saving: a rejected key returns 422 ai_key_rejected and an unreachable Anthropic 502 ai_key_unverified, and nothing is stored. The key is stored encrypted and never returned. A first key enables no Sites; replacing a key keeps the Site choice. Only call this with a key the user gave you for this purpose and their explicit go-ahead; prefer that an owner or admin enters it in the portal (Organization settings → AI assistant) so it does not pass through this conversation. Never repeat the key back. Requires an organization API key.',
+        inputSchema: { api_key: z.string().min(20).max(512).describe('The Anthropic API key (starts with sk-ant-).') },
+        handler: withErrorBoundary(async (args, { client }) => ok(await client.rootPut('organization/ai/key', { api_key: args.api_key }))),
+    },
+    {
+        name: 'remove_organization_ai_key',
+        noSite: true,
+        description: 'Remove the Organization\'s Anthropic API key. The portal AI chat disappears from every Site and the Site choice starts over; MCP and the API are unaffected. Requires an organization API key and the user\'s explicit go-ahead.',
+        inputSchema: {},
+        handler: withErrorBoundary(async (_args, { client }) => ok(await client.rootDelete('organization/ai/key'))),
+    },
+    {
+        name: 'set_organization_ai_site_access',
+        noSite: true,
+        description: 'Choose which of the Organization\'s own Sites show the portal AI chat: mode "all" (every Site, including Sites created later) or mode "selected" with site_ids from read_organization_ai_settings (an empty list turns it off everywhere). A Site shared in from another Organization follows that owner\'s setting. Needs a key first (409 ai_key_required). Requires an organization API key.',
+        inputSchema: {
+            mode: z.enum(['all', 'selected']),
+            site_ids: z.array(z.string()).max(1000).optional().describe('Required when mode is "selected".'),
+        },
+        handler: withErrorBoundary(async (args, { client }) => ok(await client.rootPut('organization/ai/site-access', args.mode === 'all' ? { mode: 'all' } : { mode: 'selected', site_ids: args.site_ids ?? [] }))),
+    },
 ];

package/dist/tools/apps.js

@@ -15,7 +15,8 @@ export const appTools = [
     },
     {
         name: 'read_app',
-        description: 'Read one Typeroll app by registry id, including its field schema and masked state. Use list_apps to discover ids and required config fields. Secret values are never returned. For setup guidance without admin access, use read_app_documentation. Admin permission required.',
+        description: 'Read one Typeroll app by registry id, including its field schema and masked state. Use list_apps to discover ids and required config fields. Secret values are never returned. For setup guidance without admin access, use read_app_documentation. Admin permission required. ' +
+            'For analytics, `setup` reports its Cloudflare Web Analytics site: status "ready" with the account it lives in (`account.owner` "organization" = the Cloudflare account of the site\'s Hosting Group, used for customer publishing; "installation" = the installation\'s own account, used for managed and self-hosted sites), or "action_required" with `code`, `message`, `next_step` and optional `settings_url`.',
         inputSchema: {
             app_id: z.string().min(1).describe('Registry id returned by list_apps, for example analytics or integrations.'),
         },
@@ -25,7 +26,9 @@ export const appTools = [
     },
     {
         name: 'update_app',
-        description: 'Enable, configure, or disable any registered Typeroll app through the same admin API key used for publishing. Read the app first and send config keys from its field schema. Omitted fields preserve existing values, including encrypted secrets; secret values are masked on reads and encrypted server-side on writes. Analytics provisioning runs server-side when enabled. If affects_build is true, trigger_deploy is required to publish the change. For setup guidance without admin access, use read_app_documentation. Admin permission required.',
+        description: 'Enable, configure, or disable any registered Typeroll app through the same admin API key used for publishing. Read the app first and send config keys from its field schema. Omitted fields preserve existing values, including encrypted secrets; secret values are masked on reads and encrypted server-side on writes. If affects_build is true, trigger_deploy is required to publish the change. For setup guidance without admin access, use read_app_documentation. Admin permission required. ' +
+            'Analytics: enabling creates the Cloudflare Web Analytics site in the account that hosts the site (customer publishing: the Hosting Group\'s Cloudflare connection, never the installation\'s account) and fills beacon_token and site_tag; a pasted beacon_token is resolved to its site_tag in that same account. ' +
+            'When no beacon could be set up, the call fails with HTTP 409, a stable `code` (for example analytics_cloudflare_access_required, analytics_cloudflare_connection_required, analytics_host_required, analytics_provider_error, analytics_token_not_in_account) and `details.next_step`; `details.saved` says whether the enabled state was stored. Relay the next step to the person (approving Analytics access needs an organization owner or admin in the browser), then call update_app again. A 200 response carries `setup` too.',
         inputSchema: {
             app_id: z.string().min(1).describe('Registry id returned by list_apps.'),
             enabled: z.boolean(),

package/dist/tools/domain.js

@@ -190,22 +190,26 @@ export const domainTools = [
     },
     {
         name: 'approve_publishing_domain_cutover',
-        description: 'Approve switching website traffic to the verified frozen deployment. Read publishing domains first and review DNS requirements and certificate readiness. Existing traffic is preserved until validation succeeds. External DNS management remains the caller’s responsibility.',
-        inputSchema: { revision: z.string(), candidate_id: z.string() },
+        description: 'Approve switching website traffic to the verified frozen deployment. Read publishing domains first and review DNS requirements, certificate readiness and redirect_preparations. Existing traffic is preserved until validation succeeds. With automatic DNS, redirect hosts switch after the website host: Typeroll ensures their zone redirect rule, then changes their reviewed record to a proxied placeholder. The publication goes live only after every redirect host answers 301 to the website host with the same path and query. When preparation.validation_blocker.resolution is accept_validation_window, Cloudflare can validate the website host only after its one existing record points at Pages: approving with accept_validation_window: true lets Typeroll change that record, and the host does not answer until Cloudflare validates it (Cloudflare does not document how long; previous_records holds the rollback). Get the user\'s explicit go-ahead for that window and choose a quiet time. External DNS management remains the caller’s responsibility.',
+        inputSchema: {
+            revision: z.string(), candidate_id: z.string(),
+            accept_validation_window: z.boolean().optional().describe('Accept the interruption until Cloudflare validates the website host after its single reviewed record changes. Only valid when preparation.validation_blocker.resolution is accept_validation_window.'),
+        },
         handler: withErrorBoundary(async (args, { client, siteId }) => ok(await client.post(siteId, 'publishing/cutover', args))),
     },
     {
         name: 'read_publishing_domains',
-        description: 'Read the desired and active website and media hosts, retained media aliases, DNS management mode and domain configuration revision. Saving intent does not switch traffic.',
+        description: 'Read the desired and active website, redirect and media hosts, retained media aliases, DNS management mode and domain configuration revision. host_checks lists each future host with its Cloudflare zone and structured blockers and warnings (code, host, message), for example apex_zone_required (an apex such as example.com needs an active Cloudflare zone in the hosting account), zone_not_active (the zone is pending until its nameservers change) or redirect_zone_required. Resolve blockers before preparing. preparation and redirect_preparations hold DNS records, the zone redirect rule and certificate state after preparation. Saving intent does not switch traffic.',
         inputSchema: {},
         handler: withErrorBoundary(async (_args, { client, siteId }) => ok(await client.get(siteId, 'publishing/domains'))),
     },
     {
         name: 'set_publishing_domains',
-        description: 'Save future website and media hosts before preparing a deployment. Requires the current revision from read_publishing_domains. This does not publish content or change traffic DNS. Choose external DNS when your agent manages Cloudflare independently.',
+        description: 'Save future website, redirect and media hosts before preparing a deployment. Requires the current revision from read_publishing_domains. This does not publish content or change traffic DNS. Choose external DNS when your agent manages Cloudflare independently. redirect_hosts (for example www.example.com when example.com is the website host) answer 301 to the website host, keeping path and query, through a Single Redirect rule in the host\'s Cloudflare zone; they are switched and verified with the website. The response includes host_checks: resolve its blockers before preparing.',
         inputSchema: {
             revision: z.string(), website_host: z.string().nullable(), media_host: z.string().nullable(),
             media_path_prefix: z.string().optional().describe('Empty on a separate media host; /media when using the website host.'),
+            redirect_hosts: z.array(z.string()).max(4).optional().describe('Hostnames that redirect permanently to website_host, such as www.example.com. Omit or send [] for none.'),
             dns_mode: z.enum(['automatic', 'external']),
         },
         handler: withErrorBoundary(async (args, { client, siteId }) => ok(await client.put(siteId, 'publishing/domains', args))),

package/dist/tools/migration.js

@@ -233,7 +233,7 @@ export const migrationTools = [
     },
     {
         name: 'get_migration_launch_report',
-        description: 'Return the launch decision report with separate inventory, exclusion-reason, internal-link, deployed URL parity, deploy freshness, reviewed SEO/content parity and migration fidelity requirements. launch_ready is false when any evidence is absent, incomplete, failed, targets an old origin, or predates the latest hosted deploy. Use this final gate instead of treating zero unhandled URLs as launch readiness.',
+        description: 'Return the launch decision report with separate inventory, exclusion-reason, internal-link, deployed URL parity, deploy freshness, reviewed SEO/content parity, migration fidelity and script requirements. scripts lists copied source-platform scripts (WordPress plugins, theme, jQuery, page builders, cookie plugins), tracking code outside the consent gate, and analytics/advertising integrations without the cookie banner; each blocks launch. launch_ready is false when any evidence is absent, incomplete, failed, targets an old origin, or predates the latest hosted deploy. Use this final gate instead of treating zero unhandled URLs as launch readiness.',
         handler: withErrorBoundary(async (_args, { client, siteId }) => {
             const res = await client.get(siteId, 'migration-report');
             return ok(res);

package/dist/tools/settings.js

@@ -64,8 +64,8 @@ export const settingsTools = [
             sitewide_nofollow: z.boolean().optional().describe('Ask search engines not to follow links. Defaults to false.'),
             image_sizes_default: z.string().optional().describe('Site-wide default `sizes` attribute for responsive-image <picture> output, e.g. "(max-width: 640px) 360px, 560px". Tells the browser how wide images actually render so it stops over-fetching the larger srcset variant. A page can override via its own image_sizes_default; a per-<img> `sizes` attribute wins over both. Leave unset for the generic "(max-width: 768px) 100vw, 800px".'),
             // Scriptable surfaces. Trusted because the caller has an API key.
-            scripts_head: z.string().optional().describe('Raw HTML injected into <head> on every page. Use for analytics, fonts, third-party CSS links.'),
-            scripts_body_end: z.string().optional().describe('Raw HTML injected just before </body> on every page. Use for chat widgets, deferred analytics.'),
+            scripts_head: z.string().optional().describe('Raw HTML injected into <head> on every page, before consent. Use for fonts and third-party CSS links. Not for analytics or advertising tags: set those by ID in the Integrations app with cookie_consent enabled (or, for a tag the catalog lacks, cookie_consent.scripts_optional). In a migration, never copy the source site\'s plugin, theme or WordPress scripts here.'),
+            scripts_body_end: z.string().optional().describe('Raw HTML injected just before </body> on every page, before consent. Use for small site-owned scripts. Not for analytics or advertising tags (Integrations app with cookie_consent enabled) or for scripts copied from the source site in a migration.'),
             custom_css: z.string().optional().describe('Global CSS in a <style> in <head>, after block CSS and before the page\'s own custom CSS and the template base stylesheet (reset + global). Base rules for :root tokens (spacing, radius, container widths), body font and line-height load after it, so override those with a more specific selector (for example html:root or body.page) rather than a bare :root/body rule. Preview uses the same order. Lets you define site-wide design tokens (CSS variables, @media queries, :hover states) without inlining on every element. Prefer named styles (create_style) for anything a style can express. Syntax errors (unbalanced braces, unclosed comments or strings, expression()/javascript:) refuse the write; selectors on platform markup ([data-block], .block-*) come back as warnings because they can change between render versions — target s-<style> classes or block custom_class instead.'),
             default_og_image: z.string().optional().describe('Site-wide fallback og:image URL for pages without their own social image. Empty string clears.'),
             twitter_handle: z.string().optional().describe('Twitter/X handle for twitter:site, with or without the leading @ (stored without it). Empty string clears.'),

package/dist/tools/sites.js

@@ -53,7 +53,7 @@ export const siteTools = [
     },
     {
         name: 'get_site_insights',
-        description: 'Read Analytics insights over the last 7, 30, or 90 days: traffic, AI-assistant referrals, and first-party conversion events grouped by event, destination, source, and campaign. Traffic is powered by Cloudflare Web Analytics; conversions come from validated attribution-funnel click events. The response carries a traffic `status`: "ok" with numbers, or "app_disabled" / "not_configured" / "no_site_tag" / "no_data". Conversion data can still be present when the traffic provider is unavailable.',
+        description: 'Read Analytics insights over the last 7, 30, or 90 days: traffic, AI-assistant referrals, and first-party conversion events grouped by event, destination, source, and campaign. Traffic is powered by Cloudflare Web Analytics; conversions come from validated attribution-funnel click events. The response carries a traffic `status`: "ok" with numbers, "no_data" for a linked site without traffic, or "app_disabled" / "not_configured" / "no_site_tag" / "connection_required" / "access_required" / "account_mismatch" / "provider_error" with a `reason` ({code, message, next_step, settings_url}). Traffic is read from the same Cloudflare account the beacon belongs to (`account`): the site\'s Hosting Group account for customer publishing, the installation\'s account otherwise. Conversion data can still be present when the traffic provider is unavailable.',
         inputSchema: {
             days: z.union([z.literal(7), z.literal(30), z.literal(90)]).optional().describe('Look-back window in days (default 30).'),
         },

package/dist/tools/workflows.js

@@ -51,7 +51,7 @@ export const workflowTools = [
     {
         name: 'create_site_and_plan',
         noSite: true,
-        description: 'Create a new Site in the Organization and start AI site planning from a business description, like "Plan a new site with AI" on the New site page. Requires an organization API key. The plan pauses for review: read it with get_workflow and approve_workflow only after the user agrees.',
+        description: 'Create a new Site in the Organization and start AI site planning from a business description, like "Plan a new site with AI" on the New site page. Requires an organization API key. Needs the Organization\'s own AI key with site access "all" (read_organization_ai_settings); otherwise it answers 403 ai_not_enabled and creates nothing — then create a blank Site and do the planning yourself, or ask an owner or admin to enable it. The plan pauses for review: read it with get_workflow and approve_workflow only after the user agrees.',
         inputSchema: {
             name: z.string().min(1),
             business_description: z.string().min(1).describe('What the business does, for whom, and what sets it apart.'),

package/dist/version.js

@@ -8,4 +8,4 @@
 //
 // Keep it in lockstep with package.json: tests/version.test.ts asserts
 // VERSION === package.json.version, so a bump that forgets this line fails CI.
-export const VERSION = '0.45.63';
+export const VERSION = '0.45.65';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@typeroll/mcp-server",
-  "version": "0.45.63",
+  "version": "0.45.65",
   "description": "Typeroll CMS MCP server – connect AI agents to the REST API to manage content and publish static websites.",
   "license": "MIT",
   "repository": {
@@ -47,7 +47,7 @@
   },
   "devDependencies": {
     "typescript": "^5.6.0",
-    "vitest": "^4.1.7"
+    "vitest": "^4.1.12"
   },
   "publishConfig": {
     "access": "public"

package/skills/tr-import-url.md

@@ -5,6 +5,10 @@ description: Use when the user wants to import or migrate content from a non-Wor
 
 # Import content from a non-WordPress site
 
+**Who runs this:** this recipe is for the user's own AI agent (Claude Code, Codex or
+another MCP client) working through MCP and the public API. The portal's built-in
+AI assistant has no migration tools: it does not import, convert or verify sites.
+
 **Before bulk conversion:** read `tr-migration-evidence` with `read_skill`.
 Complete its source baseline and one verified prototype per active template.
 Read target content to protect edits, not to justify accidental target defaults.
@@ -194,8 +198,11 @@ get_deploy_status job_id=<id>
   several. Fix it.
 - **Squarespace/Wix forms.** They won't work after import — the backend
   is vendor-locked. Create a Typeroll form instead: `create_form`.
-- **Analytics/tracking code.** If the source has GA4 or similar, don't
-  copy it into pages. Set it via `update_site_settings scripts_head="..."`.
+- **Scripts and tracking.** Never copy the source's JavaScript. Carry
+  analytics and advertising tags (GA4, GTM, Meta Pixel and others) over by
+  ID in the Integrations app, with the cookie banner enabled so they wait for
+  consent; never paste the vendor snippet into `scripts_head`. See
+  tr-migration-evidence, "Scripts, tracking and consent".
 - **Videos.** YouTube/Vimeo embeds are fine (`<iframe>` is allowed).
   Hosted MP4s need re-uploading if the source URL won't persist.
 

package/skills/tr-migrate-astro.md

@@ -5,6 +5,10 @@ description: Migrate an existing Astro site, including Astro Content Collections
 
 # Migrate an Astro site
 
+**Who runs this:** this recipe is for the user's own AI agent (Claude Code, Codex or
+another MCP client) working through MCP and the public API. The portal's built-in
+AI assistant has no migration tools: it does not import, convert or verify sites.
+
 **Before bulk conversion:** read `tr-migration-evidence` with `read_skill`.
 Complete its source baseline and one verified prototype per active template.
 Read target content to protect edits, not to justify accidental target defaults.
@@ -50,6 +54,9 @@ assume that a filename alone determines the production URL.
 - Browser scripts, integrations and server-rendered endpoints need separate
   review. A static Page cannot inherit a private server runtime by copying its
   source text. Configure the supported Forms/Extension runtime explicitly.
+  Do not copy client scripts; analytics and advertising tags move to the
+  Integrations app behind the cookie banner (tr-migration-evidence, "Scripts,
+  tracking and consent").
 
 Create templates with `create_page_template`, types with `create_content_type`,
 then one `create_page` per source record. Use returned Page IDs, not source IDs

package/skills/tr-migrate-multisite.md

@@ -5,6 +5,10 @@ description: Use when migrating SEVERAL sites at once — a WordPress multisite
 
 # Migrate a multisite / multi-domain family to Typeroll
 
+**Who runs this:** this recipe is for the user's own AI agent (Claude Code, Codex or
+another MCP client) working through MCP and the public API. The portal's built-in
+AI assistant has no migration tools: it does not import, convert or verify sites.
+
 **Before bulk conversion:** read `tr-migration-evidence` with `read_skill`.
 Complete its source baseline and one verified prototype per active template.
 Read target content to protect edits, not to justify accidental target defaults.
@@ -163,6 +167,11 @@ language and attribution. Use authorized synthetic tests with a safe recipient;
 record delivery UNVERIFIED when it cannot be tested safely. Never create real
 leads or send mail to third parties as a routine migration test.
 
+Scripts follow tr-migration-evidence, "Scripts, tracking and consent": copy no
+source JavaScript, and carry each market's own analytics and advertising IDs
+over in that site's Integrations app with its cookie banner enabled. Never
+reuse one market's tracking IDs on another.
+
 ## Phase 5 — Redirects for everything you didn't preserve
 
 Work the coverage report, not your memory:
@@ -271,6 +280,7 @@ new canonical build and is not an inventory-only operation):
 - [ ] Complete `verify_migration_urls` → 0 `missing`, 0 `broken_redirect`, 0 `error`, 0 untested variants
 - [ ] `record_migration_seo_acceptance` is accepted for the latest deploy
 - [ ] `get_migration_launch_report` → `launch_ready: true`
+- [ ] No source JavaScript copied; analytics/advertising via the Integrations app with the cookie banner on (`scripts.status: "clean"` in the launch report)
 - [ ] hreflang cluster written on both/all sides, absolute, final domains
 - [ ] `language` set on the site; `<html lang>` correct in the deployed HTML
 - [ ] Internal links rewritten (no lingering absolute links to the old domain)

package/skills/tr-migrate-wp.md

@@ -5,6 +5,10 @@ description: Use when the user asks to migrate a WordPress site to Typeroll, men
 
 # Migrate from WordPress to Typeroll
 
+**Who runs this:** this recipe is for the user's own AI agent (Claude Code, Codex or
+another MCP client) working through MCP and the public API. The portal's built-in
+AI assistant has no migration tools: it does not import, convert or verify sites.
+
 **Before bulk conversion:** read `tr-migration-evidence` with `read_skill`.
 Complete its source baseline and one verified prototype per active template.
 Read target content to protect edits, not to justify accidental target defaults.
@@ -146,6 +150,9 @@ a. Fetch from WP. Prefer the helper plugin's authenticated endpoint
 b. Clean the HTML. Strip Elementor / Gutenberg / Breakdance class
    soup. Drop empty `<div>` and `<span>` wrappers. Keep semantic tags,
    tables, iframes from known hosts (YouTube / Vimeo / Calendly).
+   Remove every `<script>`: plugin and theme JavaScript is never copied.
+   Analytics and advertising tags move to the Integrations app behind the
+   cookie banner (tr-migration-evidence, "Scripts, tracking and consent").
 
 c. Migrate referenced images with `upload_media_from_url`. The customer's
    transfer Worker copies and verifies them directly in R2. Use the returned
@@ -291,6 +298,11 @@ get_deploy_status job_id=<id>    # poll
 - **Image bandwidth.** R2 upload is metered. Use `find_pages_matching`
   contains="<old-domain>" on already-imported content to spot images
   that weren't transferred.
+- **Plugin JavaScript.** Never copy scripts from plugins, the theme or
+  WordPress core into settings, pages, partials or block types, and never
+  copy the cookie plugin. Carry analytics and advertising over by ID in the
+  Integrations app with `cookie_consent.enabled: true`. The launch report
+  fails on copied source scripts and on tracking outside consent.
 - **WP-specific JSON-LD** (Yoast, Rank Math) is usually wrong after a
   redesign because it references old URLs. Strip it; let Typeroll
   emit fresh Article/Page schemas via `kind: 'article'` + `author`.

package/skills/tr-migration-evidence.md

@@ -5,6 +5,10 @@ description: Source-first design baseline, native capability mapping and evidenc
 
 # Migration evidence contract
 
+**Who runs this:** this recipe is for the user's own AI agent (Claude Code, Codex or
+another MCP client) working through MCP and the public API. The portal's built-in
+AI assistant has no migration tools: it does not import, convert or verify sites.
+
 Use this shared contract with WordPress, Astro, URL and multisite recipes.
 Default to preserving the source appearance and behavior. A redesign requires
 explicit scope. A partly migrated target is not the design reference.
@@ -115,6 +119,33 @@ interaction and conversion separately; only use an authorized synthetic mode and
 safe recipient. Unavailable delivery remains UNVERIFIED. No real leads or mail
 to third parties merely to fill a checklist.
 
+## Scripts, tracking and consent
+
+Do not copy JavaScript from the source site. WordPress plugins and themes
+inject their own runtime: jQuery, sliders, lightboxes, form and cookie
+plugins, page builders (Elementor, Breakdance, Divi), emoji and AJAX calls to
+`admin-ajax.php` or `/wp-json/`. It loads from, or posts to, a site that is
+about to be switched off. Inventory every `<script>` on representative source
+pages (head and body, inline and external, and which plugin or theme it
+belongs to), then decide each one:
+
+| Source script | Decision |
+| --- | --- |
+| WordPress core, theme or plugin runtime | Never copy. Rebuild what it did with native blocks, Forms or settings, or report a platform gap (see "Report platform gaps"). |
+| Cookie plugin (CookieYes, Complianz, Cookiebot, Borlabs, …) | Never copy. Enable the site's cookie banner (`cookie_consent.enabled: true`) with Swedish or local text and the privacy policy URL. |
+| Analytics or advertising tag in the Integrations catalog (GA4, GTM, Meta Pixel, LinkedIn, TikTok, Hotjar, Clarity, Pinterest, Snap, Reddit, X, Microsoft Ads, HubSpot, Plausible, Fathom, Matomo) | Carry over the ID only: enable the Integrations app with the source's ID (`list_apps`, `update_app`). Enable the cookie banner; analytics and advertising integrations wait for the visitor's consent. Never paste the vendor snippet. |
+| Tracking tag the catalog does not cover | Only with the owner's approval, in `cookie_consent.scripts_optional` with the banner enabled. Never in `scripts_head`, `scripts_body_end`, `scripts_necessary`, pages or partials. |
+| Partner widget or embed the page needs to work | Prefer a native block or an iframe from an allowlisted host. Keep custom code minimal, record why, and do not load it from the source site. |
+
+Ask the owner to confirm the analytics IDs; never invent or reuse one from
+another market. Before launch, `get_migration_launch_report` must show
+`scripts.status: "clean"`: it fails on copied source-platform scripts
+(`source_runtime_script`), tracking outside consent
+(`tracking_outside_consent`) and analytics or advertising integrations without
+the banner (`tracking_without_consent_banner`). In the hosted preview, check
+that no request goes to the source host or `/wp-content/`, no tracking request
+fires before consent, and the tags fire after "accept all".
+
 ## Evidence record (repeat per recipe, viewport and state)
 
 - Source URL/date and target URL; Page/template IDs; exact publication ID.