@typeroll/mcp-server 0.45.69 → 0.45.73

package/dist/compact-tools.js

@@ -1,5 +1,4 @@
 import { z } from 'zod';
-import { zodToJsonSchema } from 'zod-to-json-schema';
 import { fail, ok } from './tools/helpers.js';
 export const COMPACT_INSTRUCTIONS = `Typeroll CMS. Use search_tools to find a task's tools, describe_tool to read one exact schema, then call_read_tool, call_write_tool or call_admin_tool. Discover before you write: identify Site/Version, capabilities and enabled app documentation. Read only the relevant skill or guide section; do not load the full manual by default. Larger changes: create_branch and keep the same version. Working copy, saved content and live output differ. Publishing and other external effects require the user's authorization; tool access alone is not approval.`;
 /** Stable discovery surface: no dynamic registration or client list-change support needed. */
@@ -18,12 +17,12 @@ export function compactTools(catalog) {
         }),
         local('describe_tool', 'Read one tool’s complete description, effect and JSON input schema before calling it.', { name: z.string().max(100) }, async (args) => {
             const tool = byName.get(String(args.name));
-            return tool ? ok({ name: tool.name, effect: tool.effect, description: tool.description, inputSchema: zodToJsonSchema(z.object(tool.schema), { $refStrategy: 'none' }) }) : fail(new Error('Unknown tool. Use search_tools.'));
+            return tool ? ok({ name: tool.name, effect: tool.effect, description: tool.description, inputSchema: z.toJSONSchema(z.object(tool.schema).meta({ additionalProperties: false }), { target: 'draft-7', io: 'input' }) }) : fail(new Error('Unknown tool. Use search_tools.'));
         }),
         ...['read', 'write', 'admin'].map(effect => ({
             name: `call_${effect}_tool`, effect,
             description: effect === 'read' ? 'Call a discovered read-only tool with its exact arguments. Does not accept write/admin tools.' : `Call a discovered ${effect} tool. May ${effect === 'admin' ? 'change app or email configuration, send a test email or activate releases' : 'save, delete, publish or otherwise change state'}. Inspect describe_tool first and follow the user’s authorization.`,
-            schema: { name: z.string().max(100), arguments: z.record(z.unknown()).default({}) },
+            schema: { name: z.string().max(100), arguments: z.record(z.string(), z.unknown()).default({}) },
             invoke: async (args) => {
                 const tool = byName.get(String(args.name));
                 if (!tool || tool.effect !== effect)

package/dist/server.js

@@ -324,7 +324,7 @@ export function buildServer(options) {
     }
     for (const tool of options.toolMode === 'compact' ? compactTools(catalog) : catalog) {
         register(tool.name, {
-            description: tool.description, inputSchema: tool.schema,
+            description: tool.description, inputSchema: z.object(tool.schema).meta({ additionalProperties: false }),
             annotations: { readOnlyHint: tool.effect === 'read', destructiveHint: tool.effect !== 'read', openWorldHint: true },
         }, tool.invoke);
     }

package/dist/structured-data.js

@@ -12,7 +12,6 @@
 // of the same @type is replaced (re-running a tool updates it), other nodes are
 // kept in an @graph, so an FAQ added later does not erase a LocalBusiness.
 import { z } from 'zod';
-import { zodToJsonSchema } from 'zod-to-json-schema';
 /** Invalid input or an unusable existing json_ld; `issues` name the field. */
 export class StructuredDataError extends Error {
     issues;
@@ -170,7 +169,7 @@ export const STRUCTURED_DATA = {
  * outside MCP (the portal chat passes it to the model as input_schema).
  */
 export function structuredDataInputSchema(kind) {
-    const schema = zodToJsonSchema(z.object({ page_id: z.string().min(1), ...STRUCTURED_DATA[kind].shape }), { $refStrategy: 'none' });
+    const schema = z.toJSONSchema(z.object({ page_id: z.string().min(1), ...STRUCTURED_DATA[kind].shape }).meta({ additionalProperties: false }), { target: 'draft-7', io: 'input' });
     const { $schema: _schema, ...rest } = schema;
     return rest;
 }

package/dist/tools/apps.js

@@ -32,7 +32,7 @@ export const appTools = [
         inputSchema: {
             app_id: z.string().min(1).describe('Registry id returned by list_apps.'),
             enabled: z.boolean(),
-            config: z.record(z.unknown()).optional().describe('Schema-driven app config. Omitted fields preserve their existing values.'),
+            config: z.record(z.string(), z.unknown()).optional().describe('Schema-driven app config. Omitted fields preserve their existing values.'),
         },
         handler: withErrorBoundary(async (args, { client, siteId }) => {
             return ok(await client.put(siteId, `apps/${encodeURIComponent(args.app_id)}`, {

package/dist/tools/block-types.js

@@ -55,7 +55,7 @@ const definitionShape = {
     item_compatible: z.boolean().optional().describe('Mark true if this block is designed to render as a repeater item (no outer padding).'),
     expand_to: z.object({
         target: z.string(),
-        defaults: z.record(z.unknown()),
+        defaults: z.record(z.string(), z.unknown()),
     }).optional().describe('Alias mechanism — render as another block type with these defaults merged under authored data.'),
     schema: z.array(z.unknown()).optional().describe('FieldDefinition[]: { name, type, label, help?, required?, default?, options? (select), fields? (array/object), item_label?, min_items?, max_items? }. Replaces the whole schema on update.'),
     composition: z.array(z.unknown()).optional().describe('Block[] a composed type is built from. Bind data to props with "{{props.name}}" and, inside a core/repeater over an array prop, to items with "{{item.name}}" — always as the whole value.'),
@@ -176,7 +176,7 @@ export const blockTypeTools = [
         name: 'validate_block_type',
         description: `Check a block type definition without saving it, with the exact validator create_block_type and update_block_type use. Pass the whole definition, or with type_id a patch to that stored type (renames are checked too). Returns { ok, problems, merged }: every error and warning with a JSON-pointer path (e.g. /schema/0/fields/2/name, /composition/0/children/1/data/text) and a line for markup and CSS, and the definition as it would be stored. Writes nothing. ${AUTHORING_GUIDE}`,
         inputSchema: {
-            definition: z.record(z.unknown()).describe('The block type definition (as for create_block_type), or a patch when type_id is set.'),
+            definition: z.record(z.string(), z.unknown()).describe('The block type definition (as for create_block_type), or a patch when type_id is set.'),
             type_id: z.string().optional().describe('Validate `definition` as a patch to this stored block type.'),
             version: versionParam,
         },
@@ -194,9 +194,9 @@ export const blockTypeTools = [
         name: 'preview_block_type',
         description: 'Render a block type definition that need not be saved, through the same preview renderer as the portal (the Site\'s render version, theme CSS, named styles, custom CSS, the other site block types, and the sanitizer). Without `data` the block shows sample values derived from its fields. Returns { ok, html, css, document, data, problems }: `html` is the block\'s markup as a page carries it, `css` the scoped block CSS that ships, `document` a standalone HTML page. A definition with errors is not rendered (ok:false, problems listed). Block scripts never run in a preview. Writes nothing.',
         inputSchema: {
-            definition: z.record(z.unknown()).optional().describe('The block type definition, or a patch when type_id is set. Omit with type_id to preview the stored type.'),
+            definition: z.record(z.string(), z.unknown()).optional().describe('The block type definition, or a patch when type_id is set. Omit with type_id to preview the stored type.'),
             type_id: z.string().optional().describe('Preview `definition` as a patch to this stored block type.'),
-            data: z.record(z.unknown()).optional().describe('Field values for the previewed block. Omit for sample data.'),
+            data: z.record(z.string(), z.unknown()).optional().describe('Field values for the previewed block. Omit for sample data.'),
             render_version: z.number().int().optional().describe('Render with this platform render version instead of the Site\'s own.'),
             version: versionParam,
         },
@@ -237,7 +237,7 @@ export const blockTypeTools = [
         inputSchema: {
             type_id: z.string().describe('Block type id (a site type). Cannot be a core/* block.'),
             ...definitionShape,
-            renames: z.record(z.string()).optional().describe('Old field path → new field name, e.g. { "title": "heading", "items.label": "text" }. Send together with the new schema.'),
+            renames: z.record(z.string(), z.string()).optional().describe('Old field path → new field name, e.g. { "title": "heading", "items.label": "text" }. Send together with the new schema.'),
             confirm_data_loss: z.boolean().optional().describe('Drop the data of removed or retyped fields that hold data. Only after the user agreed; the 409 lists what would be lost.'),
             version: versionParam,
         },

package/dist/tools/content-types.js

@@ -3,18 +3,18 @@ import { ok, withErrorBoundary, versionParam, writeAuthority } from './helpers.j
 const schema = z.array(z.object({ name: z.string(), label: z.string(), type: z.enum(['text', 'textarea', 'richtext', 'image', 'file', 'color', 'select', 'multiselect', 'boolean', 'number', 'url', 'email', 'date', 'datetime', 'list', 'list_simple', 'array', 'object', 'page_ref', 'page_ref_list']) }).passthrough());
 const fields = {
     label_singular: z.string().optional(), label_plural: z.string().optional(), fields: schema.optional(),
-    page_field_rules: z.record(z.object({ label: z.string().optional(), writable_by: z.array(z.enum(['portal', 'owner', 'agent', 'app', 'import'])) })).optional(),
+    page_field_rules: z.record(z.string(), z.object({ label: z.string().optional(), writable_by: z.array(z.enum(['portal', 'owner', 'agent', 'app', 'import'])) })).optional(),
     allowed_templates: z.array(z.string()).nullable().optional().describe('Allowed Page template IDs, including the default. Null allows all compatible templates; an empty list permits no template.'),
     route_template: z.string().optional(), template: z.string().optional(), schema_type: z.string().optional(),
     schema_field_mode: z.enum(['all', 'mapped']).optional().describe('Use mapped to emit only explicitly mapped fields. Resolve typed references in Page json_ld for complex graphs.'),
-    schema_field_map: z.record(z.string()).optional(),
+    schema_field_map: z.record(z.string(), z.string()).optional(),
     icon: z.string().optional(), sort_field: z.string().optional(), sort_dir: z.enum(['asc', 'desc']).optional(),
-    facets: z.array(z.record(z.unknown())).optional(), facet_combinations: z.array(z.tuple([z.string(), z.string()])).optional().describe('Pairs of configured facet field names, not values. Use editable Pages for a curated subset of combinations.'),
+    facets: z.array(z.record(z.string(), z.unknown())).optional(), facet_combinations: z.array(z.tuple([z.string(), z.string()])).optional().describe('Pairs of configured facet field names, not values. Use editable Pages for a curated subset of combinations.'),
 };
 export const contentTypeTools = [
     { name: 'page_completeness', description: 'Report missing, unverified and stale fields for Pages of one content type, with per-field counts and worst-first Page IDs. Read-only; agent-writable fields only by default.', inputSchema: { content_type: z.string(), limit: z.number().int().min(1).max(200).optional(), stale_after_days: z.number().min(0).optional(), agent_writable_only: z.boolean().optional(), version: versionParam },
         handler: withErrorBoundary(async (args, { client, siteId }) => { const { content_type, ...query } = args; return ok(await client.get(siteId, `content-types/${encodeURIComponent(content_type)}/completeness`, query)); }) },
-    { name: 'change_page_content_type', description: 'Change a saved Page to another content type. Preserves its identity, block body, status and existing URL. Save or discard its working copy first. If supplied, fields replaces the complete custom fields object; omitted fields are kept and must be valid for the new type. Snapshots a revision before changing.', inputSchema: { page_id: z.string(), content_type: z.string(), fields: z.record(z.unknown()).optional(), ...writeAuthority, version: versionParam },
+    { name: 'change_page_content_type', description: 'Change a saved Page to another content type. Preserves its identity, block body, status and existing URL. Save or discard its working copy first. If supplied, fields replaces the complete custom fields object; omitted fields are kept and must be valid for the new type. Snapshots a revision before changing.', inputSchema: { page_id: z.string(), content_type: z.string(), fields: z.record(z.string(), z.unknown()).optional(), ...writeAuthority, version: versionParam },
         handler: withErrorBoundary(async (args, { client, siteId }) => { const { page_id, version, ...body } = args; return ok(await client.post(siteId, `pages/${encodeURIComponent(page_id)}/content-type`, body, { version })); }) },
     { name: 'list_content_types', description: 'List the field schemas, URL patterns, sorting, allowed templates and default templates for Pages. All content is a Page; use list_pages with content_type to filter.', inputSchema: { version: versionParam },
         handler: withErrorBoundary(async (args, { client, siteId }) => ok(await client.get(siteId, 'content-types', { version: args.version }))) },

package/dist/tools/email.js

@@ -17,7 +17,7 @@ export const emailTools = [
             type: z.string().min(1).describe('Provider type from get_email_settings providers, e.g. "postmark" or "smtp".'),
             from: z.string().min(1).describe('Sender, e.g. "Acme <hello@acme.com>". Must be a sender the provider accepts.'),
             reply_to: z.string().optional().describe('Optional default Reply-To address.'),
-            config: z.record(z.unknown()).optional().describe('Provider fields keyed by the field schema.'),
+            config: z.record(z.string(), z.unknown()).optional().describe('Provider fields keyed by the field schema.'),
         },
         handler: withErrorBoundary(async (args, { client, siteId }) => ok(await client.put(siteId, 'integrations/email', {
             type: args.type,

package/dist/tools/extensions.js

@@ -7,7 +7,7 @@ export const extensionTools = [
         inputSchema: {
             installation_id: z.string().min(1), page_id: z.string().min(1),
             path: z.string().describe('Relative operation below the approved native API base, from the installed app guide.'),
-            method: z.enum(['GET', 'POST']), query: z.record(z.string()).optional(), body: z.record(z.unknown()).optional(),
+            method: z.enum(['GET', 'POST']), query: z.record(z.string(), z.string()).optional(), body: z.record(z.string(), z.unknown()).optional(),
         },
         handler: withErrorBoundary(async (args, { client, siteId }) => {
             const { installation_id, ...operation } = args;
@@ -39,7 +39,7 @@ export const extensionTools = [
         inputSchema: {
             installation_id: z.string().min(1),
             version: z.string().min(1).describe('Pending published release to activate.'),
-            config: z.record(z.unknown()).optional(),
+            config: z.record(z.string(), z.unknown()).optional(),
             granted_scopes: z.array(z.string()).optional(),
         },
         handler: withErrorBoundary(async (args, { client, siteId }) => {
@@ -53,7 +53,7 @@ export const extensionTools = [
         inputSchema: {
             version: versionParam,
             installation_id: z.string().min(1).describe('Installation id returned by list_extension_installations.'),
-            config: z.record(z.unknown()).describe('Config keys and values declared by the installation manifest config schema.'),
+            config: z.record(z.string(), z.unknown()).describe('Config keys and values declared by the installation manifest config schema.'),
             deploy: z.boolean().optional().describe('Queue a deploy of the selected site version after saving. Defaults to true.'),
         },
         handler: withErrorBoundary(async (args, { client, siteId }) => {
@@ -76,7 +76,7 @@ export const extensionTools = [
             extension_id: z.string().min(1),
             version: z.string().min(1).describe('Release version to install.'),
             granted_scopes: z.array(z.string()).optional().describe('Approved scopes; defaults to none.'),
-            config: z.record(z.unknown()).optional(),
+            config: z.record(z.string(), z.unknown()).optional(),
             developer_org_id: z.string().optional().describe('Organization that publishes the Extension. Defaults to the key\'s own organization.'),
         },
         handler: withErrorBoundary(async (args, { client, siteId }) => {
@@ -168,7 +168,7 @@ export const developerExtensionTools = [
         description: 'Save (create or replace) a draft release from a full Extension manifest. Published releases are immutable; bump manifest.version instead. Validate locally with `typeroll extension validate` first. Requires an organization API key.',
         inputSchema: {
             extension_id: z.string().min(1),
-            manifest: z.record(z.unknown()).describe('Complete manifest; its id must equal extension_id.'),
+            manifest: z.record(z.string(), z.unknown()).describe('Complete manifest; its id must equal extension_id.'),
         },
         handler: withErrorBoundary(async (args, { client }) => ok(await client.developer('POST', `${ext(args.extension_id)}/versions`, { manifest: args.manifest }))),
     },

package/dist/tools/forms.js

@@ -39,7 +39,7 @@ const showProgressSchema = z.union([z.boolean(), z.enum(['text', 'bar'])]).optio
     .describe('Multi-step forms: true or "text" shows "Step X of Y", "bar" a slim progress bar (with the same text for screen readers). Off by default; false turns it off.');
 const targetSchema = z.object({
     context_params: z.array(z.string()).max(8).optional().describe('Explicit URL query keys forwarded to the app hydration endpoint; reserved security keys are rejected.'),
-    installation_id: z.string(), path: z.string(), hydrate: z.boolean().optional(), session_param: z.string().optional(),
+    installation_id: z.string(), path: z.string(), hydrate: z.boolean().optional(), session_param: z.string().optional(), session_exchange: z.literal('confirm_post').optional().describe('Wait for a click and POST the one-time token; prevents GET link scanning from consuming it.'),
 }).optional().describe('Admin-only: bind to a declared POST route of an enabled app installation. Read its authenticated guide first.');
 // Actions run after a successful submission: email notifications, signed
 // webhooks and app-provided action types. Same validation as the portal's

package/dist/tools/owner-review.js

@@ -11,7 +11,7 @@ export const ownerReviewTools = [
     {
         name: 'override_owner_answers',
         description: 'Explicit administrator correction of protected answers. Supply the current revision from read_owner_answers, changed fields, and the factual reason. Does not publish. Never use this tool to bypass an import or scraping conflict without explicit authorization.',
-        inputSchema: { page_id: z.string(), base_revision: z.string(), fields: z.record(z.unknown()), reason: z.string().min(1), version: versionParam },
+        inputSchema: { page_id: z.string(), base_revision: z.string(), fields: z.record(z.string(), z.unknown()), reason: z.string().min(1), version: versionParam },
         handler: withErrorBoundary(async ({ version, ...input }, { client, siteId }) => ok(await client.post(siteId, 'owner-review', { ...input, action: 'override' }, versionQuery(version)))),
     },
     {
@@ -35,7 +35,7 @@ export const ownerReviewTools = [
     {
         name: 'decide_owner_proposal',
         description: 'Explicit site-administrator editorial decision: approve, reject, or approve with adjustments. Requires current content/schema and a stable request_id for retries. First decision wins. Approval updates accepted CMS content, never deploys; reviewer adjustments retain separate provenance.',
-        inputSchema: { proposal_id: z.string(), action: z.enum(['approve', 'reject']), request_id: z.string().min(16).max(100), adjustments: z.record(z.unknown()).optional(), version: versionParam },
+        inputSchema: { proposal_id: z.string(), action: z.enum(['approve', 'reject']), request_id: z.string().min(16).max(100), adjustments: z.record(z.string(), z.unknown()).optional(), version: versionParam },
         handler: withErrorBoundary(async ({ version, ...input }, { client, siteId }) => ok(await client.post(siteId, 'owner-review', input, versionQuery(version)))),
     },
     {

package/dist/tools/page-blocks.js

@@ -8,7 +8,7 @@ import { ok, withErrorBoundary, versionParam } from './helpers.js';
 const blockSchema = z.object({
     id: z.string().optional().describe('Stable id. Omit to let the server generate one.'),
     type: z.string().describe('Block type id, e.g. "core/heading", "core/section", or a custom "user/banner".'),
-    data: z.record(z.unknown()).optional().describe('Field values matching the block-type schema.'),
+    data: z.record(z.string(), z.unknown()).optional().describe('Field values matching the block-type schema.'),
     children: z.array(z.any()).optional().describe('Nested blocks for container types.'),
     slots: z.array(z.array(z.any())).optional().describe('Slot contents for slot-container types.'),
     style_overrides: z.object({
@@ -107,7 +107,7 @@ export const pageBlockTools = [
             target: targetSchema.optional(),
             page_id: z.string().optional(),
             block_id: z.string(),
-            data: z.record(z.unknown()).optional().describe('Field values to merge into block.data. null removes the key.'),
+            data: z.record(z.string(), z.unknown()).optional().describe('Field values to merge into block.data. null removes the key.'),
             style_overrides: z.object({
                 spacing_before: z.string().optional(),
                 spacing_after: z.string().optional(),

package/dist/tools/pages.js

@@ -1,7 +1,7 @@
 // Pages tools. Read + write + batch + blocks-view + preview.
 import { z } from 'zod';
 import { ok, withErrorBoundary, versionParam, writeAuthority } from './helpers.js';
-const answerSources = z.record(z.object({ source_url: z.string().url().optional(), import_run_id: z.string().max(200).optional() }).strict()).optional().describe('Evidence per schema leaf path. Actor and timestamp are always assigned by the server; unchanged answers are not confirmed.');
+const answerSources = z.record(z.string(), z.object({ source_url: z.string().url().optional(), import_run_id: z.string().max(200).optional() }).strict()).optional().describe('Evidence per schema leaf path. Actor and timestamp are always assigned by the server; unchanged answers are not confirmed.');
 function authorityBody(args) {
     return args.override_reason ? { override_reason: args.override_reason } : {};
 }
@@ -91,7 +91,7 @@ export const pageTools = [
         inputSchema: {
             title: z.string().min(1),
             content_type: z.string().optional().describe('Content type ID; defaults to page.'),
-            fields: z.record(z.unknown()).optional().describe('Custom field values defined by the content type.'),
+            fields: z.record(z.string(), z.unknown()).optional().describe('Custom field values defined by the content type.'),
             slug: z.string().optional().describe('URL slug — single path segment, no slashes (e.g. "about", "kontakt"). Empty string "" = homepage. For nested URLs set the `path` field explicitly — `slug` stays a leaf id. Already in use → 409 slug_in_use naming the existing page; omit it to derive one from the title (numbered with a slug_adjusted warning on conflict).'),
             path: z.string().optional().describe('Optional explicit URL path for nested pages (e.g. "/erbjudanden/sommar-2026"). When set, takes precedence over slug for routing. Must start with "/", lowercase a-z/0-9/-/_/ only, no "..", no "//", no trailing slash. Slug is still required as the leaf id but two pages CAN share a slug under different paths.'),
             content_mode: z.enum(['blocks', 'html']).optional().describe('Default "blocks". "blocks" stores a Block[] tree (the modern default — supports the full ~40-block library, page templates, and the responsive system). "html" stores raw markup in html_content (legacy path, still fully supported for imported content or hand-written HTML). Passing html_content without content_mode also opts into "html".'),
@@ -132,7 +132,7 @@ export const pageTools = [
             patch: z
                 .object({
                 title: z.string().optional(),
-                fields: z.record(z.unknown()).optional(),
+                fields: z.record(z.string(), z.unknown()).optional(),
                 slug: z.string().optional(),
                 html_content: z.string().optional(),
                 blocks: z.array(z.any()).optional().describe('Block tree, only used when content_mode="blocks".'),
@@ -208,7 +208,7 @@ export const pageTools = [
             updates: z
                 .array(z.object({
                 page_id: z.string(),
-                patch: z.record(z.unknown()),
+                patch: z.record(z.string(), z.unknown()),
                 save: z.boolean().optional(),
                 answer_sources: answerSources,
                 ...writeAuthority,

package/dist/tools/partials.js

@@ -93,7 +93,7 @@ export const partialTools = [
         inputSchema: {
             id: z.string().regex(/^[a-z0-9][a-z0-9-]{0,63}$/),
             name: z.string().optional(),
-            blocks: z.array(z.record(z.unknown())).optional().describe('Block tree for a block global block.'),
+            blocks: z.array(z.record(z.string(), z.unknown())).optional().describe('Block tree for a block global block.'),
             html_content: z.string().optional().describe('HTML for <x-include> in HTML pages. Send blocks or html_content.'),
             status: z.enum(['draft', 'published']).optional(),
             version: versionParam,

package/dist/tools/reusable-blocks.js

@@ -55,7 +55,7 @@ export const reusableBlockTools = [
             description: z.string().optional().describe('When to use it.'),
             id: z.string().regex(/^[a-z0-9][a-z0-9-]{0,63}$/).optional(),
             from: z.object({ page_id: z.string(), block_id: z.string() }).optional(),
-            blocks: z.array(z.record(z.unknown())).optional(),
+            blocks: z.array(z.record(z.string(), z.unknown())).optional(),
         },
         handler: withErrorBoundary(async (args, { client, siteId }) => ok(await client.post(siteId, 'block-templates', args))),
     },
@@ -66,7 +66,7 @@ export const reusableBlockTools = [
             template_id: z.string(),
             name: z.string().optional(),
             description: z.string().optional(),
-            blocks: z.array(z.record(z.unknown())).optional(),
+            blocks: z.array(z.record(z.string(), z.unknown())).optional(),
         },
         handler: withErrorBoundary(async (args, { client, siteId }) => {
             const { template_id, ...body } = args;

package/dist/tools/settings.js

@@ -76,8 +76,8 @@ export const settingsTools = [
             }).strict().nullable().optional().describe('Organization schema.org JSON-LD emitted on every page. Replaces the stored value as a whole; null (or all-empty) clears it.'),
             staging_url: z.string().nullable().optional().describe('URL of a staging environment for this site, reported as urls.staging. Stored on the Site, not per version. Trailing slashes are dropped; empty string or null clears.'),
             render_version: z.number().int().min(1).optional().describe('Platform render version. Platform output changes ship as new versions so existing sites never change look on their own. Upgrade only after previewing (get_preview_link render_version) and with the user\'s approval; the tr-upgrade-rendering skill compares every page. Lowering it returns to an earlier version.'),
-            colors: z.record(z.string().nullable()).optional().describe('Palette: primary, secondary, accent, background, surface, text, text_light (shallow-merged). Optional on_primary, on_secondary, on_accent set the text colour on that theme colour (buttons, badges, tabs, call-to-action sections, styles using the on_* tokens) as a hex colour such as "#ffffff"; null returns to the automatic black or white (chosen by APCA from render version 8, by the WCAG 2 ratio before). A chosen on_* colour applies on every render version. The response lists `on_colors` with each one\'s APCA Lc and WCAG 2 ratio; a choice below APCA Lc 60 (button text, 16px/600) is kept and returned as a warning. Prefer the automatic choice unless the brand specifies a colour.'),
-            fonts: z.record(z.unknown()).optional().describe('heading, body (Google Fonts family or "system"), size_base (px) and smoothing: "auto" (browser default) or "antialiased" (thinner text on macOS, for light text on dark backgrounds); null clears smoothing. Unset smoothing is auto from render version 6.'),
+            colors: z.record(z.string(), z.string().nullable()).optional().describe('Palette: primary, secondary, accent, background, surface, text, text_light (shallow-merged). Optional on_primary, on_secondary, on_accent set the text colour on that theme colour (buttons, badges, tabs, call-to-action sections, styles using the on_* tokens) as a hex colour such as "#ffffff"; null returns to the automatic black or white (chosen by APCA from render version 8, by the WCAG 2 ratio before). A chosen on_* colour applies on every render version. The response lists `on_colors` with each one\'s APCA Lc and WCAG 2 ratio; a choice below APCA Lc 60 (button text, 16px/600) is kept and returned as a warning. Prefer the automatic choice unless the brand specifies a colour.'),
+            fonts: z.record(z.string(), z.unknown()).optional().describe('heading, body (Google Fonts family or "system"), size_base (px) and smoothing: "auto" (browser default) or "antialiased" (thinner text on macOS, for light text on dark backgrounds); null clears smoothing. Unset smoothing is auto from render version 6.'),
             contact: z
                 .object({
                 email: z.string().optional(),
@@ -99,7 +99,7 @@ export const settingsTools = [
             })
                 .passthrough()
                 .optional(),
-            social: z.record(z.string()).optional(),
+            social: z.record(z.string(), z.string()).optional(),
             cookie_consent: z.object({
                 enabled: z.boolean().optional(),
                 text: z.string().optional().describe('Localized consent copy. May include a privacy-policy link.'),

package/dist/tools/styles.js

@@ -90,9 +90,9 @@ export const styleTools = [
             role: styleFields.role,
             targets: styleFields.targets,
             description: styleFields.description,
-            base: z.record(z.unknown()).optional().describe('Property patch for base; null removes a property.'),
-            at: z.record(z.unknown()).optional().describe('Per-breakpoint property patches; null removes a breakpoint or property.'),
-            hover: z.record(z.unknown()).optional(),
+            base: z.record(z.string(), z.unknown()).optional().describe('Property patch for base; null removes a property.'),
+            at: z.record(z.string(), z.unknown()).optional().describe('Per-breakpoint property patches; null removes a breakpoint or property.'),
+            hover: z.record(z.string(), z.unknown()).optional(),
             css: z.string().optional(),
             parts: styleFields.parts,
             version: versionParam,

package/dist/tools/workflows.js

@@ -24,7 +24,7 @@ export const workflowTools = [
         description: 'Start a server-side workflow on this Site; it runs in the background and returns workflow_id. Poll get_workflow. Config per type (same fields as the portal form): migration { wp_url, helper_api_key? } (needs verified organization import storage); site_planning { business_description }; content_generation { topic, tone?, audience? }; content_improvement { limit? }; url_parity { target_origin?, source_origin?, check_source?, statuses? }; rebuild_deploy { environment: staging | production }; seo_audit, link_check, performance_audit and schema_markup take none. Needs write permission; rebuild_deploy publishes and needs admin. Workflows that change content write to the given version (default main) — get the user\'s agreement first. ' + AI_WORKFLOWS,
         inputSchema: {
             type: z.enum(WORKFLOW_TYPES),
-            config: z.record(z.unknown()).optional(),
+            config: z.record(z.string(), z.unknown()).optional(),
             version: versionParam,
         },
         handler: withErrorBoundary(async (args, { client, siteId }) => ok(await client.post(siteId, 'workflows', { type: args.type, config: args.config }, args.version ? { version: args.version } : undefined))),

package/dist/version.js

@@ -8,4 +8,4 @@
 //
 // Keep it in lockstep with package.json: tests/version.test.ts asserts
 // VERSION === package.json.version, so a bump that forgets this line fails CI.
-export const VERSION = '0.45.69';
+export const VERSION = '0.45.73';

package/dist/workspace.js

@@ -15,7 +15,7 @@ export const workspaceSchema = z.object({
     version: z.string().min(1), tool_mode: z.enum(['compact', 'full']),
 }).strict();
 export const defaultWorkspace = { schema_version: 1, portal: 'https://app.typeroll.com', organization_id: null, site_id: null, version: 'main', tool_mode: 'compact' };
-const lockSchema = z.object({ schema_version: z.literal(1), generator_version: z.string(), files: z.record(z.string().regex(/^[a-f0-9]{64}$/)) }).strict();
+const lockSchema = z.object({ schema_version: z.literal(1), generator_version: z.string(), files: z.record(z.string(), z.string().regex(/^[a-f0-9]{64}$/)) }).strict();
 const hash = (value) => createHash('sha256').update(value).digest('hex');
 export const ignores = ['.typeroll/', '.env', '.env.*', '!.env.example', '.mcp.json', '.cursor/mcp.json', '.vscode/mcp.json', 'qa/reports/', 'sources/private/'];
 export const agentInstructions = `# Working on this website

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@typeroll/mcp-server",
-  "version": "0.45.69",
+  "version": "0.45.73",
   "description": "Typeroll CMS MCP server – connect AI agents to the REST API to manage content and publish static websites.",
   "license": "MIT",
   "repository": {
@@ -44,8 +44,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.31.0",
-    "zod": "^3.23.0",
-    "zod-to-json-schema": "3.25.2"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "typescript": "^5.6.0",