drivethrough-cli 0.1.27 → 0.1.29

package/dist/main.mjs

@@ -21658,6 +21658,80 @@ var init_names = __esm({
   }
 });
 
+// ../schema/src/integrations.ts
+var SECRET_NAME, ROUTE_METHODS, ROUTE_CACHE_SECONDS, SCHEDULE_EVERY, MAX_SECRETS, WEBHOOK_VERIFY, Headers2, RouteConfig, ActionConfig, PullConfig, ScheduleConfig, WebhookConfig, SecretsList, RoutesConfig, ActionsConfig, SchedulesConfig, WebhooksConfig, HOUR, FIXED;
+var init_integrations = __esm({
+  "../schema/src/integrations.ts"() {
+    "use strict";
+    init_zod();
+    SECRET_NAME = /^[A-Z][A-Z0-9_]{0,63}$/;
+    ROUTE_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+    ROUTE_CACHE_SECONDS = { "0": 0, "30s": 30, "1m": 60, "5m": 300, "15m": 900, "1h": 3600 };
+    SCHEDULE_EVERY = ["1h", "3h", "6h", "12h", "1d", "1w", "1mo"];
+    MAX_SECRETS = 20;
+    WEBHOOK_VERIFY = ["stripe", "github", "standard", "hmac_sha256", "url_token"];
+    Headers2 = external_exports.record(external_exports.string(), external_exports.string().max(4096));
+    RouteConfig = external_exports.object({
+      /** Literal https URL: host plus an optional base path. */
+      upstream: external_exports.string().min(1).max(2048),
+      methods: external_exports.array(external_exports.enum(ROUTE_METHODS)).min(1, "methods must list at least one of GET, POST, PUT, PATCH, DELETE"),
+      paths: external_exports.array(external_exports.string().min(1).max(512)).min(1, 'paths must list at least one path prefix, like "/v2/account"').max(50),
+      headers: Headers2.optional(),
+      access: external_exports.enum(["owner", "viewers", "public"]).optional(),
+      cache: external_exports.enum(Object.keys(ROUTE_CACHE_SECONDS), {
+        error: 'cache must be one of "0", "30s", "1m", "5m", "15m", "1h"'
+      }).optional(),
+      query: external_exports.boolean().optional()
+    }).strict();
+    ActionConfig = external_exports.object({
+      /** https URL the action POSTs to. `{{field}}` allowed in the path only. */
+      post: external_exports.string().min(1).max(2048),
+      headers: Headers2.optional(),
+      /** A JSON object template: `${NAME}` and `{{field}}` substitute inside string values. */
+      body: external_exports.record(external_exports.string(), external_exports.unknown())
+    }).strict();
+    PullConfig = external_exports.object({
+      route: external_exports.string().min(1),
+      path: external_exports.string().max(512).optional(),
+      into: external_exports.string().min(1),
+      map: external_exports.record(external_exports.string(), external_exports.string())
+    }).strict();
+    ScheduleConfig = external_exports.object({
+      every: external_exports.enum(SCHEDULE_EVERY, {
+        error: 'every must be one of "1h", "3h", "6h", "12h", "1d", "1w", "1mo". There is no time-of-day setting and no timezone: a schedule starts from the deploy that first declares it.'
+      }),
+      action: external_exports.string().optional(),
+      rotate: external_exports.string().optional(),
+      pull: PullConfig.optional()
+    }).strict();
+    WebhookConfig = external_exports.object({
+      verify: external_exports.enum(WEBHOOK_VERIFY, {
+        error: 'verify must be one of "stripe", "github", "standard", "hmac_sha256", "url_token". There is no unverified webhook.'
+      }),
+      /** The declared secret holding the signing secret (or the URL token). */
+      secret: external_exports.string().min(1),
+      /** hmac_sha256 only: the header carrying the signature. */
+      header: external_exports.string().optional(),
+      into: external_exports.string().min(1),
+      map: external_exports.record(external_exports.string(), external_exports.string())
+    }).strict();
+    SecretsList = external_exports.array(external_exports.string().regex(SECRET_NAME, "secret names are UPPER_CASE letters, numbers and underscores, like ALPACA_KEY")).max(MAX_SECRETS);
+    RoutesConfig = external_exports.record(external_exports.string(), RouteConfig);
+    ActionsConfig = external_exports.record(external_exports.string(), ActionConfig);
+    SchedulesConfig = external_exports.record(external_exports.string(), ScheduleConfig);
+    WebhooksConfig = external_exports.record(external_exports.string(), WebhookConfig);
+    HOUR = 36e5;
+    FIXED = {
+      "1h": HOUR,
+      "3h": 3 * HOUR,
+      "6h": 6 * HOUR,
+      "12h": 12 * HOUR,
+      "1d": 24 * HOUR,
+      "1w": 7 * 24 * HOUR
+    };
+  }
+});
+
 // ../schema/src/site-config.ts
 function parseSiteConfig(input2) {
   const stripped = stripRemovedKeys(input2);
@@ -21686,6 +21760,7 @@ var init_site_config = __esm({
     "use strict";
     init_zod();
     init_query();
+    init_integrations();
     FieldSpec = external_exports.enum(["string", "string?", "number", "number?", "boolean", "boolean?"]);
     RateLimit = external_exports.string().regex(/^\d+\/(minute|hour|day)$/, 'rate_limit must look like "5/hour"');
     TYPE_NAME = external_exports.string().regex(/^[a-z0-9](?:[a-z0-9_-]*[a-z0-9])?$/, "type names are lowercase letters, numbers, hyphens and underscores").max(64);
@@ -21709,7 +21784,13 @@ var init_site_config = __esm({
       notify: external_exports.enum(["owner-email"]).optional(),
       /** Constrains tree shape: a comment may only hang off a page, etc. */
       parent_types: external_exports.array(external_exports.string().min(1)).optional(),
-      rate_limit: RateLimit.optional()
+      rate_limit: RateLimit.optional(),
+      /**
+       * An action (declared under "actions") to fire after a row of this type is
+       * inserted or upserted through the page-facing Data API. Owner-API writes,
+       * imports and schedule pulls never fire it.
+       */
+      on_write: external_exports.string().optional()
     }).strict();
     SiteConfig = external_exports.object({
       /** Sitename: lowercase alphanumeric + hyphens, unique per user. */
@@ -21728,7 +21809,16 @@ var init_site_config = __esm({
        */
       query: QueryConfig.default({}),
       /** Pro (§3): additive custom-schema SQL applied to the site database. */
-      schema: external_exports.string().max(2e4).optional()
+      schema: external_exports.string().max(2e4).optional(),
+      /**
+       * Declared integrations (Pro) — see integrations.ts. All five are optional
+       * and additive: a bundle without them means exactly what it always did.
+       */
+      secrets: SecretsList.optional(),
+      routes: RoutesConfig.optional(),
+      actions: ActionsConfig.optional(),
+      schedules: SchedulesConfig.optional(),
+      webhooks: WebhooksConfig.optional()
     }).strict();
     REMOVED_KEYS = {
       indexes: 'The "indexes" key was replaced by "query" \u2014 see query.<type>.fields.'
@@ -21752,6 +21842,7 @@ var init_src = __esm({
     init_names();
     init_site_config();
     init_bundle();
+    init_integrations();
   }
 });
 
@@ -39638,7 +39729,7 @@ var init_inline_files = __esm({
   }
 });
 
-// ../mcp-tools/src/remote-assets.ts
+// ../shared/src/outbound.ts
 function isPrivateIpv4(host) {
   const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
   if (!match) return false;
@@ -39667,7 +39758,7 @@ async function resolveViaDoh(hostname3) {
   for (const type of ["A", "AAAA"]) {
     const res = await fetch(
       `https://cloudflare-dns.com/dns-query?name=${encodeURIComponent(hostname3)}&type=${type}`,
-      { headers: { Accept: "application/dns-json" }, signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) }
+      { headers: { Accept: "application/dns-json" }, signal: AbortSignal.timeout(DNS_TIMEOUT_MS) }
     );
     if (!res.ok) throw new Error(`DNS lookup returned HTTP ${res.status}`);
     const body = await res.json();
@@ -39691,6 +39782,20 @@ async function resolutionProblem(hostname3) {
   if (blocked) return `it resolves to a private or reserved address (${blocked})`;
   return null;
 }
+var BLOCKED_HOST_SUFFIXES, DNS_TIMEOUT_MS, resolveAddresses, IP_LITERAL, UPSTREAM_MAX_BODY, UPSTREAM_MAX_RESPONSE;
+var init_outbound = __esm({
+  "../shared/src/outbound.ts"() {
+    "use strict";
+    BLOCKED_HOST_SUFFIXES = [".localhost", ".local", ".internal", ".home.arpa"];
+    DNS_TIMEOUT_MS = 2e4;
+    resolveAddresses = resolveViaDoh;
+    IP_LITERAL = /^\d{1,3}(\.\d{1,3}){3}$/;
+    UPSTREAM_MAX_BODY = 64 * 1024;
+    UPSTREAM_MAX_RESPONSE = 1024 * 1024;
+  }
+});
+
+// ../mcp-tools/src/remote-assets.ts
 function urlProblem(url2, why) {
   return {
     code: "invalid_source_url",
@@ -39893,24 +39998,280 @@ async function resolveDeployFiles(files, opts = {}) {
   }
   return { ok: true, files: out };
 }
-var MAX_REMOTE_FILES, MAX_REMOTE_FILE_MB, MAX_BUNDLE_TOTAL_MB, MAX_REDIRECTS, FETCH_TIMEOUT_MS, BLOCKED_HOST_SUFFIXES, resolveAddresses, IP_LITERAL;
+var MAX_REMOTE_FILES, MAX_REMOTE_FILE_MB, MAX_BUNDLE_TOTAL_MB, MAX_REDIRECTS, FETCH_TIMEOUT_MS;
 var init_remote_assets = __esm({
   "../mcp-tools/src/remote-assets.ts"() {
     "use strict";
+    init_outbound();
+    init_outbound();
     MAX_REMOTE_FILES = 20;
     MAX_REMOTE_FILE_MB = 10;
     MAX_BUNDLE_TOTAL_MB = 50;
     MAX_REDIRECTS = 3;
     FETCH_TIMEOUT_MS = 2e4;
-    BLOCKED_HOST_SUFFIXES = [".localhost", ".local", ".internal", ".home.arpa"];
-    resolveAddresses = resolveViaDoh;
-    IP_LITERAL = /^\d{1,3}(\.\d{1,3}){3}$/;
+  }
+});
+
+// ../mcp-tools/src/output-schemas.ts
+var ok, site, deployResult, dataDoc, dnsRecord, fileEntry, OUTPUT_SCHEMAS;
+var init_output_schemas = __esm({
+  "../mcp-tools/src/output-schemas.ts"() {
+    "use strict";
+    init_zod();
+    ok = external_exports.literal(true).describe("Always true on success; failures come back as an error result instead");
+    site = external_exports.looseObject({
+      id: external_exports.string().optional().describe("Stable site id \u2014 accepted anywhere a site name is"),
+      sitename: external_exports.string().optional().describe("The site's name within the account"),
+      hostname: external_exports.string().optional().describe("DNS label on the platform domain ({username}-{sitename})"),
+      title: external_exports.string().nullish().describe("Human title shown to guests"),
+      visibility: external_exports.string().optional().describe('"public" or "private"'),
+      status: external_exports.string().optional().describe('"active", "suspended" or "deleted"'),
+      custom_domain: external_exports.string().nullish().describe("Attached custom domain, if any"),
+      domain_status: external_exports.string().optional().describe("Custom-domain verification state, when one is attached"),
+      current_version: external_exports.number().optional().describe("The live version number (0 = never deployed)"),
+      url: external_exports.string().optional().describe("Public address of the site \u2014 give this to the user"),
+      local_url: external_exports.string().optional().describe("Local-dev address of the site"),
+      created_at: external_exports.string().optional(),
+      deleted_at: external_exports.string().nullish().describe("Deleted sites only"),
+      purges_after: external_exports.string().nullish().describe("Deleted sites only: when it is destroyed for good")
+    }).describe("The site");
+    deployResult = external_exports.looseObject({
+      site_id: external_exports.string().optional(),
+      hostname: external_exports.string().optional(),
+      version: external_exports.number().describe("The new version number \u2014 a restore point for revert_site, and the base_version for the next deploy"),
+      files: external_exports.number().optional().describe("Files in the deployed version"),
+      total_bytes: external_exports.number().optional(),
+      bundle_hash: external_exports.string().optional().describe("Content hash of the deployed bundle"),
+      url: external_exports.string().optional().describe("Where the site is served"),
+      local_url: external_exports.string().optional(),
+      scan: external_exports.looseObject({
+        score: external_exports.number().optional(),
+        verdict: external_exports.string().optional().describe('"clean", or "suspended" when the abuse scan took the site down')
+      }).optional(),
+      query_plan: external_exports.record(external_exports.string(), external_exports.unknown()).optional().describe("Per data type: the indexes the query block built and what each insert now costs in billed writes"),
+      warnings: external_exports.array(external_exports.string()).optional().describe("Runtime problems only visitors would hit (missing Turnstile, unreadable fetched types\u2026). Resolve before reporting success")
+    });
+    dataDoc = external_exports.looseObject({
+      seq: external_exports.number().describe("Row number \u2014 the row's permanent identity"),
+      type: external_exports.string(),
+      parent_seq: external_exports.number().nullish(),
+      json: external_exports.record(external_exports.string(), external_exports.unknown()).describe("The row's document"),
+      created_at: external_exports.string().optional(),
+      updated_at: external_exports.string().optional()
+    });
+    dnsRecord = external_exports.looseObject({
+      type: external_exports.string(),
+      name: external_exports.string(),
+      value: external_exports.string(),
+      note: external_exports.string().optional()
+    });
+    fileEntry = external_exports.looseObject({
+      path: external_exports.string(),
+      size: external_exports.number().optional(),
+      content_type: external_exports.string().optional(),
+      sha256: external_exports.string().optional(),
+      content: external_exports.string().optional().describe("Inlined contents (text, or base64 when named in paths)"),
+      encoding: external_exports.string().optional().describe('"utf8" or "base64"'),
+      content_omitted: external_exports.string().optional().describe('Why content is absent: "binary", "too_large" or "budget"'),
+      status: external_exports.string().optional().describe('compare only: "added", "removed" or "changed"'),
+      diff: external_exports.string().optional().describe("compare only: unified line diff of a changed text file"),
+      diff_omitted: external_exports.string().optional()
+    });
+    OUTPUT_SCHEMAS = {
+      deploy_site: external_exports.looseObject({
+        ok,
+        site,
+        deploy: deployResult.describe("The deploy itself"),
+        created: external_exports.boolean().optional().describe("True when this call created the site")
+      }),
+      create_upload: external_exports.looseObject({
+        ok,
+        session: external_exports.string().optional().describe("Upload session id \u2014 pass it back to list what the user uploaded"),
+        upload_url: external_exports.string().optional().describe("Mint: the drag-and-drop page to send the user as a clickable link"),
+        put_url: external_exports.string().optional().describe("Mint: PUT target for bytes you already hold ({filename} = last path segment)"),
+        expires_in: external_exports.number().optional().describe("Mint: seconds until the link expires"),
+        max_mb: external_exports.number().optional(),
+        max_files: external_exports.number().optional(),
+        uploads: external_exports.array(
+          external_exports.looseObject({
+            upload_id: external_exports.string().describe("Reference this in deploy_site {path, upload_id}"),
+            filename: external_exports.string().optional(),
+            size_bytes: external_exports.number().optional()
+          })
+        ).optional().describe("List (with session): the files staged so far"),
+        next: external_exports.string().optional().describe("What to do next")
+      }).describe("Mint returns the link fields; a call with `session` returns `uploads`"),
+      edit_site: external_exports.looseObject({
+        ok,
+        site: external_exports.looseObject({ id: external_exports.string(), sitename: external_exports.string().optional() }),
+        deploy: deployResult.describe("The patch deploy the edits produced"),
+        files_edited: external_exports.number().optional(),
+        replacements: external_exports.number().optional().describe("Total occurrences replaced across all edits")
+      }),
+      get_site: external_exports.looseObject({
+        ok,
+        site_id: external_exports.string().optional(),
+        sitename: external_exports.string().optional(),
+        version: external_exports.number().optional().describe("The version these files or matches were read from"),
+        current_version: external_exports.number().optional().describe("What is actually live (history, or a pinned-version read)"),
+        total_bytes: external_exports.number().optional(),
+        bundle_hash: external_exports.string().optional(),
+        config: external_exports.unknown().optional().describe("The deployed drivethrough.json"),
+        files: external_exports.array(fileEntry).optional().describe("File reads: entries in deploy_site {path, content, encoding} form. compare: per-file diffs"),
+        find: external_exports.string().optional(),
+        files_searched: external_exports.number().optional(),
+        matches: external_exports.array(
+          external_exports.looseObject({
+            path: external_exports.string(),
+            line: external_exports.number(),
+            text: external_exports.string().describe("The byte-exact deployed line \u2014 usable as edit_site `find` context"),
+            occurrences: external_exports.number().optional()
+          })
+        ).optional().describe("find: where the text occurs"),
+        truncated: external_exports.boolean().optional(),
+        versions: external_exports.array(
+          external_exports.looseObject({
+            version: external_exports.number(),
+            created_at: external_exports.string().optional(),
+            files: external_exports.number().optional(),
+            total_bytes: external_exports.number().optional(),
+            current: external_exports.boolean().optional(),
+            changes: external_exports.unknown().optional().describe('{added, changed, removed} paths vs the version before, or "initial"')
+          })
+        ).optional().describe("history: newest first \u2014 the map for revert_site"),
+        from: external_exports.number().optional().describe("compare: older version"),
+        to: external_exports.number().optional().describe("compare: newer version"),
+        note: external_exports.string().optional()
+      }).describe("Shape depends on the mode: file reads (files, config), find (matches), history (versions), compare (from, to, files)"),
+      preview_site: external_exports.looseObject({
+        ok,
+        site_id: external_exports.string().optional(),
+        sitename: external_exports.string().optional(),
+        version: external_exports.number().optional().describe("The version that was rendered"),
+        current_version: external_exports.number().optional(),
+        path: external_exports.string().optional(),
+        viewport: external_exports.looseObject({ width: external_exports.number(), height: external_exports.number() }).optional(),
+        full_page: external_exports.boolean().optional(),
+        renderer: external_exports.string().optional(),
+        note: external_exports.string().optional()
+      }).describe("Metadata about the screenshot; the image itself is the result's image content block"),
+      revert_site: deployResult.extend({
+        ok,
+        reverted_to: external_exports.number().optional().describe("The version whose content was restored"),
+        byte_identical: external_exports.boolean().optional().describe("True proves the new version is byte-for-byte the target version")
+      }).describe("A revert is a new deploy: the new version number plus the proof of restoration"),
+      create_db: external_exports.looseObject({
+        ok,
+        site_id: external_exports.string().optional(),
+        d1_database_id: external_exports.string().optional(),
+        created: external_exports.boolean().optional().describe("False when the database already existed")
+      }),
+      query_db: external_exports.looseObject({
+        ok,
+        types: external_exports.array(external_exports.looseObject({ type: external_exports.string(), count: external_exports.number() })).optional().describe("types: row count per type"),
+        items: external_exports.array(dataDoc).optional().describe("list/get: the rows"),
+        next_cursor: external_exports.string().nullish().describe("list: pass back as `cursor` for the next page; null at the end"),
+        count: external_exports.number().optional(),
+        count_capped: external_exports.boolean().optional(),
+        partial: external_exports.boolean().optional().describe("Owner scan of an undeclared query stopped at its row cap"),
+        declare: external_exports.string().optional().describe("The query declaration that would make this list complete and cheap"),
+        search_status: external_exports.string().optional()
+      }).describe('"types" returns `types`; "list" and "get" return `items`'),
+      write_db: external_exports.looseObject({
+        ok,
+        item: dataDoc.optional().describe("insert/update: the row as stored"),
+        inserted: external_exports.number().optional().describe("Bulk insert: rows written"),
+        writes_charged: external_exports.number().optional(),
+        first_seq: external_exports.number().optional(),
+        last_seq: external_exports.number().optional(),
+        deleted: external_exports.boolean().optional(),
+        seq: external_exports.number().optional().describe("delete: the row removed")
+      }).describe("Single insert/update \u2192 item; bulk insert \u2192 counts and seq range; delete \u2192 {deleted, seq}"),
+      set_privacy: external_exports.looseObject({ ok, site }),
+      share_site: external_exports.looseObject({
+        ok,
+        share_link: external_exports.looseObject({
+          id: external_exports.string().optional(),
+          url: external_exports.string().describe("The link to send \u2014 anyone holding it can view"),
+          local_url: external_exports.string().optional(),
+          expires_at: external_exports.string().nullish().describe("null = never expires"),
+          revoked: external_exports.boolean().optional(),
+          created_at: external_exports.string().optional()
+        }).optional(),
+        sent_to: external_exports.string().optional().describe("Invitation: the address the magic link went to")
+      }).describe("A share link, or (with email) confirmation the invitation was sent"),
+      list_sites: external_exports.looseObject({ ok, sites: external_exports.array(site) }),
+      delete_site: external_exports.looseObject({
+        ok,
+        deleted: external_exports.boolean().optional(),
+        site: site.optional(),
+        recoverable_until: external_exports.string().nullish().describe("Restore with restore_site before this date"),
+        message: external_exports.string().optional()
+      }),
+      check_domain: external_exports.looseObject({
+        ok,
+        domain: external_exports.string().optional(),
+        status: external_exports.string().optional().describe("status: pending_dns \u2192 pending_ssl \u2192 active"),
+        target: external_exports.string().optional(),
+        records: external_exports.array(dnsRecord).optional().describe("The DNS records to create, exact and paste-ready"),
+        hostnames: external_exports.array(external_exports.unknown()).optional(),
+        supported: external_exports.boolean().optional().describe("connect: whether the registrar supports one-click setup"),
+        provider: external_exports.string().optional(),
+        url: external_exports.string().optional().describe("connect: the one-click registrar link to relay"),
+        next: external_exports.string().optional()
+      }).describe('"status" \u2192 verification progress; "connect" \u2192 one-click setup link or manual records'),
+      manage_domain: external_exports.looseObject({
+        ok,
+        domain: external_exports.string().optional(),
+        status: external_exports.string().optional(),
+        target: external_exports.string().optional(),
+        records: external_exports.array(dnsRecord).optional().describe("attach: the DNS records the user must add"),
+        next: external_exports.string().optional(),
+        detached: external_exports.string().optional().describe("detach: the domain removed")
+      }).describe("attach \u2192 DNS records to add; detach \u2192 the removed domain"),
+      restore_site: external_exports.looseObject({
+        ok,
+        restored: external_exports.boolean().optional(),
+        site: site.optional(),
+        renamed: external_exports.boolean().optional().describe("True when restored under a new name"),
+        domain_lost: external_exports.string().nullish().describe("A custom domain that could not be re-attached"),
+        message: external_exports.string().optional()
+      }),
+      manage_integrations: external_exports.looseObject({
+        ok,
+        // secrets
+        url: external_exports.string().optional().describe("secrets: the one-time link to relay to the user (they paste keys there, never in chat); test of a webhook: the URL the other service POSTs to"),
+        session: external_exports.string().optional().describe(`secrets: pass back with action "secrets" after the user says they're done`),
+        expires_at: external_exports.string().optional(),
+        names: external_exports.array(external_exports.string()).optional().describe("secrets: the names the link asks for"),
+        set: external_exports.record(external_exports.string(), external_exports.boolean()).optional().describe("secrets: every secret name \u2192 whether it has a value. Values are never returned."),
+        all_set: external_exports.boolean().optional().describe("secrets (with session): true once every declared secret is set"),
+        // status
+        secrets: external_exports.record(external_exports.string(), external_exports.string()).optional().describe('status: name \u2192 "set" | "unset"'),
+        routes: external_exports.record(external_exports.string(), external_exports.unknown()).optional().describe("status: declared routes"),
+        actions: external_exports.record(external_exports.string(), external_exports.unknown()).optional().describe("status: declared actions, their fields and triggering types"),
+        schedules: external_exports.record(external_exports.string(), external_exports.unknown()).optional().describe("status: each schedule's enabled, next_at, last_run_at, last_status, failures, disabled_reason"),
+        webhooks: external_exports.record(external_exports.string(), external_exports.unknown()).optional().describe("status: each webhook's url (what the other service POSTs to), verify, secret_set, last_event_at, last_status and setup steps"),
+        action_log: external_exports.array(external_exports.unknown()).optional().describe("status: the latest 20 outcomes, newest first"),
+        // test
+        target: external_exports.string().optional(),
+        kind: external_exports.string().optional().describe('test: "route", "action", "schedule" or "webhook"'),
+        status: external_exports.string().optional().describe('test: "ok", "failed", "skipped", "plan" or "quota"'),
+        http_status: external_exports.number().nullish().describe("test: the upstream's HTTP status"),
+        duration_ms: external_exports.number().optional(),
+        body_preview: external_exports.string().nullish().describe("test: first 1 KB of the upstream response, secrets redacted"),
+        error: external_exports.string().nullish(),
+        row: external_exports.record(external_exports.string(), external_exports.unknown()).nullish().describe("test, webhook targets: the row an event like the sample would store (nothing is written)"),
+        next: external_exports.string().optional()
+      }).describe('"secrets" \u2192 a link or the set/unset map; "status" \u2192 everything declared plus recent outcomes; "test" \u2192 one live run, or a webhook dry run')
+    };
   }
 });
 
 // ../mcp-tools/src/tools.ts
-function ok(data) {
-  return { content: [{ type: "text", text: JSON.stringify({ ok: true, ...data }) }] };
+function ok2(data) {
+  const structured = { ok: true, ...data };
+  return { content: [{ type: "text", text: JSON.stringify(structured) }], structuredContent: structured };
 }
 function toolError(error62) {
   const body = apiErrorBody(error62) ?? {
@@ -39921,8 +40282,8 @@ function toolError(error62) {
 function problemError(problem) {
   return new ToolApiError(422, { error: problem });
 }
-function sitePath(site) {
-  return `/v1/sites/${encodeURIComponent(site)}`;
+function sitePath(site2) {
+  return `/v1/sites/${encodeURIComponent(site2)}`;
 }
 function registerTools(server, ctx) {
   const canDeployDirectory = Boolean(ctx.localDirectories);
@@ -39931,6 +40292,7 @@ function registerTools(server, ctx) {
   server.registerTool(
     "deploy_site",
     {
+      outputSchema: OUTPUT_SCHEMAS.deploy_site,
       title: "Deploy site",
       description: `Deploy a site to Drivethrough. Idempotent: creates the site if needed, else ships a new version. Sites are private by default. ${deploySources} Images and other binary assets \u2014 pick the route by where the bytes live: already at a public URL \u2192 {path, source_url} (fetched server-side); ${binaryRoutes}already deployed on this site \u2192 {path, from_path} copies it server-side (with delete_paths, a move). Never base64-encode a file, by hand or in code \u2014 inline base64 is capped at 1 MB and is only for tiny pasted assets; a file shipped via upload_id is referenced, never additionally inlined. To rework an already-deployed site, read it back with get_site first, then deploy with mode "patch" \u2014 only the files that change. For small text changes to existing files, use edit_site instead: it sends find/replace pairs, never whole files. Every deploy's version number is a restore point: prior versions stay listed (get_site history), diffable, viewable (preview_site), and returnable (revert_site). A successful deploy may still return \`warnings\` \u2014 things that will bite at runtime but only for visitors, never for you: a form type anonymous visitors can write with no page loading the Turnstile widget, or a page that fetches a data type its visitors have no permission to read. Resolve them before telling the user it works.`,
       // Destructive: the default "replace" mode drops every deployed file the
@@ -39977,7 +40339,7 @@ function registerTools(server, ctx) {
     async ({
       directory,
       files,
-      site,
+      site: site2,
       title,
       mode,
       delete_paths,
@@ -40053,7 +40415,7 @@ function registerTools(server, ctx) {
             }
           });
         }
-        const sitename = site ?? config2?.site ?? fallbackName;
+        const sitename = site2 ?? config2?.site ?? fallbackName;
         if (!sitename) {
           throw new ToolApiError(422, {
             error: {
@@ -40081,7 +40443,7 @@ function registerTools(server, ctx) {
           `${sitePath(siteRes.site.id)}/deployments`,
           { form }
         );
-        return ok({ site: siteRes.site, deploy, created: siteRes.created });
+        return ok2({ site: siteRes.site, deploy, created: siteRes.created });
       } catch (error62) {
         return toolError(error62);
       }
@@ -40090,6 +40452,7 @@ function registerTools(server, ctx) {
   server.registerTool(
     "create_upload",
     {
+      outputSchema: OUTPUT_SCHEMAS.create_upload,
       title: "Create upload link",
       description: "Mint a short-lived upload link the USER opens in their browser to add local files (photos, PDFs, audio, video) \u2014 the route for binary assets when you cannot reach the bytes and they aren't hosted anywhere. Two-step: (1) relay the returned upload_url as a clickable link \u2014 it opens a drag-and-drop page (no sign-in needed) that takes up to 20 files, 25 MB each, and expires in 30 minutes. (2) When the user says they're done, call this tool again with the SAME `site` plus the returned `session` \u2014 it lists what they uploaded ({upload_id, filename, size_bytes}); ship each with deploy_site files: [{path, upload_id}] (mode \"patch\" adds them to a live site). Never base64-encode a file instead \u2014 but if the bytes are already in YOUR runtime (e.g. a chat attachment mounted in your sandbox) AND you can make HTTP requests, you may PUT them straight to the returned put_url (one file per request, its filename as the last path segment) without involving the user. Choosing a route for a binary asset: already on the public web \u2192 deploy_site {path, source_url}; this server runs on the user's machine \u2192 deploy the directory; file only in the chat or on the user's machine \u2192 this tool. Tiny pasted assets (\u22641 MB, e.g. a favicon) may still go inline as base64 content. Upload ids are single-use: the deploy that references one consumes it (the bundle keeps the bytes; the staged copy is removed and its quota refunded) \u2014 to rename or duplicate the file later, use deploy_site {path, from_path}. An upload no deploy references within 24 hours is deleted, so deploy soon after the user confirms. Pass size_bytes when the user told you a file's size \u2014 quota errors then surface here instead of failing their upload.",
       annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
@@ -40103,13 +40466,13 @@ function registerTools(server, ctx) {
         )
       }
     },
-    async ({ site, session, size_bytes }) => {
+    async ({ site: site2, session, size_bytes }) => {
       try {
         if (session !== void 0) {
-          return ok(await ctx.api.request("GET", `${sitePath(site)}/uploads/${encodeURIComponent(session)}`));
+          return ok2(await ctx.api.request("GET", `${sitePath(site2)}/uploads/${encodeURIComponent(session)}`));
         }
-        return ok(
-          await ctx.api.request("POST", `${sitePath(site)}/uploads`, {
+        return ok2(
+          await ctx.api.request("POST", `${sitePath(site2)}/uploads`, {
             body: { ...size_bytes !== void 0 ? { size_bytes } : {} }
           })
         );
@@ -40121,6 +40484,7 @@ function registerTools(server, ctx) {
   server.registerTool(
     "edit_site",
     {
+      outputSchema: OUTPUT_SCHEMAS.edit_site,
       title: "Edit site files",
       description: "Edit a deployed site's text files in place \u2014 the efficient way to make small changes (wording, values, a link, a style tweak) to a live site. Send only find/replace pairs, never whole file contents: the platform reads the current version, applies the edits, and ships a new version with everything else carried forward. Prefer this over get_site + deploy_site whenever the change is small relative to the file. Each `find` must match the deployed text exactly (whitespace included) and exactly once \u2014 add surrounding context to pin down one occurrence, or set replace_all. All-or-nothing: if any edit fails to match, nothing deploys and the error says how to recover, so you can try an edit without reading the file first. Edits are never lossy: the pre-edit version stays restorable via revert_site, so to undo an edit, revert \u2014 don't hand-invert it. After visual changes, preview_site shows what actually rendered.",
       // Destructive: find/replace overwrites text that is currently live.
@@ -40138,7 +40502,7 @@ function registerTools(server, ctx) {
         ).min(1).describe("Edits applied in order; later edits see earlier results")
       }
     },
-    async ({ site, edits }) => {
+    async ({ site: site2, edits }) => {
       try {
         const normalized = edits.map((e3) => ({ ...e3, path: e3.path.startsWith("/") ? e3.path : `/${e3.path}` }));
         for (const edit of normalized) {
@@ -40154,7 +40518,7 @@ function registerTools(server, ctx) {
         }
         const paths = [...new Set(normalized.map((e3) => e3.path))];
         const query = paths.map((p2) => `path=${encodeURIComponent(p2)}`).join("&");
-        const read = await ctx.api.request("GET", `${sitePath(site)}/files?${query}`);
+        const read = await ctx.api.request("GET", `${sitePath(site2)}/files?${query}`);
         const texts = /* @__PURE__ */ new Map();
         for (const path8 of paths) {
           const file2 = read.files.find((f3) => f3.path === path8);
@@ -40198,7 +40562,7 @@ function registerTools(server, ctx) {
           `${sitePath(read.site_id)}/deployments`,
           { form: assembled.bundle.form }
         );
-        return ok({
+        return ok2({
           site: { id: read.site_id, sitename: read.sitename },
           deploy,
           files_edited: paths.length,
@@ -40212,6 +40576,7 @@ function registerTools(server, ctx) {
   server.registerTool(
     "get_site",
     {
+      outputSchema: OUTPUT_SCHEMAS.get_site,
       title: "Read site files & history",
       description: 'Read back a deployed site: file manifest, file contents, drivethrough.json \u2014 and the site\'s version history. Use this to resume work on a site from an earlier conversation. Read the minimum you need: `find` locates text without returning file contents, `manifest_only` lists what exists, `paths` fetches only named files \u2014 a bare call inlines every text file, so reserve it for genuinely reading a whole small site. Versions: every deploy is a numbered version the platform keeps. `history: true` lists them with what each one changed (the map for revert_site), `compare: {from, to}` returns line diffs between two versions ("what did v9\u2192v10 change?"), and `version` pins any read mode to a prior version instead of the live one. Modes are exclusive per call \u2014 compare wins over history, history over find/manifest_only. Entries come back deploy_site-compatible ({path, content, encoding}); binary files are listed but only inlined when named in `paths`. For small text changes you may not need this at all \u2014 edit_site applies find/replace to the deployed files directly.',
       annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
@@ -40239,7 +40604,7 @@ function registerTools(server, ctx) {
       }
     },
     async ({
-      site,
+      site: site2,
       paths,
       find,
       manifest_only,
@@ -40249,7 +40614,7 @@ function registerTools(server, ctx) {
     }) => {
       try {
         if (compare) {
-          return ok(await ctx.api.request("GET", `${sitePath(site)}/diff?from=${compare.from}&to=${compare.to}`));
+          return ok2(await ctx.api.request("GET", `${sitePath(site2)}/diff?from=${compare.from}&to=${compare.to}`));
         }
         if (history !== void 0 && history !== false) {
           if (typeof history === "number" && history < 1) {
@@ -40262,7 +40627,7 @@ function registerTools(server, ctx) {
             });
           }
           const before = typeof history === "number" ? `?before=${history}` : "";
-          return ok(await ctx.api.request("GET", `${sitePath(site)}/versions${before}`));
+          return ok2(await ctx.api.request("GET", `${sitePath(site2)}/versions${before}`));
         }
         if (find !== void 0 && find.length === 0) {
           throw new ToolApiError(422, {
@@ -40279,7 +40644,7 @@ function registerTools(server, ctx) {
         else if (manifest_only) params.set("manifest_only", "1");
         if (version2 !== void 0) params.set("version", String(version2));
         const query = params.toString();
-        return ok(await ctx.api.request("GET", `${sitePath(site)}/files${query ? `?${query}` : ""}`));
+        return ok2(await ctx.api.request("GET", `${sitePath(site2)}/files${query ? `?${query}` : ""}`));
       } catch (error62) {
         return toolError(error62);
       }
@@ -40288,6 +40653,7 @@ function registerTools(server, ctx) {
   server.registerTool(
     "preview_site",
     {
+      outputSchema: OUTPUT_SCHEMAS.preview_site,
       title: "Preview site (screenshot)",
       description: "See a deployed site the way a visitor does: renders the page in a real browser server-side and returns a screenshot image you can look at directly. You have no browser of your own \u2014 this is your only view of rendered results, so use it to verify visual work (layout, styling, animations, responsive behavior) actually shipped correctly instead of assuming it did, and to eyeball a prior `version` before reverting to it. Works on private sites; nothing becomes public. Takes a few seconds \u2014 look once after a coherent batch of changes, not after every edit. Animations: the capture happens at page load; pass wait_ms to let one settle or reach mid-cycle.",
       // Open-world: a real browser loads the page, and with it whatever the
@@ -40303,7 +40669,7 @@ function registerTools(server, ctx) {
       }
     },
     async ({
-      site,
+      site: site2,
       path: path8,
       version: version2,
       viewport,
@@ -40311,7 +40677,7 @@ function registerTools(server, ctx) {
       full_page
     }) => {
       try {
-        const { image_base64, content_type, ...meta3 } = await ctx.api.request("POST", `${sitePath(site)}/preview`, {
+        const { image_base64, content_type, ...meta3 } = await ctx.api.request("POST", `${sitePath(site2)}/preview`, {
           body: {
             ...path8 !== void 0 ? { path: path8 } : {},
             ...version2 !== void 0 ? { version: version2 } : {},
@@ -40320,11 +40686,13 @@ function registerTools(server, ctx) {
             ...full_page !== void 0 ? { full_page } : {}
           }
         });
+        const structured = { ok: true, ...meta3 };
         return {
           content: [
             { type: "image", data: image_base64, mimeType: content_type },
-            { type: "text", text: JSON.stringify({ ok: true, ...meta3 }) }
-          ]
+            { type: "text", text: JSON.stringify(structured) }
+          ],
+          structuredContent: structured
         };
       } catch (error62) {
         return toolError(error62);
@@ -40334,6 +40702,7 @@ function registerTools(server, ctx) {
   server.registerTool(
     "revert_site",
     {
+      outputSchema: OUTPUT_SCHEMAS.revert_site,
       title: "Revert site to a version",
       description: `Return a site to a prior version, byte-exactly, in one call \u2014 the safe way to undo. When the user says "undo that" or "put it back how it was", use this; never reconstruct the old state by hand with inverse edits, which risks leaving the site neither old nor new. The platform redeploys the target version's exact stored files as a new version \u2014 history is preserved, so a revert can itself be reverted \u2014 and the response proves the restore: byte_identical: true means the new version's content hash equals the target's. Find the target with get_site {history: true} (each entry shows what that version changed), or use the version number a deploy/edit response reported. Undoing just one file of a multi-file change? Read that file at the old version (get_site {version, paths}) and deploy it with mode "patch" instead.`,
       // Destructive: the live site's current content is replaced by the older
@@ -40346,9 +40715,9 @@ function registerTools(server, ctx) {
         to_version: external_exports.number().int().min(1).describe("The version to return to (see get_site {history: true})")
       }
     },
-    async ({ site, to_version }) => {
+    async ({ site: site2, to_version }) => {
       try {
-        return ok(await ctx.api.request("POST", `${sitePath(site)}/revert`, { body: { to_version } }));
+        return ok2(await ctx.api.request("POST", `${sitePath(site2)}/revert`, { body: { to_version } }));
       } catch (error62) {
         return toolError(error62);
       }
@@ -40357,14 +40726,15 @@ function registerTools(server, ctx) {
   server.registerTool(
     "create_db",
     {
+      outputSchema: OUTPUT_SCHEMAS.create_db,
       title: "Create site database",
       description: `Provision the per-site database. Idempotent. Deploying a drivethrough.json that declares types does this automatically. Site pages read and write rows via the same-origin Data API: GET /api/data?type=X lists, POST /api/data with {type, json} inserts. Anonymous writes (write: "public", or "viewers" on a public site) additionally require Cloudflare Turnstile in that POST: GET /api/config for the turnstile_site_key, load https://challenges.cloudflare.com/turnstile/v0/api.js, render <div class="cf-turnstile" data-sitekey="\u2026"></div> inside the form, and send the widget's "cf-turnstile-response" input value as "turnstile_token" in the body. The widget is usually invisible; owner and invited-viewer writes on private sites skip it entirely.`,
       annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
       inputSchema: { site: external_exports.string().describe("Site name or id") }
     },
-    async ({ site }) => {
+    async ({ site: site2 }) => {
       try {
-        return ok(await ctx.api.request("POST", `${sitePath(site)}/db`));
+        return ok2(await ctx.api.request("POST", `${sitePath(site2)}/db`));
       } catch (error62) {
         return toolError(error62);
       }
@@ -40373,6 +40743,7 @@ function registerTools(server, ctx) {
   server.registerTool(
     "query_db",
     {
+      outputSchema: OUTPUT_SCHEMAS.query_db,
       title: "Query site database",
       description: 'Read the site\'s database as its owner (read-only \u2014 writes go through write_db). Same query surface the site\'s own pages use, so what works here works there. Every row is {seq, type, parent_seq, json, created_at, updated_at}: `seq` is the row number and its permanent identity (never reused, even after a delete), `json` is the document. Newest-first is the default and always free. Filtering, sorting and search need a matching entry in the site\'s "query" block in drivethrough.json \u2014 an undeclared query is refused with the exact line to add. As the owner you get a bounded 5,000-row scan instead of a refusal, marked "partial": true, so you can look at data you have not modelled yet; a visitor page gets the refusal.',
       annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
@@ -40404,11 +40775,11 @@ function registerTools(server, ctx) {
       }
     },
     async (args) => {
-      const { site, action, type, seq } = args;
+      const { site: site2, action, type, seq } = args;
       try {
         switch (action) {
           case "types":
-            return ok(await ctx.api.request("GET", `${sitePath(site)}/data/types`));
+            return ok2(await ctx.api.request("GET", `${sitePath(site2)}/data/types`));
           case "list": {
             if (!type) {
               throw new ToolApiError(422, {
@@ -40436,7 +40807,7 @@ function registerTools(server, ctx) {
             if (args.cursor) params.set("cursor", args.cursor);
             if (args.offset !== void 0) params.set("offset", String(args.offset));
             if (args.count) params.set("count", "1");
-            return ok(await ctx.api.request("GET", `${sitePath(site)}/data?${params}`));
+            return ok2(await ctx.api.request("GET", `${sitePath(site2)}/data?${params}`));
           }
           case "get": {
             if (seq === void 0) {
@@ -40448,7 +40819,7 @@ function registerTools(server, ctx) {
                 }
               });
             }
-            return ok(await ctx.api.request("GET", `${sitePath(site)}/data?seq=${encodeURIComponent(String(seq))}`));
+            return ok2(await ctx.api.request("GET", `${sitePath(site2)}/data?seq=${encodeURIComponent(String(seq))}`));
           }
         }
       } catch (error62) {
@@ -40459,6 +40830,7 @@ function registerTools(server, ctx) {
   server.registerTool(
     "write_db",
     {
+      outputSchema: OUTPUT_SCHEMAS.write_db,
       title: "Write site database",
       description: "Write to the site's database as its owner: insert one row, import many, update, or delete (reads go through query_db). Rows are addressed by `seq`, the row number query_db returns. To change a few fields of a row, `update` with `merge` \u2014 only the fields that change, no fetch needed. Reserve `json` (wholesale replacement) for rewriting the whole document. To load a catalogue, use `rows` for a handful and `rows_url` for thousands \u2014 never loop insert, and never try to emit 100,000 rows yourself. Writes are validated against the types declared in the site's drivethrough.json (unknown types and mismatched fields are rejected, and a bulk import is checked in full BEFORE the first row is written, so it is all-or-nothing); pass validate: false only for a deliberate migration. Deleted and overwritten rows are gone for good \u2014 there is no version history for data, so read a row (query_db) before destructive rewrites you might need to undo. Deleting a row also deletes its children. Every write counts against the account's monthly write allowance, and an import larger than what remains is refused before anything is written.",
       // Open-world for the same reason deploy_site is: rows_url makes the
@@ -40484,7 +40856,7 @@ function registerTools(server, ctx) {
       }
     },
     async ({
-      site,
+      site: site2,
       action,
       type,
       seq,
@@ -40538,8 +40910,8 @@ function registerTools(server, ctx) {
                   }
                 });
               }
-              return ok(
-                await ctx.api.request("POST", `${sitePath(site)}/data`, {
+              return ok2(
+                await ctx.api.request("POST", `${sitePath(site2)}/data`, {
                   body: {
                     type,
                     ...parent_seq !== void 0 ? { parent_seq } : {},
@@ -40559,8 +40931,8 @@ function registerTools(server, ctx) {
                 }
               });
             }
-            return ok(
-              await ctx.api.request("POST", `${sitePath(site)}/data`, {
+            return ok2(
+              await ctx.api.request("POST", `${sitePath(site2)}/data`, {
                 body: { type, parent_seq, json: json2, ...validate3 !== void 0 ? { validate: validate3 } : {} }
               })
             );
@@ -40575,8 +40947,8 @@ function registerTools(server, ctx) {
                 }
               });
             }
-            return ok(
-              await ctx.api.request("PATCH", `${sitePath(site)}/data/${encodeURIComponent(String(needSeq()))}`, {
+            return ok2(
+              await ctx.api.request("PATCH", `${sitePath(site2)}/data/${encodeURIComponent(String(needSeq()))}`, {
                 body: {
                   ...type !== void 0 ? { type } : {},
                   ...parent_seq !== void 0 ? { parent_seq } : {},
@@ -40587,8 +40959,8 @@ function registerTools(server, ctx) {
               })
             );
           case "delete":
-            return ok(
-              await ctx.api.request("DELETE", `${sitePath(site)}/data/${encodeURIComponent(String(needSeq()))}`)
+            return ok2(
+              await ctx.api.request("DELETE", `${sitePath(site2)}/data/${encodeURIComponent(String(needSeq()))}`)
             );
         }
       } catch (error62) {
@@ -40599,6 +40971,7 @@ function registerTools(server, ctx) {
   server.registerTool(
     "set_privacy",
     {
+      outputSchema: OUTPUT_SCHEMAS.set_privacy,
       title: "Set site visibility",
       description: "Set a site's visibility to public or private. Privacy is a setting \u2014 nothing redeploys.",
       // Open-world: going public puts the site on the open web.
@@ -40608,9 +40981,9 @@ function registerTools(server, ctx) {
         visibility: external_exports.enum(["public", "private"]).describe("Who can see the site")
       }
     },
-    async ({ site, visibility }) => {
+    async ({ site: site2, visibility }) => {
       try {
-        return ok(await ctx.api.request("POST", `${sitePath(site)}/privacy`, { body: { visibility } }));
+        return ok2(await ctx.api.request("POST", `${sitePath(site2)}/privacy`, { body: { visibility } }));
       } catch (error62) {
         return toolError(error62);
       }
@@ -40619,6 +40992,7 @@ function registerTools(server, ctx) {
   server.registerTool(
     "share_site",
     {
+      outputSchema: OUTPUT_SCHEMAS.share_site,
       title: "Share site",
       description: "Create a share link for a private site, or send a magic-link invitation by email. Anyone with the link can view; guests never make accounts.",
       annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
@@ -40627,10 +41001,10 @@ function registerTools(server, ctx) {
         email: external_exports.string().email().optional().describe("Send a magic-link invitation to this email instead of returning a link")
       }
     },
-    async ({ site, email: email3 }) => {
+    async ({ site: site2, email: email3 }) => {
       try {
-        if (email3) return ok(await ctx.api.request("POST", `${sitePath(site)}/invite`, { body: { email: email3 } }));
-        return ok(await ctx.api.request("POST", `${sitePath(site)}/share`));
+        if (email3) return ok2(await ctx.api.request("POST", `${sitePath(site2)}/invite`, { body: { email: email3 } }));
+        return ok2(await ctx.api.request("POST", `${sitePath(site2)}/share`));
       } catch (error62) {
         return toolError(error62);
       }
@@ -40639,6 +41013,7 @@ function registerTools(server, ctx) {
   server.registerTool(
     "list_sites",
     {
+      outputSchema: OUTPUT_SCHEMAS.list_sites,
       title: "List sites",
       description: "List the authenticated account's sites with their addresses, visibility, and status. Pass include_deleted to also see recently deleted sites (recoverable for 30 days via restore_site).",
       annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
@@ -40648,7 +41023,7 @@ function registerTools(server, ctx) {
     },
     async ({ include_deleted }) => {
       try {
-        return ok(await ctx.api.request("GET", `/v1/sites${include_deleted ? "?include_deleted=1" : ""}`));
+        return ok2(await ctx.api.request("GET", `/v1/sites${include_deleted ? "?include_deleted=1" : ""}`));
       } catch (error62) {
         return toolError(error62);
       }
@@ -40657,14 +41032,15 @@ function registerTools(server, ctx) {
   server.registerTool(
     "delete_site",
     {
+      outputSchema: OUTPUT_SCHEMAS.delete_site,
       title: "Delete site",
       description: "Delete a site. Two-phase and safe: the site leaves the driveway immediately (guests lose access, share links are revoked, the name frees up) but stays recoverable for 30 days via restore_site. Only after 30 days is it destroyed for good.",
       annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
       inputSchema: { site: external_exports.string().describe("Site name or id") }
     },
-    async ({ site }) => {
+    async ({ site: site2 }) => {
       try {
-        return ok(await ctx.api.request("DELETE", sitePath(site)));
+        return ok2(await ctx.api.request("DELETE", sitePath(site2)));
       } catch (error62) {
         return toolError(error62);
       }
@@ -40673,6 +41049,7 @@ function registerTools(server, ctx) {
   server.registerTool(
     "check_domain",
     {
+      outputSchema: OUTPUT_SCHEMAS.check_domain,
       title: "Check custom domain",
       description: `Check a site's custom domain, read-only. "status": live verification progress \u2014 pending_dns (waiting on DNS records) \u2192 pending_ssl (certificate issuing) \u2192 active (serving with TLS); poll after setup and tell the user when it's live. "connect": look up one-click setup at the user's registrar (GoDaddy, Cloudflare, IONOS, Squarespace, \u2026) \u2014 when a URL comes back, relay it and their registrar creates the records in one click; otherwise relay the copy-paste records manage_domain attach returned.`,
       // Not readOnlyHint despite being the "read" half of the domain pair:
@@ -40685,10 +41062,10 @@ function registerTools(server, ctx) {
         action: external_exports.enum(["status", "connect"]).describe('"status" = verification progress; "connect" = one-click registrar setup lookup')
       }
     },
-    async ({ site, action }) => {
+    async ({ site: site2, action }) => {
       try {
-        if (action === "connect") return ok(await ctx.api.request("GET", `${sitePath(site)}/domain/connect`));
-        return ok(await ctx.api.request("GET", `${sitePath(site)}/domain`));
+        if (action === "connect") return ok2(await ctx.api.request("GET", `${sitePath(site2)}/domain/connect`));
+        return ok2(await ctx.api.request("GET", `${sitePath(site2)}/domain`));
       } catch (error62) {
         return toolError(error62);
       }
@@ -40697,6 +41074,7 @@ function registerTools(server, ctx) {
   server.registerTool(
     "manage_domain",
     {
+      outputSchema: OUTPUT_SCHEMAS.manage_domain,
       title: "Attach/detach custom domain",
       description: 'Attach or detach a custom domain the user already owns (paid plans). "attach": connect the domain to the site \u2014 returns the exact DNS records to add; afterwards use check_domain {action: "connect"} for a one-click registrar link and check_domain {action: "status"} to poll until active. "detach": remove the domain from the site. The site keeps its drivethrough.site address throughout.',
       // Open-world like check_domain: attach initiates certificate issuance
@@ -40711,7 +41089,7 @@ function registerTools(server, ctx) {
     },
     async ({
       action,
-      site,
+      site: site2,
       domain: domain2
     }) => {
       try {
@@ -40725,9 +41103,9 @@ function registerTools(server, ctx) {
               }
             });
           }
-          return ok(await ctx.api.request("POST", `${sitePath(site)}/domain`, { body: { domain: domain2 } }));
+          return ok2(await ctx.api.request("POST", `${sitePath(site2)}/domain`, { body: { domain: domain2 } }));
         }
-        return ok(await ctx.api.request("DELETE", `${sitePath(site)}/domain`));
+        return ok2(await ctx.api.request("DELETE", `${sitePath(site2)}/domain`));
       } catch (error62) {
         return toolError(error62);
       }
@@ -40736,6 +41114,7 @@ function registerTools(server, ctx) {
   server.registerTool(
     "restore_site",
     {
+      outputSchema: OUTPUT_SCHEMAS.restore_site,
       title: "Restore deleted site",
       description: "Restore a deleted site within its 30-day recovery window. It comes back exactly as it was \u2014 content, data, visibility \u2014 minus guest access (share links stay revoked; create new ones). If the old name is taken, pass `sitename` to restore under a new name. (Undoing changes to a live site is different \u2014 that's revert_site.)",
       // Open-world: a site that was public comes back public, served to visitors.
@@ -40745,7 +41124,7 @@ function registerTools(server, ctx) {
         sitename: external_exports.string().optional().describe("Restore under this new name instead (when the old name is taken)")
       }
     },
-    async ({ site, sitename }) => {
+    async ({ site: site2, sitename }) => {
       try {
         if (sitename !== void 0 && sitename.length === 0) {
           throw new ToolApiError(422, {
@@ -40756,8 +41135,8 @@ function registerTools(server, ctx) {
             }
           });
         }
-        return ok(
-          await ctx.api.request("POST", `${sitePath(site)}/restore`, {
+        return ok2(
+          await ctx.api.request("POST", `${sitePath(site2)}/restore`, {
             body: sitename ? { sitename } : {}
           })
         );
@@ -40766,8 +41145,90 @@ function registerTools(server, ctx) {
       }
     }
   );
+  server.registerTool(
+    "manage_integrations",
+    {
+      outputSchema: OUTPUT_SCHEMAS.manage_integrations,
+      title: "Manage integrations",
+      description: `Connect a site to another service's API \u2014 get its keys set, check what's running, and test it \u2014 with no server code (Pro plan). (1) THE SETUP NEEDS NO TOOL: declare it in drivethrough.json and deploy. "secrets" names the keys; "routes" proxies same-origin paths under /api/ext/<name> to an upstream, allowing only the listed methods and path prefixes and adding secret headers server-side (\${NAME}); "actions" POST a JSON body ({{field}} reads a row's field) when a type with "on_write" gets a row; "schedules" run every 1h/3h/6h/12h/1d/1w/1mo \u2014 "rotate" sends the next row of a type through an action, "pull" saves a route's JSON response as a new row ("map" uses $.dotted.paths; numeric strings become numbers); "webhooks" receive events another service POSTs to https://<site>/api/hook/<name> \u2014 "verify" is "stripe", "github", "standard" (Standard Webhooks: Resend, Clerk, Svix\u2026), "hmac_sha256" (with "header": the signature header's name) or, only for services that can't sign, "url_token"; "secret" names the declared secret; each verified event is mapped ("map", same $.paths) into a row of "into", which fires that type's on_write. Unverified, duplicate and replayed deliveries are never stored. No cron strings, no times of day, no timezones. Two complete examples \u2014 a read-only brokerage dashboard that also snapshots equity hourly for a chart: \`${INTEGRATION_EXAMPLE_A}\` \u2014 and a display that shows a quote when the owner clicks, and cycles through saved quotes every 3 hours: \`${INTEGRATION_EXAMPLE_B}\`. Every mistake is refused at deploy time with the corrected snippet \u2014 follow it. (2) SECRETS, TWO STEPS, like create_upload: action "secrets" returns a one-time link (10 minutes, no sign-in) \u2014 send it to the user as a clickable link and have them paste the keys there. NEVER ask for a key in the chat, and never put one in a file. When they say they're done, call again with the returned session to confirm every name is set. A deploy that needs an unset secret is refused with a fresh link already in the error \u2014 relay that one. Pass names to rotate a key that is already set. A webhook's secret comes FROM the other service: tell the user to add a webhook there pointing at its URL (status and the deploy error give it) and paste the signing secret it shows into the link page; a url_token secret is generated on the link page, which then shows the full URL to paste. (3) TEST BEFORE YOU SAY IT WORKS: action "test" with target = a route plus path ("/api/ext/alpaca/v2/account"), an action name (with fields: the row values it uses), or a schedule name runs it once, now, for real (a schedule test inserts its row or advances its rotation) and returns the upstream's status and a redacted preview. Read the preview \u2014 a 200 with an error body is still a failure. A webhook target ("/api/hook/payments", with fields: sample values) is a dry run that shows the row such an event would store; real delivery is proven by the other service's own "send test event" and then status. action "status" shows secrets set/unset, routes, schedules (next run, last result, failures), webhooks (URL, last event) and the latest outcomes. (4) WHAT FIRES AN ACTION: only a row written through the page-facing POST /api/data (a visitor's form, or the owner's own button on the page). write_db, imports and schedule pulls do NOT fire actions \u2014 to trigger one by hand, test it. Route access defaults to the owner only; set "access": "viewers" or "public" for pages others use. Schedules pause after 10 failures in a row (the owner gets one email); a deploy or a successful test re-enables them.`,
+      // Open-world: tests call a third-party API on the user's behalf.
+      annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+      inputSchema: {
+        site: external_exports.string().describe("Site name or id"),
+        action: external_exports.enum(["secrets", "status", "test"]).describe('"secrets": get a link for the user to set keys (or, with session, confirm they are set); "status": what is declared and how it ran; "test": run one route, action or schedule now, or dry-run a webhook'),
+        names: external_exports.array(external_exports.string()).optional().describe("secrets: which secret names the link asks for. Default: every declared secret that is still unset. Include a set one to replace (rotate) it."),
+        session: external_exports.string().optional().describe("secrets: the session a previous call returned \u2014 confirms what is set now instead of minting a new link"),
+        target: external_exports.string().optional().describe('test: a route key plus path ("/api/ext/weather/v1/forecast?city=Oslo"), an action name, a schedule name, or a webhook path ("/api/hook/payments")'),
+        fields: external_exports.record(external_exports.string(), external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean()])).optional().describe("test, action and webhook targets only: for an action, the row values its {{field}} references use; for a webhook, sample values for the fields its map fills")
+      }
+    },
+    async ({
+      site: site2,
+      action,
+      names,
+      session,
+      target,
+      fields
+    }) => {
+      try {
+        const setMap = async () => {
+          const listed = await ctx.api.request(
+            "GET",
+            `${sitePath(site2)}/secrets`
+          );
+          return listed.secrets;
+        };
+        if (action === "secrets") {
+          if (session !== void 0) {
+            const secrets2 = await setMap();
+            const declared = secrets2.filter((s2) => s2.declared);
+            const unset = declared.filter((s2) => !s2.set).map((s2) => s2.name);
+            if (declared.length === 0) {
+              return ok2({
+                session,
+                set: Object.fromEntries(secrets2.map((s2) => [s2.name, s2.set])),
+                next: "This site has no deployed secrets list yet, so deploy again now \u2014 the deploy checks every secret it needs and answers with a fresh link if one is still missing."
+              });
+            }
+            return ok2({
+              session,
+              set: Object.fromEntries(secrets2.map((s2) => [s2.name, s2.set])),
+              all_set: unset.length === 0,
+              next: unset.length ? `Still unset: ${unset.join(", ")}. Ask the user to finish on the page \u2014 or, if the link was used or expired, call this tool with action "secrets" again for a fresh one.` : "Every declared secret is set. Deploy (or redeploy) the site, then test each route, action, schedule and webhook."
+            });
+          }
+          const link = await ctx.api.request("POST", `${sitePath(site2)}/secrets/link`, {
+            body: names ? { names } : {}
+          });
+          const secrets = await setMap();
+          const set2 = Object.fromEntries((link.names ?? []).map((name) => [name, false]));
+          for (const s2 of secrets) set2[s2.name] = s2.set;
+          return ok2({ ...link, set: set2 });
+        }
+        if (action === "status") {
+          return ok2(await ctx.api.request("GET", `${sitePath(site2)}/integrations`));
+        }
+        if (!target) {
+          throw new ToolApiError(422, {
+            error: {
+              code: "target_required",
+              message: 'action "test" needs a target.',
+              next: 'Pass target: a route plus path ("/api/ext/name/path"), an action name, a schedule name, or a webhook path ("/api/hook/name"). action "status" lists them.'
+            }
+          });
+        }
+        return ok2(
+          await ctx.api.request("POST", `${sitePath(site2)}/integrations/test`, {
+            body: { target, ...fields ? { fields } : {} }
+          })
+        );
+      } catch (error62) {
+        return toolError(error62);
+      }
+    }
+  );
 }
-var MAX_BUNDLE_MB, SERVER_INSTRUCTIONS;
+var MAX_BUNDLE_MB, SERVER_INSTRUCTIONS, INTEGRATION_EXAMPLE_A, INTEGRATION_EXAMPLE_B;
 var init_tools = __esm({
   "../mcp-tools/src/tools.ts"() {
     "use strict";
@@ -40776,6 +41237,7 @@ var init_tools = __esm({
     init_edits();
     init_inline_files();
     init_remote_assets();
+    init_output_schemas();
     MAX_BUNDLE_MB = 50;
     SERVER_INSTRUCTIONS = `Drivethrough hosts websites: deploy, share, collect data. Sites are private by default; guests never need accounts.
 
@@ -40847,7 +41309,52 @@ RECIPE \u2014 a searchable, filterable list (catalogue, directory, archive)
    whose query the config doesn't declare (it will render empty for visitors),
    and a declaration no page uses (pure cost on every insert).
 
+RECIPE \u2014 call another service's API (stock prices, a smart display, a CRM, weather; Pro plan):
+No server code. Declare it in drivethrough.json and the platform enforces it:
+- "secrets": names of the keys the site needs, like ["WEATHER_KEY"]. Values are NEVER typed into the chat \u2014 manage_integrations {action: "secrets"} gives you a one-time link to send the user, who pastes the keys there.
+- "routes": {"/api/ext/weather": {"upstream": "https://api.example.com", "methods": ["GET"], "paths": ["/v1/forecast"], "headers": {"Authorization": "Bearer \${WEATHER_KEY}"}, "access": "public", "cache": "5m", "query": true}} \u2192 the page fetches /api/ext/weather/v1/forecast?city=\u2026 same-origin; the key is added server-side and only the listed methods and path prefixes go through.
+- "actions": {"notify": {"post": "https://\u2026", "headers": {\u2026}, "body": {"text": "{{message}}"}}} plus "on_write": "notify" on a type \u2192 each row a page POSTs to /api/data fires the call. {{field}} reads the row; \${NAME} reads a secret.
+- "schedules": {"name": {"every": "1h"|"3h"|"6h"|"12h"|"1d"|"1w"|"1mo", "rotate": "<type>", "action": "<action>"}} cycles rows through an action; {"every": \u2026, "pull": {"route", "path", "into": "<type>", "map": {"field": "$.json.path"}}} saves a route's JSON as rows (for charts and history).
+- "webhooks": {"payments": {"verify": "stripe", "secret": "STRIPE_WEBHOOK_SECRET", "into": "payment", "map": {"amount": "$.data.object.amount"}}} \u2192 the other service POSTs events to https://<site>/api/hook/payments; each is verified ("stripe", "github", "standard", "hmac_sha256" + "header", or "url_token" for services that can't sign) and stored as a row, which fires that type's on_write. Give the event type "read": "owner" unless visitors should see it.
+Deploy, relay the secrets link if the deploy asks for one, then manage_integrations {action: "test"} each piece before telling the user it works. Full examples are in manage_integrations' description.
+
 Custom domains (paid plans): manage_domain attaches a domain the user already owns. After attaching, check_domain {action: "connect"} looks up one-click setup at their registrar (relay the URL when offered, else the exact DNS records from attach), and check_domain {action: "status"} polls until "active" \u2014 DNS seen, then TLS issued.`;
+    INTEGRATION_EXAMPLE_A = JSON.stringify({
+      secrets: ["ALPACA_KEY", "ALPACA_SECRET"],
+      routes: {
+        "/api/ext/alpaca": {
+          upstream: "https://paper-api.alpaca.markets",
+          methods: ["GET"],
+          paths: ["/v2/account", "/v2/positions", "/v2/account/portfolio/history"],
+          headers: { "APCA-API-KEY-ID": "${ALPACA_KEY}", "APCA-API-SECRET-KEY": "${ALPACA_SECRET}" },
+          access: "viewers",
+          cache: "30s",
+          query: true
+        }
+      },
+      types: { snapshot: { fields: { equity: "number", cash: "number" } } },
+      schedules: {
+        portfolio: {
+          every: "1h",
+          pull: { route: "/api/ext/alpaca", path: "/v2/account", into: "snapshot", map: { equity: "$.equity", cash: "$.cash" } }
+        }
+      }
+    });
+    INTEGRATION_EXAMPLE_B = JSON.stringify({
+      secrets: ["VESTABOARD_KEY"],
+      actions: {
+        show: {
+          post: "https://rw.vestaboard.com/",
+          headers: { "X-Vestaboard-Read-Write-Key": "${VESTABOARD_KEY}" },
+          body: { text: "{{text}}" }
+        }
+      },
+      types: {
+        quote: { fields: { text: "string" } },
+        activation: { fields: { text: "string" }, on_write: "show" }
+      },
+      schedules: { cycle: { every: "3h", rotate: "quote", action: "show" } }
+    });
   }
 });
 
@@ -40860,6 +41367,7 @@ var init_src2 = __esm({
     init_inline_files();
     init_remote_assets();
     init_tools();
+    init_output_schemas();
   }
 });
 
@@ -42788,6 +43296,28 @@ var dD = class extends x2 {
 };
 var A3;
 A3 = /* @__PURE__ */ new WeakMap();
+var TD = Object.defineProperty;
+var jD2 = (e3, u4, t2) => u4 in e3 ? TD(e3, u4, { enumerable: true, configurable: true, writable: true, value: t2 }) : e3[u4] = t2;
+var U = (e3, u4, t2) => (jD2(e3, typeof u4 != "symbol" ? u4 + "" : u4, t2), t2);
+var MD = class extends x2 {
+  constructor({ mask: u4, ...t2 }) {
+    super(t2), U(this, "valueWithCursor", ""), U(this, "_mask", "\u2022"), this._mask = u4 ?? "\u2022", this.on("finalize", () => {
+      this.valueWithCursor = this.masked;
+    }), this.on("value", () => {
+      if (this.cursor >= this.value.length) this.valueWithCursor = `${this.masked}${import_picocolors.default.inverse(import_picocolors.default.hidden("_"))}`;
+      else {
+        const F4 = this.masked.slice(0, this.cursor), s2 = this.masked.slice(this.cursor);
+        this.valueWithCursor = `${F4}${import_picocolors.default.inverse(s2[0])}${s2.slice(1)}`;
+      }
+    });
+  }
+  get cursor() {
+    return this._cursor;
+  }
+  get masked() {
+    return this.value.replaceAll(/./g, this._mask);
+  }
+};
 var RD = class extends x2 {
   get valueWithCursor() {
     if (this.state === "submit") return this.value;
@@ -42833,7 +43363,7 @@ var de = u3("\u251C", "+");
 var pe = u3("\u256F", "+");
 var q2 = u3("\u25CF", "\u2022");
 var D2 = u3("\u25C6", "*");
-var U = u3("\u25B2", "!");
+var U2 = u3("\u25B2", "!");
 var K2 = u3("\u25A0", "x");
 var b3 = (t2) => {
   switch (t2) {
@@ -42869,6 +43399,27 @@ ${import_picocolors2.default.cyan(d3)}
 `;
   }
 } }).prompt();
+var ge = (t2) => new MD({ validate: t2.validate, mask: t2.mask ?? $e, render() {
+  const n2 = `${import_picocolors2.default.gray(o3)}
+${b3(this.state)}  ${t2.message}
+`, r3 = this.valueWithCursor, i2 = this.masked;
+  switch (this.state) {
+    case "error":
+      return `${n2.trim()}
+${import_picocolors2.default.yellow(o3)}  ${i2}
+${import_picocolors2.default.yellow(d3)}  ${import_picocolors2.default.yellow(this.error)}
+`;
+    case "submit":
+      return `${n2}${import_picocolors2.default.gray(o3)}  ${import_picocolors2.default.dim(i2)}`;
+    case "cancel":
+      return `${n2}${import_picocolors2.default.gray(o3)}  ${import_picocolors2.default.strikethrough(import_picocolors2.default.dim(i2 ?? ""))}${i2 ? `
+${import_picocolors2.default.gray(o3)}` : ""}`;
+    default:
+      return `${n2}${import_picocolors2.default.cyan(o3)}  ${r3}
+${import_picocolors2.default.cyan(d3)}
+`;
+  }
+} }).prompt();
 var ye2 = (t2) => {
   const n2 = t2.active ?? "Yes", r3 = t2.inactive ?? "No";
   return new dD({ active: n2, inactive: r3, initialValue: t2.initialValue ?? true, render() {
@@ -42930,7 +43481,7 @@ var M2 = { message: (t2 = "", { symbol: n2 = import_picocolors2.default.gray(o3)
 }, step: (t2) => {
   M2.message(t2, { symbol: import_picocolors2.default.green(C4) });
 }, warn: (t2) => {
-  M2.message(t2, { symbol: import_picocolors2.default.yellow(U) });
+  M2.message(t2, { symbol: import_picocolors2.default.yellow(U2) });
 }, warning: (t2) => {
   M2.warn(t2);
 }, error: (t2) => {
@@ -43075,15 +43626,15 @@ var sitesCommand = defineCommand({
           );
           return;
         }
-        for (const site of sites) {
-          if (site.status === "deleted") {
+        for (const site2 of sites) {
+          if (site2.status === "deleted") {
             M2.message(
-              `${site.title}  \u2014  ${site.sitename}  (deleted, recoverable until ${site.purges_after ?? "?"} \u2014 \`drivethrough restore ${site.sitename}\`)`
+              `${site2.title}  \u2014  ${site2.sitename}  (deleted, recoverable until ${site2.purges_after ?? "?"} \u2014 \`drivethrough restore ${site2.sitename}\`)`
             );
             continue;
           }
-          const flags = [site.visibility, site.status !== "active" ? site.status : null].filter(Boolean).join(", ");
-          M2.message(`${site.title}  \u2014  ${site.local_url}  (${flags}, v${site.current_version})`);
+          const flags = [site2.visibility, site2.status !== "active" ? site2.status : null].filter(Boolean).join(", ");
+          M2.message(`${site2.title}  \u2014  ${site2.local_url}  (${flags}, v${site2.current_version})`);
         }
       });
     } catch (error62) {
@@ -43828,6 +44379,86 @@ var collaboratorsCommand = defineCommand({
   subCommands: { list: listCmd, add: addCmd }
 });
 
+// src/commands/secrets.ts
+init_api();
+var listCmd2 = defineCommand({
+  meta: { name: "list", description: "List a site's secrets (names and whether each is set \u2014 never values)" },
+  args: {
+    site: { type: "positional", description: "Site name", required: true },
+    json: { type: "boolean" }
+  },
+  async run({ args }) {
+    const jsonArgs = { json: args.json };
+    try {
+      const res = await api("GET", `/v1/sites/${encodeURIComponent(args.site)}/secrets`);
+      emit(jsonArgs, { secrets: res.secrets }, () => {
+        if (!res.secrets.length) M2.info("This site declares no secrets.");
+        for (const s2 of res.secrets) {
+          const note = s2.declared ? "" : " (not in drivethrough.json)";
+          M2.message(`${s2.name}  ${s2.set ? `set ${s2.updated_at?.slice(0, 10) ?? ""}` : "NOT SET"}${note}`);
+        }
+      });
+    } catch (error62) {
+      fail(jsonArgs, error62);
+    }
+  }
+});
+async function readValue(name) {
+  if (!process.stdin.isTTY) {
+    const chunks = [];
+    for await (const chunk of process.stdin) chunks.push(chunk);
+    return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+  }
+  const value = await ge({ message: `Value for ${name}` });
+  if (pD2(value)) process.exit(1);
+  return value;
+}
+var setCmd = defineCommand({
+  meta: { name: "set", description: "Set (or replace) a secret \u2014 the value is prompted for, or read from stdin" },
+  args: {
+    site: { type: "positional", description: "Site name", required: true },
+    name: { type: "positional", description: "Secret name, e.g. API_KEY", required: true },
+    json: { type: "boolean" }
+  },
+  async run({ args }) {
+    const jsonArgs = { json: args.json };
+    try {
+      const value = await readValue(args.name);
+      await api("PUT", `/v1/sites/${encodeURIComponent(args.site)}/secrets/${encodeURIComponent(args.name)}`, {
+        body: { value }
+      });
+      emit(jsonArgs, { name: args.name, set: true }, () => M2.success(`${args.name} is set on ${args.site}.`));
+    } catch (error62) {
+      fail(jsonArgs, error62);
+    }
+  }
+});
+var unsetCmd = defineCommand({
+  meta: { name: "unset", description: "Remove a secret's value" },
+  args: {
+    site: { type: "positional", description: "Site name", required: true },
+    name: { type: "positional", description: "Secret name", required: true },
+    json: { type: "boolean" }
+  },
+  async run({ args }) {
+    const jsonArgs = { json: args.json };
+    try {
+      await api("DELETE", `/v1/sites/${encodeURIComponent(args.site)}/secrets/${encodeURIComponent(args.name)}`);
+      emit(
+        jsonArgs,
+        { name: args.name, set: false },
+        () => M2.success(`${args.name} is unset on ${args.site}. Anything that uses it now fails until it's set again.`)
+      );
+    } catch (error62) {
+      fail(jsonArgs, error62);
+    }
+  }
+});
+var secretsCommand = defineCommand({
+  meta: { name: "secrets", description: "API keys a site's integrations use (Pro) \u2014 write-only" },
+  subCommands: { list: listCmd2, set: setCmd, unset: unsetCmd }
+});
+
 // src/commands/usage.ts
 init_api();
 function human(value, unit) {
@@ -44403,8 +45034,8 @@ function resolveSitename(root, explicit) {
   const raw = localConfigRaw(root);
   if (raw) {
     try {
-      const site = JSON.parse(raw).site;
-      if (site) return site;
+      const site2 = JSON.parse(raw).site;
+      if (site2) return site2;
     } catch {
     }
   }
@@ -44746,6 +45377,7 @@ var main = defineCommand({
     upgrade: upgradeCommand,
     domain: domainCommand,
     collaborators: collaboratorsCommand,
+    secrets: secretsCommand,
     usage: usageCommand,
     mcp: mcpCommand,
     "agent-setup": agentSetupCommand

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drivethrough-cli",
-  "version": "0.1.27",
+  "version": "0.1.29",
   "description": "Agent-first hosting CLI. Say what you want. Stay in the car.",
   "type": "module",
   "license": "MIT",