elementor-mcp-agent 0.1.0 → 1.0.0

package/dist/server.js

@@ -1,43 +1,17 @@
 #!/usr/bin/env node
-
-// src/server.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { dirname as dirname2, resolve as resolve2 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import {
-  CallToolRequestSchema,
-  ListToolsRequestSchema,
-  ListResourcesRequestSchema,
-  ReadResourceRequestSchema
-} from "@modelcontextprotocol/sdk/types.js";
-import { zodToJsonSchema } from "zod-to-json-schema";
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 
 // src/config.ts
 import { readFileSync } from "fs";
 import { z } from "zod";
-var SiteSchema = z.object({
-  id: z.string().min(1, "site id required"),
-  url: z.string().url("invalid site url"),
-  username: z.string().min(1),
-  application_password: z.string().min(20, "WP application password should be ~24 chars"),
-  ssh: z.object({
-    host: z.string(),
-    user: z.string(),
-    port: z.coerce.number().int().min(1).max(65535).default(22),
-    path: z.string().describe("WP root path on remote, e.g. ~/sites/example.com"),
-    key_path: z.string().optional().describe("absolute path to private key")
-  }).optional()
-});
-var ConfigSchema = z.object({
-  sites: z.array(SiteSchema).min(1, "at least one site is required"),
-  default_site_id: z.string().optional(),
-  rate_limit_per_minute: z.coerce.number().int().min(1).max(600).default(60),
-  confirmation_ttl_seconds: z.coerce.number().int().min(10).max(600).default(60),
-  log_level: z.enum(["trace", "debug", "info", "warn", "error", "fatal", "silent"]).default("info")
-});
-var cached = null;
 function loadConfig() {
   if (cached) return cached;
   let raw;
@@ -111,47 +85,36 @@ function getSite(siteId) {
   }
   return s;
 }
-
-// src/tools/sites.ts
-import { z as z2 } from "zod";
-
-// src/types/tool.ts
-function defineTool(def) {
-  return def;
-}
+var SiteSchema, ConfigSchema, cached;
+var init_config = __esm({
+  "src/config.ts"() {
+    "use strict";
+    SiteSchema = z.object({
+      id: z.string().min(1, "site id required"),
+      url: z.string().url("invalid site url"),
+      username: z.string().min(1),
+      application_password: z.string().min(20, "WP application password should be ~24 chars"),
+      ssh: z.object({
+        host: z.string(),
+        user: z.string(),
+        port: z.coerce.number().int().min(1).max(65535).default(22),
+        path: z.string().describe("WP root path on remote, e.g. ~/sites/example.com"),
+        key_path: z.string().optional().describe("absolute path to private key"),
+        wp_cli_path: z.string().optional().describe("Explicit wp-cli invocation prefix. Examples: 'wp' (default, if wp is in PATH), 'php ~/bin/wp.phar', '/usr/local/bin/wp'. Auto-detected if omitted.")
+      }).optional()
+    });
+    ConfigSchema = z.object({
+      sites: z.array(SiteSchema).min(1, "at least one site is required"),
+      default_site_id: z.string().optional(),
+      rate_limit_per_minute: z.coerce.number().int().min(1).max(600).default(60),
+      confirmation_ttl_seconds: z.coerce.number().int().min(10).max(600).default(60),
+      log_level: z.enum(["trace", "debug", "info", "warn", "error", "fatal", "silent"]).default("info")
+    });
+    cached = null;
+  }
+});
 
 // src/throttle/token-bucket.ts
-var TokenBucket = class {
-  constructor(capacityPerMinute) {
-    this.capacityPerMinute = capacityPerMinute;
-    this.tokens = capacityPerMinute;
-    this.refillPerMs = capacityPerMinute / 6e4;
-  }
-  capacityPerMinute;
-  tokens;
-  lastRefill = Date.now();
-  refillPerMs;
-  async acquire() {
-    while (this.tokens < 1) {
-      this.refill();
-      if (this.tokens < 1) await new Promise((r) => setTimeout(r, 80));
-    }
-    this.tokens -= 1;
-  }
-  refill() {
-    const now = Date.now();
-    this.tokens = Math.min(
-      this.capacityPerMinute,
-      this.tokens + (now - this.lastRefill) * this.refillPerMs
-    );
-    this.lastRefill = now;
-  }
-  get available() {
-    this.refill();
-    return Math.floor(this.tokens);
-  }
-};
-var buckets = /* @__PURE__ */ new Map();
 function bucketFor(siteId, perMinute) {
   let b = buckets.get(siteId);
   if (!b) {
@@ -160,20 +123,45 @@ function bucketFor(siteId, perMinute) {
   }
   return b;
 }
+var TokenBucket, buckets;
+var init_token_bucket = __esm({
+  "src/throttle/token-bucket.ts"() {
+    "use strict";
+    TokenBucket = class {
+      constructor(capacityPerMinute) {
+        this.capacityPerMinute = capacityPerMinute;
+        this.tokens = capacityPerMinute;
+        this.refillPerMs = capacityPerMinute / 6e4;
+      }
+      capacityPerMinute;
+      tokens;
+      lastRefill = Date.now();
+      refillPerMs;
+      async acquire() {
+        while (this.tokens < 1) {
+          this.refill();
+          if (this.tokens < 1) await new Promise((r) => setTimeout(r, 80));
+        }
+        this.tokens -= 1;
+      }
+      refill() {
+        const now = Date.now();
+        this.tokens = Math.min(
+          this.capacityPerMinute,
+          this.tokens + (now - this.lastRefill) * this.refillPerMs
+        );
+        this.lastRefill = now;
+      }
+      get available() {
+        this.refill();
+        return Math.floor(this.tokens);
+      }
+    };
+    buckets = /* @__PURE__ */ new Map();
+  }
+});
 
 // src/api/errors.ts
-var WPError = class extends Error {
-  constructor(kind, code, message, raw) {
-    super(message);
-    this.kind = kind;
-    this.code = code;
-    this.raw = raw;
-    this.name = "WPError";
-  }
-  kind;
-  code;
-  raw;
-};
 function fromHttp(status, body, fallback = "WordPress API error") {
   const raw = body;
   const code = raw?.code ?? `http_${status}`;
@@ -186,17 +174,41 @@ function fromHttp(status, body, fallback = "WordPress API error") {
   else if (status >= 500) kind = "server";
   return new WPError(kind, code, msg, body);
 }
+var WPError;
+var init_errors = __esm({
+  "src/api/errors.ts"() {
+    "use strict";
+    WPError = class extends Error {
+      constructor(kind, code, message, raw) {
+        super(message);
+        this.kind = kind;
+        this.code = code;
+        this.raw = raw;
+        this.name = "WPError";
+      }
+      kind;
+      code;
+      raw;
+    };
+  }
+});
 
 // src/utils/logger.ts
 import pino from "pino";
-var logger = pino(
-  {
-    level: process.env.LOG_LEVEL ?? "info",
-    base: { name: "elementor-mcp-agent" }
-  },
-  // Critical: stdout is reserved for MCP JSON-RPC. All logs MUST go to stderr.
-  pino.destination(2)
-);
+var logger;
+var init_logger = __esm({
+  "src/utils/logger.ts"() {
+    "use strict";
+    logger = pino(
+      {
+        level: process.env.LOG_LEVEL ?? "info",
+        base: { name: "elementor-mcp-agent" }
+      },
+      // Critical: stdout is reserved for MCP JSON-RPC. All logs MUST go to stderr.
+      pino.destination(2)
+    );
+  }
+});
 
 // src/api/wp-rest.ts
 function authHeader(site) {
@@ -245,23 +257,443 @@ async function wpRequest(path, opts = {}) {
   }
   return parsed;
 }
+var init_wp_rest = __esm({
+  "src/api/wp-rest.ts"() {
+    "use strict";
+    init_config();
+    init_token_bucket();
+    init_errors();
+    init_logger();
+  }
+});
+
+// src/transport/ssh-wpcli.ts
+import { spawn } from "child_process";
+async function detectWpCliPath(site, sshOpts) {
+  if (site.ssh?.wp_cli_path) return site.ssh.wp_cli_path;
+  const cached2 = wpCliPathCache.get(site.id);
+  if (cached2) return cached2;
+  const probe = `command -v wp 2>/dev/null && echo wp || (test -f "$HOME/bin/wp.phar" && echo "php $HOME/bin/wp.phar") || (test -f "$HOME/wp-cli.phar" && echo "php $HOME/wp-cli.phar") || echo NONE`;
+  const { spawn: spawn3 } = await import("child_process");
+  const result = await new Promise((resolve3) => {
+    const child = spawn3("ssh", [...sshOpts, `${site.ssh.user}@${site.ssh.host}`, probe], { stdio: ["ignore", "pipe", "pipe"] });
+    let out = "";
+    child.stdout.on("data", (b) => {
+      out += b.toString();
+    });
+    child.on("close", () => resolve3(out.trim().split("\n").pop() ?? "NONE"));
+  });
+  const detected = result === "NONE" ? "wp" : result;
+  wpCliPathCache.set(site.id, detected);
+  return detected;
+}
+async function sshWpCli(site, wpArgs, opts = {}) {
+  if (!site.ssh) {
+    throw new Error(
+      `Site '${site.id}' has no SSH configuration. WP-CLI tools require SSH access. Add an "ssh" object to the site config with at least {host, user, path}.`
+    );
+  }
+  const { host, user, port, path: wpPath, key_path } = site.ssh;
+  const timeout = opts.timeout_ms ?? 6e4;
+  const sshArgs = [
+    "-o",
+    "StrictHostKeyChecking=no",
+    "-o",
+    "BatchMode=yes",
+    "-o",
+    `ConnectTimeout=${Math.min(15, Math.floor(timeout / 1e3))}`,
+    "-p",
+    String(port ?? 22)
+  ];
+  if (key_path) sshArgs.push("-i", key_path);
+  const wpCmd = await detectWpCliPath(site, sshArgs);
+  sshArgs.push(`${user}@${host}`);
+  const remoteCmd = `${wpCmd} --path=${shellEscape(wpPath)} ${wpArgs}`;
+  sshArgs.push(remoteCmd);
+  logger.debug({ site_id: site.id, cmd: remoteCmd }, "ssh wp-cli");
+  const t0 = Date.now();
+  return new Promise((resolve3, reject) => {
+    const child = spawn("ssh", sshArgs, { stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    const killer = setTimeout(() => {
+      child.kill("SIGKILL");
+      reject(new Error(`SSH wp-cli timed out after ${timeout}ms: ${remoteCmd}`));
+    }, timeout);
+    child.stdout.on("data", (b) => {
+      stdout += b.toString();
+    });
+    child.stderr.on("data", (b) => {
+      stderr += b.toString();
+    });
+    child.on("error", (e) => {
+      clearTimeout(killer);
+      reject(e);
+    });
+    child.on("close", (code) => {
+      clearTimeout(killer);
+      const duration_ms = Date.now() - t0;
+      const cleanedStderr = stderr.split("\n").filter((l) => !l.includes("post-quantum") && !l.includes("openssh.com/pq") && !l.includes("decrypt later") && !l.includes("This session may be") && !l.includes("server may need to be")).join("\n").trim();
+      resolve3({
+        stdout: stdout.trim(),
+        stderr: cleanedStderr,
+        exitCode: code ?? -1,
+        duration_ms,
+        command: remoteCmd
+      });
+    });
+  });
+}
+function shellEscape(s) {
+  return `'${s.replace(/'/g, "'\\''")}'`;
+}
+function isDestructiveWpCli(args) {
+  return DESTRUCTIVE_WPCLI_PATTERNS.some((p) => p.test(args));
+}
+var wpCliPathCache, DESTRUCTIVE_WPCLI_PATTERNS;
+var init_ssh_wpcli = __esm({
+  "src/transport/ssh-wpcli.ts"() {
+    "use strict";
+    init_logger();
+    wpCliPathCache = /* @__PURE__ */ new Map();
+    DESTRUCTIVE_WPCLI_PATTERNS = [
+      /\bdelete-all\b/i,
+      /\bdelete\b(?!.*--dry-run)/i,
+      /\bdrop\b/i,
+      /\bdb\s+(reset|drop)\b/i,
+      /\bpost\s+delete\b/i,
+      /\boption\s+delete\b/i,
+      /\bplugin\s+(deactivate|uninstall)\b/i,
+      /\bsearch-replace\b(?!.*--dry-run)/i,
+      /\buser\s+delete\b/i
+    ];
+  }
+});
+
+// src/elementor/backup.ts
+var backup_exports = {};
+__export(backup_exports, {
+  fullBackup: () => fullBackup,
+  listBackups: () => listBackups,
+  restoreBackup: () => restoreBackup,
+  restoreFromFile: () => restoreFromFile
+});
+import { writeFileSync, mkdirSync, existsSync, readFileSync as readFileSync2 } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+async function fullBackup(siteId, postId, opts = {}) {
+  const current = await wpRequest(
+    `/wp/v2/pages/${postId}?context=edit&_fields=meta,title`,
+    { siteId }
+  );
+  const data_raw_v = current.meta?._elementor_data;
+  const data_raw = typeof data_raw_v === "string" ? data_raw_v : JSON.stringify(data_raw_v ?? []);
+  const settings_raw_v = current.meta?._elementor_page_settings;
+  const settings_raw = typeof settings_raw_v === "string" ? settings_raw_v : JSON.stringify(settings_raw_v ?? {});
+  const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const meta_key = `_elementor_data_backup_${ts}`;
+  const page_settings_meta_key = `_elementor_page_settings_backup_${ts}`;
+  const size_bytes = data_raw.length + settings_raw.length;
+  const site = getSite(siteId);
+  let method = "file";
+  if (site.ssh && !opts.force_file_only) {
+    try {
+      const setDataCmd = `post meta update ${postId} ${meta_key} ${shellQuote(data_raw)}`;
+      const setSettingsCmd = `post meta update ${postId} ${page_settings_meta_key} ${shellQuote(settings_raw)}`;
+      const r1 = await sshWpCli(site, setDataCmd, { timeout_ms: 3e4 });
+      if (r1.exitCode !== 0) throw new Error(`wp-cli postmeta data set failed: ${r1.stderr}`);
+      const r2 = await sshWpCli(site, setSettingsCmd, { timeout_ms: 3e4 });
+      if (r2.exitCode !== 0) throw new Error(`wp-cli postmeta settings set failed: ${r2.stderr}`);
+      method = "wp-cli";
+    } catch (e) {
+      logger.warn({ err: e.message }, "WP-CLI backup failed, falling back to file");
+    }
+  }
+  let file_path;
+  if (opts.to_file || method !== "wp-cli") {
+    if (!existsSync(BACKUP_DIR)) mkdirSync(BACKUP_DIR, { recursive: true });
+    const safeSiteId = (siteId ?? "default").replace(/[^a-zA-Z0-9_-]/g, "_");
+    const filename = `${safeSiteId}_page${postId}_${ts}.json`;
+    file_path = join(BACKUP_DIR, filename);
+    writeFileSync(file_path, JSON.stringify({
+      site_id: siteId,
+      page_id: postId,
+      title: current.title.rendered,
+      timestamp: ts,
+      _elementor_data: data_raw,
+      _elementor_page_settings: settings_raw
+    }, null, 2));
+    if (method !== "wp-cli") method = "file";
+    logger.info({ file_path }, "backup written to file");
+  }
+  return {
+    meta_key,
+    page_settings_meta_key,
+    file_path,
+    size_bytes,
+    method
+  };
+}
+async function restoreBackup(siteId, postId, data_meta_key, settings_meta_key) {
+  const site = getSite(siteId);
+  if (!site.ssh) {
+    throw new Error("Restoring from postmeta backup requires SSH (WP-CLI). For file backups, use restoreFromFile.");
+  }
+  const r1 = await sshWpCli(site, `post meta get ${postId} ${data_meta_key}`, { timeout_ms: 3e4 });
+  if (r1.exitCode !== 0) throw new Error(`Backup '${data_meta_key}' not found: ${r1.stderr}`);
+  const data_value = r1.stdout;
+  if (!data_value) throw new Error(`Backup '${data_meta_key}' is empty`);
+  let settings_value;
+  if (settings_meta_key) {
+    const r2 = await sshWpCli(site, `post meta get ${postId} ${settings_meta_key}`, { timeout_ms: 3e4 });
+    if (r2.exitCode === 0 && r2.stdout) settings_value = r2.stdout;
+  }
+  const writeData = await sshWpCli(site, `post meta update ${postId} _elementor_data ${shellQuote(data_value)}`, { timeout_ms: 3e4 });
+  if (writeData.exitCode !== 0) throw new Error(`Restore write failed: ${writeData.stderr}`);
+  if (settings_value !== void 0) {
+    await sshWpCli(site, `post meta update ${postId} _elementor_page_settings ${shellQuote(settings_value)}`, { timeout_ms: 3e4 });
+  }
+  return { restored: true, method: "wp-cli" };
+}
+async function listBackups(siteId, postId) {
+  const site = getSite(siteId);
+  if (!site.ssh) {
+    throw new Error("Listing postmeta backups requires SSH (WP-CLI). REST API doesn't expose unregistered custom postmeta keys.");
+  }
+  const r = await sshWpCli(site, `post meta list ${postId} --format=json --fields=meta_key`, { timeout_ms: 3e4 });
+  if (r.exitCode !== 0) throw new Error(`wp-cli post meta list failed: ${r.stderr}`);
+  const all = JSON.parse(r.stdout);
+  const dataBackupKeys = all.filter((m) => m.meta_key.startsWith("_elementor_data_backup_"));
+  const settingsBackupKeys = new Set(all.filter((m) => m.meta_key.startsWith("_elementor_page_settings_backup_")).map((m) => m.meta_key));
+  return dataBackupKeys.map((m) => {
+    const ts = m.meta_key.replace("_elementor_data_backup_", "");
+    const expectedSettingsKey = `_elementor_page_settings_backup_${ts}`;
+    return {
+      meta_key: m.meta_key,
+      settings_key: settingsBackupKeys.has(expectedSettingsKey) ? expectedSettingsKey : void 0,
+      timestamp: ts
+    };
+  });
+}
+async function restoreFromFile(siteId, postId, file_path) {
+  if (!existsSync(file_path)) throw new Error(`Backup file not found: ${file_path}`);
+  const j = JSON.parse(readFileSync2(file_path, "utf8"));
+  if (!j._elementor_data) throw new Error("Backup file missing _elementor_data");
+  const site = getSite(siteId);
+  if (site.ssh) {
+    await sshWpCli(site, `post meta update ${postId} _elementor_data ${shellQuote(j._elementor_data)}`, { timeout_ms: 3e4 });
+    if (j._elementor_page_settings) {
+      await sshWpCli(site, `post meta update ${postId} _elementor_page_settings ${shellQuote(j._elementor_page_settings)}`, { timeout_ms: 3e4 });
+    }
+    return { restored: true, method: "wp-cli" };
+  }
+  await wpRequest(`/wp/v2/pages/${postId}`, {
+    siteId,
+    method: "PUT",
+    body: {
+      meta: {
+        _elementor_data: j._elementor_data,
+        ...j._elementor_page_settings ? { _elementor_page_settings: j._elementor_page_settings } : {}
+      }
+    }
+  });
+  return { restored: true, method: "rest" };
+}
+function shellQuote(s) {
+  return `'${s.replace(/'/g, "'\\''")}'`;
+}
+var BACKUP_DIR;
+var init_backup = __esm({
+  "src/elementor/backup.ts"() {
+    "use strict";
+    init_wp_rest();
+    init_ssh_wpcli();
+    init_config();
+    init_logger();
+    BACKUP_DIR = process.env.ELEMENTOR_MCP_BACKUP_DIR ?? join(tmpdir(), "elementor-mcp-backups");
+  }
+});
+
+// src/elementor/css-flush.ts
+var css_flush_exports = {};
+__export(css_flush_exports, {
+  flushCSS: () => flushCSS
+});
+async function flushCSS(siteId, postId) {
+  try {
+    const url = postId ? `/elementor/v1/css?id=${postId}&action=regenerate` : `/elementor/v1/css?action=regenerate`;
+    await wpRequest(url, { siteId, method: "POST" });
+    return { method: "rest" };
+  } catch (e) {
+    logger.debug({ err: e.message }, "REST css flush failed, trying next");
+  }
+  try {
+    const site = getSite(siteId);
+    if (site.ssh) {
+      const r = await sshWpCli(site, "elementor flush-css");
+      if (r.exitCode === 0) return { method: "wp-cli", details: r.stdout };
+    }
+  } catch (e) {
+    logger.debug({ err: e.message }, "WP-CLI css flush failed, trying next");
+  }
+  try {
+    const site = getSite(siteId);
+    if (site.ssh) {
+      await sshWpCli(site, "option delete _elementor_global_css", { timeout_ms: 3e4 });
+      await sshWpCli(site, "post meta delete-all _elementor_css", { timeout_ms: 3e4 });
+      return { method: "option-delete" };
+    }
+  } catch (e) {
+    logger.debug({ err: e.message }, "WP-CLI option-delete failed, trying next");
+  }
+  if (postId) {
+    try {
+      await wpRequest(`/wp/v2/pages/${postId}`, {
+        siteId,
+        method: "PUT",
+        body: { date: (/* @__PURE__ */ new Date()).toISOString() }
+      });
+      return { method: "resave" };
+    } catch (e) {
+      logger.warn({ err: e.message }, "Resave fallback also failed");
+    }
+  }
+  return { method: "none", details: "All CSS flush strategies failed" };
+}
+var init_css_flush = __esm({
+  "src/elementor/css-flush.ts"() {
+    "use strict";
+    init_wp_rest();
+    init_ssh_wpcli();
+    init_config();
+    init_logger();
+  }
+});
+
+// src/elementor/policies.ts
+var policies_exports = {};
+__export(policies_exports, {
+  FORBIDDEN_WPCLI_PATTERNS: () => FORBIDDEN_WPCLI_PATTERNS,
+  POLICIES: () => POLICIES,
+  isForbiddenWpCli: () => isForbiddenWpCli
+});
+function isForbiddenWpCli(args) {
+  for (const p of FORBIDDEN_WPCLI_PATTERNS) {
+    if (p.test(args)) return { forbidden: true, reason: `Pattern ${p} is hard-blocked.` };
+  }
+  return { forbidden: false };
+}
+var POLICIES, FORBIDDEN_WPCLI_PATTERNS;
+var init_policies = __esm({
+  "src/elementor/policies.ts"() {
+    "use strict";
+    POLICIES = {
+      // Always backup _elementor_data BEFORE any write
+      BACKUP_BEFORE_WRITE: true,
+      // Always backup _elementor_page_settings too (it carries page-level CSS, fonts, layout)
+      BACKUP_PAGE_SETTINGS: true,
+      // Re-validate the JSON after a programmatic edit; abort + auto-restore if invalid
+      VALIDATE_JSON_AFTER_EDIT: true,
+      // Block edits to global widgets unless caller explicitly opts in
+      BLOCK_GLOBAL_WIDGET_WRITES_BY_DEFAULT: true,
+      // Confirmation token TTL — short for destructive ops
+      CONFIRMATION_TTL_SECONDS: 60,
+      // Stricter TTL for global widget ops (less margin for mistakes)
+      GLOBAL_WIDGET_CONFIRMATION_TTL_SECONDS: 30,
+      // CSS flush is non-optional after _elementor_data writes
+      FLUSH_CSS_AFTER_WRITE: true,
+      // Maximum size of a single page's _elementor_data we'll touch (sanity bound)
+      MAX_ELEMENTOR_DATA_BYTES: 5 * 1024 * 1024,
+      // 5 MB
+      // wp-cli commands matching this pattern require confirmation
+      WP_CLI_DESTRUCTIVE_REQUIRES_CONFIRM: true
+    };
+    FORBIDDEN_WPCLI_PATTERNS = [
+      // Hard 'no' regardless of confirmation — we never accept these
+      /\brm\s+-rf\b/i,
+      /\bsudo\b/i,
+      /\bdb\s+reset\s+--yes\b/i,
+      /\bdb\s+drop\s+--yes\b/i
+    ];
+  }
+});
+
+// src/utils/confirmation.ts
+var confirmation_exports = {};
+__export(confirmation_exports, {
+  _clearAllConfirmations: () => _clearAllConfirmations,
+  consumeConfirmation: () => consumeConfirmation,
+  issueConfirmation: () => issueConfirmation
+});
+import { randomBytes } from "crypto";
+function issueConfirmation(intent, payload, ttlSeconds) {
+  const token = randomBytes(8).toString("hex");
+  pending.set(token, {
+    token,
+    intent,
+    payload,
+    expiresAt: Date.now() + ttlSeconds * 1e3
+  });
+  return token;
+}
+function consumeConfirmation(token, expectedIntent) {
+  const c = pending.get(token);
+  if (!c) return null;
+  pending.delete(token);
+  if (c.expiresAt < Date.now()) return null;
+  if (c.intent !== expectedIntent) return null;
+  return c;
+}
+function _clearAllConfirmations() {
+  pending.clear();
+}
+var pending;
+var init_confirmation = __esm({
+  "src/utils/confirmation.ts"() {
+    "use strict";
+    pending = /* @__PURE__ */ new Map();
+  }
+});
+
+// src/server.ts
+init_config();
+import { readFileSync as readFileSync5 } from "fs";
+import { dirname as dirname2, resolve as resolve2 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import {
+  CallToolRequestSchema,
+  ListToolsRequestSchema,
+  ListResourcesRequestSchema,
+  ReadResourceRequestSchema
+} from "@modelcontextprotocol/sdk/types.js";
+import { zodToJsonSchema } from "zod-to-json-schema";
+
+// src/tools/sites.ts
+import { z as z2 } from "zod";
+
+// src/types/tool.ts
+function defineTool(def) {
+  return def;
+}
 
 // src/tools/sites.ts
+init_config();
+init_wp_rest();
 var listSitesTool = defineTool({
   name: "list_sites",
-  description: "List every WordPress site configured in this MCP server's pool. Best called first in a session to discover available sites.",
+  description: "List every WordPress site configured. Best called first in a session.",
   inputSchema: z2.object({}),
   outputSchema: z2.object({
     total: z2.number(),
     default_site_id: z2.string().optional(),
-    sites: z2.array(
-      z2.object({
-        id: z2.string(),
-        url: z2.string(),
-        username: z2.string(),
-        has_ssh: z2.boolean()
-      })
-    )
+    sites: z2.array(z2.object({
+      id: z2.string(),
+      url: z2.string(),
+      username: z2.string(),
+      has_ssh: z2.boolean()
+    }))
   }),
   annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: false },
   async handler() {
@@ -269,21 +701,14 @@ var listSitesTool = defineTool({
     return {
       total: cfg.sites.length,
       default_site_id: cfg.default_site_id ?? cfg.sites[0]?.id,
-      sites: cfg.sites.map((s) => ({
-        id: s.id,
-        url: s.url,
-        username: s.username,
-        has_ssh: !!s.ssh
-      }))
+      sites: cfg.sites.map((s) => ({ id: s.id, url: s.url, username: s.username, has_ssh: !!s.ssh }))
     };
   }
 });
 var pingSiteTool = defineTool({
   name: "ping_site",
-  description: "Verify connectivity + authentication to a WordPress site. Calls /wp-json/wp/v2/users/me to validate credentials and returns the WP version + Elementor version if detected.",
-  inputSchema: z2.object({
-    site_id: z2.string().optional().describe("Site id from list_sites. Defaults to the default site.")
-  }),
+  description: "Verify connectivity + authentication to a WordPress site. Returns user identity + WP/Elementor/Elementor Pro versions if accessible.",
+  inputSchema: z2.object({ site_id: z2.string().optional() }),
   outputSchema: z2.object({
     ok: z2.boolean(),
     site_id: z2.string(),
@@ -298,29 +723,19 @@ var pingSiteTool = defineTool({
   async handler(input) {
     const site = getSite(input.site_id);
     try {
-      const me = await wpRequest(
-        "/wp/v2/users/me?context=edit",
-        { siteId: site.id }
-      );
+      const me = await wpRequest("/wp/v2/users/me?context=edit", { siteId: site.id });
       let wp_version;
       try {
-        const health = await wpRequest(
-          "/wp-site-health/v1/info",
-          { siteId: site.id }
-        );
+        const health = await wpRequest("/wp-site-health/v1/info", { siteId: site.id });
         wp_version = health.wordpress?.version;
       } catch {
       }
       let elementor_version;
       let elementor_pro_version;
       try {
-        const plugins = await wpRequest(
-          "/wp/v2/plugins",
-          { siteId: site.id }
-        );
+        const plugins = await wpRequest("/wp/v2/plugins", { siteId: site.id });
         for (const p of plugins) {
-          if (p.plugin.startsWith("elementor/") && p.plugin.endsWith("/elementor.php"))
-            elementor_version = p.version;
+          if (p.plugin.startsWith("elementor/") && p.plugin.endsWith("/elementor.php")) elementor_version = p.version;
           if (p.plugin.startsWith("elementor-pro/")) elementor_pro_version = p.version;
         }
       } catch {
@@ -335,18 +750,85 @@ var pingSiteTool = defineTool({
         user: { id: me.id, name: me.name, roles: me.roles }
       };
     } catch (e) {
-      return {
-        ok: false,
-        site_id: site.id,
-        url: site.url,
-        error: e.message
-      };
+      return { ok: false, site_id: site.id, url: site.url, error: e.message };
+    }
+  }
+});
+var siteHealthTool = defineTool({
+  name: "site_health",
+  description: "Comprehensive site health snapshot: WP/PHP/Elementor versions, disk space (if SSH), plugin count, theme info. Aggregates multiple REST calls into a single overview.",
+  inputSchema: z2.object({ site_id: z2.string().optional() }),
+  outputSchema: z2.object({
+    site_id: z2.string(),
+    url: z2.string(),
+    wp_version: z2.string().optional(),
+    php_version: z2.string().optional(),
+    elementor_version: z2.string().optional(),
+    elementor_pro_version: z2.string().optional(),
+    active_theme: z2.string().optional(),
+    plugins_total: z2.number().optional(),
+    plugins_active: z2.number().optional(),
+    plugins_outdated: z2.number().optional(),
+    elementor_pages_count: z2.number().optional(),
+    errors: z2.array(z2.string())
+  }),
+  annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  async handler(input) {
+    const site = getSite(input.site_id);
+    const errors = [];
+    let wp_version, php_version, elementor_version, elementor_pro_version, active_theme;
+    let plugins_total, plugins_active, plugins_outdated, elementor_pages_count;
+    try {
+      const info = await wpRequest("/wp-site-health/v1/info", { siteId: site.id });
+      wp_version = info.wordpress?.version;
+      php_version = info["wp-server"]?.fields?.php_version?.value;
+    } catch (e) {
+      errors.push("site-health: " + e.message);
+    }
+    try {
+      const plugins = await wpRequest("/wp/v2/plugins", { siteId: site.id });
+      plugins_total = plugins.length;
+      plugins_active = plugins.filter((p) => p.status === "active").length;
+      for (const p of plugins) {
+        if (p.plugin.startsWith("elementor/") && p.plugin.endsWith("/elementor.php")) elementor_version = p.version;
+        if (p.plugin.startsWith("elementor-pro/")) elementor_pro_version = p.version;
+      }
+    } catch (e) {
+      errors.push("plugins: " + e.message);
+    }
+    try {
+      const themes = await wpRequest("/wp/v2/themes", { siteId: site.id });
+      const active = themes.find((t) => t.status === "active");
+      active_theme = active?.name?.raw;
+    } catch (e) {
+      errors.push("themes: " + e.message);
+    }
+    try {
+      const pages = await wpRequest("/wp/v2/pages", { siteId: site.id, query: { meta_key: "_elementor_edit_mode", meta_value: "builder", per_page: 1, _fields: "id" } });
+      elementor_pages_count = pages.length > 0 ? -1 : 0;
+    } catch (e) {
+      errors.push("pages: " + e.message);
     }
+    return {
+      site_id: site.id,
+      url: site.url,
+      wp_version,
+      php_version,
+      elementor_version,
+      elementor_pro_version,
+      active_theme,
+      plugins_total,
+      plugins_active,
+      plugins_outdated,
+      elementor_pages_count,
+      errors
+    };
   }
 });
 
 // src/tools/pages.ts
 import { z as z3 } from "zod";
+init_wp_rest();
 
 // src/elementor/data-parser.ts
 function parseElementorData(raw) {
@@ -422,59 +904,101 @@ function summarize(data) {
   return { totalElements, sections, containers, columns, widgets, byWidgetType, maxDepth };
 }
 
-// src/elementor/safety.ts
-async function backupElementorData(siteId, postId) {
-  const current = await wpRequest(`/wp/v2/pages/${postId}?context=edit&_fields=meta`, { siteId });
-  const raw = current.meta?._elementor_data ?? "[]";
-  const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const meta_key = `_elementor_data_backup_${ts}`;
-  await wpRequest(`/wp/v2/pages/${postId}`, {
+// src/tools/pages.ts
+init_backup();
+init_css_flush();
+
+// src/elementor/validator.ts
+init_policies();
+function validateElementorData(input) {
+  const errors = [];
+  const warnings = [];
+  if (typeof input === "string" && input.length > POLICIES.MAX_ELEMENTOR_DATA_BYTES) {
+    errors.push(`_elementor_data exceeds ${POLICIES.MAX_ELEMENTOR_DATA_BYTES} bytes (got ${input.length})`);
+    return { valid: false, errors, warnings };
+  }
+  let data;
+  try {
+    data = parseElementorData(input);
+  } catch (e) {
+    errors.push(`JSON parse failed: ${e.message}`);
+    return { valid: false, errors, warnings };
+  }
+  function validateElement(el, depth, path) {
+    const here = [...path, el.id ?? "?"];
+    if (typeof el.id !== "string" || el.id.length === 0) {
+      errors.push(`element at ${here.join(".")}: missing or empty id`);
+    }
+    if (!["section", "container", "column", "widget"].includes(el.elType)) {
+      errors.push(`element ${el.id}: unknown elType "${el.elType}"`);
+    }
+    if (el.elType === "widget" && (typeof el.widgetType !== "string" || el.widgetType.length === 0)) {
+      errors.push(`widget ${el.id}: missing widgetType`);
+    }
+    if (el.settings === null || el.settings === void 0 || typeof el.settings !== "object" || Array.isArray(el.settings)) {
+      errors.push(`element ${el.id}: settings must be an object (got ${typeof el.settings})`);
+    }
+    if (depth > 20) warnings.push(`element ${el.id}: depth ${depth} is unusually deep`);
+    if (Array.isArray(el.elements)) {
+      for (const child of el.elements) validateElement(child, depth + 1, here);
+    }
+  }
+  if (!Array.isArray(data)) {
+    errors.push("Top-level must be an array");
+    return { valid: false, errors, warnings };
+  }
+  for (const el of data) validateElement(el, 0, []);
+  return { valid: errors.length === 0, errors, warnings };
+}
+
+// src/elementor/globals.ts
+init_wp_rest();
+async function listGlobalWidgets(siteId) {
+  const items = await wpRequest("/wp/v2/elementor_library", {
     siteId,
-    method: "PUT",
-    body: { meta: { [meta_key]: raw } }
+    query: {
+      context: "edit",
+      per_page: 100,
+      _fields: "id,title,meta"
+    }
+  });
+  const widgetsOnly = items.filter((t) => t.meta?._elementor_template_type === "widget");
+  return widgetsOnly.map((t) => {
+    const data = parseElementorData(t.meta?._elementor_data ?? "[]");
+    let widget_type;
+    for (const { element } of walkElements(data)) {
+      if (element.elType === "widget") {
+        widget_type = element.widgetType;
+        break;
+      }
+    }
+    return {
+      template_id: t.id,
+      title: t.title.rendered,
+      widget_type
+    };
   });
-  return { meta_key, size_bytes: raw.length };
 }
-async function flushElementorCSS(siteId, postId) {
+function findGlobalReferences(data) {
+  const out = [];
   try {
-    await wpRequest(`/elementor/v1/css?id=${postId}&action=regenerate`, { siteId, method: "POST" });
-    return { method: "rest" };
+    for (const { element } of walkElements(parseElementorData(data))) {
+      if (element.elType === "widget" && element.widgetType === "global") {
+        const tid = element.settings.template_id ?? element.settings.templateID;
+        if (typeof tid === "number") out.push({ widget_id: element.id, template_id: tid });
+      }
+    }
   } catch {
-    await wpRequest(`/wp/v2/pages/${postId}`, {
-      siteId,
-      method: "PUT",
-      body: { date: (/* @__PURE__ */ new Date()).toISOString() }
-    });
-    return { method: "resave" };
   }
-}
-
-// src/utils/confirmation.ts
-import { randomBytes } from "crypto";
-var pending = /* @__PURE__ */ new Map();
-function issueConfirmation(intent, payload, ttlSeconds) {
-  const token = randomBytes(8).toString("hex");
-  pending.set(token, {
-    token,
-    intent,
-    payload,
-    expiresAt: Date.now() + ttlSeconds * 1e3
-  });
-  return token;
-}
-function consumeConfirmation(token, expectedIntent) {
-  const c = pending.get(token);
-  if (!c) return null;
-  pending.delete(token);
-  if (c.expiresAt < Date.now()) return null;
-  if (c.intent !== expectedIntent) return null;
-  return c;
+  return out;
 }
 
 // src/tools/pages.ts
+init_confirmation();
+init_policies();
 var listElementorPagesTool = defineTool({
   name: "list_elementor_pages",
-  description: "List pages on a site that are built with Elementor (i.e. have _elementor_edit_mode = 'builder'). Returns id, title, slug, status, modified date.",
+  description: "List pages built with Elementor (have _elementor_edit_mode = 'builder'). Returns id, title, slug, status, modified date.",
   inputSchema: z3.object({
     site_id: z3.string().optional(),
     per_page: z3.number().int().min(1).max(100).default(25),
@@ -482,16 +1006,14 @@ var listElementorPagesTool = defineTool({
   }),
   outputSchema: z3.object({
     total: z3.number(),
-    pages: z3.array(
-      z3.object({
-        id: z3.number(),
-        title: z3.string(),
-        slug: z3.string(),
-        status: z3.string(),
-        link: z3.string(),
-        modified: z3.string()
-      })
-    )
+    pages: z3.array(z3.object({
+      id: z3.number(),
+      title: z3.string(),
+      slug: z3.string(),
+      status: z3.string(),
+      link: z3.string(),
+      modified: z3.string()
+    }))
   }),
   annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true },
   async handler(input) {
@@ -521,11 +1043,11 @@ var listElementorPagesTool = defineTool({
 });
 var readPageElementorTool = defineTool({
   name: "read_page_elementor",
-  description: "Fetch the raw _elementor_data of a page and return a structured summary (counts by widget type, depth, total elements). Optionally returns the full parsed tree (verbose=true) which may be very large.",
+  description: "Fetch a page's Elementor data structure summary. With verbose=true returns the full parsed tree (potentially MBs).",
   inputSchema: z3.object({
     site_id: z3.string().optional(),
     page_id: z3.number().int().positive(),
-    verbose: z3.boolean().default(false).describe("If true, return the entire parsed Elementor data tree (can be MBs).")
+    verbose: z3.boolean().default(false)
   }),
   outputSchema: z3.object({
     page_id: z3.number(),
@@ -539,6 +1061,7 @@ var readPageElementorTool = defineTool({
       maxDepth: z3.number(),
       byWidgetType: z3.record(z3.number())
     }),
+    global_references: z3.array(z3.object({ widget_id: z3.string(), template_id: z3.number() })),
     data: z3.array(z3.any()).optional()
   }),
   annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true },
@@ -549,113 +1072,426 @@ var readPageElementorTool = defineTool({
     );
     const raw = page.meta?._elementor_data ?? "[]";
     const data = parseElementorData(raw);
-    const summary = summarize(data);
     return {
       page_id: page.id,
       title: page.title.rendered,
-      summary,
+      summary: summarize(data),
+      global_references: findGlobalReferences(raw),
       data: input.verbose ? data : void 0
     };
   }
 });
+var listWidgetsInPageTool = defineTool({
+  name: "list_widgets_in_page",
+  description: "Flat list of every widget in a page with id, type, parent path, and an excerpt of the first text setting (for spot-checking before find/replace).",
+  inputSchema: z3.object({
+    site_id: z3.string().optional(),
+    page_id: z3.number().int().positive(),
+    widget_type: z3.string().optional()
+  }),
+  outputSchema: z3.object({
+    page_id: z3.number(),
+    total: z3.number(),
+    widgets: z3.array(z3.object({
+      widget_id: z3.string(),
+      widget_type: z3.string(),
+      path: z3.array(z3.string()),
+      excerpt: z3.string().optional()
+    }))
+  }),
+  annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  async handler(input) {
+    const page = await wpRequest(
+      `/wp/v2/pages/${input.page_id}?context=edit&_fields=id,meta`,
+      { siteId: input.site_id }
+    );
+    const data = parseElementorData(page.meta?._elementor_data ?? "[]");
+    const widgets = [];
+    for (const { element, path } of walkElements(data)) {
+      if (element.elType !== "widget") continue;
+      if (input.widget_type && element.widgetType !== input.widget_type) continue;
+      let excerpt;
+      for (const v of Object.values(element.settings ?? {})) {
+        if (typeof v === "string" && v.length > 0) {
+          excerpt = v.replace(/<[^>]+>/g, "").slice(0, 80);
+          break;
+        }
+      }
+      widgets.push({
+        widget_id: element.id,
+        widget_type: element.widgetType ?? "unknown",
+        path: path.slice(0, -1),
+        excerpt
+      });
+    }
+    return { page_id: page.id, total: widgets.length, widgets };
+  }
+});
+var listGlobalWidgetsTool = defineTool({
+  name: "list_global_widgets",
+  description: "List all global widgets on a site (Elementor library entries of type 'widget'). These are shared across pages \u2014 editing one affects every page using it.",
+  inputSchema: z3.object({ site_id: z3.string().optional() }),
+  outputSchema: z3.object({
+    total: z3.number(),
+    globals: z3.array(z3.object({
+      template_id: z3.number(),
+      title: z3.string(),
+      widget_type: z3.string().optional()
+    }))
+  }),
+  annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  async handler(input) {
+    const globals = await listGlobalWidgets(input.site_id);
+    return { total: globals.length, globals };
+  }
+});
+var preflightCheckTool = defineTool({
+  name: "preflight_check",
+  description: "Validate a page is safe to edit. Checks: page exists, is Elementor-built, data parses cleanly, references valid global widgets, isn't currently locked by another editor.",
+  inputSchema: z3.object({
+    site_id: z3.string().optional(),
+    page_id: z3.number().int().positive()
+  }),
+  outputSchema: z3.object({
+    safe_to_edit: z3.boolean(),
+    page_id: z3.number(),
+    title: z3.string(),
+    issues: z3.array(z3.string()),
+    warnings: z3.array(z3.string()),
+    data_bytes: z3.number(),
+    global_widget_references: z3.number()
+  }),
+  annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  async handler(input) {
+    const issues = [];
+    const warnings = [];
+    let title = "";
+    let data_bytes = 0;
+    let global_widget_references = 0;
+    try {
+      const page = await wpRequest(
+        `/wp/v2/pages/${input.page_id}?context=edit`,
+        { siteId: input.site_id }
+      );
+      title = page.title.rendered;
+      const raw = page.meta?._elementor_data ?? "[]";
+      data_bytes = raw.length;
+      if (page.meta?._elementor_edit_mode !== "builder") {
+        issues.push("Page is not in Elementor builder mode");
+      }
+      const v = validateElementorData(raw);
+      if (!v.valid) issues.push(...v.errors);
+      warnings.push(...v.warnings);
+      global_widget_references = findGlobalReferences(raw).length;
+      if (global_widget_references > 0) {
+        warnings.push(`Page references ${global_widget_references} global widget(s). Edits via find_replace will NOT affect the globals themselves \u2014 modify the global template directly if needed.`);
+      }
+      if (data_bytes > POLICIES.MAX_ELEMENTOR_DATA_BYTES) {
+        issues.push(`Elementor data exceeds policy max (${POLICIES.MAX_ELEMENTOR_DATA_BYTES} bytes)`);
+      }
+    } catch (e) {
+      issues.push(`Cannot fetch page: ${e.message}`);
+    }
+    return { safe_to_edit: issues.length === 0, page_id: input.page_id, title, issues, warnings, data_bytes, global_widget_references };
+  }
+});
 var findReplaceTool = defineTool({
   name: "elementor_find_replace",
-  description: "Find/replace plain text in every widget's settings on a single page. TWO-CALL DESTRUCTIVE FLOW: first call without `confirmation` performs a dry-run and returns a confirmation token + match count. Second call with the token actually applies the change after backing up the page's elementor data.",
+  description: "Find/replace plain text in every widget on one page. TWO-CALL FLOW: dry-run returns match_count + detailed widget hits + confirmation_token. Second call with token applies the change with auto-backup + JSON validation + auto-rollback if validation fails + CSS flush.",
   inputSchema: z3.object({
     site_id: z3.string().optional(),
     page_id: z3.number().int().positive(),
     find: z3.string().min(1),
     replace: z3.string(),
-    widget_type: z3.string().optional().describe("Restrict to one widget type, e.g. 'heading'."),
+    widget_type: z3.string().optional(),
     case_sensitive: z3.boolean().default(false),
-    confirmation: z3.string().optional().describe("Token returned from the dry-run call.")
+    backup_to_file: z3.boolean().default(false).describe("Also dump backup to /tmp/elementor-mcp-backups/"),
+    confirmation: z3.string().optional()
   }),
   outputSchema: z3.object({
-    mode: z3.enum(["dry_run", "applied"]),
+    mode: z3.enum(["dry_run", "applied", "rolled_back"]),
     page_id: z3.number(),
     match_count: z3.number(),
+    affected_widgets: z3.array(z3.object({
+      widget_id: z3.string(),
+      widget_type: z3.string(),
+      before: z3.string(),
+      after: z3.string()
+    })).optional(),
     confirmation_token: z3.string().optional(),
     expires_in_seconds: z3.number().optional(),
     backup_meta_key: z3.string().optional(),
-    css_flush: z3.string().optional()
+    backup_file: z3.string().optional(),
+    css_flush: z3.string().optional(),
+    validation_error: z3.string().optional()
   }),
   annotations: { destructiveHint: true, idempotentHint: false, openWorldHint: true },
   async handler(input) {
-    const cfg = loadConfig();
     const page = await wpRequest(
-      `/wp/v2/pages/${input.page_id}?context=edit`,
+      `/wp/v2/pages/${input.page_id}?context=edit&_fields=id,meta`,
       { siteId: input.site_id }
     );
     const raw = page.meta?._elementor_data ?? "[]";
-    const data = parseElementorData(raw);
-    const dry = findReplaceInWidgets(JSON.parse(JSON.stringify(data)), input.find, input.replace, {
+    const dryData = parseElementorData(raw);
+    const dry = findReplaceInWidgets(JSON.parse(JSON.stringify(dryData)), input.find, input.replace, {
       widgetType: input.widget_type,
       caseSensitive: input.case_sensitive
     });
+    const affected = [];
+    const beforeData = parseElementorData(raw);
+    const afterCopy = JSON.parse(JSON.stringify(beforeData));
+    findReplaceInWidgets(afterCopy, input.find, input.replace, {
+      widgetType: input.widget_type,
+      caseSensitive: input.case_sensitive
+    });
+    function collectAffected(orig, modified) {
+      const beforeMap = /* @__PURE__ */ new Map();
+      for (const { element } of walkElements(orig)) {
+        if (element.elType !== "widget") continue;
+        const firstStr = Object.values(element.settings ?? {}).find((v) => typeof v === "string");
+        if (firstStr) beforeMap.set(element.id, { type: element.widgetType ?? "?", first: firstStr });
+      }
+      for (const { element } of walkElements(modified)) {
+        if (element.elType !== "widget") continue;
+        const firstStr = Object.values(element.settings ?? {}).find((v) => typeof v === "string");
+        const b = beforeMap.get(element.id);
+        if (b && firstStr && b.first !== firstStr) {
+          affected.push({
+            widget_id: element.id,
+            widget_type: element.widgetType ?? "?",
+            before: b.first.slice(0, 120),
+            after: firstStr.slice(0, 120)
+          });
+        }
+      }
+    }
+    collectAffected(beforeData, afterCopy);
     if (!input.confirmation) {
       if (dry.replacementCount === 0) {
-        return { mode: "dry_run", page_id: input.page_id, match_count: 0 };
+        return {
+          mode: "dry_run",
+          page_id: input.page_id,
+          match_count: 0,
+          affected_widgets: []
+        };
       }
       const token = issueConfirmation(
         "elementor_find_replace",
         { page_id: input.page_id, find: input.find, replace: input.replace },
-        cfg.confirmation_ttl_seconds
+        POLICIES.CONFIRMATION_TTL_SECONDS
       );
       return {
         mode: "dry_run",
         page_id: input.page_id,
         match_count: dry.replacementCount,
+        affected_widgets: affected.slice(0, 25),
         confirmation_token: token,
-        expires_in_seconds: cfg.confirmation_ttl_seconds
+        expires_in_seconds: POLICIES.CONFIRMATION_TTL_SECONDS
       };
     }
     const conf = consumeConfirmation(input.confirmation, "elementor_find_replace");
     if (!conf) throw new Error("Invalid or expired confirmation token");
-    const original = conf.payload;
-    if (original.page_id !== input.page_id || original.find !== input.find || original.replace !== input.replace) {
+    const o = conf.payload;
+    if (o.page_id !== input.page_id || o.find !== input.find || o.replace !== input.replace) {
       throw new Error("Confirmation parameters don't match the original dry-run");
     }
-    const backup = await backupElementorData(input.site_id, input.page_id);
-    const applied = findReplaceInWidgets(parseElementorData(raw), input.find, input.replace, {
+    const backup = await fullBackup(input.site_id, input.page_id, { to_file: input.backup_to_file });
+    const newData = parseElementorData(raw);
+    findReplaceInWidgets(newData, input.find, input.replace, {
       widgetType: input.widget_type,
       caseSensitive: input.case_sensitive
     });
+    const serialized = serializeElementorData(newData);
+    const validation = validateElementorData(serialized);
+    if (!validation.valid) {
+      return {
+        mode: "rolled_back",
+        page_id: input.page_id,
+        match_count: dry.replacementCount,
+        affected_widgets: affected.slice(0, 25),
+        backup_meta_key: backup.meta_key,
+        validation_error: validation.errors.join("; ")
+      };
+    }
     await wpRequest(`/wp/v2/pages/${input.page_id}`, {
       siteId: input.site_id,
       method: "PUT",
-      body: { meta: { _elementor_data: serializeElementorData(applied.data) } }
+      body: { meta: { _elementor_data: serialized } }
     });
-    const flush = await flushElementorCSS(input.site_id, input.page_id);
+    const flush = POLICIES.FLUSH_CSS_AFTER_WRITE ? await flushCSS(input.site_id, input.page_id) : { method: "none" };
     return {
       mode: "applied",
       page_id: input.page_id,
-      match_count: applied.replacementCount,
+      match_count: dry.replacementCount,
+      affected_widgets: affected.slice(0, 25),
       backup_meta_key: backup.meta_key,
+      backup_file: backup.file_path,
+      css_flush: flush.method
+    };
+  }
+});
+var listElementorBackupsTool = defineTool({
+  name: "list_elementor_backups",
+  description: "List timestamped backups of a page's Elementor data (created by previous edit ops). Use restore_elementor_backup with one of these meta keys to roll back.",
+  inputSchema: z3.object({
+    site_id: z3.string().optional(),
+    page_id: z3.number().int().positive()
+  }),
+  outputSchema: z3.object({
+    page_id: z3.number(),
+    total: z3.number(),
+    backups: z3.array(z3.object({
+      meta_key: z3.string(),
+      settings_key: z3.string().optional(),
+      timestamp: z3.string()
+    }))
+  }),
+  annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  async handler(input) {
+    const backups = await listBackups(input.site_id, input.page_id);
+    return {
+      page_id: input.page_id,
+      total: backups.length,
+      backups
+    };
+  }
+});
+var restoreElementorBackupTool = defineTool({
+  name: "restore_elementor_backup",
+  description: "Restore a page's _elementor_data and _elementor_page_settings from a backup created by a previous edit. TWO-CALL FLOW with confirmation token.",
+  inputSchema: z3.object({
+    site_id: z3.string().optional(),
+    page_id: z3.number().int().positive(),
+    backup_meta_key: z3.string().describe("From list_elementor_backups."),
+    settings_meta_key: z3.string().optional(),
+    confirmation: z3.string().optional()
+  }),
+  outputSchema: z3.object({
+    mode: z3.enum(["dry_run", "restored"]),
+    page_id: z3.number(),
+    backup_meta_key: z3.string(),
+    settings_meta_key: z3.string().optional(),
+    confirmation_token: z3.string().optional(),
+    expires_in_seconds: z3.number().optional(),
+    css_flush: z3.string().optional(),
+    pre_restore_backup_meta_key: z3.string().optional()
+  }),
+  annotations: { destructiveHint: true, idempotentHint: false, openWorldHint: true },
+  async handler(input) {
+    if (!input.confirmation) {
+      const token = issueConfirmation("restore_elementor_backup", {
+        page_id: input.page_id,
+        backup_meta_key: input.backup_meta_key
+      }, POLICIES.CONFIRMATION_TTL_SECONDS);
+      return {
+        mode: "dry_run",
+        page_id: input.page_id,
+        backup_meta_key: input.backup_meta_key,
+        settings_meta_key: input.settings_meta_key,
+        confirmation_token: token,
+        expires_in_seconds: POLICIES.CONFIRMATION_TTL_SECONDS
+      };
+    }
+    const conf = consumeConfirmation(input.confirmation, "restore_elementor_backup");
+    if (!conf) throw new Error("Invalid or expired confirmation token");
+    const pre = await fullBackup(input.site_id, input.page_id);
+    await restoreBackup(input.site_id, input.page_id, input.backup_meta_key, input.settings_meta_key);
+    const flush = await flushCSS(input.site_id, input.page_id);
+    return {
+      mode: "restored",
+      page_id: input.page_id,
+      backup_meta_key: input.backup_meta_key,
+      settings_meta_key: input.settings_meta_key,
+      css_flush: flush.method,
+      pre_restore_backup_meta_key: pre.meta_key
+    };
+  }
+});
+var duplicateElementorPageTool = defineTool({
+  name: "duplicate_elementor_page",
+  description: "Duplicate an Elementor page within the same site. Creates a new draft page, copies _elementor_data + _elementor_page_settings + _elementor_edit_mode, flushes CSS.",
+  inputSchema: z3.object({
+    site_id: z3.string().optional(),
+    source_page_id: z3.number().int().positive(),
+    new_title: z3.string().optional().describe("Defaults to '<original> (Copy)'"),
+    status: z3.enum(["draft", "publish", "private"]).default("draft")
+  }),
+  outputSchema: z3.object({
+    new_page_id: z3.number(),
+    new_page_url: z3.string(),
+    source_page_id: z3.number(),
+    title: z3.string(),
+    status: z3.string(),
+    css_flush: z3.string().optional()
+  }),
+  annotations: { destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  async handler(input) {
+    const source = await wpRequest(
+      `/wp/v2/pages/${input.source_page_id}?context=edit`,
+      { siteId: input.site_id }
+    );
+    const title = input.new_title ?? `${source.title.rendered} (Copy)`;
+    const data_raw = source.meta?._elementor_data ?? "[]";
+    const settings_raw = source.meta?._elementor_page_settings ?? "{}";
+    const created = await wpRequest("/wp/v2/pages", {
+      siteId: input.site_id,
+      method: "POST",
+      body: {
+        title,
+        status: input.status,
+        meta: {
+          _elementor_data: data_raw,
+          _elementor_page_settings: parseSettingsForRest(settings_raw),
+          _elementor_edit_mode: "builder"
+        }
+      }
+    });
+    const flush = await flushCSS(input.site_id, created.id);
+    return {
+      new_page_id: created.id,
+      new_page_url: created.link,
+      source_page_id: input.source_page_id,
+      title,
+      status: input.status,
       css_flush: flush.method
     };
   }
 });
+function parseSettingsForRest(raw) {
+  if (typeof raw === "object" && raw !== null) return raw;
+  if (typeof raw === "string") {
+    if (!raw.trim()) return {};
+    try {
+      return JSON.parse(raw);
+    } catch {
+      return {};
+    }
+  }
+  return {};
+}
 
 // src/tools/templates.ts
 import { z as z4 } from "zod";
+init_wp_rest();
+var TEMPLATE_TYPES = ["section", "page", "popup", "header", "footer", "archive", "single", "widget", "any"];
 var listTemplatesTool = defineTool({
   name: "list_elementor_templates",
-  description: "List Elementor library templates on a site (saved sections, pages, popups). Type can be filtered: 'section', 'page', 'popup', 'header', 'footer'.",
+  description: "List Elementor library entries on a site: saved sections, pages, popups, headers/footers (Theme Builder Pro), single/archive templates (Theme Builder Pro), and global widgets. Type filter narrows results.",
   inputSchema: z4.object({
     site_id: z4.string().optional(),
-    type: z4.enum(["section", "page", "popup", "header", "footer", "any"]).default("any"),
+    type: z4.enum(TEMPLATE_TYPES).default("any"),
     per_page: z4.number().int().min(1).max(100).default(50)
   }),
   outputSchema: z4.object({
     total: z4.number(),
-    templates: z4.array(
-      z4.object({
-        id: z4.number(),
-        title: z4.string(),
-        type: z4.string(),
-        modified: z4.string()
-      })
-    )
+    templates: z4.array(z4.object({
+      id: z4.number(),
+      title: z4.string(),
+      type: z4.string(),
+      is_theme_builder: z4.boolean(),
+      display_conditions_count: z4.number(),
+      modified: z4.string()
+    }))
   }),
   annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true },
   async handler(input) {
@@ -664,28 +1500,35 @@ var listTemplatesTool = defineTool({
       context: "edit",
       _fields: "id,title,modified,meta"
     };
-    if (input.type !== "any") {
-      query.meta_key = "_elementor_template_type";
-      query.meta_value = input.type;
-    }
-    const items = await wpRequest("/wp/v2/elementor_library", {
-      siteId: input.site_id,
-      query
-    });
+    const allItems = await wpRequest("/wp/v2/elementor_library", { siteId: input.site_id, query });
+    const items = input.type === "any" ? allItems : allItems.filter((t) => t.meta?._elementor_template_type === input.type);
+    const themeBuilderTypes = /* @__PURE__ */ new Set(["header", "footer", "archive", "single"]);
     return {
       total: items.length,
-      templates: items.map((t) => ({
-        id: t.id,
-        title: t.title.rendered,
-        type: t.meta?._elementor_template_type ?? "unknown",
-        modified: t.modified
-      }))
+      templates: items.map((t) => {
+        const type = t.meta?._elementor_template_type ?? "unknown";
+        let conds = 0;
+        try {
+          const c = t.meta?._elementor_conditions;
+          if (typeof c === "string") conds = JSON.parse(c).length;
+          else if (Array.isArray(c)) conds = c.length;
+        } catch {
+        }
+        return {
+          id: t.id,
+          title: t.title.rendered,
+          type,
+          is_theme_builder: themeBuilderTypes.has(type),
+          display_conditions_count: conds,
+          modified: t.modified
+        };
+      })
     };
   }
 });
 var exportTemplateTool = defineTool({
   name: "export_elementor_template",
-  description: "Export an Elementor template as a portable JSON object. Output is the same structure Elementor expects on import. Use it to copy sections between sites.",
+  description: "Export an Elementor template (section, page, header, footer, etc.) as a portable JSON object. Output goes into import_elementor_template on another site.",
   inputSchema: z4.object({
     site_id: z4.string().optional(),
     template_id: z4.number().int().positive()
@@ -694,18 +1537,12 @@ var exportTemplateTool = defineTool({
     template_id: z4.number(),
     title: z4.string(),
     type: z4.string(),
-    summary: z4.object({
-      totalElements: z4.number(),
-      widgets: z4.number(),
-      sections: z4.number()
-    }),
-    portable_json: z4.string().describe("JSON-stringified payload ready to import via import_elementor_template.")
+    summary: z4.object({ totalElements: z4.number(), widgets: z4.number(), sections: z4.number() }),
+    portable_json: z4.string()
   }),
   annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true },
   async handler(input) {
-    const tpl = await wpRequest(`/wp/v2/elementor_library/${input.template_id}?context=edit`, {
-      siteId: input.site_id
-    });
+    const tpl = await wpRequest(`/wp/v2/elementor_library/${input.template_id}?context=edit`, { siteId: input.site_id });
     const data = parseElementorData(tpl.meta?._elementor_data ?? "[]");
     const sum = summarize(data);
     const portable = {
@@ -725,10 +1562,10 @@ var exportTemplateTool = defineTool({
 });
 var importTemplateTool = defineTool({
   name: "import_elementor_template",
-  description: "Import an Elementor template (output of export_elementor_template) into a target site as a new template entry. Useful for syncing reusable sections across an agency's site fleet.",
+  description: "Import a portable template JSON (output of export_elementor_template) into a target site as a new library entry. Useful for cross-site template sync.",
   inputSchema: z4.object({
-    site_id: z4.string().optional().describe("Target site id."),
-    portable_json: z4.string().describe("JSON-stringified payload from export_elementor_template."),
+    site_id: z4.string().optional(),
+    portable_json: z4.string(),
     override_title: z4.string().optional()
   }),
   outputSchema: z4.object({
@@ -760,40 +1597,493 @@ var importTemplateTool = defineTool({
         }
       }
     });
+    return { new_template_id: res.id, title, type: payload.type, url: res.link };
+  }
+});
+var applyTemplateToPageTool = defineTool({
+  name: "apply_template_to_page",
+  description: "Copy the _elementor_data + _elementor_page_settings of a SOURCE template (or page) onto a TARGET page on the same site. Backs up the target first. Use to apply a section/page template to an existing draft.",
+  inputSchema: z4.object({
+    site_id: z4.string().optional(),
+    source_id: z4.number().int().positive().describe("Source post id: a template or a page."),
+    target_page_id: z4.number().int().positive(),
+    backup_to_file: z4.boolean().default(false),
+    confirmation: z4.string().optional()
+  }),
+  outputSchema: z4.object({
+    mode: z4.enum(["dry_run", "applied"]),
+    target_page_id: z4.number(),
+    source_id: z4.number(),
+    confirmation_token: z4.string().optional(),
+    expires_in_seconds: z4.number().optional(),
+    backup_meta_key: z4.string().optional(),
+    backup_file: z4.string().optional(),
+    css_flush: z4.string().optional()
+  }),
+  annotations: { destructiveHint: true, idempotentHint: false, openWorldHint: true },
+  async handler(input) {
+    const { issueConfirmation: issueConfirmation2, consumeConfirmation: consumeConfirmation2 } = await Promise.resolve().then(() => (init_confirmation(), confirmation_exports));
+    const { POLICIES: POLICIES2 } = await Promise.resolve().then(() => (init_policies(), policies_exports));
+    const { fullBackup: fullBackup2 } = await Promise.resolve().then(() => (init_backup(), backup_exports));
+    const { flushCSS: flushCSS2 } = await Promise.resolve().then(() => (init_css_flush(), css_flush_exports));
+    if (!input.confirmation) {
+      const token = issueConfirmation2("apply_template_to_page", { src: input.source_id, tgt: input.target_page_id, site: input.site_id }, POLICIES2.CONFIRMATION_TTL_SECONDS);
+      return {
+        mode: "dry_run",
+        target_page_id: input.target_page_id,
+        source_id: input.source_id,
+        confirmation_token: token,
+        expires_in_seconds: POLICIES2.CONFIRMATION_TTL_SECONDS
+      };
+    }
+    const conf = consumeConfirmation2(input.confirmation, "apply_template_to_page");
+    if (!conf) throw new Error("Invalid or expired confirmation token");
+    let src_meta;
+    try {
+      const src = await wpRequest(`/wp/v2/elementor_library/${input.source_id}?context=edit`, { siteId: input.site_id });
+      src_meta = src.meta;
+    } catch {
+      const src = await wpRequest(`/wp/v2/pages/${input.source_id}?context=edit`, { siteId: input.site_id });
+      src_meta = src.meta;
+    }
+    const data_raw = src_meta?._elementor_data ?? "[]";
+    const settings_raw = src_meta?._elementor_page_settings ?? "{}";
+    const backup = await fullBackup2(input.site_id, input.target_page_id, { to_file: input.backup_to_file });
+    await wpRequest(`/wp/v2/pages/${input.target_page_id}`, {
+      siteId: input.site_id,
+      method: "PUT",
+      body: {
+        meta: {
+          _elementor_data: data_raw,
+          _elementor_page_settings: parseSettingsForRest2(settings_raw),
+          _elementor_edit_mode: "builder"
+        }
+      }
+    });
+    const flush = await flushCSS2(input.site_id, input.target_page_id);
     return {
-      new_template_id: res.id,
-      title,
-      type: payload.type,
-      url: res.link
+      mode: "applied",
+      target_page_id: input.target_page_id,
+      source_id: input.source_id,
+      backup_meta_key: backup.meta_key,
+      backup_file: backup.file_path,
+      css_flush: flush.method
     };
   }
 });
+function parseSettingsForRest2(raw) {
+  if (typeof raw === "object" && raw !== null) return raw;
+  if (typeof raw === "string") {
+    if (!raw.trim()) return {};
+    try {
+      return JSON.parse(raw);
+    } catch {
+      return {};
+    }
+  }
+  return {};
+}
 
-// src/tools/updates.ts
+// src/tools/wpcli.ts
 import { z as z5 } from "zod";
+init_config();
+init_ssh_wpcli();
+init_policies();
+init_confirmation();
+var wpCliRunTool = defineTool({
+  name: "wp_cli_run",
+  description: "Execute an arbitrary wp-cli command on a site via SSH. The `wp` prefix and `--path` are added automatically \u2014 pass only the args (e.g. 'post list --post_type=page'). Destructive commands (delete, drop, search-replace without --dry-run, plugin deactivate/uninstall) require a two-call confirmation flow.",
+  inputSchema: z5.object({
+    site_id: z5.string().optional(),
+    args: z5.string().min(1).describe("WP-CLI args without leading 'wp', e.g. 'post list --post_type=page'"),
+    timeout_ms: z5.number().int().min(1e3).max(3e5).default(6e4),
+    confirmation: z5.string().optional()
+  }),
+  outputSchema: z5.object({
+    mode: z5.enum(["dry_run_destructive", "executed"]),
+    command: z5.string(),
+    stdout: z5.string().optional(),
+    stderr: z5.string().optional(),
+    exit_code: z5.number().optional(),
+    duration_ms: z5.number().optional(),
+    destructive_pattern_detected: z5.boolean().optional(),
+    confirmation_token: z5.string().optional(),
+    expires_in_seconds: z5.number().optional()
+  }),
+  annotations: { destructiveHint: true, idempotentHint: false, openWorldHint: true },
+  async handler(input) {
+    const forbidden = isForbiddenWpCli(input.args);
+    if (forbidden.forbidden) {
+      throw new Error(`Forbidden wp-cli command. ${forbidden.reason}`);
+    }
+    const isDestructive = isDestructiveWpCli(input.args);
+    if (isDestructive && !input.confirmation) {
+      const token = issueConfirmation("wp_cli_run", { site_id: input.site_id, args: input.args }, POLICIES.CONFIRMATION_TTL_SECONDS);
+      return {
+        mode: "dry_run_destructive",
+        command: `wp <path> ${input.args}`,
+        destructive_pattern_detected: true,
+        confirmation_token: token,
+        expires_in_seconds: POLICIES.CONFIRMATION_TTL_SECONDS
+      };
+    }
+    if (isDestructive && input.confirmation) {
+      const conf = consumeConfirmation(input.confirmation, "wp_cli_run");
+      if (!conf) throw new Error("Invalid or expired confirmation token");
+      const o = conf.payload;
+      if (o.args !== input.args || o.site_id !== input.site_id) {
+        throw new Error("Confirmation parameters don't match the original dry-run");
+      }
+    }
+    const site = getSite(input.site_id);
+    const r = await sshWpCli(site, input.args, { timeout_ms: input.timeout_ms });
+    return {
+      mode: "executed",
+      command: r.command,
+      stdout: r.stdout,
+      stderr: r.stderr,
+      exit_code: r.exitCode,
+      duration_ms: r.duration_ms,
+      destructive_pattern_detected: isDestructive
+    };
+  }
+});
+var wpSearchReplaceTool = defineTool({
+  name: "wp_search_replace",
+  description: "Run `wp search-replace` against wp_postmeta (default) \u2014 the standard agency way to update Elementor text content. ALWAYS dry-run first; the apply call requires a confirmation token. Includes --precise --all-tables-with-prefix by default if you specify table='all'.",
+  inputSchema: z5.object({
+    site_id: z5.string().optional(),
+    find: z5.string().min(1),
+    replace: z5.string(),
+    table: z5.string().default("wp_postmeta"),
+    include_columns: z5.string().optional().describe("e.g. 'meta_value'. Default: meta_value when table=wp_postmeta."),
+    precise: z5.boolean().default(true),
+    confirmation: z5.string().optional()
+  }),
+  outputSchema: z5.object({
+    mode: z5.enum(["dry_run", "applied"]),
+    command: z5.string(),
+    stdout: z5.string().optional(),
+    stderr: z5.string().optional(),
+    exit_code: z5.number().optional(),
+    replacement_count: z5.number().optional(),
+    confirmation_token: z5.string().optional(),
+    expires_in_seconds: z5.number().optional()
+  }),
+  annotations: { destructiveHint: true, idempotentHint: false, openWorldHint: true },
+  async handler(input) {
+    const includeCols = input.include_columns ?? (input.table === "wp_postmeta" ? "meta_value" : "");
+    const baseArgs = [
+      "search-replace",
+      `'${input.find.replace(/'/g, "'\\''")}'`,
+      `'${input.replace.replace(/'/g, "'\\''")}'`,
+      input.table,
+      includeCols ? `--include-columns=${includeCols}` : "",
+      input.precise ? "--precise" : ""
+    ].filter(Boolean).join(" ");
+    const site = getSite(input.site_id);
+    if (!input.confirmation) {
+      const dry = await sshWpCli(site, baseArgs + " --dry-run");
+      const m2 = dry.stdout.match(/Success: (\d+) replacement/);
+      const count = m2 ? parseInt(m2[1], 10) : 0;
+      if (count === 0) {
+        return { mode: "dry_run", command: dry.command, stdout: dry.stdout, exit_code: dry.exitCode, replacement_count: 0 };
+      }
+      const token = issueConfirmation("wp_search_replace", { args: baseArgs, site_id: input.site_id }, POLICIES.CONFIRMATION_TTL_SECONDS);
+      return {
+        mode: "dry_run",
+        command: dry.command,
+        stdout: dry.stdout,
+        replacement_count: count,
+        confirmation_token: token,
+        expires_in_seconds: POLICIES.CONFIRMATION_TTL_SECONDS
+      };
+    }
+    const conf = consumeConfirmation(input.confirmation, "wp_search_replace");
+    if (!conf) throw new Error("Invalid or expired confirmation token");
+    const o = conf.payload;
+    if (o.args !== baseArgs || o.site_id !== input.site_id) throw new Error("Confirmation params mismatch");
+    const r = await sshWpCli(site, baseArgs);
+    const m = r.stdout.match(/Success: (\d+) replacement/);
+    return {
+      mode: "applied",
+      command: r.command,
+      stdout: r.stdout,
+      stderr: r.stderr,
+      exit_code: r.exitCode,
+      replacement_count: m ? parseInt(m[1], 10) : 0
+    };
+  }
+});
+var wpElementorFlushCssTool = defineTool({
+  name: "wp_elementor_flush_css",
+  description: "Flush Elementor's CSS cache on a site using the 3-level fallback strategy (REST endpoint \u2192 wp-cli native \u2192 option/meta delete). Always call after writing _elementor_data programmatically.",
+  inputSchema: z5.object({
+    site_id: z5.string().optional(),
+    page_id: z5.number().int().positive().optional().describe("Optional: flush only this page's cache. If omitted, flushes site-wide.")
+  }),
+  outputSchema: z5.object({
+    method: z5.enum(["rest", "wp-cli", "option-delete", "resave", "none"]),
+    details: z5.string().optional()
+  }),
+  annotations: { destructiveHint: false, idempotentHint: true, openWorldHint: true },
+  async handler(input) {
+    const { flushCSS: flushCSS2 } = await Promise.resolve().then(() => (init_css_flush(), css_flush_exports));
+    return flushCSS2(input.site_id, input.page_id);
+  }
+});
+var wpPluginListTool = defineTool({
+  name: "wp_plugin_list",
+  description: "List installed plugins on a site with name, version, status (active/inactive), and update_version (if outdated). Uses WP-CLI for accurate version data including update_version.",
+  inputSchema: z5.object({
+    site_id: z5.string().optional(),
+    only_outdated: z5.boolean().default(false)
+  }),
+  outputSchema: z5.object({
+    total: z5.number(),
+    plugins: z5.array(z5.object({
+      name: z5.string(),
+      status: z5.string(),
+      version: z5.string(),
+      update: z5.string().optional(),
+      update_version: z5.string().optional()
+    }))
+  }),
+  annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true },
+  async handler(input) {
+    const site = getSite(input.site_id);
+    const r = await sshWpCli(site, "plugin list --format=json");
+    if (r.exitCode !== 0) throw new Error(`wp plugin list failed: ${r.stderr}`);
+    const arr = JSON.parse(r.stdout);
+    const filtered = input.only_outdated ? arr.filter((p) => p.update === "available") : arr;
+    return { total: filtered.length, plugins: filtered };
+  }
+});
+var wpPluginUpdateTool = defineTool({
+  name: "wp_plugin_update",
+  description: "Update one or more plugins on a site to their latest version. Requires confirmation token (uses wp-cli).",
+  inputSchema: z5.object({
+    site_id: z5.string().optional(),
+    plugins: z5.array(z5.string()).min(1).describe("Plugin slugs to update, e.g. ['elementor', 'elementor-pro']. Use 'all' for everything outdated."),
+    confirmation: z5.string().optional()
+  }),
+  outputSchema: z5.object({
+    mode: z5.enum(["dry_run", "applied"]),
+    plugins: z5.array(z5.string()),
+    command: z5.string().optional(),
+    stdout: z5.string().optional(),
+    stderr: z5.string().optional(),
+    exit_code: z5.number().optional(),
+    confirmation_token: z5.string().optional(),
+    expires_in_seconds: z5.number().optional()
+  }),
+  annotations: { destructiveHint: true, idempotentHint: false, openWorldHint: true },
+  async handler(input) {
+    if (!input.confirmation) {
+      const token = issueConfirmation("wp_plugin_update", { site_id: input.site_id, plugins: input.plugins }, POLICIES.CONFIRMATION_TTL_SECONDS);
+      return {
+        mode: "dry_run",
+        plugins: input.plugins,
+        confirmation_token: token,
+        expires_in_seconds: POLICIES.CONFIRMATION_TTL_SECONDS
+      };
+    }
+    const conf = consumeConfirmation(input.confirmation, "wp_plugin_update");
+    if (!conf) throw new Error("Invalid or expired confirmation token");
+    const site = getSite(input.site_id);
+    const target = input.plugins.includes("all") ? "--all" : input.plugins.map((p) => `'${p}'`).join(" ");
+    const r = await sshWpCli(site, `plugin update ${target}`, { timeout_ms: 18e4 });
+    return {
+      mode: "applied",
+      plugins: input.plugins,
+      command: r.command,
+      stdout: r.stdout,
+      stderr: r.stderr,
+      exit_code: r.exitCode
+    };
+  }
+});
+
+// src/tools/visual.ts
+import { z as z6 } from "zod";
+
+// src/transport/screenshot.ts
+init_logger();
+import { spawn as spawn2 } from "child_process";
+import { existsSync as existsSync2 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join2 } from "path";
+import { randomBytes as randomBytes2 } from "crypto";
+var CHROME_PATHS = [
+  "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+  "/Applications/Chromium.app/Contents/MacOS/Chromium",
+  "/usr/bin/google-chrome",
+  "/usr/bin/chromium",
+  "/usr/bin/chromium-browser"
+];
+function findChrome() {
+  if (process.env.ELEMENTOR_MCP_CHROME) {
+    return existsSync2(process.env.ELEMENTOR_MCP_CHROME) ? process.env.ELEMENTOR_MCP_CHROME : null;
+  }
+  for (const p of CHROME_PATHS) {
+    if (existsSync2(p)) return p;
+  }
+  return null;
+}
+async function screenshotUrl(url, opts = {}) {
+  const chrome = findChrome();
+  if (!chrome) {
+    throw new Error(
+      "Could not locate a Chrome/Chromium binary for screenshots. Set ELEMENTOR_MCP_CHROME to its path or install Chrome at one of: " + CHROME_PATHS.join(", ")
+    );
+  }
+  const filename = `elementor-mcp-${randomBytes2(4).toString("hex")}-${Date.now()}.png`;
+  const path = join2(tmpdir2(), filename);
+  const args = [
+    "--headless=new",
+    "--disable-gpu",
+    "--no-sandbox",
+    "--hide-scrollbars",
+    `--window-size=${opts.width ?? 1440},${opts.height ?? 900}`,
+    `--screenshot=${path}`,
+    ...opts.full_page ? ["--virtual-time-budget=10000"] : [],
+    "--default-background-color=00000000",
+    url
+  ];
+  const timeout = opts.timeout_ms ?? 6e4;
+  logger.debug({ url, chrome }, "screenshot");
+  await new Promise((resolve3, reject) => {
+    const child = spawn2(chrome, args, { stdio: ["ignore", "ignore", "pipe"] });
+    let stderr = "";
+    const killer = setTimeout(() => {
+      child.kill("SIGKILL");
+      reject(new Error(`Screenshot timed out after ${timeout}ms`));
+    }, timeout);
+    child.stderr.on("data", (b) => {
+      stderr += b.toString();
+    });
+    child.on("close", (code) => {
+      clearTimeout(killer);
+      if (code !== 0) reject(new Error(`Chrome exited ${code}: ${stderr.slice(0, 300)}`));
+      else resolve3();
+    });
+    child.on("error", (e) => {
+      clearTimeout(killer);
+      reject(e);
+    });
+  });
+  if (!existsSync2(path)) throw new Error(`Screenshot file not created: ${path}`);
+  const fs = await import("fs");
+  const stat = fs.statSync(path);
+  return { path, bytes: stat.size };
+}
+
+// src/tools/visual.ts
+init_wp_rest();
+import { readFileSync as readFileSync3 } from "fs";
+import { createHash } from "crypto";
+var screenshotPageTool = defineTool({
+  name: "screenshot_page",
+  description: "Capture a PNG screenshot of a page's frontend (visitor-facing URL). Requires a Chrome/Chromium binary on the host. Returns the local file path so the LLM can analyse it or compare against another shot.",
+  inputSchema: z6.object({
+    site_id: z6.string().optional(),
+    page_id: z6.number().int().positive().optional(),
+    url: z6.string().url().optional().describe("Alternative to page_id: hit any URL directly."),
+    width: z6.number().int().min(320).max(3840).default(1440),
+    height: z6.number().int().min(240).max(2400).default(900),
+    full_page: z6.boolean().default(false)
+  }),
+  outputSchema: z6.object({
+    url: z6.string(),
+    file_path: z6.string(),
+    bytes: z6.number(),
+    sha256: z6.string(),
+    width: z6.number(),
+    height: z6.number()
+  }),
+  annotations: { readOnlyHint: true, idempotentHint: false, openWorldHint: true },
+  async handler(input) {
+    let target = input.url;
+    if (!target) {
+      if (!input.page_id) throw new Error("Provide either 'url' or 'page_id'.");
+      const page = await wpRequest(`/wp/v2/pages/${input.page_id}?_fields=link`, { siteId: input.site_id });
+      target = page.link;
+    }
+    const shot = await screenshotUrl(target, { width: input.width, height: input.height, full_page: input.full_page });
+    const hash = createHash("sha256").update(readFileSync3(shot.path)).digest("hex");
+    return {
+      url: target,
+      file_path: shot.path,
+      bytes: shot.bytes,
+      sha256: hash,
+      width: input.width,
+      height: input.height
+    };
+  }
+});
+var compareScreenshotsTool = defineTool({
+  name: "compare_screenshots",
+  description: "Compare two screenshot files via SHA-256 hash equality and size delta. Quick way to spot whether a page changed visually after an edit. For pixel diffs, use a dedicated tool externally.",
+  inputSchema: z6.object({
+    before_path: z6.string(),
+    after_path: z6.string()
+  }),
+  outputSchema: z6.object({
+    identical: z6.boolean(),
+    before_bytes: z6.number(),
+    after_bytes: z6.number(),
+    delta_bytes: z6.number(),
+    before_sha256: z6.string(),
+    after_sha256: z6.string()
+  }),
+  annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: false },
+  async handler(input) {
+    const a = readFileSync3(input.before_path);
+    const b = readFileSync3(input.after_path);
+    const ah = createHash("sha256").update(a).digest("hex");
+    const bh = createHash("sha256").update(b).digest("hex");
+    return {
+      identical: ah === bh,
+      before_bytes: a.length,
+      after_bytes: b.length,
+      delta_bytes: b.length - a.length,
+      before_sha256: ah,
+      after_sha256: bh
+    };
+  }
+});
+
+// src/tools/updates.ts
+import { z as z7 } from "zod";
+init_wp_rest();
+init_config();
 async function fetchLatestElementor() {
-  const free = await fetch("https://api.wordpress.org/plugins/info/1.0/elementor.json").then((r) => r.json()).catch(() => null);
-  return { free: free?.version ?? "unknown" };
+  try {
+    const free = await fetch("https://api.wordpress.org/plugins/info/1.0/elementor.json", {
+      headers: { "User-Agent": "elementor-mcp-agent" }
+    }).then((r) => r.json());
+    return { free: free.version ?? "unknown" };
+  } catch {
+    return { free: "unknown" };
+  }
 }
 var checkElementorVersionsTool = defineTool({
   name: "check_elementor_versions",
-  description: "For every configured site, fetch the installed Elementor / Elementor Pro version and compare against the latest available on wordpress.org. Returns a per-site row with 'outdated' flag.",
-  inputSchema: z5.object({
-    site_ids: z5.array(z5.string()).optional().describe("Subset of sites to check. Defaults to all.")
+  description: "Fleet-wide Elementor version audit. For every site, fetches installed Elementor/Pro versions and compares against wordpress.org latest. Flags outdated installs.",
+  inputSchema: z7.object({
+    site_ids: z7.array(z7.string()).optional()
   }),
-  outputSchema: z5.object({
-    checked: z5.number(),
-    latest_elementor_free: z5.string(),
-    sites: z5.array(
-      z5.object({
-        site_id: z5.string(),
-        url: z5.string(),
-        elementor_version: z5.string().optional(),
-        elementor_pro_version: z5.string().optional(),
-        outdated_free: z5.boolean(),
-        error: z5.string().optional()
-      })
-    )
+  outputSchema: z7.object({
+    checked: z7.number(),
+    latest_elementor_free: z7.string(),
+    sites: z7.array(z7.object({
+      site_id: z7.string(),
+      url: z7.string(),
+      elementor_version: z7.string().optional(),
+      elementor_pro_version: z7.string().optional(),
+      outdated_free: z7.boolean(),
+      error: z7.string().optional()
+    }))
   }),
   annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true },
   async handler(input) {
@@ -807,8 +2097,7 @@ var checkElementorVersionsTool = defineTool({
         let elementor_version;
         let elementor_pro_version;
         for (const p of plugins) {
-          if (p.plugin.startsWith("elementor/") && p.plugin.endsWith("/elementor.php"))
-            elementor_version = p.version;
+          if (p.plugin.startsWith("elementor/") && p.plugin.endsWith("/elementor.php")) elementor_version = p.version;
           if (p.plugin.startsWith("elementor-pro/")) elementor_pro_version = p.version;
         }
         rows.push({
@@ -819,43 +2108,58 @@ var checkElementorVersionsTool = defineTool({
           outdated_free: !!elementor_version && elementor_version !== latest.free && latest.free !== "unknown"
         });
       } catch (e) {
-        rows.push({
-          site_id: site.id,
-          url: site.url,
-          outdated_free: false,
-          error: e.message
-        });
+        rows.push({ site_id: site.id, url: site.url, outdated_free: false, error: e.message });
       }
     }
-    return {
-      checked: rows.length,
-      latest_elementor_free: latest.free,
-      sites: rows
-    };
+    return { checked: rows.length, latest_elementor_free: latest.free, sites: rows };
   }
 });
 
 // src/tools/index.ts
 var tools = [
+  // Sites & health
   listSitesTool,
   pingSiteTool,
+  siteHealthTool,
+  // Pages
   listElementorPagesTool,
   readPageElementorTool,
+  listWidgetsInPageTool,
+  listGlobalWidgetsTool,
+  preflightCheckTool,
   findReplaceTool,
+  listElementorBackupsTool,
+  restoreElementorBackupTool,
+  duplicateElementorPageTool,
+  // Templates
   listTemplatesTool,
   exportTemplateTool,
   importTemplateTool,
+  applyTemplateToPageTool,
+  // WP-CLI escape
+  wpCliRunTool,
+  wpSearchReplaceTool,
+  wpElementorFlushCssTool,
+  wpPluginListTool,
+  wpPluginUpdateTool,
+  // Visual
+  screenshotPageTool,
+  compareScreenshotsTool,
+  // Versions
   checkElementorVersionsTool
 ];
 
+// src/server.ts
+init_logger();
+
 // src/resources/index.ts
-import { readFileSync as readFileSync2, existsSync, readdirSync } from "fs";
-import { dirname, resolve, join, basename } from "path";
+import { readFileSync as readFileSync4, existsSync as existsSync3, readdirSync } from "fs";
+import { dirname, resolve, join as join3, basename } from "path";
 import { fileURLToPath } from "url";
 var __dirname = dirname(fileURLToPath(import.meta.url));
 var DOCS_DIR = resolve(__dirname, "../resources/elementor-docs");
 async function listResources() {
-  if (!existsSync(DOCS_DIR)) return [];
+  if (!existsSync3(DOCS_DIR)) return [];
   const files = readdirSync(DOCS_DIR).filter((f) => f.endsWith(".md"));
   return files.map((f) => ({
     uri: `elementor-docs://${f}`,
@@ -869,14 +2173,14 @@ async function readResource(uri) {
     throw new Error(`Unknown resource URI: ${uri}`);
   }
   const filename = uri.replace("elementor-docs://", "");
-  const path = join(DOCS_DIR, filename);
-  if (!existsSync(path)) throw new Error(`Resource not found: ${filename}`);
+  const path = join3(DOCS_DIR, filename);
+  if (!existsSync3(path)) throw new Error(`Resource not found: ${filename}`);
   return {
     contents: [
       {
         uri,
         mimeType: "text/markdown",
-        text: readFileSync2(path, "utf8")
+        text: readFileSync4(path, "utf8")
       }
     ]
   };
@@ -884,7 +2188,7 @@ async function readResource(uri) {
 
 // src/server.ts
 var __dirname2 = dirname2(fileURLToPath2(import.meta.url));
-var pkg = JSON.parse(readFileSync3(resolve2(__dirname2, "../package.json"), "utf8"));
+var pkg = JSON.parse(readFileSync5(resolve2(__dirname2, "../package.json"), "utf8"));
 function toMcpInputSchema(zod) {
   return zodToJsonSchema(zod, { target: "jsonSchema7", $refStrategy: "none" });
 }