sbuilder-mcp 0.53.0 → 0.54.0

package/CHANGELOG.md

@@ -6,6 +6,11 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.54.0] - 2026-09-15
+
+### Added
+- `sb_review` reports a `mergedAuthPage` readiness gap when a single page carries two or more account forms (login, register, forgot-password, reset, or verify), since none of them then has an address a header can link to or a password-reset email can point at; the fix names `sb_store action:"form"` with a `page_name` to give each its own page.
+
 ## [0.53.0] - 2026-09-15
 
 ### Added

package/CHANGELOG.vi.md

@@ -6,6 +6,11 @@ Mọi thay đổi đáng chú ý của dự án được ghi lại trong file n
 Định dạng dựa trên [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 và dự án tuân theo [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.54.0] - 2026-09-15
+
+### Added
+- `sb_review` giờ báo cáo lỗi sẵn sàng `mergedAuthPage` khi một trang duy nhất chứa từ hai form tài khoản trở lên (đăng nhập, đăng ký, quên mật khẩu, đặt lại, hoặc xác thực), vì khi đó không form nào có địa chỉ riêng để header liên kết tới hay để email đặt lại mật khẩu trỏ đến; hướng khắc phục nêu tên `sb_store action:"form"` kèm `page_name` để tách mỗi form ra trang riêng của nó.
+
 ## [0.53.0] - 2026-09-15
 
 ### Added

package/dist/domains/site/readiness-fetch.js

@@ -24,7 +24,7 @@ export async function gatherReadiness(ctx, siteId, pageNodes) {
         }
     };
     const site = encodeURIComponent(siteId);
-    const [pageList, gateways, shipping, globals, productList, categoryList, pageLinks] = await Promise.all([
+    const [pageList, gateways, shipping, globals, productList, categoryList, pageLinks, formList] = await Promise.all([
         get(`/api/sites/${site}/pages`),
         get(`/api/sites/${site}/payment-gateways`),
         get(`/api/sites/${site}/shipping-methods`),
@@ -42,6 +42,12 @@ export async function gatherReadiness(ctx, siteId, pageNodes) {
         // right, and the rest list the whole catalogue.
         get(`/api/sites/${site}/product-categories`),
         get(`/api/sites/${site}/page-links`),
+        // THE FORMS, BY TYPE. A page document carries only `specials.formId` — which
+        // form a node shows, never what KIND of form it is — so nothing reading a
+        // page can tell a login form from a register form without this list. That
+        // blindness is what let one page quietly become the site's whole account
+        // area, which is the shape `mergedAuthPage` reports.
+        get(`/api/sites/${site}/forms`),
     ]);
     // A gateway counts only when it is BOTH enabled and configured — the editor's
     // `live` getter also filters by the store's currency, which is a narrowing:
@@ -87,5 +93,6 @@ export async function gatherReadiness(ctx, siteId, pageNodes) {
         globalKinds,
         categories,
         categoryPageLinks,
+        forms: formList?.forms ?? null,
     };
 }

package/dist/domains/site/readiness.js

@@ -132,6 +132,52 @@ export function readinessGaps(input) {
                     'footer and a link back to the home page.',
         });
     }
+    // ONE PAGE QUIETLY BECAME THE WHOLE ACCOUNT AREA.
+    //
+    // This server used to tell agents, in as many words, to put the login and the
+    // register form behind a member-gate on /account. They did. The result is a
+    // page carrying two or three different jobs, and — the part that is not a
+    // matter of taste — NEITHER JOB HAS AN ADDRESS. A header can link to one
+    // thing, an email that says "reset your password" has nowhere specific to
+    // point, and a visitor who came to register meets a login form first because
+    // that is what was stacked on top.
+    //
+    // The rule was fixed; the pages it already built were not, and nothing could
+    // see them: a page document carries `specials.formId` and never the KIND of
+    // form, so only the site's own form list can tell these apart.
+    //
+    // COUNTED BY DISTINCT TYPE, not by how many form nodes there are. A form split
+    // across segments is several nodes of ONE type and is not this defect.
+    const authTypes = new Set(['login', 'register', 'forgot', 'reset', 'verify']);
+    if (input.forms && input.forms.length > 0) {
+        const typeOf = new Map(input.forms
+            .filter((f) => !!f?.id && !!f?.type)
+            .map((f) => [f.id, f.type]));
+        const onPage = new Set();
+        for (const n of input.pageNodes) {
+            if (n.data.type !== 'form')
+                continue;
+            const id = n.specials?.formId;
+            const t = typeof id === 'string' ? typeOf.get(id) : undefined;
+            if (t && authTypes.has(t))
+                onPage.add(t);
+        }
+        if (onPage.size >= 2) {
+            const named = [...onPage].sort().join(', ');
+            gaps.push({
+                id: 'mergedAuthPage',
+                draft: false,
+                problem: `This page carries ${onPage.size} different account forms (${named}). Neither has an ` +
+                    'address of its own, so a header can link to only one of them, a password-reset mail ' +
+                    'has nowhere specific to point, and whoever came to do the second thing meets the ' +
+                    'first one stacked on top.',
+                fix: 'Give each its own page: sb_store action:"form" with template "login", "register" or ' +
+                    '"forgot" and a page_name builds the form AND the page in one call. Leave /account ' +
+                    'showing the profile behind a member-gate with audience "members", and a short ' +
+                    'sign-in prompt LINKING to the login page behind audience "guests".',
+            });
+        }
+    }
     if (!isStore(input))
         return gaps;
     if (pages && !published(pages, 'checkout')) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sbuilder-mcp",
-  "version": "0.53.0",
+  "version": "0.54.0",
   "description": "MCP server that designs and operates a Store Builder site — pages, data, theme and publish — through the platform's own API and live-edit protocol.",
   "mcpName": "io.github.vuluu2k/sbuilder-mcp",
   "type": "module",