sbuilder-mcp 0.83.2 → 0.84.0

package/CHANGELOG.md

@@ -6,6 +6,22 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.84.0] - 2026-10-11
+
+### Added
+- `sb_api_call` reports `unknown_keys` for body keys the handler's Go struct does not have, which the platform otherwise drops silently (for example `price` on a delivery method saves `feeCents` as 0 and still returns 201).
+- `sb_review` flags `cartLine.*` bindings used outside a cart-order context as `no_data_context`.
+
+### Fixed
+- Undoing an `sb_move` rewrites only the node that changed instead of all five nodes on the page, because document comparisons no longer depend on the key order the platform returns.
+- The request shape of the `/refund` and `/refund-via-gateway` operations is now `refundRequest` with `note`, so `sb_api_call` no longer validates them against the charge shape.
+
+## [0.83.3] - 2026-10-11
+
+### Fixed
+- `sb_page_create` rejects a page `type` that does not exist and lists the valid types, instead of letting the platform silently store it as `page`; a `home` type points to `is_homepage: true`.
+- `sb_page_state` and `sb_page_version` take the site of the open page when `SB_SITE` is not set, instead of refusing with "no site".
+
 ## [0.83.2] - 2026-10-11
 
 ### Added

package/CHANGELOG.vi.md

@@ -6,6 +6,22 @@ Mọi thay đổi đáng chú ý của dự án được ghi lại trong file n
 Định dạng dựa trên [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 và dự án tuân theo [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.84.0] - 2026-10-11
+
+### Added
+- `sb_api_call` báo `unknown_keys` cho các key trong body mà struct Go của handler không có, vì platform vốn bỏ chúng lặng lẽ (ví dụ `price` trên phương thức giao hàng lưu `feeCents` bằng 0 mà vẫn trả 201).
+- `sb_review` báo binding `cartLine.*` dùng ngoài ngữ cảnh cart-order là `no_data_context`.
+
+### Fixed
+- Hoàn tác một `sb_move` chỉ ghi lại node đã thay đổi thay vì cả năm node của trang, vì việc so sánh tài liệu không còn phụ thuộc thứ tự key mà platform trả về.
+- Shape request của operation `/refund` và `/refund-via-gateway` giờ là `refundRequest` với `note`, nên `sb_api_call` không còn kiểm tra chúng theo shape của charge.
+
+## [0.83.3] - 2026-10-11
+
+### Fixed
+- `sb_page_create` từ chối `type` trang không tồn tại và liệt kê các loại hợp lệ, thay vì để platform lặng lẽ lưu thành `page`; type `home` được chỉ sang `is_homepage: true`.
+- `sb_page_state` và `sb_page_version` lấy site của trang đang mở khi không có `SB_SITE`, thay vì từ chối với lỗi "no site".
+
 ## [0.83.2] - 2026-10-11
 
 ### Added

package/dist/catalog/shapes.generated.js

@@ -5869,30 +5869,22 @@ export const REQUEST_SHAPES = {
     "post:/api/sites/{siteId}/payment-transactions/{transactionId}/refund": {
         "fields": [
             {
-                "name": "orderId",
-                "type": "string"
-            },
-            {
-                "name": "provider",
+                "name": "note",
                 "type": "string"
             }
         ],
         "source": "go",
-        "goType": "chargeRequest"
+        "goType": "refundRequest"
     },
     "post:/api/sites/{siteId}/payment-transactions/{transactionId}/refund-via-gateway": {
         "fields": [
             {
-                "name": "orderId",
-                "type": "string"
-            },
-            {
-                "name": "provider",
+                "name": "note",
                 "type": "string"
             }
         ],
         "source": "go",
-        "goType": "chargeRequest"
+        "goType": "refundRequest"
     },
     "post:/api/sites/{id}/plan-checkout": {
         "fields": [

package/dist/core/patch.js

@@ -1,3 +1,11 @@
+/**
+ * The document patch primitive, mirrored from the editor's live-edit channel
+ * (editor/src/history/patchRecorder.ts + features/liveedit/ops.ts).
+ *
+ * The shape has to match exactly: these patches go on the wire to peers running
+ * the editor's own code, and a shape it does not recognise is dropped silently.
+ */
+import { isDeepStrictEqual } from 'node:util';
 /** Segments that must never appear in a path we apply or send. */
 const FORBIDDEN = new Set(['__proto__', 'constructor', 'prototype']);
 /**
@@ -149,7 +157,10 @@ export function applyPatches(state, patches) {
 export function documentPatches(before, after) {
     const out = [];
     for (const [id, node] of Object.entries(after.nodes)) {
-        if (JSON.stringify(before.nodes[id]) !== JSON.stringify(node))
+        // Not JSON.stringify: a document read back from the platform (Postgres
+        // jsonb) orders keys differently from one built here, so every node
+        // "differed" — undoing one sb_move rewrote all five nodes of a page, live.
+        if (!isDeepStrictEqual(before.nodes[id], node))
             out.push({ op: 'set', path: ['nodes', id], value: node });
     }
     for (const id of Object.keys(before.nodes)) {

package/dist/domains/site/findings.js

@@ -103,7 +103,8 @@ export const FIX = {
         'renderer resolves a page id), { "id": "<popup id>" } for popup.',
     no_data_context: 'Give it a record: put it inside a list-dataset / dataset-block, pin one with sb_bind ' +
         '(target id), or move it to a page whose type supplies "<key>" (product, category, course, ' +
-        'post, blog). Off those it renders its placeholder for ever.',
+        'post, blog). A cartLine field goes inside a cart-order instead. Off those it renders its ' +
+        'placeholder for ever.',
     unread_value: 'Write a value the renderer reads: sb_traits_for "<type>" lists them; sb_set id "<id>" ' +
         'with one, at the same breakpoint it is stored at.',
     unknown_icon: 'Write a real icon name: sb_set id "<id>", namespace <ns>, keys { "<key>": "<name>" } — the ' +

package/dist/domains/site/review.js

@@ -131,7 +131,20 @@ function drawsItsOwnContent(type) {
     return (BOUND_SPECIALS[type] ?? []).some((k) => !LINK_SPECIALS.has(k));
 }
 /** Binding-source prefixes that name a RECORD (not `site.*`, which every page has). */
-const RECORD_ENTITIES = new Set(['product', 'category', 'course', 'article', 'blogCategory', 'brand']);
+// cartLine: only a cart-order's line row supplies it (render/nodes/cart-order,
+// scope.PlaceholderCartLine) — see ROW_SUPPLIER. searchRow is left out: no
+// element supplies it yet, so there is no right place to point at.
+const RECORD_ENTITIES = new Set(['product', 'category', 'course', 'article', 'blogCategory', 'brand', 'cartLine']);
+/** A record only one element type's rows supply, which is not a dataset repeater. */
+const ROW_SUPPLIER = { cartLine: 'cart-order' };
+/** Does this node sit inside an element of `type`? */
+function insideType(d, id, type) {
+    for (let x = d.nodes[id]?.data.parent; x && d.nodes[x]; x = d.nodes[x].data.parent) {
+        if (d.nodes[x].data.type === type)
+            return true;
+    }
+    return false;
+}
 /**
  * Which records a page TYPE supplies outside any repeater — read off the
  * platform's own seeds (STORE_PAGE_SEEDS bind exactly these at top level).
@@ -443,13 +456,16 @@ opts = {}) {
             const missing = (n.bindings ?? [])
                 .map((b) => String(b?.source ?? '').split('.')[0])
                 .find((e) => RECORD_ENTITIES.has(e) && !entities.includes(e));
-            if (missing && !pinnedAbove(d, id)) {
+            const supplied = missing && ROW_SUPPLIER[missing] ? insideType(d, id, ROW_SUPPLIER[missing]) : false;
+            if (missing && !supplied && !pinnedAbove(d, id)) {
                 out.push({
                     code: 'no_data_context',
                     nodeId: id,
                     type,
-                    problem: `Bound to a ${missing} record, but it sits in no repeater and a "${opts.pageType}" ` +
-                        'page supplies none — it renders its placeholder on the published page.',
+                    problem: (ROW_SUPPLIER[missing]
+                        ? `Bound to a ${missing} field, but it sits outside any ${ROW_SUPPLIER[missing]} — only its line rows supply one, so it renders its placeholder on the published page.`
+                        : `Bound to a ${missing} record, but it sits in no repeater and a "${opts.pageType}" ` +
+                            'page supplies none — it renders its placeholder on the published page.'),
                     key: missing,
                     fix: fill('no_data_context', { id, key: missing }),
                 });

package/dist/tools/api.js

@@ -1,3 +1,4 @@
+import { isDeepStrictEqual } from 'node:util';
 import { z } from 'zod';
 import { API_OPERATIONS, SWAGGER_SOURCE } from '../catalog/api.generated.js';
 import { REQUEST_SHAPES } from '../catalog/shapes.generated.js';
@@ -54,12 +55,33 @@ export function deepMerge(base, over) {
         out[k] = deepMerge(base[k], v);
     return out;
 }
+/**
+ * Top-level body keys the handler's Go struct has no field for. encoding/json
+ * DROPS them without a word, so a misspelt field is a write that "worked":
+ * measured, `price: 30000` on a shipping method stored `feeCents: 0`. Matched
+ * case-insensitively, as Go's decoder does. Silent when the shape is unknown or
+ * partial — a warning there would be a guess.
+ */
+export function unknownBodyKeys(opId, body) {
+    const shape = REQUEST_SHAPES[opId];
+    if (!shape || shape.partial || !isPlain(body))
+        return undefined;
+    const known = new Set(shape.fields.map((f) => f.name.toLowerCase()));
+    const keys = Object.keys(body).filter((k) => !known.has(k.toLowerCase()));
+    if (!keys.length)
+        return undefined;
+    return {
+        keys,
+        note: `Not fields of ${shape.goType}: the platform ignores them silently. ` +
+            `Its fields: ${shape.fields.map((f) => f.name).join(', ')}.`,
+    };
+}
 /** Leaf paths where `b` differs from `a` (arrays compared whole). */
 function changedPaths(a, b, at = '') {
     if (isPlain(a) && isPlain(b)) {
         return [...new Set([...Object.keys(a), ...Object.keys(b)])].flatMap((k) => changedPaths(a[k], b[k], at ? `${at}.${k}` : k));
     }
-    return JSON.stringify(a) === JSON.stringify(b) ? [] : [at];
+    return isDeepStrictEqual(a, b) ? [] : [at];
 }
 const isEmpty = (v) => v === null || v === undefined || v === '' || v === false || v === 0 ||
     (Array.isArray(v) && v.length === 0) || (isPlain(v) && Object.keys(v).length === 0);
@@ -604,6 +626,7 @@ export async function callOperation(ctx, args) {
             `${dryRun ? 'would be' : 'were'} erased: ${listPaths(erased)}. ` +
             (dryRun ? 'Pass merge:true to keep them.' : 'sb_undo puts them back.')
         : undefined;
+    const unknownKeys = unknownBodyKeys(op.id, args.file ? undefined : args.body);
     // If-Match: given, or — on a route that refuses a write without one — the
     // version the GET answers right now.
     const headers = {};
@@ -672,6 +695,7 @@ export async function callOperation(ctx, args) {
             ...(download ? { would_save: args.file.path } : {}),
             ...(merged ? { merge: merged } : {}),
             ...(replaceWarning ? { replace_warning: replaceWarning } : {}),
+            ...(unknownKeys ? { unknown_keys: unknownKeys } : {}),
             // Shaping is part of what the call WOULD do, so the preview says it;
             // otherwise a dry run reads identically whether or not it was asked for.
             ...(args.pick !== undefined || args.max_items !== undefined || args.item_offset !== undefined
@@ -745,6 +769,7 @@ export async function callOperation(ctx, args) {
         ...(ifMatchRead ? { if_match: { sent: headers['If-Match'], read_from: `GET ${ifMatchRead}` } } : {}),
         ...(merged ? { merge: merged } : {}),
         ...(replaceWarning ? { replace_warning: replaceWarning } : {}),
+        ...(unknownKeys ? { unknown_keys: unknownKeys } : {}),
     };
     const told = Object.keys(extra).length && isPlain(answer) ? { ...answer, ...extra } : answer;
     if (!op.raw)

package/dist/tools/page.js

@@ -1,3 +1,4 @@
+import { isDeepStrictEqual } from 'node:util';
 import { z } from 'zod';
 import { composeWarnings } from '../domains/site/findings.js';
 import { text } from '../mcp/response.js';
@@ -681,7 +682,7 @@ export class PageSession {
         const d = this.current();
         // Rev when both sides have one; an older platform reports none, and the
         // document is then compared whole — a false refusal is the safe failure.
-        const moved = fence.rev > 0 && this.sourceRev > 0 ? this.sourceRev !== fence.rev : JSON.stringify(d.doc) !== fence.json;
+        const moved = fence.rev > 0 && this.sourceRev > 0 ? this.sourceRev !== fence.rev : !isDeepStrictEqual(d.doc, JSON.parse(fence.json));
         if (moved) {
             throw new Error(`sbuilder: refusing to undo — page ${pageId}'s draft moved since this process last saved it ` +
                 `(rev ${this.sourceRev}, last stored here ${fence.rev}): someone else saved it, and restoring ` +
@@ -2227,6 +2228,14 @@ export function registerPageTools(server, ctx) {
         // its own type is what gives it its icon and tells the next reader what it
         // is for. Only when the caller named no type; an explicit one wins.
         const askedType = type;
+        // AN UNKNOWN TYPE IS STORED AS "page", SILENTLY (page.go validType). Measured:
+        // type "home" created a plain page at /home and answered 201, so the site
+        // still had no homepage and nothing said so.
+        if (type !== undefined && !PAGE_TYPES.some((t) => t.type === type)) {
+            throw new Error(`sbuilder: page type "${type}" does not exist — the platform would store it as "page". ` +
+                (/^home(page)?$/i.test(type) ? 'A homepage is is_homepage:true on any page. ' : '') +
+                `Types: ${PAGE_TYPES.map((t) => t.type).join(', ')}.`);
+        }
         type ??= purposeTypeForName(name);
         // TYPE IS THE ROUTE for several kinds of page: /checkout and
         // /products/{slug} resolve to the site's PUBLISHED page of that type and
@@ -2590,7 +2599,9 @@ export function registerPageTools(server, ctx) {
         },
         annotations: { readOnlyHint: true },
     }, async ({ site_id: given, page_id }) => {
-        const site_id = siteFor(ctx, given);
+        // The open page's site, like its page id: with no SB_SITE this refused a
+        // call on the page it had just been pointed at.
+        const site_id = siteFor(ctx, given ?? (page_id ? undefined : session.page()?.siteId));
         // No open page is fine when page_id names one — `location()` throws.
         const here = session.page() ?? { siteId: '', pageId: '' };
         const pageId = page_id ?? here.pageId;

package/dist/tools/pageupdate.js

@@ -1,3 +1,4 @@
+import { isDeepStrictEqual } from 'node:util';
 import { z } from 'zod';
 import { text } from '../mcp/response.js';
 import { request, redact } from '../transport/http.js';
@@ -87,7 +88,7 @@ export function registerPageUpdateTools(server, ctx) {
         // courseGate, courseLesson and keys unknown here — so the write is always the
         // whole old blob with only the named keys moved, as the editor's PageSeoDialog does.
         const changes = {};
-        const differs = (a, b) => JSON.stringify(a) !== JSON.stringify(b);
+        const differs = (a, b) => !isDeepStrictEqual(a, b);
         const settings = { ...old };
         for (const [k, v] of Object.entries(seo ?? {})) {
             if (differs(old[k], v))

package/dist/tools/pageversion.js

@@ -30,8 +30,8 @@ export function registerPageVersionTools(server, ctx, session) {
         },
         annotations: { readOnlyHint: false, destructiveHint: true },
     }, async ({ action, site_id: given, page_id, label, version_id, history_id, dry_run }) => {
-        const siteId = siteFor(ctx, given);
         const open = session.page();
+        const siteId = siteFor(ctx, given ?? (page_id ? undefined : open?.siteId));
         const pageId = page_id ?? (open?.siteId === siteId ? open.pageId : undefined);
         if (!pageId)
             throw new Error('sbuilder: sb_page_version needs page_id, or a page opened with sb_page_open.');

package/dist/tools/store.js

@@ -34,6 +34,7 @@
  * `app.ts`) and are dispatched from here; the checkout and `form` are written
  * out below, because they came first.
  */
+import { isDeepStrictEqual } from 'node:util';
 import { z } from 'zod';
 import { text } from '../mcp/response.js';
 import { request, redact, ApiError } from '../transport/http.js';
@@ -121,7 +122,7 @@ export function syncOrderDocument(doc, fresh, shipping) {
         if (sp?.name === 'payment_method') {
             const had = new Map((sp.methods ?? []).map((m) => [m.value, m]));
             const next = fresh.map((m) => had.get(m.value) ?? m);
-            if (JSON.stringify(next) !== JSON.stringify(sp.methods ?? [])) {
+            if (!isDeepStrictEqual(next, sp.methods ?? [])) {
                 sp.methods = next;
                 if (!next.some((m) => m.value === sp.defaultValue))
                     sp.defaultValue = next[0]?.value ?? '';
@@ -130,7 +131,7 @@ export function syncOrderDocument(doc, fresh, shipping) {
             out.payment_methods = next.map((m) => m.value);
         }
         if (sp?.name === 'shipping_method') {
-            if (JSON.stringify(sp.options ?? []) !== JSON.stringify(shipping)) {
+            if (!isDeepStrictEqual(sp.options ?? [], shipping)) {
                 sp.options = [...shipping];
                 out.changed = true;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sbuilder-mcp",
-  "version": "0.83.2",
+  "version": "0.84.0",
   "description": "MCP server that designs and operates a Store Builder site — pages, data, theme and publish — through the platform's own API and live-edit protocol.",
   "mcpName": "io.github.vuluu2k/sbuilder-mcp",
   "type": "module",