sbuilder-mcp 0.83.3 → 0.84.0

package/CHANGELOG.md

@@ -6,6 +6,16 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.84.0] - 2026-10-11
+
+### Added
+- `sb_api_call` reports `unknown_keys` for body keys the handler's Go struct does not have, which the platform otherwise drops silently (for example `price` on a delivery method saves `feeCents` as 0 and still returns 201).
+- `sb_review` flags `cartLine.*` bindings used outside a cart-order context as `no_data_context`.
+
+### Fixed
+- Undoing an `sb_move` rewrites only the node that changed instead of all five nodes on the page, because document comparisons no longer depend on the key order the platform returns.
+- The request shape of the `/refund` and `/refund-via-gateway` operations is now `refundRequest` with `note`, so `sb_api_call` no longer validates them against the charge shape.
+
 ## [0.83.3] - 2026-10-11
 
 ### Fixed

package/CHANGELOG.vi.md

@@ -6,6 +6,16 @@ Mọi thay đổi đáng chú ý của dự án được ghi lại trong file n
 Định dạng dựa trên [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 và dự án tuân theo [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.84.0] - 2026-10-11
+
+### Added
+- `sb_api_call` báo `unknown_keys` cho các key trong body mà struct Go của handler không có, vì platform vốn bỏ chúng lặng lẽ (ví dụ `price` trên phương thức giao hàng lưu `feeCents` bằng 0 mà vẫn trả 201).
+- `sb_review` báo binding `cartLine.*` dùng ngoài ngữ cảnh cart-order là `no_data_context`.
+
+### Fixed
+- Hoàn tác một `sb_move` chỉ ghi lại node đã thay đổi thay vì cả năm node của trang, vì việc so sánh tài liệu không còn phụ thuộc thứ tự key mà platform trả về.
+- Shape request của operation `/refund` và `/refund-via-gateway` giờ là `refundRequest` với `note`, nên `sb_api_call` không còn kiểm tra chúng theo shape của charge.
+
 ## [0.83.3] - 2026-10-11
 
 ### Fixed

package/dist/catalog/shapes.generated.js

@@ -5869,30 +5869,22 @@ export const REQUEST_SHAPES = {
     "post:/api/sites/{siteId}/payment-transactions/{transactionId}/refund": {
         "fields": [
             {
-                "name": "orderId",
-                "type": "string"
-            },
-            {
-                "name": "provider",
+                "name": "note",
                 "type": "string"
             }
         ],
         "source": "go",
-        "goType": "chargeRequest"
+        "goType": "refundRequest"
     },
     "post:/api/sites/{siteId}/payment-transactions/{transactionId}/refund-via-gateway": {
         "fields": [
             {
-                "name": "orderId",
-                "type": "string"
-            },
-            {
-                "name": "provider",
+                "name": "note",
                 "type": "string"
             }
         ],
         "source": "go",
-        "goType": "chargeRequest"
+        "goType": "refundRequest"
     },
     "post:/api/sites/{id}/plan-checkout": {
         "fields": [

package/dist/core/patch.js

@@ -1,3 +1,11 @@
+/**
+ * The document patch primitive, mirrored from the editor's live-edit channel
+ * (editor/src/history/patchRecorder.ts + features/liveedit/ops.ts).
+ *
+ * The shape has to match exactly: these patches go on the wire to peers running
+ * the editor's own code, and a shape it does not recognise is dropped silently.
+ */
+import { isDeepStrictEqual } from 'node:util';
 /** Segments that must never appear in a path we apply or send. */
 const FORBIDDEN = new Set(['__proto__', 'constructor', 'prototype']);
 /**
@@ -149,7 +157,10 @@ export function applyPatches(state, patches) {
 export function documentPatches(before, after) {
     const out = [];
     for (const [id, node] of Object.entries(after.nodes)) {
-        if (JSON.stringify(before.nodes[id]) !== JSON.stringify(node))
+        // Not JSON.stringify: a document read back from the platform (Postgres
+        // jsonb) orders keys differently from one built here, so every node
+        // "differed" — undoing one sb_move rewrote all five nodes of a page, live.
+        if (!isDeepStrictEqual(before.nodes[id], node))
             out.push({ op: 'set', path: ['nodes', id], value: node });
     }
     for (const id of Object.keys(before.nodes)) {

package/dist/domains/site/findings.js

@@ -103,7 +103,8 @@ export const FIX = {
         'renderer resolves a page id), { "id": "<popup id>" } for popup.',
     no_data_context: 'Give it a record: put it inside a list-dataset / dataset-block, pin one with sb_bind ' +
         '(target id), or move it to a page whose type supplies "<key>" (product, category, course, ' +
-        'post, blog). Off those it renders its placeholder for ever.',
+        'post, blog). A cartLine field goes inside a cart-order instead. Off those it renders its ' +
+        'placeholder for ever.',
     unread_value: 'Write a value the renderer reads: sb_traits_for "<type>" lists them; sb_set id "<id>" ' +
         'with one, at the same breakpoint it is stored at.',
     unknown_icon: 'Write a real icon name: sb_set id "<id>", namespace <ns>, keys { "<key>": "<name>" } — the ' +

package/dist/domains/site/review.js

@@ -131,7 +131,20 @@ function drawsItsOwnContent(type) {
     return (BOUND_SPECIALS[type] ?? []).some((k) => !LINK_SPECIALS.has(k));
 }
 /** Binding-source prefixes that name a RECORD (not `site.*`, which every page has). */
-const RECORD_ENTITIES = new Set(['product', 'category', 'course', 'article', 'blogCategory', 'brand']);
+// cartLine: only a cart-order's line row supplies it (render/nodes/cart-order,
+// scope.PlaceholderCartLine) — see ROW_SUPPLIER. searchRow is left out: no
+// element supplies it yet, so there is no right place to point at.
+const RECORD_ENTITIES = new Set(['product', 'category', 'course', 'article', 'blogCategory', 'brand', 'cartLine']);
+/** A record only one element type's rows supply, which is not a dataset repeater. */
+const ROW_SUPPLIER = { cartLine: 'cart-order' };
+/** Does this node sit inside an element of `type`? */
+function insideType(d, id, type) {
+    for (let x = d.nodes[id]?.data.parent; x && d.nodes[x]; x = d.nodes[x].data.parent) {
+        if (d.nodes[x].data.type === type)
+            return true;
+    }
+    return false;
+}
 /**
  * Which records a page TYPE supplies outside any repeater — read off the
  * platform's own seeds (STORE_PAGE_SEEDS bind exactly these at top level).
@@ -443,13 +456,16 @@ opts = {}) {
             const missing = (n.bindings ?? [])
                 .map((b) => String(b?.source ?? '').split('.')[0])
                 .find((e) => RECORD_ENTITIES.has(e) && !entities.includes(e));
-            if (missing && !pinnedAbove(d, id)) {
+            const supplied = missing && ROW_SUPPLIER[missing] ? insideType(d, id, ROW_SUPPLIER[missing]) : false;
+            if (missing && !supplied && !pinnedAbove(d, id)) {
                 out.push({
                     code: 'no_data_context',
                     nodeId: id,
                     type,
-                    problem: `Bound to a ${missing} record, but it sits in no repeater and a "${opts.pageType}" ` +
-                        'page supplies none — it renders its placeholder on the published page.',
+                    problem: (ROW_SUPPLIER[missing]
+                        ? `Bound to a ${missing} field, but it sits outside any ${ROW_SUPPLIER[missing]} — only its line rows supply one, so it renders its placeholder on the published page.`
+                        : `Bound to a ${missing} record, but it sits in no repeater and a "${opts.pageType}" ` +
+                            'page supplies none — it renders its placeholder on the published page.'),
                     key: missing,
                     fix: fill('no_data_context', { id, key: missing }),
                 });

package/dist/tools/api.js

@@ -1,3 +1,4 @@
+import { isDeepStrictEqual } from 'node:util';
 import { z } from 'zod';
 import { API_OPERATIONS, SWAGGER_SOURCE } from '../catalog/api.generated.js';
 import { REQUEST_SHAPES } from '../catalog/shapes.generated.js';
@@ -54,12 +55,33 @@ export function deepMerge(base, over) {
         out[k] = deepMerge(base[k], v);
     return out;
 }
+/**
+ * Top-level body keys the handler's Go struct has no field for. encoding/json
+ * DROPS them without a word, so a misspelt field is a write that "worked":
+ * measured, `price: 30000` on a shipping method stored `feeCents: 0`. Matched
+ * case-insensitively, as Go's decoder does. Silent when the shape is unknown or
+ * partial — a warning there would be a guess.
+ */
+export function unknownBodyKeys(opId, body) {
+    const shape = REQUEST_SHAPES[opId];
+    if (!shape || shape.partial || !isPlain(body))
+        return undefined;
+    const known = new Set(shape.fields.map((f) => f.name.toLowerCase()));
+    const keys = Object.keys(body).filter((k) => !known.has(k.toLowerCase()));
+    if (!keys.length)
+        return undefined;
+    return {
+        keys,
+        note: `Not fields of ${shape.goType}: the platform ignores them silently. ` +
+            `Its fields: ${shape.fields.map((f) => f.name).join(', ')}.`,
+    };
+}
 /** Leaf paths where `b` differs from `a` (arrays compared whole). */
 function changedPaths(a, b, at = '') {
     if (isPlain(a) && isPlain(b)) {
         return [...new Set([...Object.keys(a), ...Object.keys(b)])].flatMap((k) => changedPaths(a[k], b[k], at ? `${at}.${k}` : k));
     }
-    return JSON.stringify(a) === JSON.stringify(b) ? [] : [at];
+    return isDeepStrictEqual(a, b) ? [] : [at];
 }
 const isEmpty = (v) => v === null || v === undefined || v === '' || v === false || v === 0 ||
     (Array.isArray(v) && v.length === 0) || (isPlain(v) && Object.keys(v).length === 0);
@@ -604,6 +626,7 @@ export async function callOperation(ctx, args) {
             `${dryRun ? 'would be' : 'were'} erased: ${listPaths(erased)}. ` +
             (dryRun ? 'Pass merge:true to keep them.' : 'sb_undo puts them back.')
         : undefined;
+    const unknownKeys = unknownBodyKeys(op.id, args.file ? undefined : args.body);
     // If-Match: given, or — on a route that refuses a write without one — the
     // version the GET answers right now.
     const headers = {};
@@ -672,6 +695,7 @@ export async function callOperation(ctx, args) {
             ...(download ? { would_save: args.file.path } : {}),
             ...(merged ? { merge: merged } : {}),
             ...(replaceWarning ? { replace_warning: replaceWarning } : {}),
+            ...(unknownKeys ? { unknown_keys: unknownKeys } : {}),
             // Shaping is part of what the call WOULD do, so the preview says it;
             // otherwise a dry run reads identically whether or not it was asked for.
             ...(args.pick !== undefined || args.max_items !== undefined || args.item_offset !== undefined
@@ -745,6 +769,7 @@ export async function callOperation(ctx, args) {
         ...(ifMatchRead ? { if_match: { sent: headers['If-Match'], read_from: `GET ${ifMatchRead}` } } : {}),
         ...(merged ? { merge: merged } : {}),
         ...(replaceWarning ? { replace_warning: replaceWarning } : {}),
+        ...(unknownKeys ? { unknown_keys: unknownKeys } : {}),
     };
     const told = Object.keys(extra).length && isPlain(answer) ? { ...answer, ...extra } : answer;
     if (!op.raw)

package/dist/tools/page.js

@@ -1,3 +1,4 @@
+import { isDeepStrictEqual } from 'node:util';
 import { z } from 'zod';
 import { composeWarnings } from '../domains/site/findings.js';
 import { text } from '../mcp/response.js';
@@ -681,7 +682,7 @@ export class PageSession {
         const d = this.current();
         // Rev when both sides have one; an older platform reports none, and the
         // document is then compared whole — a false refusal is the safe failure.
-        const moved = fence.rev > 0 && this.sourceRev > 0 ? this.sourceRev !== fence.rev : JSON.stringify(d.doc) !== fence.json;
+        const moved = fence.rev > 0 && this.sourceRev > 0 ? this.sourceRev !== fence.rev : !isDeepStrictEqual(d.doc, JSON.parse(fence.json));
         if (moved) {
             throw new Error(`sbuilder: refusing to undo — page ${pageId}'s draft moved since this process last saved it ` +
                 `(rev ${this.sourceRev}, last stored here ${fence.rev}): someone else saved it, and restoring ` +

package/dist/tools/pageupdate.js

@@ -1,3 +1,4 @@
+import { isDeepStrictEqual } from 'node:util';
 import { z } from 'zod';
 import { text } from '../mcp/response.js';
 import { request, redact } from '../transport/http.js';
@@ -87,7 +88,7 @@ export function registerPageUpdateTools(server, ctx) {
         // courseGate, courseLesson and keys unknown here — so the write is always the
         // whole old blob with only the named keys moved, as the editor's PageSeoDialog does.
         const changes = {};
-        const differs = (a, b) => JSON.stringify(a) !== JSON.stringify(b);
+        const differs = (a, b) => !isDeepStrictEqual(a, b);
         const settings = { ...old };
         for (const [k, v] of Object.entries(seo ?? {})) {
             if (differs(old[k], v))

package/dist/tools/store.js

@@ -34,6 +34,7 @@
  * `app.ts`) and are dispatched from here; the checkout and `form` are written
  * out below, because they came first.
  */
+import { isDeepStrictEqual } from 'node:util';
 import { z } from 'zod';
 import { text } from '../mcp/response.js';
 import { request, redact, ApiError } from '../transport/http.js';
@@ -121,7 +122,7 @@ export function syncOrderDocument(doc, fresh, shipping) {
         if (sp?.name === 'payment_method') {
             const had = new Map((sp.methods ?? []).map((m) => [m.value, m]));
             const next = fresh.map((m) => had.get(m.value) ?? m);
-            if (JSON.stringify(next) !== JSON.stringify(sp.methods ?? [])) {
+            if (!isDeepStrictEqual(next, sp.methods ?? [])) {
                 sp.methods = next;
                 if (!next.some((m) => m.value === sp.defaultValue))
                     sp.defaultValue = next[0]?.value ?? '';
@@ -130,7 +131,7 @@ export function syncOrderDocument(doc, fresh, shipping) {
             out.payment_methods = next.map((m) => m.value);
         }
         if (sp?.name === 'shipping_method') {
-            if (JSON.stringify(sp.options ?? []) !== JSON.stringify(shipping)) {
+            if (!isDeepStrictEqual(sp.options ?? [], shipping)) {
                 sp.options = [...shipping];
                 out.changed = true;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sbuilder-mcp",
-  "version": "0.83.3",
+  "version": "0.84.0",
   "description": "MCP server that designs and operates a Store Builder site — pages, data, theme and publish — through the platform's own API and live-edit protocol.",
   "mcpName": "io.github.vuluu2k/sbuilder-mcp",
   "type": "module",