sbuilder-mcp 0.87.0 → 0.88.1

package/CHANGELOG.md

@@ -6,6 +6,26 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.88.1] - 2026-10-12
+
+### Added
+- The API catalog is refreshed to 853 operations, including device sign-in for the CLI; the device approval operation cannot be called with a session.
+
+### Fixed
+- Every tool call keeps working after the access token expires, because a rejected session token is refreshed once and the call is retried once; API keys are never refreshed.
+- Concurrent rejections share a single token refresh, and signing out or back in during a refresh is no longer overwritten.
+- `sb_media_upload` and `sb_live_join` reconnects refresh the token before it expires, so uploads and live sessions survive past the token lifetime.
+
+## [0.88.0] - 2026-10-12
+
+### Added
+- `sb_review` reports `default_seed_copy` for pages built earlier that still carry the English seed copy, such as "Add To Cart", on a Vietnamese site, with the Vietnamese wording to use instead.
+
+### Changed
+- `sb_page_create` writes the store page seeds in Vietnamese for a Vietnamese site, taking the locale from the site's settings when none is passed.
+- `sb_page_create` uses English thank-you copy on the completed-order page of an `en-US` site.
+- `sb_review` words its `categoryImages` note to say that a collection tile without an image now shows a placeholder instead of a broken image.
+
 ## [0.87.0] - 2026-10-12
 
 ### Added

package/CHANGELOG.vi.md

@@ -6,6 +6,26 @@ Mọi thay đổi đáng chú ý của dự án được ghi lại trong file n
 Định dạng dựa trên [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 và dự án tuân theo [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.88.1] - 2026-10-12
+
+### Added
+- Catalog API được làm mới lên 853 operation, gồm đăng nhập bằng thiết bị cho CLI; operation duyệt thiết bị không gọi được bằng phiên đăng nhập.
+
+### Fixed
+- Mọi lời gọi tool tiếp tục chạy sau khi access token hết hạn, vì token phiên bị từ chối sẽ được làm mới một lần và lời gọi được thử lại một lần; API key không bao giờ bị làm mới.
+- Các lần bị từ chối đồng thời dùng chung một lượt làm mới token, và việc đăng xuất hoặc đăng nhập lại trong lúc làm mới không còn bị ghi đè.
+- `sb_media_upload` và việc kết nối lại của `sb_live_join` làm mới token trước khi hết hạn, nên upload và phiên live vẫn chạy được sau thời hạn của token.
+
+## [0.88.0] - 2026-10-12
+
+### Added
+- `sb_review` báo `default_seed_copy` cho trang dựng trước đó còn mang chữ mẫu tiếng Anh, như "Add To Cart", trên site tiếng Việt, kèm bản tiếng Việt nên dùng.
+
+### Changed
+- `sb_page_create` viết seed trang cửa hàng bằng tiếng Việt cho site tiếng Việt, lấy locale từ cài đặt của site khi không truyền.
+- `sb_page_create` dùng câu cảm ơn tiếng Anh cho trang hoàn tất đơn hàng của site `en-US`.
+- `sb_review` sửa câu báo `categoryImages`: ô danh mục thiếu ảnh giờ hiện placeholder thay vì ảnh vỡ.
+
 ## [0.87.0] - 2026-10-12
 
 ### Added

package/README.md

@@ -118,7 +118,7 @@ in this client: one would put the very key the platform exists to hold back into
 | `sb_store` | Run a store flow that must happen in a fixed order — `checkout` (the four writes that make a working one), `checkout_sync` (the store's current payment and delivery methods into every existing order form, checkout page republished), `form` (any of the platform's 17 templates with its own field document), `chrome` (one shared header or footer on a real site menu — desktop menu, mobile drawer, cart and account icons), `menu` (a menu node bound to the site's menu, its links resolved), `overlay_attach` (a pop-up or quick view on the open page), `cart` (the site's cart drawer, when it has none; `relocalize` puts an existing one in the site's language) and `app` (a built-in app plus the pages it needs), `global_attach` / `global_detach` (put an EXISTING shared section on the open page, or take it off), `global_promote` (make a section on the page a NEW shared section) and `template_save` (save a section as a reusable template) |
 | `sb_undo` | Undo / redo this session's writes — page and form edits and `sb_api_call` PUTs; a page is refused if someone else saved it since. The platform's versions and history (`sb_page_version`) outlive this process |
 
-Twenty-eight tools, **849 API operations** (312 of the 393 writes carrying a body shape read
+Twenty-eight tools, **853 API operations** (316 of the 397 writes carrying a body shape read
 off the handler), 123 elements, 94 binding sources. `sb_api_find`
 is an index rather than a tool per endpoint, so the tool list stays short while everything
 the platform can do stays reachable — and operations added to the platform arrive with the

package/README.vi.md

@@ -115,7 +115,7 @@ nhét ngược lại vào mọi bản cài.
 | `sb_store` | Chạy một luồng cửa hàng bắt buộc đúng thứ tự — `checkout` (bốn lệnh ghi tạo nên trang thanh toán), `checkout_sync` (đưa phương thức thanh toán và giao hàng hiện tại vào mọi form đặt hàng đã có, publish lại trang thanh toán), `form` (một trong 17 template của nền tảng kèm field document của nó), `chrome` (một header hoặc footer dùng chung trên menu thật của site — menu desktop, drawer mobile, icon giỏ hàng và tài khoản), `menu` (một node menu bind vào menu của site, link đã phân giải), `overlay_attach` (một pop-up hay quick view trên trang đang mở), `cart` (ngăn giỏ hàng của site, khi chưa có; `relocalize` đưa ngăn giỏ đã có về ngôn ngữ của site), `app` (một app dựng sẵn kèm những trang nó cần), và `global_attach` / `global_detach` (đặt một section dùng chung ĐÃ CÓ lên trang đang mở, hoặc gỡ ra), `global_promote` (biến một section trên trang thành section dùng chung MỚI) và `template_save` (lưu một section làm mẫu dùng lại) |
 | `sb_undo` | Hoàn tác / làm lại các thao tác ghi trong phiên — chỉnh sửa trang, form và PUT qua `sb_api_call`; trang bị từ chối nếu người khác đã lưu sau đó. Version và history của nền tảng (`sb_page_version`) sống lâu hơn process này |
 
-Hai mươi tám tool, **849 operation API** (312 trong 393 lệnh ghi có hình dạng body đọc thẳng
+Hai mươi tám tool, **853 operation API** (316 trong 397 lệnh ghi có hình dạng body đọc thẳng
 từ handler), 123 element, 94 nguồn binding. `sb_api_find` là
 một chỉ mục chứ không phải mỗi endpoint một tool, nên danh sách tool vẫn ngắn trong khi mọi
 thứ nền tảng làm được vẫn với tới — và operation mới thêm bên nền tảng sẽ tự có sau lần

package/dist/catalog/api.generated.js

@@ -1,8 +1,8 @@
 export const SWAGGER_SOURCE = {
-    "operations": 849,
-    "definitions": 280,
-    "bodyCarrying": 376,
-    "bodyUndescribed": 102,
+    "operations": 853,
+    "definitions": 282,
+    "bodyCarrying": 380,
+    "bodyUndescribed": 106,
     "generatedFrom": "server/docs/swagger.json"
 };
 export const API_OPERATIONS = [
@@ -1900,6 +1900,90 @@ export const API_OPERATIONS = [
         "bodyRef": null,
         "credential": "none"
     },
+    {
+        "id": "post:/api/auth/device/approve",
+        "method": "POST",
+        "path": "/api/auth/device/approve",
+        "tags": [
+            "auth"
+        ],
+        "summary": "Approve or deny a pending device login",
+        "params": [
+            {
+                "name": "body",
+                "in": "body",
+                "required": true,
+                "type": "object",
+                "description": "userCode + decision (approve|deny)"
+            }
+        ],
+        "bodyDescribed": false,
+        "bodyRef": null,
+        "credential": "none"
+    },
+    {
+        "id": "post:/api/auth/device/inspect",
+        "method": "POST",
+        "path": "/api/auth/device/inspect",
+        "tags": [
+            "auth"
+        ],
+        "summary": "Describe a pending device login by its typed user code",
+        "params": [
+            {
+                "name": "body",
+                "in": "body",
+                "required": true,
+                "type": "object",
+                "description": "userCode"
+            }
+        ],
+        "bodyDescribed": false,
+        "bodyRef": null,
+        "credential": "none"
+    },
+    {
+        "id": "post:/api/auth/device/start",
+        "method": "POST",
+        "path": "/api/auth/device/start",
+        "tags": [
+            "auth"
+        ],
+        "summary": "Start a browser device login (sb CLI)",
+        "params": [
+            {
+                "name": "body",
+                "in": "body",
+                "required": true,
+                "type": "object",
+                "description": "client + clientVersion"
+            }
+        ],
+        "bodyDescribed": false,
+        "bodyRef": null,
+        "credential": "none"
+    },
+    {
+        "id": "post:/api/auth/device/token",
+        "method": "POST",
+        "path": "/api/auth/device/token",
+        "tags": [
+            "auth"
+        ],
+        "summary": "Poll a device login; returns a token pair once approved",
+        "params": [
+            {
+                "name": "body",
+                "in": "body",
+                "required": true,
+                "type": "object",
+                "description": "deviceCode"
+            }
+        ],
+        "bodyDescribed": false,
+        "bodyRef": null,
+        "credential": "none"
+    },
     {
         "id": "post:/api/auth/forgot-password",
         "method": "POST",
@@ -27046,6 +27130,43 @@ export const API_OPERATIONS = [
     }
 ];
 export const API_DEFINITIONS = {
+    "github_com_webbuilder_server_internal_auth.DeviceRequest": {
+        "type": "object",
+        "properties": {
+            "client": {
+                "type": "string"
+            },
+            "clientVersion": {
+                "type": "string"
+            },
+            "createdAt": {
+                "type": "string"
+            },
+            "expiresAt": {
+                "type": "string"
+            }
+        }
+    },
+    "github_com_webbuilder_server_internal_auth.DeviceStart": {
+        "type": "object",
+        "properties": {
+            "deviceCode": {
+                "type": "string"
+            },
+            "expiresIn": {
+                "type": "integer"
+            },
+            "interval": {
+                "type": "integer"
+            },
+            "userCode": {
+                "type": "string"
+            },
+            "verificationUri": {
+                "type": "string"
+            }
+        }
+    },
     "github_com_webbuilder_server_internal_codefiles.CodeFile": {
         "type": "object",
         "properties": {

package/dist/catalog/deadkeys.generated.js

@@ -1,6 +1,6 @@
 export const DEAD_KEY_SOURCE = {
-    "files": 5691,
-    "identifiers": 104085,
+    "files": 5704,
+    "identifiers": 104277,
     "seededKeys": 445,
     "dead": 0
 };

package/dist/catalog/shapes.generated.js

@@ -1,10 +1,10 @@
 export const SHAPE_SOURCE = {
-    "writeOperations": 393,
-    "shaped": 312,
-    "fromHandlers": 302,
+    "writeOperations": 397,
+    "shaped": 316,
+    "fromHandlers": 306,
     "fromSwaggerOnly": 10,
     "withReadOnly": 30,
-    "structsRead": 3226
+    "structsRead": 3237
 };
 export const REQUEST_SHAPES = {
     "post:/api/sites/{id}/ai-credits/purchase": {
@@ -656,6 +656,58 @@ export const REQUEST_SHAPES = {
         "source": "go",
         "goType": "(inline)"
     },
+    "post:/api/auth/device/start": {
+        "fields": [
+            {
+                "name": "client",
+                "type": "string"
+            },
+            {
+                "name": "clientVersion",
+                "type": "string"
+            }
+        ],
+        "source": "go",
+        "goType": "(inline)"
+    },
+    "post:/api/auth/device/inspect": {
+        "fields": [
+            {
+                "name": "userCode",
+                "type": "string"
+            },
+            {
+                "name": "decision",
+                "type": "string"
+            }
+        ],
+        "source": "go",
+        "goType": "deviceDecision"
+    },
+    "post:/api/auth/device/approve": {
+        "fields": [
+            {
+                "name": "userCode",
+                "type": "string"
+            },
+            {
+                "name": "decision",
+                "type": "string"
+            }
+        ],
+        "source": "go",
+        "goType": "deviceDecision"
+    },
+    "post:/api/auth/device/token": {
+        "fields": [
+            {
+                "name": "deviceCode",
+                "type": "string"
+            }
+        ],
+        "source": "go",
+        "goType": "(inline)"
+    },
     "post:/api/auth/register": {
         "fields": [
             {

package/dist/catalog/source.generated.js

@@ -1,7 +1,7 @@
 // GENERATED by scripts/gen-catalog.ts — do not edit by hand.
 // The platform commit every other generated file here describes.
 export const PLATFORM_SOURCE = {
-    "commit": "df9accca9c8a0e402ca5520beddcb52c0843f7f5",
-    "committedAt": "2026-10-12T09:14:30+07:00",
+    "commit": "e69eb03e217da1518783d08db53c776038293778",
+    "committedAt": "2026-10-12T11:10:11+07:00",
     "dirty": false
 };

package/dist/domains/site/readiness.js

@@ -612,11 +612,11 @@ export function readinessGaps(input) {
                 '/api/media/{siteId}/from-url ingests straight from a url in one hop.',
         });
     }
-    // A COLLECTION TILE WITH NO PICTURE IS A BROKEN-IMAGE ICON, not a grey card:
-    // render/nodes/collection-media writes `<img src="">` (the image element has a
-    // placeholder; this one does not). Measured on the sb_category_strip a store
-    // built here put on its home page — two broken icons above the category names.
-    // Asked only where a collection tile is actually on screen.
+    // A COLLECTION TILE WITH NO PICTURE. Measured on the sb_category_strip a store
+    // built here put on its home page: render/nodes/collection-media wrote
+    // `<img src="">`, two broken icons above the category names. web_builder PR
+    // #118 (74ca59dd2) gives it the image element's grey placeholder instead —
+    // better, still not the category. Asked only where a tile is on screen.
     if ((input.categoriesUnpictured ?? 0) > 0 &&
         [...input.pageNodes, ...(input.globalNodes ?? [])].some((n) => n.data?.type === 'collection-media')) {
         const n = input.categoriesUnpictured;
@@ -624,7 +624,8 @@ export function readinessGaps(input) {
             id: 'categoryImages',
             draft: false,
             problem: `${n} product categor${n === 1 ? 'y has' : 'ies have'} no image, and this page shows category ` +
-                'tiles — each renders a broken-image icon above its name.',
+                "tiles — each draws the platform's grey placeholder (a broken-image icon on a platform " +
+                'older than web_builder 74ca59dd2) where the picture goes.',
             fix: 'Upload a picture (sb_media_upload), then PUT the category back with image: url ' +
                 '(sb_api_call put:/api/sites/{siteId}/product-categories/{id}, merge:true).',
         });

package/dist/domains/site/review.js

@@ -3,6 +3,7 @@ import { childrenOf, childrenWithSatellites, isOverlay, isSharedSection, pageChi
 import { STUCK_STATE, stickyBlockedBy, stuckHostOf, isPinnedNode } from './sticky.js';
 import { bandOf, isGlobal } from './traps.js';
 import { exampleCopy } from './examplecopy.js';
+import { SEED_COPY_VI, langOf } from './seedcopy.js';
 import { HOVER_STATE, hoverHome } from './hover.js';
 import { ELEMENTS, BINDING_SOURCES, BOUND_SPECIALS, FIRST_CHILD_ONLY, SATELLITE_RULES, ELEMENT_SEEDS } from '../../catalog/elements.generated.js';
 import { fill } from './findings.js';
@@ -867,6 +868,23 @@ opts = {}) {
                     fix: fill('default_seed_copy', { id, key }),
                 });
             }
+            // THE STORE SEEDS' ENGLISH COPY ON A VIETNAMESE SITE ("Add To Cart") —
+            // fine on an English site, so asked only when the site's language is
+            // known. sb_page_create now seeds it in Vietnamese; this is for pages
+            // made before that, or with locale:"en" on a Vietnamese site.
+            else if (typeof value === 'string' &&
+                SEED_COPY_VI[value] &&
+                langOf(opts.siteLocale) === 'vi') {
+                out.push({
+                    code: 'default_seed_copy',
+                    nodeId: id,
+                    type,
+                    problem: `Still the platform's English seed copy (${JSON.stringify(value)}) on a Vietnamese site — ` +
+                        `"${SEED_COPY_VI[value]}" is what this storefront should say.`,
+                    key,
+                    fix: fill('default_seed_copy', { id, key }),
+                });
+            }
             // A BUILT-IN LAYOUT'S EXAMPLE COPY — see examplecopy.ts.
             else if (typeof value === 'string' && exampleCopy().has(value)) {
                 out.push({

package/dist/domains/site/seedcopy.js

@@ -0,0 +1,28 @@
+/**
+ * THE STORE SEEDS' ENGLISH COPY, IN VIETNAMESE — applied when the page is made
+ * for a Vietnamese site.
+ *
+ * The platform seeds in English on purpose (editor/src/element/emptyState.ts:
+ * "a seed is a seed", decided 2026-09-17) and a table per language was offered
+ * there and declined. Here the agent IS the author, and it knows the site's
+ * language: measured on a store built end to end, the product page published
+ * "Add To Cart" / "Buy It Now" to a Vietnamese storefront and every page
+ * reviewed clean. sb_page_create seeds through this; sb_review (which reads the
+ * site's locale) reports a page still carrying the English. Exact strings only; a seed string
+ * this table does not carry is left as it was — and test/store-page-seeds
+ * fails when codegen brings one in, so the table cannot fall behind silently.
+ */
+export const SEED_COPY_VI = {
+    'Add To Cart': 'Thêm vào giỏ',
+    'Buy It Now': 'Mua ngay',
+    'This item is unavailable': 'Sản phẩm tạm hết',
+    'It may have been removed. Have a look at the rest of the shop.': 'Sản phẩm có thể đã ngừng bán. Mời bạn xem các sản phẩm khác.',
+    'No products yet': 'Chưa có sản phẩm',
+    'New arrivals will show up here. Check back soon.': 'Sản phẩm mới sẽ sớm có ở đây — mời bạn quay lại sau.',
+    'No posts yet': 'Chưa có bài viết',
+    'New stories will show up here. Check back soon.': 'Bài viết mới sẽ sớm có ở đây.',
+};
+/** The language part of a locale tag — "vi-VN", "vi_VN" and "VI" are all "vi". */
+export function langOf(locale) {
+    return String(locale ?? '').toLowerCase().split(/[-_]/)[0];
+}

package/dist/domains/site/storepage.js

@@ -1,3 +1,4 @@
+import { SEED_COPY_VI, langOf } from './seedcopy.js';
 import { COMPLETION_HEADLINE, COMPLETION_HEADLINE_SENTINEL, PAGE_LAYOUT_SEEDS, PAGE_TYPES, STORE_PAGE_SEEDS } from '../../catalog/storepages.generated.js';
 import { BINDING_SOURCES } from '../../catalog/elements.generated.js';
 import { withFreshIds } from './ids.js';
@@ -40,22 +41,44 @@ export function seededTypes() {
  * An explicit `headline` wins over both — a merchant's own wording is not the
  * client's to overrule.
  */
+/** Rewrite every exact seed string the table carries, in place. */
+function localizeSeed(doc, table) {
+    for (const n of Object.values(doc.nodes)) {
+        const sp = n.specials;
+        if (!sp)
+            continue;
+        for (const k of ['text', 'label']) {
+            const v = sp[k];
+            if (typeof v === 'string' && table[v])
+                sp[k] = table[v];
+        }
+    }
+}
+export { SEED_COPY_VI } from './seedcopy.js';
 export function seedDocument(type, opts = {}) {
     const seed = STORE_PAGE_SEEDS[type];
     if (!seed)
         return null;
     const raw = JSON.stringify(seed);
+    const vi = langOf(opts.locale ?? 'vi') === 'vi';
+    const out = (doc) => {
+        if (vi)
+            localizeSeed(doc, SEED_COPY_VI);
+        return withFreshIds(doc);
+    };
     // Fresh ids per create, so two pages from one seed share nothing but ROOT.
     if (!raw.includes(COMPLETION_HEADLINE_SENTINEL)) {
-        return withFreshIds(JSON.parse(raw));
+        return out(JSON.parse(raw));
     }
-    const lang = opts.locale && opts.locale in COMPLETION_HEADLINE ? opts.locale : 'vi';
+    // Normalized: a site whose locale is "en-US" reads its own language here too.
+    const tag = langOf(opts.locale);
+    const lang = tag && tag in COMPLETION_HEADLINE ? tag : 'vi';
     const headline = opts.headline || COMPLETION_HEADLINE[lang];
     // JSON.stringify already escaped the seed; the substitute has to be escaped
     // the same way or an apostrophe in a merchant's own headline breaks the
     // document. Slicing the quotes off a stringified string is that escaping.
     const escaped = JSON.stringify(headline).slice(1, -1);
-    return withFreshIds(JSON.parse(raw.split(COMPLETION_HEADLINE_SENTINEL).join(escaped)));
+    return out(JSON.parse(raw.split(COMPLETION_HEADLINE_SENTINEL).join(escaped)));
 }
 /**
  * What to put on an ENTITY TEMPLATE that opens empty, or null.

package/dist/tools/live.js

@@ -272,7 +272,9 @@ export function liveTokenFor(ctx) {
 export function joinRoom(ctx, session, siteId) {
     const tokenFn = liveTokenFor(ctx);
     const wsBase = ctx.base.replace(/^http/, 'ws').replace(/\/$/, '');
-    const socket = new RealtimeSocket(`${wsBase}/api/realtime/ws?site=${encodeURIComponent(siteId)}`, tokenFn);
+    const socket = new RealtimeSocket(`${wsBase}/api/realtime/ws?site=${encodeURIComponent(siteId)}`, tokenFn, undefined, 
+    // A key never expires this way; a session renews near its end of life.
+    ctx.apiKey ? undefined : () => ctx.session.ensureFresh());
     const live = new LiveSession(socket, {
         onRemote: (patches) => session.applyRemote(patches),
         onDesync: (reason) => session.roomDesync(reason),

package/dist/tools/page.js

@@ -47,8 +47,8 @@ import { projectList, PAGE_FIELDS, TEMPLATE_FIELDS } from './project.js';
  * copies of a directive is how one of them quietly loses it. The fix for each
  * KIND is sent once under `fixes`, and the directive once per process.
  */
-export function reviewField(ctx, doc, formTypes, pageType, formDocType, formRedirects) {
-    const all = reviewDesign(doc, { formTypes, pageType, formDocType, formRedirects });
+export function reviewField(ctx, doc, formTypes, pageType, formDocType, formRedirects, siteLocale) {
+    const all = reviewDesign(doc, { formTypes, pageType, formDocType, formRedirects, siteLocale });
     if (all.length === 0)
         return {};
     // MAINTENANCE IS ADVICE, kept out of `findings`: it works for a visitor, so
@@ -1807,6 +1807,7 @@ export function registerPageTools(server, ctx) {
         // The page's TYPE says which record it supplies — `no_data_context` stays
         // silent without it rather than guessing.
         let pageType;
+        let siteLocale;
         try {
             const { siteId, pageId } = session.location();
             const input = await gatherReadiness(ctx, siteId, Object.values(doc.doc.nodes), pageId);
@@ -1817,6 +1818,7 @@ export function registerPageTools(server, ctx) {
                 return f.id && a?.action === 'redirect' && (a.url || a.pageId) ? [f.id] : [];
             }));
             pageType = input.pages?.find((p) => p.id === pageId)?.type;
+            siteLocale = input.siteLocale;
             const gaps = readinessGaps(input);
             const lang = siteLanguage(input.siteLocale, input.pageNodes);
             const said = lang ? ctx.notices.once(`site-language:${siteId}`, lang) : undefined;
@@ -1830,7 +1832,7 @@ export function registerPageTools(server, ctx) {
         catch {
             // Readiness is additional information, never the reason a review fails.
         }
-        const field = reviewField(ctx, doc, formTypes, pageType, session.formType(), formRedirects);
+        const field = reviewField(ctx, doc, formTypes, pageType, session.formType(), formRedirects, siteLocale);
         // Clean = no finding a visitor meets; `advice` (maintenance) rides beside the verdict.
         const clean = !field.findings;
         return text({
@@ -2237,7 +2239,7 @@ export function registerPageTools(server, ctx) {
             settings: z.record(z.unknown()).optional(),
             seed: z.boolean().optional().describe('Default true; false creates a blank page.'),
             chrome: z.boolean().optional().describe("Carry the site's header and footer, default true"),
-            locale: z.string().optional().describe("vi (default) or en — the complete page's wording."),
+            locale: z.string().optional().describe("vi or en — a store seed's wording; defaults to the site's language, else vi."),
             headline: z.string().optional().describe("The complete page's thank-you line."),
             dry_run: z.boolean().optional(),
         },
@@ -2420,7 +2422,25 @@ export function registerPageTools(server, ctx) {
         let seeded = null;
         const newId = res.page?.id;
         if ((willSeed || layout) && typeof newId === 'string' && newId) {
-            const document = layout ? layoutDocument(layout) : seedDocument(type ?? '', { locale, headline });
+            // The SITE's language when the caller named none — the seed's English
+            // copy is rewritten for a Vietnamese site (SEED_COPY_VI). Unreadable
+            // settings fall back to the old default rather than block the create.
+            const lang = locale ??
+                (layout
+                    ? undefined
+                    : await request({
+                        base: ctx.base,
+                        method: 'GET',
+                        path: `/api/sites/${encodeURIComponent(site_id)}/settings`,
+                        token: siteToken(ctx),
+                        fetchImpl: ctx.fetchImpl,
+                    })
+                        .then((r) => {
+                        const l = r?.settings?.locale;
+                        return typeof l === 'string' && l ? l : undefined;
+                    })
+                        .catch(() => undefined));
+            const document = layout ? layoutDocument(layout) : seedDocument(type ?? '', { locale: lang, headline });
             if (document) {
                 try {
                     await request({

package/dist/transport/auth.js

@@ -1,9 +1,9 @@
-import { request } from './http.js';
+import { onUnauthorized, request } from './http.js';
 /**
  * A user session against the platform's private API.
  *
  * `token()` is a GETTER, deliberately, and every consumer must call it per use
- * rather than capture its result. The access token lives ~15 minutes and rotates
+ * rather than capture its result. The access token's lifetime is the operator's (AUTH_ACCESS_TTL) and it rotates
  * on refresh; a client holding the string it was built with replays an expired
  * token forever, and the failure is SILENT — a rejected socket auth still fires
  * onopen, so there is no error event and nothing in any UI. The editor shipped
@@ -15,12 +15,39 @@ export class Session {
     base;
     fetchImpl;
     access = null;
+    /** When the access token stops working (ms epoch), from the pair's expiresIn; 0 = unknown. */
+    expiresAt = 0;
     refreshToken = null;
     name = '';
     constructor(base, fetchImpl) {
         this.base = base;
         this.fetchImpl = fetchImpl;
     }
+    /**
+     * Answer a 401 on THIS session's current token with one refresh — see
+     * onUnauthorized in http.ts. Concurrent 401s share one refresh: refresh
+     * tokens are single-use, and presenting one twice ends the session.
+     * Registered while signed in only, so a signed-out session holds nothing.
+     */
+    unrenew = null;
+    listen() {
+        this.unrenew ??= onUnauthorized(async (stale) => {
+            // A request that carried a token THIS session already replaced (a second
+            // 401 landing after the first one renewed) takes the current one.
+            if (this.retired.has(stale) && this.access)
+                return this.access;
+            if (stale !== this.access || !this.refreshToken)
+                return null;
+            this.renewing ??= this.refresh().finally(() => {
+                this.renewing = null;
+            });
+            await this.renewing;
+            return this.access;
+        });
+    }
+    renewing = null;
+    /** Access tokens this session has replaced, so a late 401 on one still renews. */
+    retired = new Set();
     get userName() {
         return this.name;
     }
@@ -52,37 +79,65 @@ export class Session {
         }));
         this.access = out.tokens.accessToken;
         this.refreshToken = out.tokens.refreshToken;
+        this.expiresAt = expiry(out.tokens.expiresIn);
         this.name = out.user?.name ?? '';
+        this.listen();
     }
     /** Rotate. The platform issues a NEW refresh token each time; keep that one. */
     async refresh() {
-        if (!this.refreshToken)
+        const rt = this.refreshToken;
+        if (!rt)
             throw new Error('sbuilder: no refresh token — log in first');
         const out = (await request({
             base: this.base,
             method: 'POST',
             path: '/api/auth/refresh',
-            body: { refreshToken: this.refreshToken },
+            body: { refreshToken: rt },
             fetchImpl: this.fetchImpl,
         }));
+        // Signed out, or signed in afresh, while this was in flight: the pair it
+        // brought back belongs to a session that no longer exists here.
+        if (this.refreshToken !== rt)
+            return;
+        if (this.access)
+            this.retired.add(this.access);
         this.access = out.tokens.accessToken;
         this.refreshToken = out.tokens.refreshToken;
+        this.expiresAt = expiry(out.tokens.expiresIn);
+    }
+    /**
+     * Renew BEFORE a call that cannot retry itself — a media upload sends its
+     * own fetch, outside the 401 retry in http.ts. Within 30s of the lifetime the
+     * pair was issued with, refresh first (shared with any 401 renewal in flight).
+     */
+    async ensureFresh() {
+        if (!this.refreshToken || !this.expiresAt || Date.now() < this.expiresAt - 30_000)
+            return;
+        this.renewing ??= this.refresh().finally(() => {
+            this.renewing = null;
+        });
+        await this.renewing;
     }
     /**
      * Sign this device out. Best effort, never throws.
      *
      * EVERY password sign-in is its own DEVICE SESSION since web_builder 9db1b2a9e,
      * capped at 10 per account; past the cap the one that has gone longest
-     * without a REFRESH is deleted. This client never refreshes (the access token
-     * lives 30 days), so a process that exits without signing out leaves a slot
-     * held, and about ten agent runs later the evicted session is the merchant's
+     * without a REFRESH is deleted. This client refreshes only when refused (the
+     * access token lives 30 days by default), so a process that exits without
+     * signing out leaves a slot held, and about ten agent runs later the evicted session is the merchant's
      * own editor — signed out mid-edit, by nothing they can see. A SIGKILLed
      * process still leaks its slot; nothing on this side can prevent that.
      */
     async logout() {
+        // A renewal in flight is about to rotate the refresh token; revoke the one it
+        // brings back, not the one it just spent (presenting a used one ends the session).
+        await this.renewing?.catch(() => undefined);
         const refreshToken = this.refreshToken;
         this.access = null;
         this.refreshToken = null;
+        this.unrenew?.();
+        this.unrenew = null;
         if (!refreshToken)
             return;
         try {
@@ -99,3 +154,7 @@ export class Session {
         }
     }
 }
+/** expiresIn seconds → an epoch deadline; 0 when the pair carried none. */
+function expiry(seconds) {
+    return typeof seconds === 'number' && seconds > 0 ? Date.now() + seconds * 1000 : 0;
+}

package/dist/transport/http.js

@@ -222,7 +222,12 @@ async function announced(opts, siteId, pageId, doc) {
     }
     return out;
 }
-async function send(opts) {
+const renewers = new Set();
+export function onUnauthorized(r) {
+    renewers.add(r);
+    return () => renewers.delete(r);
+}
+async function send(opts, retried = false) {
     const doFetch = opts.fetchImpl ?? fetch;
     // Identity rides on EVERY call rather than on a handshake of its own. There is
     // no "connect" request to hang it off — the first thing this server does is
@@ -243,6 +248,15 @@ async function send(opts) {
         headers,
         body: body === undefined ? undefined : multipart ? body : JSON.stringify(body),
     });
+    if (res.status === 401 && opts.token && !retried) {
+        for (const renew of renewers) {
+            const fresh = await renew(opts.token).catch(() => null);
+            if (fresh && fresh !== opts.token) {
+                void res.body?.cancel().catch(() => undefined); // release the refused response
+                return send({ ...opts, token: fresh }, true);
+            }
+        }
+    }
     if (opts.binary && res.ok)
         return new Uint8Array(await res.arrayBuffer());
     const raw = await res.text();

package/dist/transport/media.js

@@ -86,6 +86,9 @@ export function typeForName(name) {
  */
 async function fromUrl(ctx, siteId, url, source) {
     const doFetch = ctx.fetchImpl ?? fetch;
+    // Its own fetch, so the 401 renewal in http.ts never sees it — renew first.
+    if (!ctx.apiKey && ctx.session.loggedIn())
+        await ctx.session.ensureFresh().catch(() => undefined);
     const res = await doFetch(`${ctx.base.replace(/\/$/, '')}/api/media/${encodeURIComponent(siteId)}/from-url`, {
         method: 'POST',
         headers: {
@@ -311,6 +314,8 @@ export async function fetchPublic(ctx, doFetch, url) {
 }
 export async function uploadMedia(ctx, siteId, source) {
     const doFetch = ctx.fetchImpl ?? fetch;
+    if (!ctx.apiKey && ctx.session.loggedIn())
+        await ctx.session.ensureFresh().catch(() => undefined);
     // THE SERVER'S OWN DOOR FIRST, when the source is a URL.
     //
     // `POST /api/media/{siteId}/from-url` fetches it where the platform already

package/dist/transport/socket.js

@@ -17,6 +17,7 @@ export class RealtimeSocket {
     url;
     token;
     factory;
+    prepare;
     ws = null;
     closed = false;
     attempt = 0;
@@ -42,10 +43,17 @@ export class RealtimeSocket {
      * expired token on every reconnect, and the failure is SILENT — a rejected
      * auth still fires `onopen`, so no error event ever surfaces.
      */
-    token, factory = (u) => new WebSocket(u)) {
+    token, factory = (u) => new WebSocket(u), 
+    /**
+     * Run before each RECONNECT — renews a session token near its end of life,
+     * since the getter above is synchronous and a reconnect is the moment an
+     * expired token would be presented. Failure never blocks the attempt.
+     */
+    prepare) {
         this.url = url;
         this.token = token;
         this.factory = factory;
+        this.prepare = prepare;
     }
     get attempts() {
         return this.attempt;
@@ -127,7 +135,13 @@ export class RealtimeSocket {
             if (this.closed)
                 return;
             const wait = Math.min(RETRY_BASE_MS * 2 ** this.attempt, RETRY_MAX_MS);
-            this.timer = setTimeout(() => this.connect(), wait);
+            this.timer = setTimeout(() => {
+                if (!this.prepare)
+                    return this.connect();
+                void this.prepare()
+                    .catch(() => undefined)
+                    .then(() => this.connect());
+            }, wait);
         };
         ws.onerror = () => {
             // Genuinely rare: a policy close is not an error. Nothing to do here —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sbuilder-mcp",
-  "version": "0.87.0",
+  "version": "0.88.1",
   "description": "MCP server that designs and operates a Store Builder site — pages, data, theme and publish — through the platform's own API and live-edit protocol.",
   "mcpName": "io.github.vuluu2k/sbuilder-mcp",
   "type": "module",