# Site integration This generated site is a PHP-ready, responsive web app with a safe database bootstrap, a server-side platform API client, an event bridge, and a site-scoped MCP connection. The installed feature contract is `2026-10-17-mcp-pack-v154`. It includes a public, noindex search page (`search.html`), a branded search form in site navigation, and the compact `pocketpapi-search-index.json` used by the browser and MCP. Course funnels also include a learning-materials manifest. The site store is not active yet. Open Shop, add the course catalog, and publish the store before enabling checkout. ## Connect the site 1. Sign in to the site platform and open https://pocketpapi.com/projects/30/sites/30/integrations/control-plane. 2. Create or rotate the site-scoped connection and copy the token once. 3. Configure `POCKETPAPI_SITE_TOKEN` and `POCKETPAPI_APP_URL` (`https://pocketpapi.com`) in the hosting environment. Never paste a token into HTML, JavaScript, a public repository, or this file. 4. Keep the generated PHP bridge files together when downloading or transferring the site over FTP/FTPS. ## Automatic feature updates `pocketpapi-features.json` is the source of truth for the installed pack. At the start of every AI or MCP session, read it and compare `contract_version` with the current project instructions. If the instructions describe a newer contract, add or repair the missing generated runtime in staging, preserve the site brand tokens and styling, append a secret-free entry to `SITE_STUDIO_CHANGELOG.md`, and save the implementation summary to project knowledge. `pocketpapi-mcp-update.php` returns the current contract to authorized staff. Production changes require separate approval of the exact reviewed staging revision. ## Customer accounts and platform Terms The managed customer experience includes site-themed sign-in, registration, and dashboard pages. New accounts and sign-ins through the current portal require an explicit Terms/data-processing acceptance. The required PocketPapi notice on `terms.html` explains that PocketPapi generates and maintains this website and processes information submitted through it to host, secure, and maintain the site and provide requested features. Site Studio restores this notice after edits and protects the Terms page from removal. Imported owner Terms content is retained with the notice appended. After an existing site publishes the current portal pack, older sessions must return to sign-in and accept the current Terms version. Staff SSO routes to the PocketPapi Business Hub. ## Site search The site search index includes public page copy and labeled links from indexable pages, is fetched only on the search page, and is excluded from the sitemap. The browser reads the public index without a bearer token; `sitecommander_site_search` and `GET /api/control-plane/site-search` read the published index by default and can read an explicitly requested authorized staging version. ## POS and shared data `pocketpapi-pos.php` is a site-local, staff-only POS surface styled from this site's `styles.css`. Catalog, modifiers, orders, registers, inventory, delivery, loyalty, promotions, rewards, gift cards, giveaways, broadcasts, social inbox, and sync status remain platform-owned data and are read through the site-scoped POS MCP/API contract. Do not create a second unsynchronized catalog or order database in the site. ## Database The platform provisions and tracks the project database from Project Setup when the cPanel account is connected. The generated PHP layer reads `POCKETPAPI_DB_HOST`, `POCKETPAPI_DB_NAME`, `POCKETPAPI_DB_USER`, `POCKETPAPI_DB_PASSWORD`, and optional `POCKETPAPI_DB_PORT` from the server environment, or the equivalent `DB_*` variables. It never writes credentials into the downloaded files. On first PHP load it creates the safe `pocketpapi_site_events` table; `database/schema.sql` is included for manual database review or migration. ## API and MCP The bridge posts server-side events to `https://pocketpapi.com/api/control-plane/events` through `pocketpapi-api.php`. The same site-scoped bearer credential can call the documented control-plane API at `https://pocketpapi.com/api/control-plane` and JSON-RPC MCP at `https://pocketpapi.com/mcp`. For OpenClaw, import `pocketpapi-agent-config.example.json`, set the private `POCKETPAPI_SITE_TOKEN` environment variable, and use the listed streamable HTTP MCP URL. For ChatGPT, add the remote MCP URL `https://pocketpapi.com/mcp` through the approved connector flow and provide the site-scoped bearer credential when prompted. Both agents remain restricted to this site/project by the token; the public website never receives the credential. ## Visual and release contract Site Studio validates local references, SEO entry points, responsive/mobile navigation, iOS-safe form sizing, refresh controls, keyboard focus, explicit hover colors, and fixed palette contrast before staging. Preview the exact `change_set_id`, request separate production approval, and publish only that approved revision through the verified site-hosting path. ## Weekly learning refresh The learning library is designed for a weekly refresh because AI tools and best practices change quickly. The scheduled Learning Materials agent prepares a candidate refresh from the current brief, provider context, and staged site changes. Review the candidate, regenerate staging, and verify links and claims before publishing the next site version. It does not publish changed AI guidance without approval.