@neopress/mcp 1.1.3 → 1.2.0

package/integrations/claude-desktop/manifest.json

@@ -72,7 +72,7 @@
     "claude_desktop": ">=1.0.0",
     "platforms": ["darwin", "win32"],
     "runtimes": {
-      "node": ">=18.0.0"
+      "node": ">=24.0.0"
     }
   },
   "user_config": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neopress/mcp",
-  "version": "1.1.3",
+  "version": "1.2.0",
   "description": "Neopress MCP server for first-party AI agents",
   "type": "module",
   "bin": {
@@ -21,6 +21,9 @@
     "scripts",
     "README.md"
   ],
+  "engines": {
+    "node": ">=24"
+  },
   "publishConfig": {
     "access": "public"
   },
@@ -29,14 +32,14 @@
     "zod": "^4.1.12"
   },
   "devDependencies": {
-    "@types/node": "^22",
-    "tsup": "^8.5.1",
-    "typescript": "^5.9.3",
+    "@types/node": "^24",
+    "tsdown": "^0.22.14",
+    "typescript": "npm:@typescript/typescript6@6.0.2",
     "vitest": "^4.1.5",
     "@neopress/sdk": "0.4.0"
   },
   "scripts": {
-    "build": "tsup",
+    "build": "tsdown && node ./scripts/check-dist-contract.mjs",
     "mcpb:stage": "node ./scripts/prepare-mcpb-package.mjs",
     "start:http": "node ./dist/http-bin.cjs",
     "lint": "tsc --noEmit",

package/scripts/check-dist-contract.mjs

@@ -0,0 +1,91 @@
+#!/usr/bin/env node
+// Build-path gate for the published artifact. See packages/cli/scripts/check-dist-contract.mjs
+// for the rationale; the file-set invariant matters more here because
+// prepare-mcpb-package.mjs copies dist/bin.cjs alone into the Claude Desktop bundle,
+// so a shared chunk would produce an extension that breaks at runtime.
+import { readFileSync, readdirSync } from 'node:fs';
+import path from 'node:path';
+
+const packageRoot = path.resolve(import.meta.dirname, '..');
+const distDir = path.join(packageRoot, 'dist');
+const packageJson = JSON.parse(readFileSync(path.join(packageRoot, 'package.json'), 'utf8'));
+
+const expectedFiles = ['bin.cjs', 'http-bin.cjs', 'index.d.ts', 'index.js'];
+const allowedBareImports = new Set(Object.keys(packageJson.dependencies ?? {}));
+// See the cli script: tsdown inlines a leaked third-party type instead of leaving a
+// dangling import, turning a loud failure into silent bloat. Current output is ~26KB.
+const maxDeclarationBytes = 120_000;
+
+const errors = [];
+
+const actualFiles = readdirSync(distDir).sort();
+const unexpected = actualFiles.filter((f) => !expectedFiles.includes(f));
+const missing = expectedFiles.filter((f) => !actualFiles.includes(f));
+if (unexpected.length > 0) {
+  errors.push(
+    `dist has unexpected files: ${unexpected.join(', ')}\n` +
+      `  Likely code splitting — give each entry its own config object in tsdown.config.ts.\n` +
+      `  dist/bin.cjs must stay self-contained: prepare-mcpb-package.mjs ships it alone.`
+  );
+}
+if (missing.length > 0) {
+  errors.push(`dist is missing: ${missing.join(', ')}`);
+}
+
+// Every emitted bundle must have the workspace packages inlined. tsdown reports an
+// unresolved import (a missing packages/sdk/dist, say) as a *warning* and still exits 0,
+// which would publish a binary carrying a bare require("@neopress/sdk") that no consumer
+// can resolve. Checking the .d.ts alone does not see this.
+for (const file of actualFiles.filter((f) => /\.(cjs|js|mjs)$/.test(f))) {
+  const bundle = readFileSync(path.join(distDir, file), 'utf8');
+  const leaked = [
+    ...new Set(
+      [...bundle.matchAll(/(?:require\(|from\s*)["'](@neopress\/[^"']+)["']/g)].map((m) => m[1])
+    ),
+  ];
+  if (leaked.length > 0) {
+    errors.push(
+      `dist/${file} still imports workspace packages at runtime: ${leaked.join(', ')}\n` +
+        `  They must be bundled. A missing dependency build leaves these unresolved and\n` +
+        `  tsdown only warns — build the workspace deps first (turbo handles this via ^build).`
+    );
+  }
+}
+
+const declarations = actualFiles.includes('index.d.ts')
+  ? readFileSync(path.join(distDir, 'index.d.ts'), 'utf8')
+  : '';
+if (declarations.length > maxDeclarationBytes) {
+  errors.push(
+    `dist/index.d.ts is ${Math.round(declarations.length / 1000)}KB, over the ${Math.round(maxDeclarationBytes / 1000)}KB ceiling\n` +
+      `  A third-party type tree was probably inlined. Narrow the public surface\n` +
+      `  (@internal + stripInternal) rather than raising this number.`
+  );
+}
+const specifiers = [
+  ...[...declarations.matchAll(/\bfrom\s*["']([^"']+)["']/g)].map((m) => m[1]),
+  // `typeof import("x")` is what TS emits when a type leaks through an inferred
+  // signature — the `from` form above never matches it.
+  ...[...declarations.matchAll(/\bimport\s*\(\s*["']([^"']+)["']\s*\)/g)].map((m) => m[1]),
+];
+const unresolvable = [...new Set(specifiers)].filter((specifier) => {
+  if (specifier.startsWith('node:')) return false;
+  const packageName = specifier.startsWith('@')
+    ? specifier.split('/').slice(0, 2).join('/')
+    : specifier.split('/')[0];
+  return !allowedBareImports.has(packageName);
+});
+if (unresolvable.length > 0) {
+  errors.push(
+    `dist/index.d.ts imports that consumers cannot resolve: ${unresolvable.join(', ')}\n` +
+      `  Allowed: node: builtins and this package's own dependencies.\n` +
+      `  Relative imports mean a type was not inlined; bare ones mean an undeclared dependency leaked.`
+  );
+}
+
+if (errors.length > 0) {
+  console.error(`[check-dist-contract] ${packageJson.name} failed:\n\n${errors.join('\n\n')}\n`);
+  process.exit(1);
+}
+
+console.log(`[check-dist-contract] ${packageJson.name} ok — ${actualFiles.length} files, no unresolvable type imports`);