@shapio/mcp 0.2.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/bin.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+import { n as USAGE, o as createShapioMcpServer, r as parseOptions, t as OptionsError } from "./options-Bc0S3ldO.js";
+import { StdioServerTransport } from "@modelcontextprotocol/server/stdio";
+//#region src/bin.ts
+/**
+* `shapio-mcp`: stdio MCP server. stdout carries the protocol, so everything for people goes to stderr.
+*/
+const main = async () => {
+	const options = parseOptions(process.argv.slice(2), process.env, process.cwd());
+	if (options === "help") {
+		process.stderr.write(USAGE);
+		return;
+	}
+	await createShapioMcpServer(options).connect(new StdioServerTransport());
+};
+main().catch((error) => {
+	const message = error instanceof OptionsError ? `${error.message}\n\n${USAGE}` : error instanceof Error ? error.stack ?? error.message : String(error);
+	process.stderr.write(`shapio-mcp: ${message}\n`);
+	process.exitCode = 1;
+});
+//#endregion
+export {};
+
+//# sourceMappingURL=bin.js.map

package/dist/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.js","names":[],"sources":["../src/bin.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { StdioServerTransport } from '@modelcontextprotocol/server/stdio';\nimport { OptionsError, parseOptions, USAGE } from './options.js';\nimport { createShapioMcpServer } from './server.js';\n\n/**\n * `shapio-mcp`: stdio MCP server. stdout carries the protocol, so everything for people goes to stderr.\n */\nconst main = async () => {\n  const options = parseOptions(process.argv.slice(2), process.env, process.cwd());\n  if (options === 'help') {\n    process.stderr.write(USAGE);\n    return;\n  }\n  const server = createShapioMcpServer(options);\n  await server.connect(new StdioServerTransport());\n};\n\nmain().catch((error: unknown) => {\n  const message =\n    error instanceof OptionsError\n      ? `${error.message}\\n\\n${USAGE}`\n      : error instanceof Error\n        ? (error.stack ?? error.message)\n        : String(error);\n  process.stderr.write(`shapio-mcp: ${message}\\n`);\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;AAQA,MAAM,OAAO,YAAY;CACvB,MAAM,UAAU,aAAa,QAAQ,KAAK,MAAM,CAAC,GAAG,QAAQ,KAAK,QAAQ,IAAI,CAAC;CAC9E,IAAI,YAAY,QAAQ;EACtB,QAAQ,OAAO,MAAM,KAAK;EAC1B;CACF;CAEA,MADe,sBAAsB,OAC1B,CAAC,CAAC,QAAQ,IAAI,qBAAqB,CAAC;AACjD;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,MAAM,UACJ,iBAAiB,eACb,GAAG,MAAM,QAAQ,MAAM,UACvB,iBAAiB,QACd,MAAM,SAAS,MAAM,UACtB,OAAO,KAAK;CACpB,QAAQ,OAAO,MAAM,eAAe,QAAQ,GAAG;CAC/C,QAAQ,WAAW;AACrB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,34 @@
+import { McpServer } from "@modelcontextprotocol/server";
+import { ShapioClient } from "@shapio/client";
+//#region src/options.d.ts
+/** How the server was started: the Shapio instance, its token, and the two guards. */
+type McpOptions = {
+  /** Shapio's base URL including any BASE_PATH (`SHAPIO_URL`). */
+  baseUrl: string;
+  /** An admin-scope API token (`SHAPIO_TOKEN`). Give its role no `changes.ship`: shipping stays with people. */
+  token: string;
+  /** Registers `change_sets_ship` (`--allow-ship`). A client-side guard only: the token's role decides. */
+  allowShip: boolean;
+  /** `media_upload` reads files only under this directory (`--media-root`, default: the working directory). */
+  mediaRoot: string;
+  /**
+   * The site key every request is about (`--site`, else `SHAPIO_SITE`), on multi-site instances. Left out:
+   * the token's site (a site token), else the primary site. A site token cannot name another site.
+   */
+  site?: string;
+};
+export declare const USAGE = "Usage: shapio-mcp [--allow-ship] [--media-root <dir>] [--site <key>]\n\nA Model Context Protocol server (stdio) for a Shapio instance.\n\nEnvironment:\n  SHAPIO_URL     Shapio's base URL, including any BASE_PATH (e.g. https://cms.example.com)\n  SHAPIO_TOKEN   An admin-scope API token. Give its role no \"changes.ship\" permission: agents propose\n                 change sets, people ship them.\n  SHAPIO_SITE    The site key to work on (multi-site instances); --site overrides it. Default: the\n                 token's site, else the primary site.\n\nOptions:\n  --allow-ship         Offer the change_sets_ship tool (the token's role must also allow changes.ship)\n  --media-root <dir>   Directory media_upload may read files from (default: the working directory)\n  --site <key>         The site to work on (overrides SHAPIO_SITE)\n  -h, --help           Show this help\n";
+export declare class OptionsError extends Error {
+  constructor(message: string);
+}
+/** Reads the command line and environment; throws OptionsError with a message meant for stderr. */
+export declare const parseOptions: (argv: readonly string[], env: Readonly<Record<string, string | undefined>>, cwd: string) => McpOptions | "help";
+//#endregion
+//#region src/server.d.ts
+export declare const MCP_SERVER_NAME = "shapio";
+export declare const MCP_SERVER_VERSION: string;
+/** The MCP server for one Shapio instance, with every tool, resource and prompt registered. */
+export declare const createShapioMcpServer: (options: McpOptions, client?: ShapioClient) => McpServer;
+//#endregion
+export type { McpOptions };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -0,0 +1,2 @@
+import { a as MCP_SERVER_VERSION, i as MCP_SERVER_NAME, n as USAGE, o as createShapioMcpServer, r as parseOptions, t as OptionsError } from "./options-Bc0S3ldO.js";
+export { MCP_SERVER_NAME, MCP_SERVER_VERSION, OptionsError, USAGE, createShapioMcpServer, parseOptions };

package/dist/options-Bc0S3ldO.js

@@ -0,0 +1,749 @@
+import { McpServer, ResourceTemplate } from "@modelcontextprotocol/server";
+import { HEALTH_RULES, ShapioApiError, createClient } from "@shapio/client";
+import { z } from "zod";
+import { isModelDefinition, isStableId, routeKeyOf, serializeDefinition } from "@shapio/schema";
+import { realpath } from "node:fs/promises";
+import { isAbsolute, relative, resolve } from "node:path";
+import { uploadFile } from "@shapio/client/node";
+import { randomUUID } from "node:crypto";
+import { parseArgs } from "node:util";
+//#region package.json
+var version = "0.2.0";
+//#endregion
+//#region src/prompts.ts
+const userMessage = (text) => ({ messages: [{
+	role: "user",
+	content: {
+		type: "text",
+		text
+	}
+}] });
+/** Starting points for the two jobs agents do most: modelling and reviewing a change set. */
+const registerPrompts = ({ server }) => {
+	server.registerPrompt("model_content_type", {
+		title: "Model a content type for …",
+		description: "Design a content type for something and draft it into a change set for review.",
+		argsSchema: z.object({ subject: z.string().min(1).describe("What the content type is for, e.g. \"a blog\"") })
+	}, ({ subject }) => userMessage(`Model content types in Shapio for ${subject}.\n\n1. Call schema_list and read the existing types first; reuse or extend them instead of duplicating.
+2. Design the types: API IDs are camelCase GraphQL names, labels are for people; prefer components for repeated groups and relations for shared entities.
+3. Draft each type with schema_draft (one change set for the whole design: pass the changeSetId from the first call to the rest).
+4. Read change_sets_review, fix every blocking issue, and summarise the design and the review for me. Do not ship: I review and ship the change set myself.`));
+	server.registerPrompt("review_change_set", {
+		title: "Review change set N",
+		description: "Explain what a change set would do when it ships, and what to check first.",
+		argsSchema: z.object({ changeSetId: z.string().min(1).describe("The change set ID") })
+	}, ({ changeSetId }) => userMessage(`Review Shapio change set ${changeSetId}. Call change_sets_review and tell me, briefly:\n- what goes live (schema changes and entries, with the field diffs that matter);
+- anything breaking or destructive, and which API consumers read the affected fields (usage_fields);
+- blocking issues and warnings, and how to fix each;
+- whether you would ship it. Do not ship it yourself.`));
+};
+//#endregion
+//#region src/definitions.ts
+/** The active schema (the pull format), read fresh for each call: models change live. */
+const readSchema = (client) => client.admin.schema.export();
+/** An active definition by API ID (or stable ID); throws a message the agent can act on. */
+const findDefinition = (schema, key) => {
+	const found = schema.definitions.find(({ definition }) => definition.apiKey === key || definition.id === key);
+	if (!found) {
+		const known = schema.definitions.map(({ definition }) => definition.apiKey).join(", ") || "(none)";
+		throw new Error(`No model or component with API ID "${key}". Known: ${known}`);
+	}
+	return found;
+};
+/**
+* The delivery route key: a collection's plural API ID (`articles`), a singleton's API ID. The admin content
+* API uses the singular API ID instead. Components have no route.
+*/
+const routeKeyOf$1 = (definition) => {
+	if (!isModelDefinition(definition)) throw new Error(`"${definition.apiKey}" is a component: components are read through the models that use them`);
+	return routeKeyOf(definition);
+};
+/** A one-line summary per definition, for listings that should not carry every field's settings. */
+const summarize = ({ definition, version }) => ({
+	id: definition.id,
+	kind: definition.kind,
+	apiKey: definition.apiKey,
+	...definition.kind === "collection" ? { pluralApiKey: routeKeyOf(definition) } : {},
+	label: definition.label,
+	version,
+	fields: definition.fields.map((field) => ({
+		apiKey: field.apiKey,
+		type: field.type,
+		required: field.required,
+		localized: field.localized
+	}))
+});
+//#endregion
+//#region src/generated/deliveryApiDoc.ts
+const DELIVERY_API_DOC = "# Delivery API (REST)\n\nYour sites and apps read published content from one generic route per model:\n\n```text\nGET {PUBLIC_URL}{BASE_PATH}/api/content/<plural API ID>              # a collection: a page of entries\nGET {PUBLIC_URL}{BASE_PATH}/api/content/<plural API ID>/<entry id>   # a collection: one entry\nGET {PUBLIC_URL}{BASE_PATH}/api/content/<API ID>                     # a single type: its entry\n```\n\nA collection is addressed by its **plural API ID** (`/api/content/articles`), a single type by its **API ID**\n(`/api/content/homepage`). The singular API ID of a collection is not a delivery route: `/api/content/article`\nis a 404. Both IDs are set on the model ([Modelling](modelling.md#kinds-of-definitions)). The admin content API\n(`/api/admin/content/<API ID>`) always uses the singular.\n\nThere is no generated code per model: a model created a minute ago is served by the same routes at once.\nDelivery returns **published** content only; drafts, unpublished entries, private media and fields your token\nmay not read never appear. The [REST reference](reference/rest-api.md) lists every read parameter (app-user\nwrites are described in [End users](end-users.md)); your instance's own OpenAPI document, for its current\nschema, is at `/api/docs` (admins).\n\nThe examples below use the [example site](example-site.md)'s models.\n\n## Tokens\n\nCreate a **delivery role** (Network → Roles → New role, kind _Delivery_) with `read` on the models your site\nneeds, then an API token bound to it (Settings → API tokens). Send it as a bearer token:\n\n```sh\ncurl -H \"Authorization: Bearer $SHAPIO_DELIVERY_TOKEN\" \"$SHAPIO_URL/api/content/articles?locale=fr\"\n```\n\n- Delivery tokens can only ever read, whatever their role says.\n- A role's grant covers every field marked `public` (the default); `public: false` fields are hidden unless the\n  grant names them.\n- Without a token, a request is _anonymous_: it gets what the built-in **public** app role grants, which is\n  nothing until you allow it (Network → Roles → App roles). Use that for content anyone may read from the\n  browser. App users' own tokens are covered in [End users](end-users.md).\n\n## Sites\n\nOne Shapio instance can host several [sites](sites.md) that share the content types but each have their own\ncontent, tokens and snapshots. Every delivery request reads exactly one site:\n\n1. **The token's site.** Delivery tokens belong to the site they were created on, and only ever read it.\n2. **The site the request names**, with `?site=<key>` or the `Shapio-Site: <key>` header. Anonymous callers and\n   network admin tokens use this to pick a site.\n3. **The primary site**, when neither names one. An instance with a single site never needs to name it.\n\nNaming a different site than the token's is refused with `403 SITE_MISMATCH`, never redirected, and so is a\nrequest whose header and `?site=` disagree. An unknown key is `404 SITE_NOT_FOUND`. Entries of another site\nread as not found, and relations never cross sites.\n\n```sh\ncurl \"$SHAPIO_URL/api/content/articles?site=marketing\"\n```\n\nAnonymous reads get what the app roles bound to the request site's `public` audience grant. The primary site\nbinds the built-in **public** role; a new site binds none, so it serves nothing anonymously until you bind one\n([Sites](sites.md#app-users-and-anonymous-access)).\n\nWith `@shapio/client`, pass the site once:\n\n```ts\nconst shapio = createClient({ baseUrl: process.env.SHAPIO_URL, token, site: 'marketing' });\n```\n\nThe client sends it as `?site=` on delivery and snapshot reads, which keeps a cross-origin `GET` free of a\nCORS preflight and keeps URL-keyed caches apart. Every other request (writes, GraphQL, the admin API) carries\nthe `Shapio-Site` header. Leave `site` out to read the token's site, or the primary site.\n\n## Responses\n\n```json\n{\n  \"data\": [\n    {\n      \"id\": \"6f2c…\",\n      \"locale\": \"fr\",\n      \"createdAt\": \"2026-10-01T09:12:44.512Z\",\n      \"updatedAt\": \"2026-10-01T09:30:02.104Z\",\n      \"publishedAt\": \"2026-10-01T09:30:02.104Z\",\n      \"title\": \"Modéliser du contenu sans déploiement\",\n      \"slug\": \"modelling-without-a-deploy\",\n      \"excerpt\": \"…\",\n      \"body\": {\n        \"format\": \"shapio-richtext\",\n        \"version\": 1,\n        \"doc\": { \"type\": \"doc\", \"content\": [] },\n        \"html\": \"<p>…</p>\"\n      },\n      \"cover\": { \"id\": \"…\", \"url\": \"…\", \"width\": 1600, \"height\": 900, \"alt\": \"…\", \"variants\": [] },\n      \"author\": \"0b7e…\",\n      \"publishedOn\": \"2026-09-01\"\n    }\n  ],\n  \"meta\": {\n    \"locale\": \"fr\",\n    \"snapshot\": 10,\n    \"pagination\": { \"page\": 1, \"pageSize\": 25, \"total\": 2, \"pageCount\": 1 }\n  }\n}\n```\n\n- Entries are flat: system attributes, then every readable field by API ID, `null` (or `[]`) when empty.\n- **Rich text** is the stored JSON document plus `html`, rendered on the server from the JSON with an allow-list\n  sanitiser (safe link protocols only, images resolved through the media library).\n- **Media** fields are asset objects with URLs and ready [variants](media.md#image-variants); private assets\n  carry an expiring signed URL.\n- **Relations** are target IDs unless you `populate` them. A target that is not published, or that your token\n  may not read, is left out (never its ID).\n- **Components** are objects; **dynamic zones** are arrays of objects with `__component` (the component's\n  API ID).\n- A single type answers `/api/content/<API ID>` with `{ data: {…}, meta }`.\n\nErrors always look like `{ \"error\": { \"code\": \"…\", \"message\": \"…\", \"details\": … } }`: 400 for an invalid query,\n401 without credentials for content that needs them, 403 when your role may not read the model, 404 for an\nunknown model or entry.\n\n## Query parameters\n\n| Parameter          | Example                               | Notes                                                                             |\n| ------------------ | ------------------------------------- | --------------------------------------------------------------------------------- |\n| `locale`           | `locale=fr`                           | falls back along the locale chain ([Localization](localization.md))               |\n| `filters`          | `filters[slug][$eq]=about`            | see below                                                                         |\n| `sort`             | `sort=publishedOn:desc,createdAt:asc` | fields marked sortable, `id`, `createdAt`, `updatedAt`                            |\n| `page`, `pageSize` | `page=2&pageSize=50`                  | `pageSize` 25 by default, at most 100                                             |\n| `fields`           | `fields=title,slug`                   | top-level fields to return (system attributes always come)                        |\n| `populate`         | `populate=author`                     | relation paths: `author`, `author,tags.author`, or `*`; at most 3 levels          |\n| `q`                | `q=snapshot`                          | searches the title field chosen in the model's display settings (400 without one) |\n| `snapshot`         | `snapshot=10`                         | read as of a publication snapshot (below)                                         |\n\n### Filters\n\n`filters[<field>][<operator>]=<value>`, combined with `$and`, `$or` and `$not`:\n\n```sh\ncurl -G \"$SHAPIO_URL/api/content/articles\" -H \"Authorization: Bearer $SHAPIO_DELIVERY_TOKEN\" \\\n  --data-urlencode 'filters[publishedOn][$gte]=2026-09-10' \\\n  --data-urlencode 'filters[$or][0][slug][$eq]=why-builds-pin-a-snapshot' \\\n  --data-urlencode 'filters[$or][1][slug][$eq]=modelling-without-a-deploy'\n```\n\n| Operators                                                             | Field types                                                                                                                                                              |\n| --------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |\n| `$eq`, `$ne`, `$in`, `$nin`, `$null`, `$notNull`                      | text, numbers, dates, enums, relations and media (booleans: `$eq`, `$ne`, `$null`, `$notNull`); on lists (`many` relations, multiple media/enums) `$eq` means \"contains\" |\n| `$lt`, `$lte`, `$gt`, `$gte`                                          | text, numbers, dates and times, on fields marked **filterable** or **sortable**                                                                                          |\n| `$contains`, `$notContains`, `$containsi`, `$startsWith`, `$endsWith` | text fields marked **filterable**                                                                                                                                        |\n\n`id`, `createdAt` and `updatedAt` can be filtered too (`publishedAt` is returned but cannot be filtered or\nsorted). JSON, rich text, component and dynamic zone fields cannot be filtered. `$in` takes repeated values or `a,b`. Values are read\nlike stored values, so `2026-10-01T10:00:00+02:00` matches `2026-10-01T08:00:00.000Z`. Unknown fields,\noperators a type does not support, and filters or sorts on fields your token may not read are refused (400/403)\nrather than ignored, so a filter can never reveal a hidden value.\n\n## Snapshots: one consistent moment\n\nEvery publish moves a global **publication snapshot** number forward; every delivery response reports the\none it read in `meta.snapshot`. Pass `snapshot=N` and Shapio answers exactly as it would have at that moment,\neven if more was published since:\n\n```sh\ncurl -H \"Authorization: Bearer $SHAPIO_DELIVERY_TOKEN\" \"$SHAPIO_URL/api/content/pages?snapshot=10&locale=en\"\n```\n\nA static site build should read the current snapshot once at the start and pass it with every request: then\na publish in the middle of the build cannot produce a site that mixes two moments. The\n[example site](example-site.md) does exactly this, and Shapio's deployment triggers carry the snapshot to build.\n\nOld snapshots are read through the current schema (a value stored under an earlier field type comes back as\n`null`). A [change set](change-sets.md) goes live as one snapshot, schema and entries together, so a pinned\nbuild sees all of it or none of it.\n\nTwo endpoints serve builds, with the same tokens as `/api/content` and only for models the token may read:\n\n| Endpoint                                         | Answer                                                                   |\n| ------------------------------------------------ | ------------------------------------------------------------------------ |\n| `GET /api/snapshots/current`                     | `{ snapshot, schemaVersion, publishedAt }`: what an unpinned read serves |\n| `GET /api/snapshots/changes?from&to&after&limit` | entries and locales whose live content changed between the two snapshots |\n\nDetails, the change classification and incremental-build recipes are in\n[Snapshots and the changes API](snapshots.md).\n\n## Caching\n\nResponses carry a strong `ETag` over the exact body and `Vary: Authorization, Cookie, Shapio-Site`. Send\n`If-None-Match` to get `304 Not Modified` when nothing changed. Anonymous responses are `Cache-Control: public,\nmax-age=0, must-revalidate`; authenticated ones `private`. A CDN that keys its cache on the URL alone and\nignores `Vary` must be given the site as `?site=`, not as the header, so that two sites never share a cached\nresponse.\n\n## Writes\n\nThe same routes accept `POST`, `PUT` and `DELETE` from app users whose roles allow it (for example, members\nediting their own entries). Delivery tokens cannot write. See [End users](end-users.md). Editors and your\nbuild tools use the admin API (`/api/admin/content/<key>`) with admin credentials.\n";
+//#endregion
+//#region src/resources.ts
+const SCHEMA_URI_TEMPLATE = "shapio://schema/{apiKey}";
+const DELIVERY_DOC_URI = "shapio://docs/delivery-api";
+/** Each definition in the pull format (`shapio schema pull`'s files), and the delivery API guide. */
+const registerResources = ({ server, client }) => {
+	server.registerResource("schema", new ResourceTemplate(SCHEMA_URI_TEMPLATE, { list: async () => {
+		return { resources: (await readSchema(client)).definitions.map(({ definition }) => ({
+			uri: `shapio://schema/${definition.apiKey}`,
+			name: definition.apiKey,
+			title: definition.label,
+			mimeType: "application/json"
+		})) };
+	} }), {
+		title: "Content type definition",
+		description: "A model or component in the schema file format, with stable IDs.",
+		mimeType: "application/json"
+	}, async (uri, variables) => {
+		const apiKey = String(variables.apiKey);
+		const { definition } = findDefinition(await readSchema(client), apiKey);
+		return { contents: [{
+			uri: uri.href,
+			mimeType: "application/json",
+			text: serializeDefinition(definition)
+		}] };
+	});
+	server.registerResource("delivery-api", DELIVERY_DOC_URI, {
+		title: "Delivery API guide",
+		description: "How sites and apps read published content: routes, filters, locales, snapshots, tokens.",
+		mimeType: "text/markdown"
+	}, (uri) => ({ contents: [{
+		uri: uri.href,
+		mimeType: "text/markdown",
+		text: DELIVERY_API_DOC
+	}] }));
+};
+//#endregion
+//#region src/tools/results.ts
+/** A tool's answer: the API response as pretty JSON text (what agents read best). */
+const jsonResult = (value) => ({ content: [{
+	type: "text",
+	text: JSON.stringify(value ?? null, null, 2)
+}] });
+/**
+* A refusal or failure the agent should see and act on (a stale version, a missing permission, validation
+* issues), with Shapio's error code and details. Never thrown: the MCP client gets `isError`.
+*/
+const errorResult = (error) => {
+	const body = error instanceof ShapioApiError ? {
+		status: error.status,
+		code: error.code,
+		message: error.message,
+		details: error.details
+	} : {
+		code: "TOOL_FAILED",
+		message: error instanceof Error ? error.message : String(error)
+	};
+	return {
+		isError: true,
+		content: [{
+			type: "text",
+			text: JSON.stringify({ error: body }, null, 2)
+		}]
+	};
+};
+/** Runs a tool body, turning any failure into an error result. */
+const runTool = async (body) => {
+	try {
+		return jsonResult(await body());
+	} catch (error) {
+		return errorResult(error);
+	}
+};
+//#endregion
+//#region src/tools/changeSets.ts
+const SET_ID = z.string().min(1).describe("Change set ID");
+/**
+* Change sets: the reviewable bundle of schema drafts and entry publications that ships as one snapshot.
+* Agents create and fill them; shipping is a person's call (`change_sets_ship` exists only with
+* --allow-ship, and the server also needs the token's role to hold changes.ship).
+*/
+const registerChangeSetTools = ({ server, client, options }) => {
+	server.registerTool("change_sets_list", {
+		title: "List change sets",
+		description: "Change sets, newest first (every status but discarded unless status is given).",
+		inputSchema: z.object({
+			status: z.string().optional().describe("Comma-separated: open, scheduled, shipping, shipped, failed, discarded"),
+			cursor: z.string().optional(),
+			limit: z.number().int().positive().max(100).optional()
+		}),
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: false
+		}
+	}, (query) => runTool(() => client.admin.changeSets.list(query)));
+	server.registerTool("change_sets_create", {
+		title: "Create a change set",
+		description: "An empty, open change set to collect schema drafts and entry publications for review.",
+		inputSchema: z.object({
+			title: z.string().min(1).max(200),
+			description: z.string().max(5e3).optional()
+		}),
+		annotations: {
+			destructiveHint: false,
+			openWorldHint: false
+		}
+	}, ({ title, description }) => runTool(() => client.admin.changeSets.create({
+		title,
+		...description ? { description } : {}
+	})));
+	server.registerTool("change_sets_add_entry", {
+		title: "Add an entry to a change set",
+		description: "Proposes publishing (or unpublishing) one entry locale when the set ships. The entry's current draft is what ships; the review shows the field diff against what is live.",
+		inputSchema: z.object({
+			changeSetId: SET_ID,
+			model: z.string().min(1).describe("The model's API ID"),
+			entryId: z.string().min(1),
+			locale: z.string().optional().describe("Omit for non-localized models and the default locale"),
+			action: z.enum(["publish", "unpublish"]).default("publish")
+		}),
+		annotations: {
+			destructiveHint: false,
+			openWorldHint: false
+		}
+	}, ({ changeSetId, model, entryId, locale, action }) => runTool(() => client.admin.changeSets.addEntry(changeSetId, {
+		modelKey: model,
+		entryId,
+		action,
+		...locale ? { locale } : {}
+	})));
+	server.registerTool("change_sets_review", {
+		title: "Review a change set",
+		description: "The set (status, version, items) and its review: field diffs per entry, the schema plan per draft (breaking, destructive, conversions), blocking issues, warnings and the consumers of affected fields.",
+		inputSchema: z.object({ changeSetId: SET_ID }),
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: false
+		}
+	}, ({ changeSetId }) => runTool(async () => {
+		const [set, review] = await Promise.all([client.admin.changeSets.get(changeSetId), client.admin.changeSets.review(changeSetId)]);
+		return {
+			set,
+			review
+		};
+	}));
+	if (options.allowShip) server.registerTool("change_sets_ship", {
+		title: "Ship a change set",
+		description: "Makes the set live as one snapshot. Only when the person you work for asked for it. expectedVersion is the set version change_sets_review showed; breaking or destructive schema changes need the acknowledgement. Refused when the token's role lacks changes.ship.",
+		inputSchema: z.object({
+			changeSetId: SET_ID,
+			expectedVersion: z.number().int().nonnegative(),
+			acknowledgeBreaking: z.boolean().optional(),
+			acknowledgeDestructive: z.boolean().optional()
+		}),
+		annotations: {
+			destructiveHint: true,
+			openWorldHint: false
+		}
+	}, ({ changeSetId, ...body }) => runTool(() => client.admin.changeSets.ship(changeSetId, body)));
+};
+//#endregion
+//#region src/tools/content.ts
+const MODEL = z.string().min(1).describe("The model's API ID (singular, e.g. \"article\")");
+const LOCALE = z.string().min(1).optional().describe("Locale code; the default locale when omitted");
+const PUBLISHED = z.boolean().optional().describe("Read published content through the delivery API instead of drafts (implied by snapshot)");
+const SNAPSHOT = z.number().int().nonnegative().optional().describe("Read published content as of publication snapshot N");
+const QUERY = z.object({
+	model: MODEL,
+	filters: z.record(z.string(), z.unknown()).optional().describe("Filter tree by field API ID, e.g. { \"title\": { \"$containsi\": \"launch\" } }; $and/$or take lists"),
+	sort: z.array(z.object({
+		field: z.string().min(1),
+		direction: z.enum(["asc", "desc"])
+	})).optional(),
+	page: z.number().int().positive().optional(),
+	pageSize: z.number().int().positive().max(100).optional(),
+	q: z.string().optional().describe("Free-text search over the title field"),
+	locale: LOCALE,
+	fields: z.array(z.string()).optional().describe("Top-level fields to return"),
+	populate: z.array(z.string()).optional().describe("Relation paths to expand, e.g. \"author\""),
+	status: z.enum([
+		"draft",
+		"published",
+		"modified"
+	]).optional().describe("Drafts only: entries in this status"),
+	published: PUBLISHED,
+	snapshot: SNAPSHOT
+});
+const DATA = z.record(z.string(), z.unknown()).describe("Field values by API ID. Rich text is Shapio's JSON document format, never HTML.");
+/** Entries: query and read (drafts or published), create and update drafts. Never publishes. */
+const registerContentTools = ({ server, client }) => {
+	server.registerTool("content_query", {
+		title: "Query entries",
+		description: "A page of a model's entries. Drafts by default (what editors see); published=true or snapshot=N reads what the delivery API serves.",
+		inputSchema: QUERY,
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: false
+		}
+	}, ({ model, published, snapshot, status, filters, sort, ...rest }) => runTool(async () => {
+		const query = {
+			...rest,
+			...filters ? { filters } : {},
+			...sort ? { sort } : {}
+		};
+		if (published || snapshot !== void 0) {
+			const { definition } = findDefinition(await readSchema(client), model);
+			const routeKey = routeKeyOf$1(definition);
+			return definition.kind === "singleton" ? client.delivery.singleton(routeKey, {
+				...rest.locale ? { locale: rest.locale } : {},
+				...snapshot !== void 0 ? { snapshot } : {}
+			}) : client.delivery.list(routeKey, {
+				...query,
+				...snapshot !== void 0 ? { snapshot } : {}
+			});
+		}
+		return client.admin.content.list(model, {
+			...query,
+			...status ? { status } : {}
+		});
+	}));
+	server.registerTool("content_get", {
+		title: "Read an entry",
+		description: "One entry: its draft with every locale's status and version (send version back as expectedVersion to content_update), or the published version when published=true or snapshot=N.",
+		inputSchema: z.object({
+			model: MODEL,
+			id: z.string().min(1),
+			locale: LOCALE,
+			published: PUBLISHED,
+			snapshot: SNAPSHOT
+		}),
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: false
+		}
+	}, ({ model, id, locale, published, snapshot }) => runTool(async () => {
+		if (published || snapshot !== void 0) {
+			const { definition } = findDefinition(await readSchema(client), model);
+			return client.delivery.get(routeKeyOf$1(definition), id, {
+				...locale ? { locale } : {},
+				...snapshot !== void 0 ? { snapshot } : {}
+			});
+		}
+		return client.admin.content.get(model, id, locale ? { locale } : {});
+	}));
+	server.registerTool("content_create", {
+		title: "Create a draft entry",
+		description: "Creates an entry as a draft (never published). Validated by the server against the live model. Add it to a change set with change_sets_add_entry to propose publishing it.",
+		inputSchema: z.object({
+			model: MODEL,
+			data: DATA,
+			locale: LOCALE
+		}),
+		annotations: {
+			destructiveHint: false,
+			openWorldHint: false
+		}
+	}, ({ model, data, locale }) => runTool(() => client.admin.content.create(model, {
+		data,
+		...locale ? { locale } : {}
+	})));
+	server.registerTool("content_update", {
+		title: "Update a draft entry",
+		description: "Saves changed fields into one locale's draft (absent fields are kept, null clears). expectedVersion is the version content_get returned; a stale one is refused (CONTENT_VERSION_CONFLICT): read again and redo. Pass expectedVersion null to start a new locale of the entry.",
+		inputSchema: z.object({
+			model: MODEL,
+			id: z.string().min(1),
+			data: DATA,
+			expectedVersion: z.number().int().nonnegative().nullable(),
+			locale: LOCALE
+		}),
+		annotations: {
+			destructiveHint: false,
+			idempotentHint: false,
+			openWorldHint: false
+		}
+	}, ({ model, id, data, expectedVersion, locale }) => runTool(() => client.admin.content.update(model, id, {
+		data,
+		expectedVersion,
+		...locale ? { locale } : {}
+	})));
+};
+//#endregion
+//#region src/tools/insights.ts
+/** Checks and signals: pre-flight for one entry, content health findings, field usage by consumers. */
+const registerInsightTools = ({ server, client }) => {
+	server.registerTool("preflight_run", {
+		title: "Pre-flight an entry",
+		description: "What publishing these locales of an entry would run into (validation, missing locales, references, alt text), without publishing anything.",
+		inputSchema: z.object({
+			model: z.string().min(1).describe("The model's API ID"),
+			id: z.string().min(1),
+			locales: z.array(z.string()).optional()
+		}),
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: false
+		}
+	}, ({ model, id, locales }) => runTool(() => client.admin.preflight.run(model, id, locales ? { locales } : {})));
+	server.registerTool("health_list", {
+		title: "List content health findings",
+		description: `Open findings of the content health rules (${HEALTH_RULES.join(", ")}), by rule and model.`,
+		inputSchema: z.object({
+			rule: z.enum(HEALTH_RULES).optional(),
+			model: z.string().optional().describe("The model's API ID"),
+			cursor: z.string().optional(),
+			limit: z.number().int().positive().max(100).optional()
+		}),
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: false
+		}
+	}, ({ model, ...query }) => runTool(() => client.admin.contentHealth.list({
+		...query,
+		...model ? { modelKey: model } : {}
+	})));
+	server.registerTool("usage_fields", {
+		title: "Field usage",
+		description: "Which fields of a model sites and apps read, per API token, over the last N days: check before renaming or removing a field.",
+		inputSchema: z.object({
+			model: z.string().min(1).describe("The model's API ID"),
+			days: z.number().int().positive().max(365).optional()
+		}),
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: false
+		}
+	}, ({ model, days }) => runTool(async () => {
+		const { definition } = findDefinition(await readSchema(client), model);
+		return client.admin.usage.fields({
+			modelId: definition.id,
+			...days ? { days } : {}
+		});
+	}));
+};
+//#endregion
+//#region src/tools/media.ts
+/**
+* The file a `media_upload` may read: inside the media root after resolving symlinks, so an agent (or text
+* injected into what it reads) cannot have the server read ~/.ssh or anything else outside the project.
+*/
+const resolveMediaPath = async (mediaRoot, path) => {
+	const root = await realpath(mediaRoot);
+	const target = await realpath(resolve(root, path)).catch(() => {
+		throw new Error(`No file at ${path} (relative to the media root ${root})`);
+	});
+	const inside = relative(root, target);
+	if (inside === "" || inside.startsWith("..") || isAbsolute(inside)) throw new Error(`media_upload only reads files under the media root (${root}); start the server with --media-root to change it`);
+	return target;
+};
+/** The media library: browse, and upload files from the media root. */
+const registerMediaTools = ({ server, client, options }) => {
+	server.registerTool("media_list", {
+		title: "List media",
+		description: "A page of media assets (ID, filename, type, alt text, visibility, URLs), newest first.",
+		inputSchema: z.object({
+			folder: z.string().optional().describe("A folder ID, or \"root\" for assets in no folder"),
+			mimeType: z.string().optional().describe("\"image/png\" or \"image/*\""),
+			search: z.string().optional(),
+			cursor: z.string().optional().describe("nextCursor of the previous page"),
+			limit: z.number().int().positive().max(100).optional()
+		}),
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: false
+		}
+	}, (query) => runTool(() => client.admin.media.assets.list(query)));
+	server.registerTool("media_upload", {
+		title: "Upload a file",
+		description: `Uploads a local file into the media library and returns the asset (use its ID in media fields). Only files under ${options.mediaRoot} can be read. Media is stored at once (it is not part of change sets).`,
+		inputSchema: z.object({
+			path: z.string().min(1).describe("Path relative to the media root (or absolute, inside it)"),
+			alt: z.string().max(1e3).optional().describe("Alt text for images"),
+			mimeType: z.string().optional().describe("Needed when the extension is not a common one"),
+			folderId: z.string().optional(),
+			visibility: z.enum(["public", "private"]).optional()
+		}),
+		annotations: {
+			destructiveHint: false,
+			openWorldHint: false
+		}
+	}, ({ path, alt, mimeType, folderId, visibility }) => runTool(async () => {
+		const file = await resolveMediaPath(options.mediaRoot, path);
+		const asset = await uploadFile(client, {
+			baseUrl: options.baseUrl,
+			path: file,
+			...mimeType ? { mimeType } : {},
+			...folderId ? { folderId } : {},
+			...visibility ? { visibility } : {}
+		});
+		return alt ? client.admin.media.assets.update(asset.id, {
+			expectedVersion: asset.version,
+			alt
+		}) : asset;
+	}));
+};
+//#endregion
+//#region src/schemaDrafts.ts
+const schemaItemsOf = (set) => set.items.filter((item) => item.kind === "schema");
+/**
+* Relation targets and component references are stable IDs. Agents think in API IDs, so a reference that
+* is not an ID is looked up among the active definitions and the set's drafts (and this definition itself,
+* for a self-relation); anything unknown is left for the server to report.
+*/
+const resolveReferences = (definition, idsByApiKey) => {
+	const resolve = (value) => typeof value === "string" && !isStableId(value) ? idsByApiKey.get(value) ?? value : value;
+	const fields = Array.isArray(definition.fields) ? definition.fields : [];
+	return {
+		...definition,
+		fields: fields.map((field) => {
+			const settings = field.settings;
+			if (!settings) return field;
+			if (field.type === "relation") return {
+				...field,
+				settings: {
+					...settings,
+					target: resolve(settings.target)
+				}
+			};
+			if (field.type === "component") return {
+				...field,
+				settings: {
+					...settings,
+					component: resolve(settings.component)
+				}
+			};
+			if (field.type === "dynamiczone" && Array.isArray(settings.components)) return {
+				...field,
+				settings: {
+					...settings,
+					components: settings.components.map(resolve)
+				}
+			};
+			return field;
+		})
+	};
+};
+/**
+* Puts a definition into a change set as a draft: picks its stable ID (the active definition's, the set's
+* existing draft's, or a new one), its base version and the draft version to replace, then lets the server
+* parse, validate and plan it. Nothing goes live until a person ships the set.
+*/
+const putDefinitionDraft = async (client, changeSetId, definition) => {
+	if (typeof definition.apiKey !== "string" || typeof definition.kind !== "string") throw new Error("A definition needs at least \"kind\" (collection, singleton or component) and \"apiKey\"");
+	const [schema, set] = await Promise.all([readSchema(client), client.admin.changeSets.get(changeSetId)]);
+	const drafts = schemaItemsOf(set);
+	const apiKey = definition.apiKey;
+	const explicitId = typeof definition.id === "string" ? definition.id : void 0;
+	const active = schema.definitions.find(({ definition: candidate }) => candidate.id === explicitId || !explicitId && candidate.apiKey === apiKey);
+	const drafted = drafts.find((item) => item.definitionId === explicitId || !explicitId && item.apiKey === apiKey);
+	const id = explicitId ?? active?.definition.id ?? drafted?.definitionId ?? randomUUID();
+	const idsByApiKey = new Map([
+		...schema.definitions.map(({ definition: candidate }) => [candidate.apiKey, candidate.id]),
+		...drafts.map((item) => [item.apiKey, item.definitionId]),
+		[apiKey, id]
+	]);
+	const payload = resolveReferences({
+		...definition,
+		id
+	}, idsByApiKey);
+	const draft = await client.admin.changeSets.putSchemaDraft(changeSetId, id, {
+		category: definition.kind === "component" ? "component" : "model",
+		definition: payload,
+		baseVersion: active?.version ?? null,
+		...drafted ? { expectedDraftVersion: drafted.draftVersion } : {}
+	});
+	return {
+		changeSetId,
+		definitionId: id,
+		operation: draft.operation,
+		draftVersion: draft.version,
+		draft
+	};
+};
+//#endregion
+//#region src/tools/schema.ts
+const READ_ONLY = {
+	readOnlyHint: true,
+	openWorldHint: false
+};
+const DEFINITION_DESCRIPTION = "A whole definition in Shapio's authored format: { kind: \"collection\" | \"singleton\" | \"component\", apiKey, label, pluralApiKey? (collections), localized?, draftAndPublish?, fields: [{ apiKey, label, type, required?, localized?, settings? }] }. IDs are optional: an existing definition keeps its IDs (matched by API ID). Relation targets and component references may be given as API IDs. Read shapio://schema/{apiKey} to see the format of an existing one.";
+/** The schema: list and read definitions, and draft changes into a change set (never activated here). */
+const registerSchemaTools = ({ server, client }) => {
+	server.registerTool("schema_list", {
+		title: "List content types",
+		description: "Every model (collection, singleton) and component with its API IDs, version and fields (types only). Delivery reads use pluralApiKey for collections.",
+		inputSchema: z.object({}),
+		annotations: READ_ONLY
+	}, () => runTool(async () => {
+		const schema = await readSchema(client);
+		return {
+			schemaVersion: schema.schemaVersion,
+			definitions: schema.definitions.map(summarize)
+		};
+	}));
+	server.registerTool("schema_get", {
+		title: "Read a content type",
+		description: "One definition in full (fields with settings), by API ID or stable ID, with its version.",
+		inputSchema: z.object({ apiKey: z.string().min(1).describe("API ID (or stable ID) of the definition") }),
+		annotations: READ_ONLY
+	}, ({ apiKey }) => runTool(async () => findDefinition(await readSchema(client), apiKey)));
+	server.registerTool("schema_draft", {
+		title: "Draft a content type change",
+		description: "Proposes a new or changed definition as a draft in a change set (a new set when changeSetId is omitted). Nothing changes on the live schema until a person reviews and ships the set. Returns the change set ID; read change_sets_review next.",
+		inputSchema: z.object({
+			definition: z.record(z.string(), z.unknown()).describe(DEFINITION_DESCRIPTION),
+			changeSetId: z.string().optional().describe("An open change set; omit to start a new one"),
+			title: z.string().min(1).max(200).optional().describe("Title of the new change set")
+		}),
+		annotations: {
+			destructiveHint: false,
+			openWorldHint: false
+		}
+	}, ({ definition, changeSetId, title }) => runTool(async () => {
+		const apiKey = typeof definition.apiKey === "string" ? definition.apiKey : "draft";
+		const setId = changeSetId ?? (await client.admin.changeSets.create({ title: title ?? `Schema: ${apiKey}` })).id;
+		return putDefinitionDraft(client, setId, definition);
+	}));
+	server.registerTool("change_sets_add_schema_draft", {
+		title: "Add a schema draft to a change set",
+		description: "Puts a new or changed definition into an existing change set as a draft (replaces this set's earlier draft of the same definition). Ships only when a person ships the set.",
+		inputSchema: z.object({
+			changeSetId: z.string().min(1),
+			definition: z.record(z.string(), z.unknown()).describe(DEFINITION_DESCRIPTION)
+		}),
+		annotations: {
+			destructiveHint: false,
+			openWorldHint: false
+		}
+	}, ({ changeSetId, definition }) => runTool(() => putDefinitionDraft(client, changeSetId, definition)));
+};
+//#endregion
+//#region src/tools/snapshots.ts
+/** Publication snapshots: the ledger, the diff between two, and restore (as a reviewable change set). */
+const registerSnapshotTools = ({ server, client }) => {
+	server.registerTool("snapshots_list", {
+		title: "List snapshots",
+		description: "The publication ledger, newest first: what went live, when, why and by whom.",
+		inputSchema: z.object({
+			cursor: z.string().optional(),
+			limit: z.number().int().positive().max(100).optional()
+		}),
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: false
+		}
+	}, (query) => runTool(() => client.admin.snapshots.list(query)));
+	server.registerTool("snapshots_changes", {
+		title: "Changes between snapshots",
+		description: "Which entries were published, updated or unpublished between snapshot \"from\" and \"to\" (default: now). Names entries, never values.",
+		inputSchema: z.object({
+			from: z.number().int().nonnegative(),
+			to: z.number().int().nonnegative().optional(),
+			after: z.string().optional().describe("nextCursor of the previous page"),
+			limit: z.number().int().positive().max(500).optional()
+		}),
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: false
+		}
+	}, (query) => runTool(() => client.snapshots.changes(query)));
+	server.registerTool("snapshots_restore", {
+		title: "Propose restoring a snapshot",
+		description: "Creates an open change set that would bring live content back to what snapshot N served. Nothing changes until a person ships it; the schema is never rolled back.",
+		inputSchema: z.object({ seq: z.number().int().positive() }),
+		annotations: {
+			destructiveHint: false,
+			openWorldHint: false
+		}
+	}, ({ seq }) => runTool(() => client.admin.snapshots.restore(seq)));
+};
+//#endregion
+//#region src/server.ts
+const MCP_SERVER_NAME = "shapio";
+const MCP_SERVER_VERSION = version;
+const INSTRUCTIONS = "Shapio is a headless CMS whose content types are live data. Agents propose, people ship: draft schema changes and entries, collect them in a change set, and leave shipping to a person. Model and field identifiers are called \"API IDs\". Read shapio://docs/delivery-api for how sites read content.";
+/** The MCP server for one Shapio instance, with every tool, resource and prompt registered. */
+const createShapioMcpServer = (options, client = createClient({
+	baseUrl: options.baseUrl,
+	token: options.token,
+	...options.site !== void 0 ? { site: options.site } : {}
+})) => {
+	const server = new McpServer({
+		name: MCP_SERVER_NAME,
+		version: MCP_SERVER_VERSION
+	}, { instructions: INSTRUCTIONS });
+	const context = {
+		server,
+		client,
+		options
+	};
+	registerSchemaTools(context);
+	registerContentTools(context);
+	registerMediaTools(context);
+	registerInsightTools(context);
+	registerChangeSetTools(context);
+	registerSnapshotTools(context);
+	registerResources(context);
+	registerPrompts(context);
+	return server;
+};
+//#endregion
+//#region src/options.ts
+/** A site key as Shapio creates them (sites are named by key in URLs, `?site=` and config). */
+const SITE_KEY = /^[a-z][a-z0-9-]{0,62}$/;
+const USAGE = `Usage: shapio-mcp [--allow-ship] [--media-root <dir>] [--site <key>]
+
+A Model Context Protocol server (stdio) for a Shapio instance.
+
+Environment:
+  SHAPIO_URL     Shapio's base URL, including any BASE_PATH (e.g. https://cms.example.com)
+  SHAPIO_TOKEN   An admin-scope API token. Give its role no "changes.ship" permission: agents propose
+                 change sets, people ship them.
+  SHAPIO_SITE    The site key to work on (multi-site instances); --site overrides it. Default: the
+                 token's site, else the primary site.
+
+Options:
+  --allow-ship         Offer the change_sets_ship tool (the token's role must also allow changes.ship)
+  --media-root <dir>   Directory media_upload may read files from (default: the working directory)
+  --site <key>         The site to work on (overrides SHAPIO_SITE)
+  -h, --help           Show this help
+`;
+var OptionsError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "OptionsError";
+	}
+};
+/** Reads the command line and environment; throws OptionsError with a message meant for stderr. */
+const parseOptions = (argv, env, cwd) => {
+	let parsed;
+	try {
+		parsed = parseArgs({
+			args: [...argv],
+			options: {
+				"allow-ship": {
+					type: "boolean",
+					default: false
+				},
+				"media-root": { type: "string" },
+				site: { type: "string" },
+				help: {
+					type: "boolean",
+					short: "h",
+					default: false
+				}
+			},
+			strict: true,
+			allowPositionals: false
+		});
+	} catch (error) {
+		throw new OptionsError(error instanceof Error ? error.message : String(error));
+	}
+	if (parsed.values.help) return "help";
+	const baseUrl = env.SHAPIO_URL?.trim();
+	const token = env.SHAPIO_TOKEN?.trim();
+	if (!baseUrl || !/^https?:\/\//.test(baseUrl)) throw new OptionsError("Set SHAPIO_URL to the Shapio base URL (http:// or https://).");
+	if (!token) throw new OptionsError("Set SHAPIO_TOKEN to an admin-scope API token.");
+	const site = (parsed.values.site ?? env.SHAPIO_SITE)?.trim() || void 0;
+	if (site !== void 0 && !SITE_KEY.test(site)) throw new OptionsError(`"${site}" is not a site key (lower case, starting with a letter).`);
+	return {
+		baseUrl: baseUrl.replace(/\/+$/, ""),
+		token,
+		allowShip: parsed.values["allow-ship"],
+		mediaRoot: resolve(cwd, parsed.values["media-root"] ?? "."),
+		...site !== void 0 ? { site } : {}
+	};
+};
+//#endregion
+export { MCP_SERVER_VERSION as a, MCP_SERVER_NAME as i, USAGE as n, createShapioMcpServer as o, parseOptions as r, OptionsError as t };
+
+//# sourceMappingURL=options-Bc0S3ldO.js.map

package/dist/options-Bc0S3ldO.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options-Bc0S3ldO.js","names":["routeKeyOf","modelRouteKeyOf","routeKeyOf","packageJson.version"],"sources":["../package.json","../src/prompts.ts","../src/definitions.ts","../src/generated/deliveryApiDoc.ts","../src/resources.ts","../src/tools/results.ts","../src/tools/changeSets.ts","../src/tools/content.ts","../src/tools/insights.ts","../src/tools/media.ts","../src/schemaDrafts.ts","../src/tools/schema.ts","../src/tools/snapshots.ts","../src/server.ts","../src/options.ts"],"sourcesContent":["","import { z } from 'zod';\nimport type { ToolContext } from './context.js';\n\nconst userMessage = (text: string) => ({\n  messages: [{ role: 'user' as const, content: { type: 'text' as const, text } }],\n});\n\n/** Starting points for the two jobs agents do most: modelling and reviewing a change set. */\nexport const registerPrompts = ({ server }: ToolContext) => {\n  server.registerPrompt(\n    'model_content_type',\n    {\n      title: 'Model a content type for …',\n      description: 'Design a content type for something and draft it into a change set for review.',\n      argsSchema: z.object({\n        subject: z.string().min(1).describe('What the content type is for, e.g. \"a blog\"'),\n      }),\n    },\n    ({ subject }) =>\n      userMessage(\n        `Model content types in Shapio for ${subject}.\\n\\n` +\n          '1. Call schema_list and read the existing types first; reuse or extend them instead of duplicating.\\n' +\n          '2. Design the types: API IDs are camelCase GraphQL names, labels are for people; prefer components ' +\n          'for repeated groups and relations for shared entities.\\n' +\n          '3. Draft each type with schema_draft (one change set for the whole design: pass the changeSetId ' +\n          'from the first call to the rest).\\n' +\n          '4. Read change_sets_review, fix every blocking issue, and summarise the design and the review for ' +\n          'me. Do not ship: I review and ship the change set myself.',\n      ),\n  );\n\n  server.registerPrompt(\n    'review_change_set',\n    {\n      title: 'Review change set N',\n      description: 'Explain what a change set would do when it ships, and what to check first.',\n      argsSchema: z.object({ changeSetId: z.string().min(1).describe('The change set ID') }),\n    },\n    ({ changeSetId }) =>\n      userMessage(\n        `Review Shapio change set ${changeSetId}. Call change_sets_review and tell me, briefly:\\n` +\n          '- what goes live (schema changes and entries, with the field diffs that matter);\\n' +\n          '- anything breaking or destructive, and which API consumers read the affected fields ' +\n          '(usage_fields);\\n' +\n          '- blocking issues and warnings, and how to fix each;\\n' +\n          '- whether you would ship it. Do not ship it yourself.',\n      ),\n  );\n};\n","import type { ShapioClient } from '@shapio/client';\nimport { isModelDefinition, routeKeyOf as modelRouteKeyOf, type SchemaDefinition } from '@shapio/schema';\n\ntype Exported = Awaited<ReturnType<ShapioClient['admin']['schema']['export']>>;\nexport type ExportedDefinition = Exported['definitions'][number];\n\n/** The active schema (the pull format), read fresh for each call: models change live. */\nexport const readSchema = (client: ShapioClient): Promise<Exported> => client.admin.schema.export();\n\n/** An active definition by API ID (or stable ID); throws a message the agent can act on. */\nexport const findDefinition = (schema: Exported, key: string): ExportedDefinition => {\n  const found = schema.definitions.find(\n    ({ definition }) => definition.apiKey === key || definition.id === key,\n  );\n  if (!found) {\n    const known = schema.definitions.map(({ definition }) => definition.apiKey).join(', ') || '(none)';\n    throw new Error(`No model or component with API ID \"${key}\". Known: ${known}`);\n  }\n  return found;\n};\n\n/**\n * The delivery route key: a collection's plural API ID (`articles`), a singleton's API ID. The admin content\n * API uses the singular API ID instead. Components have no route.\n */\nexport const routeKeyOf = (definition: SchemaDefinition): string => {\n  if (!isModelDefinition(definition)) {\n    throw new Error(\n      `\"${definition.apiKey}\" is a component: components are read through the models that use them`,\n    );\n  }\n  return modelRouteKeyOf(definition);\n};\n\n/** A one-line summary per definition, for listings that should not carry every field's settings. */\nexport const summarize = ({ definition, version }: ExportedDefinition) => ({\n  id: definition.id,\n  kind: definition.kind,\n  apiKey: definition.apiKey,\n  ...(definition.kind === 'collection' ? { pluralApiKey: modelRouteKeyOf(definition) } : {}),\n  label: definition.label,\n  version,\n  fields: definition.fields.map((field) => ({\n    apiKey: field.apiKey,\n    type: field.type,\n    required: field.required,\n    localized: field.localized,\n  })),\n});\n","// Generated by scripts/embedDocs.mjs from documentation/delivery-api.md. Do not edit.\nexport const DELIVERY_API_DOC = \"# Delivery API (REST)\\n\\nYour sites and apps read published content from one generic route per model:\\n\\n```text\\nGET {PUBLIC_URL}{BASE_PATH}/api/content/<plural API ID>              # a collection: a page of entries\\nGET {PUBLIC_URL}{BASE_PATH}/api/content/<plural API ID>/<entry id>   # a collection: one entry\\nGET {PUBLIC_URL}{BASE_PATH}/api/content/<API ID>                     # a single type: its entry\\n```\\n\\nA collection is addressed by its **plural API ID** (`/api/content/articles`), a single type by its **API ID**\\n(`/api/content/homepage`). The singular API ID of a collection is not a delivery route: `/api/content/article`\\nis a 404. Both IDs are set on the model ([Modelling](modelling.md#kinds-of-definitions)). The admin content API\\n(`/api/admin/content/<API ID>`) always uses the singular.\\n\\nThere is no generated code per model: a model created a minute ago is served by the same routes at once.\\nDelivery returns **published** content only; drafts, unpublished entries, private media and fields your token\\nmay not read never appear. The [REST reference](reference/rest-api.md) lists every read parameter (app-user\\nwrites are described in [End users](end-users.md)); your instance's own OpenAPI document, for its current\\nschema, is at `/api/docs` (admins).\\n\\nThe examples below use the [example site](example-site.md)'s models.\\n\\n## Tokens\\n\\nCreate a **delivery role** (Network → Roles → New role, kind _Delivery_) with `read` on the models your site\\nneeds, then an API token bound to it (Settings → API tokens). Send it as a bearer token:\\n\\n```sh\\ncurl -H \\\"Authorization: Bearer $SHAPIO_DELIVERY_TOKEN\\\" \\\"$SHAPIO_URL/api/content/articles?locale=fr\\\"\\n```\\n\\n- Delivery tokens can only ever read, whatever their role says.\\n- A role's grant covers every field marked `public` (the default); `public: false` fields are hidden unless the\\n  grant names them.\\n- Without a token, a request is _anonymous_: it gets what the built-in **public** app role grants, which is\\n  nothing until you allow it (Network → Roles → App roles). Use that for content anyone may read from the\\n  browser. App users' own tokens are covered in [End users](end-users.md).\\n\\n## Sites\\n\\nOne Shapio instance can host several [sites](sites.md) that share the content types but each have their own\\ncontent, tokens and snapshots. Every delivery request reads exactly one site:\\n\\n1. **The token's site.** Delivery tokens belong to the site they were created on, and only ever read it.\\n2. **The site the request names**, with `?site=<key>` or the `Shapio-Site: <key>` header. Anonymous callers and\\n   network admin tokens use this to pick a site.\\n3. **The primary site**, when neither names one. An instance with a single site never needs to name it.\\n\\nNaming a different site than the token's is refused with `403 SITE_MISMATCH`, never redirected, and so is a\\nrequest whose header and `?site=` disagree. An unknown key is `404 SITE_NOT_FOUND`. Entries of another site\\nread as not found, and relations never cross sites.\\n\\n```sh\\ncurl \\\"$SHAPIO_URL/api/content/articles?site=marketing\\\"\\n```\\n\\nAnonymous reads get what the app roles bound to the request site's `public` audience grant. The primary site\\nbinds the built-in **public** role; a new site binds none, so it serves nothing anonymously until you bind one\\n([Sites](sites.md#app-users-and-anonymous-access)).\\n\\nWith `@shapio/client`, pass the site once:\\n\\n```ts\\nconst shapio = createClient({ baseUrl: process.env.SHAPIO_URL, token, site: 'marketing' });\\n```\\n\\nThe client sends it as `?site=` on delivery and snapshot reads, which keeps a cross-origin `GET` free of a\\nCORS preflight and keeps URL-keyed caches apart. Every other request (writes, GraphQL, the admin API) carries\\nthe `Shapio-Site` header. Leave `site` out to read the token's site, or the primary site.\\n\\n## Responses\\n\\n```json\\n{\\n  \\\"data\\\": [\\n    {\\n      \\\"id\\\": \\\"6f2c…\\\",\\n      \\\"locale\\\": \\\"fr\\\",\\n      \\\"createdAt\\\": \\\"2026-10-01T09:12:44.512Z\\\",\\n      \\\"updatedAt\\\": \\\"2026-10-01T09:30:02.104Z\\\",\\n      \\\"publishedAt\\\": \\\"2026-10-01T09:30:02.104Z\\\",\\n      \\\"title\\\": \\\"Modéliser du contenu sans déploiement\\\",\\n      \\\"slug\\\": \\\"modelling-without-a-deploy\\\",\\n      \\\"excerpt\\\": \\\"…\\\",\\n      \\\"body\\\": {\\n        \\\"format\\\": \\\"shapio-richtext\\\",\\n        \\\"version\\\": 1,\\n        \\\"doc\\\": { \\\"type\\\": \\\"doc\\\", \\\"content\\\": [] },\\n        \\\"html\\\": \\\"<p>…</p>\\\"\\n      },\\n      \\\"cover\\\": { \\\"id\\\": \\\"…\\\", \\\"url\\\": \\\"…\\\", \\\"width\\\": 1600, \\\"height\\\": 900, \\\"alt\\\": \\\"…\\\", \\\"variants\\\": [] },\\n      \\\"author\\\": \\\"0b7e…\\\",\\n      \\\"publishedOn\\\": \\\"2026-09-01\\\"\\n    }\\n  ],\\n  \\\"meta\\\": {\\n    \\\"locale\\\": \\\"fr\\\",\\n    \\\"snapshot\\\": 10,\\n    \\\"pagination\\\": { \\\"page\\\": 1, \\\"pageSize\\\": 25, \\\"total\\\": 2, \\\"pageCount\\\": 1 }\\n  }\\n}\\n```\\n\\n- Entries are flat: system attributes, then every readable field by API ID, `null` (or `[]`) when empty.\\n- **Rich text** is the stored JSON document plus `html`, rendered on the server from the JSON with an allow-list\\n  sanitiser (safe link protocols only, images resolved through the media library).\\n- **Media** fields are asset objects with URLs and ready [variants](media.md#image-variants); private assets\\n  carry an expiring signed URL.\\n- **Relations** are target IDs unless you `populate` them. A target that is not published, or that your token\\n  may not read, is left out (never its ID).\\n- **Components** are objects; **dynamic zones** are arrays of objects with `__component` (the component's\\n  API ID).\\n- A single type answers `/api/content/<API ID>` with `{ data: {…}, meta }`.\\n\\nErrors always look like `{ \\\"error\\\": { \\\"code\\\": \\\"…\\\", \\\"message\\\": \\\"…\\\", \\\"details\\\": … } }`: 400 for an invalid query,\\n401 without credentials for content that needs them, 403 when your role may not read the model, 404 for an\\nunknown model or entry.\\n\\n## Query parameters\\n\\n| Parameter          | Example                               | Notes                                                                             |\\n| ------------------ | ------------------------------------- | --------------------------------------------------------------------------------- |\\n| `locale`           | `locale=fr`                           | falls back along the locale chain ([Localization](localization.md))               |\\n| `filters`          | `filters[slug][$eq]=about`            | see below                                                                         |\\n| `sort`             | `sort=publishedOn:desc,createdAt:asc` | fields marked sortable, `id`, `createdAt`, `updatedAt`                            |\\n| `page`, `pageSize` | `page=2&pageSize=50`                  | `pageSize` 25 by default, at most 100                                             |\\n| `fields`           | `fields=title,slug`                   | top-level fields to return (system attributes always come)                        |\\n| `populate`         | `populate=author`                     | relation paths: `author`, `author,tags.author`, or `*`; at most 3 levels          |\\n| `q`                | `q=snapshot`                          | searches the title field chosen in the model's display settings (400 without one) |\\n| `snapshot`         | `snapshot=10`                         | read as of a publication snapshot (below)                                         |\\n\\n### Filters\\n\\n`filters[<field>][<operator>]=<value>`, combined with `$and`, `$or` and `$not`:\\n\\n```sh\\ncurl -G \\\"$SHAPIO_URL/api/content/articles\\\" -H \\\"Authorization: Bearer $SHAPIO_DELIVERY_TOKEN\\\" \\\\\\n  --data-urlencode 'filters[publishedOn][$gte]=2026-09-10' \\\\\\n  --data-urlencode 'filters[$or][0][slug][$eq]=why-builds-pin-a-snapshot' \\\\\\n  --data-urlencode 'filters[$or][1][slug][$eq]=modelling-without-a-deploy'\\n```\\n\\n| Operators                                                             | Field types                                                                                                                                                              |\\n| --------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |\\n| `$eq`, `$ne`, `$in`, `$nin`, `$null`, `$notNull`                      | text, numbers, dates, enums, relations and media (booleans: `$eq`, `$ne`, `$null`, `$notNull`); on lists (`many` relations, multiple media/enums) `$eq` means \\\"contains\\\" |\\n| `$lt`, `$lte`, `$gt`, `$gte`                                          | text, numbers, dates and times, on fields marked **filterable** or **sortable**                                                                                          |\\n| `$contains`, `$notContains`, `$containsi`, `$startsWith`, `$endsWith` | text fields marked **filterable**                                                                                                                                        |\\n\\n`id`, `createdAt` and `updatedAt` can be filtered too (`publishedAt` is returned but cannot be filtered or\\nsorted). JSON, rich text, component and dynamic zone fields cannot be filtered. `$in` takes repeated values or `a,b`. Values are read\\nlike stored values, so `2026-10-01T10:00:00+02:00` matches `2026-10-01T08:00:00.000Z`. Unknown fields,\\noperators a type does not support, and filters or sorts on fields your token may not read are refused (400/403)\\nrather than ignored, so a filter can never reveal a hidden value.\\n\\n## Snapshots: one consistent moment\\n\\nEvery publish moves a global **publication snapshot** number forward; every delivery response reports the\\none it read in `meta.snapshot`. Pass `snapshot=N` and Shapio answers exactly as it would have at that moment,\\neven if more was published since:\\n\\n```sh\\ncurl -H \\\"Authorization: Bearer $SHAPIO_DELIVERY_TOKEN\\\" \\\"$SHAPIO_URL/api/content/pages?snapshot=10&locale=en\\\"\\n```\\n\\nA static site build should read the current snapshot once at the start and pass it with every request: then\\na publish in the middle of the build cannot produce a site that mixes two moments. The\\n[example site](example-site.md) does exactly this, and Shapio's deployment triggers carry the snapshot to build.\\n\\nOld snapshots are read through the current schema (a value stored under an earlier field type comes back as\\n`null`). A [change set](change-sets.md) goes live as one snapshot, schema and entries together, so a pinned\\nbuild sees all of it or none of it.\\n\\nTwo endpoints serve builds, with the same tokens as `/api/content` and only for models the token may read:\\n\\n| Endpoint                                         | Answer                                                                   |\\n| ------------------------------------------------ | ------------------------------------------------------------------------ |\\n| `GET /api/snapshots/current`                     | `{ snapshot, schemaVersion, publishedAt }`: what an unpinned read serves |\\n| `GET /api/snapshots/changes?from&to&after&limit` | entries and locales whose live content changed between the two snapshots |\\n\\nDetails, the change classification and incremental-build recipes are in\\n[Snapshots and the changes API](snapshots.md).\\n\\n## Caching\\n\\nResponses carry a strong `ETag` over the exact body and `Vary: Authorization, Cookie, Shapio-Site`. Send\\n`If-None-Match` to get `304 Not Modified` when nothing changed. Anonymous responses are `Cache-Control: public,\\nmax-age=0, must-revalidate`; authenticated ones `private`. A CDN that keys its cache on the URL alone and\\nignores `Vary` must be given the site as `?site=`, not as the header, so that two sites never share a cached\\nresponse.\\n\\n## Writes\\n\\nThe same routes accept `POST`, `PUT` and `DELETE` from app users whose roles allow it (for example, members\\nediting their own entries). Delivery tokens cannot write. See [End users](end-users.md). Editors and your\\nbuild tools use the admin API (`/api/admin/content/<key>`) with admin credentials.\\n\";\n","import { ResourceTemplate } from '@modelcontextprotocol/server';\nimport { serializeDefinition } from '@shapio/schema';\nimport type { ToolContext } from './context.js';\nimport { findDefinition, readSchema } from './definitions.js';\nimport { DELIVERY_API_DOC } from './generated/deliveryApiDoc.js';\n\nexport const SCHEMA_URI_TEMPLATE = 'shapio://schema/{apiKey}';\nexport const DELIVERY_DOC_URI = 'shapio://docs/delivery-api';\n\n/** Each definition in the pull format (`shapio schema pull`'s files), and the delivery API guide. */\nexport const registerResources = ({ server, client }: ToolContext) => {\n  server.registerResource(\n    'schema',\n    new ResourceTemplate(SCHEMA_URI_TEMPLATE, {\n      list: async () => {\n        const schema = await readSchema(client);\n        return {\n          resources: schema.definitions.map(({ definition }) => ({\n            uri: `shapio://schema/${definition.apiKey}`,\n            name: definition.apiKey,\n            title: definition.label,\n            mimeType: 'application/json',\n          })),\n        };\n      },\n    }),\n    {\n      title: 'Content type definition',\n      description: 'A model or component in the schema file format, with stable IDs.',\n      mimeType: 'application/json',\n    },\n    async (uri, variables) => {\n      const apiKey = String(variables.apiKey);\n      const { definition } = findDefinition(await readSchema(client), apiKey);\n      return {\n        contents: [{ uri: uri.href, mimeType: 'application/json', text: serializeDefinition(definition) }],\n      };\n    },\n  );\n\n  server.registerResource(\n    'delivery-api',\n    DELIVERY_DOC_URI,\n    {\n      title: 'Delivery API guide',\n      description: 'How sites and apps read published content: routes, filters, locales, snapshots, tokens.',\n      mimeType: 'text/markdown',\n    },\n    (uri) => ({ contents: [{ uri: uri.href, mimeType: 'text/markdown', text: DELIVERY_API_DOC }] }),\n  );\n};\n","import type { CallToolResult } from '@modelcontextprotocol/server';\nimport { ShapioApiError } from '@shapio/client';\n\n/** A tool's answer: the API response as pretty JSON text (what agents read best). */\nexport const jsonResult = (value: unknown): CallToolResult => ({\n  content: [{ type: 'text', text: JSON.stringify(value ?? null, null, 2) }],\n});\n\n/**\n * A refusal or failure the agent should see and act on (a stale version, a missing permission, validation\n * issues), with Shapio's error code and details. Never thrown: the MCP client gets `isError`.\n */\nexport const errorResult = (error: unknown): CallToolResult => {\n  const body =\n    error instanceof ShapioApiError\n      ? { status: error.status, code: error.code, message: error.message, details: error.details }\n      : { code: 'TOOL_FAILED', message: error instanceof Error ? error.message : String(error) };\n  return { isError: true, content: [{ type: 'text', text: JSON.stringify({ error: body }, null, 2) }] };\n};\n\n/** Runs a tool body, turning any failure into an error result. */\nexport const runTool = async (body: () => Promise<unknown>): Promise<CallToolResult> => {\n  try {\n    return jsonResult(await body());\n  } catch (error) {\n    return errorResult(error);\n  }\n};\n","import { z } from 'zod';\nimport type { ToolContext } from '../context.js';\nimport { runTool } from './results.js';\n\nconst SET_ID = z.string().min(1).describe('Change set ID');\n\n/**\n * Change sets: the reviewable bundle of schema drafts and entry publications that ships as one snapshot.\n * Agents create and fill them; shipping is a person's call (`change_sets_ship` exists only with\n * --allow-ship, and the server also needs the token's role to hold changes.ship).\n */\nexport const registerChangeSetTools = ({ server, client, options }: ToolContext) => {\n  server.registerTool(\n    'change_sets_list',\n    {\n      title: 'List change sets',\n      description: 'Change sets, newest first (every status but discarded unless status is given).',\n      inputSchema: z.object({\n        status: z\n          .string()\n          .optional()\n          .describe('Comma-separated: open, scheduled, shipping, shipped, failed, discarded'),\n        cursor: z.string().optional(),\n        limit: z.number().int().positive().max(100).optional(),\n      }),\n      annotations: { readOnlyHint: true, openWorldHint: false },\n    },\n    (query) => runTool(() => client.admin.changeSets.list(query)),\n  );\n\n  server.registerTool(\n    'change_sets_create',\n    {\n      title: 'Create a change set',\n      description: 'An empty, open change set to collect schema drafts and entry publications for review.',\n      inputSchema: z.object({\n        title: z.string().min(1).max(200),\n        description: z.string().max(5000).optional(),\n      }),\n      annotations: { destructiveHint: false, openWorldHint: false },\n    },\n    ({ title, description }) =>\n      runTool(() => client.admin.changeSets.create({ title, ...(description ? { description } : {}) })),\n  );\n\n  server.registerTool(\n    'change_sets_add_entry',\n    {\n      title: 'Add an entry to a change set',\n      description:\n        \"Proposes publishing (or unpublishing) one entry locale when the set ships. The entry's current draft \" +\n        'is what ships; the review shows the field diff against what is live.',\n      inputSchema: z.object({\n        changeSetId: SET_ID,\n        model: z.string().min(1).describe(\"The model's API ID\"),\n        entryId: z.string().min(1),\n        locale: z.string().optional().describe('Omit for non-localized models and the default locale'),\n        action: z.enum(['publish', 'unpublish']).default('publish'),\n      }),\n      annotations: { destructiveHint: false, openWorldHint: false },\n    },\n    ({ changeSetId, model, entryId, locale, action }) =>\n      runTool(() =>\n        client.admin.changeSets.addEntry(changeSetId, {\n          modelKey: model,\n          entryId,\n          action,\n          ...(locale ? { locale } : {}),\n        }),\n      ),\n  );\n\n  server.registerTool(\n    'change_sets_review',\n    {\n      title: 'Review a change set',\n      description:\n        'The set (status, version, items) and its review: field diffs per entry, the schema plan per draft ' +\n        '(breaking, destructive, conversions), blocking issues, warnings and the consumers of affected fields.',\n      inputSchema: z.object({ changeSetId: SET_ID }),\n      annotations: { readOnlyHint: true, openWorldHint: false },\n    },\n    ({ changeSetId }) =>\n      runTool(async () => {\n        const [set, review] = await Promise.all([\n          client.admin.changeSets.get(changeSetId),\n          client.admin.changeSets.review(changeSetId),\n        ]);\n        return { set, review };\n      }),\n  );\n\n  if (options.allowShip) {\n    server.registerTool(\n      'change_sets_ship',\n      {\n        title: 'Ship a change set',\n        description:\n          'Makes the set live as one snapshot. Only when the person you work for asked for it. expectedVersion ' +\n          'is the set version change_sets_review showed; breaking or destructive schema changes need the ' +\n          \"acknowledgement. Refused when the token's role lacks changes.ship.\",\n        inputSchema: z.object({\n          changeSetId: SET_ID,\n          expectedVersion: z.number().int().nonnegative(),\n          acknowledgeBreaking: z.boolean().optional(),\n          acknowledgeDestructive: z.boolean().optional(),\n        }),\n        annotations: { destructiveHint: true, openWorldHint: false },\n      },\n      ({ changeSetId, ...body }) => runTool(() => client.admin.changeSets.ship(changeSetId, body)),\n    );\n  }\n};\n","import type { ContentFilter, ContentSort } from '@shapio/client';\nimport { z } from 'zod';\nimport type { ToolContext } from '../context.js';\nimport { findDefinition, readSchema, routeKeyOf } from '../definitions.js';\nimport { runTool } from './results.js';\n\nconst MODEL = z.string().min(1).describe('The model\\'s API ID (singular, e.g. \"article\")');\nconst LOCALE = z.string().min(1).optional().describe('Locale code; the default locale when omitted');\nconst PUBLISHED = z\n  .boolean()\n  .optional()\n  .describe('Read published content through the delivery API instead of drafts (implied by snapshot)');\nconst SNAPSHOT = z\n  .number()\n  .int()\n  .nonnegative()\n  .optional()\n  .describe('Read published content as of publication snapshot N');\n\nconst QUERY = z.object({\n  model: MODEL,\n  filters: z\n    .record(z.string(), z.unknown())\n    .optional()\n    .describe(\n      'Filter tree by field API ID, e.g. { \"title\": { \"$containsi\": \"launch\" } }; $and/$or take lists',\n    ),\n  sort: z.array(z.object({ field: z.string().min(1), direction: z.enum(['asc', 'desc']) })).optional(),\n  page: z.number().int().positive().optional(),\n  pageSize: z.number().int().positive().max(100).optional(),\n  q: z.string().optional().describe('Free-text search over the title field'),\n  locale: LOCALE,\n  fields: z.array(z.string()).optional().describe('Top-level fields to return'),\n  populate: z.array(z.string()).optional().describe('Relation paths to expand, e.g. \"author\"'),\n  status: z\n    .enum(['draft', 'published', 'modified'])\n    .optional()\n    .describe('Drafts only: entries in this status'),\n  published: PUBLISHED,\n  snapshot: SNAPSHOT,\n});\n\nconst DATA = z\n  .record(z.string(), z.unknown())\n  .describe(\"Field values by API ID. Rich text is Shapio's JSON document format, never HTML.\");\n\n/** Entries: query and read (drafts or published), create and update drafts. Never publishes. */\nexport const registerContentTools = ({ server, client }: ToolContext) => {\n  server.registerTool(\n    'content_query',\n    {\n      title: 'Query entries',\n      description:\n        \"A page of a model's entries. Drafts by default (what editors see); published=true or snapshot=N reads \" +\n        'what the delivery API serves.',\n      inputSchema: QUERY,\n      annotations: { readOnlyHint: true, openWorldHint: false },\n    },\n    ({ model, published, snapshot, status, filters, sort, ...rest }) =>\n      runTool(async () => {\n        const query = {\n          ...rest,\n          ...(filters ? { filters: filters as ContentFilter } : {}),\n          ...(sort ? { sort: sort as ContentSort[] } : {}),\n        };\n        if (published || snapshot !== undefined) {\n          const { definition } = findDefinition(await readSchema(client), model);\n          const routeKey = routeKeyOf(definition);\n          return definition.kind === 'singleton'\n            ? client.delivery.singleton(routeKey, {\n                ...(rest.locale ? { locale: rest.locale } : {}),\n                ...(snapshot !== undefined ? { snapshot } : {}),\n              })\n            : client.delivery.list(routeKey, { ...query, ...(snapshot !== undefined ? { snapshot } : {}) });\n        }\n        return client.admin.content.list(model, { ...query, ...(status ? { status } : {}) });\n      }),\n  );\n\n  server.registerTool(\n    'content_get',\n    {\n      title: 'Read an entry',\n      description:\n        \"One entry: its draft with every locale's status and version (send version back as expectedVersion \" +\n        'to content_update), or the published version when published=true or snapshot=N.',\n      inputSchema: z.object({\n        model: MODEL,\n        id: z.string().min(1),\n        locale: LOCALE,\n        published: PUBLISHED,\n        snapshot: SNAPSHOT,\n      }),\n      annotations: { readOnlyHint: true, openWorldHint: false },\n    },\n    ({ model, id, locale, published, snapshot }) =>\n      runTool(async () => {\n        if (published || snapshot !== undefined) {\n          const { definition } = findDefinition(await readSchema(client), model);\n          return client.delivery.get(routeKeyOf(definition), id, {\n            ...(locale ? { locale } : {}),\n            ...(snapshot !== undefined ? { snapshot } : {}),\n          });\n        }\n        return client.admin.content.get(model, id, locale ? { locale } : {});\n      }),\n  );\n\n  server.registerTool(\n    'content_create',\n    {\n      title: 'Create a draft entry',\n      description:\n        'Creates an entry as a draft (never published). Validated by the server against the live model. ' +\n        'Add it to a change set with change_sets_add_entry to propose publishing it.',\n      inputSchema: z.object({ model: MODEL, data: DATA, locale: LOCALE }),\n      annotations: { destructiveHint: false, openWorldHint: false },\n    },\n    ({ model, data, locale }) =>\n      runTool(() => client.admin.content.create(model, { data, ...(locale ? { locale } : {}) })),\n  );\n\n  server.registerTool(\n    'content_update',\n    {\n      title: 'Update a draft entry',\n      description:\n        \"Saves changed fields into one locale's draft (absent fields are kept, null clears). expectedVersion is \" +\n        'the version content_get returned; a stale one is refused (CONTENT_VERSION_CONFLICT): read again and redo. ' +\n        'Pass expectedVersion null to start a new locale of the entry.',\n      inputSchema: z.object({\n        model: MODEL,\n        id: z.string().min(1),\n        data: DATA,\n        expectedVersion: z.number().int().nonnegative().nullable(),\n        locale: LOCALE,\n      }),\n      annotations: { destructiveHint: false, idempotentHint: false, openWorldHint: false },\n    },\n    ({ model, id, data, expectedVersion, locale }) =>\n      runTool(() =>\n        client.admin.content.update(model, id, { data, expectedVersion, ...(locale ? { locale } : {}) }),\n      ),\n  );\n};\n","import { HEALTH_RULES } from '@shapio/client';\nimport { z } from 'zod';\nimport type { ToolContext } from '../context.js';\nimport { findDefinition, readSchema } from '../definitions.js';\nimport { runTool } from './results.js';\n\n/** Checks and signals: pre-flight for one entry, content health findings, field usage by consumers. */\nexport const registerInsightTools = ({ server, client }: ToolContext) => {\n  server.registerTool(\n    'preflight_run',\n    {\n      title: 'Pre-flight an entry',\n      description:\n        'What publishing these locales of an entry would run into (validation, missing locales, references, ' +\n        'alt text), without publishing anything.',\n      inputSchema: z.object({\n        model: z.string().min(1).describe(\"The model's API ID\"),\n        id: z.string().min(1),\n        locales: z.array(z.string()).optional(),\n      }),\n      annotations: { readOnlyHint: true, openWorldHint: false },\n    },\n    ({ model, id, locales }) =>\n      runTool(() => client.admin.preflight.run(model, id, locales ? { locales } : {})),\n  );\n\n  server.registerTool(\n    'health_list',\n    {\n      title: 'List content health findings',\n      description: `Open findings of the content health rules (${HEALTH_RULES.join(', ')}), by rule and model.`,\n      inputSchema: z.object({\n        rule: z.enum(HEALTH_RULES).optional(),\n        model: z.string().optional().describe(\"The model's API ID\"),\n        cursor: z.string().optional(),\n        limit: z.number().int().positive().max(100).optional(),\n      }),\n      annotations: { readOnlyHint: true, openWorldHint: false },\n    },\n    ({ model, ...query }) =>\n      runTool(() => client.admin.contentHealth.list({ ...query, ...(model ? { modelKey: model } : {}) })),\n  );\n\n  server.registerTool(\n    'usage_fields',\n    {\n      title: 'Field usage',\n      description:\n        'Which fields of a model sites and apps read, per API token, over the last N days: check before ' +\n        'renaming or removing a field.',\n      inputSchema: z.object({\n        model: z.string().min(1).describe(\"The model's API ID\"),\n        days: z.number().int().positive().max(365).optional(),\n      }),\n      annotations: { readOnlyHint: true, openWorldHint: false },\n    },\n    ({ model, days }) =>\n      runTool(async () => {\n        const { definition } = findDefinition(await readSchema(client), model);\n        return client.admin.usage.fields({ modelId: definition.id, ...(days ? { days } : {}) });\n      }),\n  );\n};\n","import { realpath } from 'node:fs/promises';\nimport { isAbsolute, relative, resolve } from 'node:path';\nimport { uploadFile } from '@shapio/client/node';\nimport { z } from 'zod';\nimport type { ToolContext } from '../context.js';\nimport { runTool } from './results.js';\n\n/**\n * The file a `media_upload` may read: inside the media root after resolving symlinks, so an agent (or text\n * injected into what it reads) cannot have the server read ~/.ssh or anything else outside the project.\n */\nexport const resolveMediaPath = async (mediaRoot: string, path: string): Promise<string> => {\n  const root = await realpath(mediaRoot);\n  const target = await realpath(resolve(root, path)).catch(() => {\n    throw new Error(`No file at ${path} (relative to the media root ${root})`);\n  });\n  const inside = relative(root, target);\n  if (inside === '' || inside.startsWith('..') || isAbsolute(inside)) {\n    throw new Error(\n      `media_upload only reads files under the media root (${root}); start the server with --media-root to change it`,\n    );\n  }\n  return target;\n};\n\n/** The media library: browse, and upload files from the media root. */\nexport const registerMediaTools = ({ server, client, options }: ToolContext) => {\n  server.registerTool(\n    'media_list',\n    {\n      title: 'List media',\n      description: 'A page of media assets (ID, filename, type, alt text, visibility, URLs), newest first.',\n      inputSchema: z.object({\n        folder: z.string().optional().describe('A folder ID, or \"root\" for assets in no folder'),\n        mimeType: z.string().optional().describe('\"image/png\" or \"image/*\"'),\n        search: z.string().optional(),\n        cursor: z.string().optional().describe('nextCursor of the previous page'),\n        limit: z.number().int().positive().max(100).optional(),\n      }),\n      annotations: { readOnlyHint: true, openWorldHint: false },\n    },\n    (query) => runTool(() => client.admin.media.assets.list(query)),\n  );\n\n  server.registerTool(\n    'media_upload',\n    {\n      title: 'Upload a file',\n      description:\n        `Uploads a local file into the media library and returns the asset (use its ID in media fields). Only ` +\n        `files under ${options.mediaRoot} can be read. Media is stored at once (it is not part of change sets).`,\n      inputSchema: z.object({\n        path: z.string().min(1).describe('Path relative to the media root (or absolute, inside it)'),\n        alt: z.string().max(1000).optional().describe('Alt text for images'),\n        mimeType: z.string().optional().describe('Needed when the extension is not a common one'),\n        folderId: z.string().optional(),\n        visibility: z.enum(['public', 'private']).optional(),\n      }),\n      annotations: { destructiveHint: false, openWorldHint: false },\n    },\n    ({ path, alt, mimeType, folderId, visibility }) =>\n      runTool(async () => {\n        const file = await resolveMediaPath(options.mediaRoot, path);\n        const asset = await uploadFile(client, {\n          baseUrl: options.baseUrl,\n          path: file,\n          ...(mimeType ? { mimeType } : {}),\n          ...(folderId ? { folderId } : {}),\n          ...(visibility ? { visibility } : {}),\n        });\n        return alt\n          ? client.admin.media.assets.update(asset.id, { expectedVersion: asset.version, alt })\n          : asset;\n      }),\n  );\n};\n","import { randomUUID } from 'node:crypto';\nimport type { ChangeSet, ChangeSetSchemaItem, ShapioClient } from '@shapio/client';\nimport { isStableId, type DefinitionInput } from '@shapio/schema';\nimport { readSchema } from './definitions.js';\n\n/** A definition as an agent writes it: the authored format, IDs optional, references by API ID allowed. */\nexport type DraftDefinition = Record<string, unknown> & { apiKey?: unknown; kind?: unknown; id?: unknown };\n\ntype FieldLike = { type?: unknown; settings?: Record<string, unknown> };\n\nconst schemaItemsOf = (set: ChangeSet) =>\n  set.items.filter((item): item is ChangeSetSchemaItem => item.kind === 'schema');\n\n/**\n * Relation targets and component references are stable IDs. Agents think in API IDs, so a reference that\n * is not an ID is looked up among the active definitions and the set's drafts (and this definition itself,\n * for a self-relation); anything unknown is left for the server to report.\n */\nconst resolveReferences = (definition: DraftDefinition, idsByApiKey: ReadonlyMap<string, string>) => {\n  const resolve = (value: unknown) =>\n    typeof value === 'string' && !isStableId(value) ? (idsByApiKey.get(value) ?? value) : value;\n  const fields = Array.isArray(definition.fields) ? (definition.fields as FieldLike[]) : [];\n  return {\n    ...definition,\n    fields: fields.map((field) => {\n      const settings = field.settings;\n      if (!settings) {\n        return field;\n      }\n      if (field.type === 'relation') {\n        return { ...field, settings: { ...settings, target: resolve(settings.target) } };\n      }\n      if (field.type === 'component') {\n        return { ...field, settings: { ...settings, component: resolve(settings.component) } };\n      }\n      if (field.type === 'dynamiczone' && Array.isArray(settings.components)) {\n        return { ...field, settings: { ...settings, components: settings.components.map(resolve) } };\n      }\n      return field;\n    }),\n  };\n};\n\n/**\n * Puts a definition into a change set as a draft: picks its stable ID (the active definition's, the set's\n * existing draft's, or a new one), its base version and the draft version to replace, then lets the server\n * parse, validate and plan it. Nothing goes live until a person ships the set.\n */\nexport const putDefinitionDraft = async (\n  client: ShapioClient,\n  changeSetId: string,\n  definition: DraftDefinition,\n) => {\n  if (typeof definition.apiKey !== 'string' || typeof definition.kind !== 'string') {\n    throw new Error('A definition needs at least \"kind\" (collection, singleton or component) and \"apiKey\"');\n  }\n  const [schema, set] = await Promise.all([readSchema(client), client.admin.changeSets.get(changeSetId)]);\n  const drafts = schemaItemsOf(set);\n  const apiKey = definition.apiKey;\n  const explicitId = typeof definition.id === 'string' ? definition.id : undefined;\n  const active = schema.definitions.find(\n    ({ definition: candidate }) =>\n      candidate.id === explicitId || (!explicitId && candidate.apiKey === apiKey),\n  );\n  const drafted = drafts.find(\n    (item) => item.definitionId === explicitId || (!explicitId && item.apiKey === apiKey),\n  );\n  const id = explicitId ?? active?.definition.id ?? drafted?.definitionId ?? randomUUID();\n  const idsByApiKey = new Map<string, string>([\n    ...schema.definitions.map(({ definition: candidate }) => [candidate.apiKey, candidate.id] as const),\n    ...drafts.map((item) => [item.apiKey, item.definitionId] as const),\n    [apiKey, id],\n  ]);\n  const payload = resolveReferences({ ...definition, id }, idsByApiKey) as unknown as DefinitionInput;\n  const draft = await client.admin.changeSets.putSchemaDraft(changeSetId, id, {\n    category: definition.kind === 'component' ? 'component' : 'model',\n    definition: payload,\n    baseVersion: active?.version ?? null,\n    ...(drafted ? { expectedDraftVersion: drafted.draftVersion } : {}),\n  });\n  return { changeSetId, definitionId: id, operation: draft.operation, draftVersion: draft.version, draft };\n};\n","import { z } from 'zod';\nimport type { ToolContext } from '../context.js';\nimport { findDefinition, readSchema, summarize } from '../definitions.js';\nimport { putDefinitionDraft } from '../schemaDrafts.js';\nimport { runTool } from './results.js';\n\nconst READ_ONLY = { readOnlyHint: true, openWorldHint: false } as const;\n\nconst DEFINITION_DESCRIPTION =\n  'A whole definition in Shapio\\'s authored format: { kind: \"collection\" | \"singleton\" | \"component\", apiKey, ' +\n  'label, pluralApiKey? (collections), localized?, draftAndPublish?, fields: [{ apiKey, label, type, required?, ' +\n  'localized?, settings? }] }. IDs are optional: an existing definition keeps its IDs (matched by API ID). ' +\n  'Relation targets and component references may be given as API IDs. Read shapio://schema/{apiKey} to see ' +\n  'the format of an existing one.';\n\n/** The schema: list and read definitions, and draft changes into a change set (never activated here). */\nexport const registerSchemaTools = ({ server, client }: ToolContext) => {\n  server.registerTool(\n    'schema_list',\n    {\n      title: 'List content types',\n      description:\n        'Every model (collection, singleton) and component with its API IDs, version and fields (types only). ' +\n        'Delivery reads use pluralApiKey for collections.',\n      inputSchema: z.object({}),\n      annotations: READ_ONLY,\n    },\n    () =>\n      runTool(async () => {\n        const schema = await readSchema(client);\n        return { schemaVersion: schema.schemaVersion, definitions: schema.definitions.map(summarize) };\n      }),\n  );\n\n  server.registerTool(\n    'schema_get',\n    {\n      title: 'Read a content type',\n      description: 'One definition in full (fields with settings), by API ID or stable ID, with its version.',\n      inputSchema: z.object({\n        apiKey: z.string().min(1).describe('API ID (or stable ID) of the definition'),\n      }),\n      annotations: READ_ONLY,\n    },\n    ({ apiKey }) => runTool(async () => findDefinition(await readSchema(client), apiKey)),\n  );\n\n  server.registerTool(\n    'schema_draft',\n    {\n      title: 'Draft a content type change',\n      description:\n        'Proposes a new or changed definition as a draft in a change set (a new set when changeSetId is ' +\n        'omitted). Nothing changes on the live schema until a person reviews and ships the set. Returns the ' +\n        'change set ID; read change_sets_review next.',\n      inputSchema: z.object({\n        definition: z.record(z.string(), z.unknown()).describe(DEFINITION_DESCRIPTION),\n        changeSetId: z.string().optional().describe('An open change set; omit to start a new one'),\n        title: z.string().min(1).max(200).optional().describe('Title of the new change set'),\n      }),\n      annotations: { destructiveHint: false, openWorldHint: false },\n    },\n    ({ definition, changeSetId, title }) =>\n      runTool(async () => {\n        const apiKey = typeof definition.apiKey === 'string' ? definition.apiKey : 'draft';\n        const setId =\n          changeSetId ?? (await client.admin.changeSets.create({ title: title ?? `Schema: ${apiKey}` })).id;\n        return putDefinitionDraft(client, setId, definition);\n      }),\n  );\n\n  server.registerTool(\n    'change_sets_add_schema_draft',\n    {\n      title: 'Add a schema draft to a change set',\n      description:\n        \"Puts a new or changed definition into an existing change set as a draft (replaces this set's \" +\n        'earlier draft of the same definition). Ships only when a person ships the set.',\n      inputSchema: z.object({\n        changeSetId: z.string().min(1),\n        definition: z.record(z.string(), z.unknown()).describe(DEFINITION_DESCRIPTION),\n      }),\n      annotations: { destructiveHint: false, openWorldHint: false },\n    },\n    ({ changeSetId, definition }) => runTool(() => putDefinitionDraft(client, changeSetId, definition)),\n  );\n};\n","import { z } from 'zod';\nimport type { ToolContext } from '../context.js';\nimport { runTool } from './results.js';\n\n/** Publication snapshots: the ledger, the diff between two, and restore (as a reviewable change set). */\nexport const registerSnapshotTools = ({ server, client }: ToolContext) => {\n  server.registerTool(\n    'snapshots_list',\n    {\n      title: 'List snapshots',\n      description: 'The publication ledger, newest first: what went live, when, why and by whom.',\n      inputSchema: z.object({\n        cursor: z.string().optional(),\n        limit: z.number().int().positive().max(100).optional(),\n      }),\n      annotations: { readOnlyHint: true, openWorldHint: false },\n    },\n    (query) => runTool(() => client.admin.snapshots.list(query)),\n  );\n\n  server.registerTool(\n    'snapshots_changes',\n    {\n      title: 'Changes between snapshots',\n      description:\n        'Which entries were published, updated or unpublished between snapshot \"from\" and \"to\" (default: now). ' +\n        'Names entries, never values.',\n      inputSchema: z.object({\n        from: z.number().int().nonnegative(),\n        to: z.number().int().nonnegative().optional(),\n        after: z.string().optional().describe('nextCursor of the previous page'),\n        limit: z.number().int().positive().max(500).optional(),\n      }),\n      annotations: { readOnlyHint: true, openWorldHint: false },\n    },\n    (query) => runTool(() => client.snapshots.changes(query)),\n  );\n\n  server.registerTool(\n    'snapshots_restore',\n    {\n      title: 'Propose restoring a snapshot',\n      description:\n        'Creates an open change set that would bring live content back to what snapshot N served. Nothing ' +\n        'changes until a person ships it; the schema is never rolled back.',\n      inputSchema: z.object({ seq: z.number().int().positive() }),\n      annotations: { destructiveHint: false, openWorldHint: false },\n    },\n    ({ seq }) => runTool(() => client.admin.snapshots.restore(seq)),\n  );\n};\n","import { McpServer } from '@modelcontextprotocol/server';\nimport { createClient, type ShapioClient } from '@shapio/client';\nimport packageJson from '../package.json' with { type: 'json' };\nimport type { ToolContext } from './context.js';\nimport type { McpOptions } from './options.js';\nimport { registerPrompts } from './prompts.js';\nimport { registerResources } from './resources.js';\nimport { registerChangeSetTools } from './tools/changeSets.js';\nimport { registerContentTools } from './tools/content.js';\nimport { registerInsightTools } from './tools/insights.js';\nimport { registerMediaTools } from './tools/media.js';\nimport { registerSchemaTools } from './tools/schema.js';\nimport { registerSnapshotTools } from './tools/snapshots.js';\n\nexport const MCP_SERVER_NAME = 'shapio';\nexport const MCP_SERVER_VERSION: string = packageJson.version;\n\nconst INSTRUCTIONS =\n  'Shapio is a headless CMS whose content types are live data. Agents propose, people ship: draft schema ' +\n  'changes and entries, collect them in a change set, and leave shipping to a person. Model and field ' +\n  'identifiers are called \"API IDs\". Read shapio://docs/delivery-api for how sites read content.';\n\n/** The MCP server for one Shapio instance, with every tool, resource and prompt registered. */\nexport const createShapioMcpServer = (\n  options: McpOptions,\n  client: ShapioClient = createClient({\n    baseUrl: options.baseUrl,\n    token: options.token,\n    ...(options.site !== undefined ? { site: options.site } : {}),\n  }),\n): McpServer => {\n  const server = new McpServer(\n    { name: MCP_SERVER_NAME, version: MCP_SERVER_VERSION },\n    { instructions: INSTRUCTIONS },\n  );\n  const context: ToolContext = { server, client, options };\n  registerSchemaTools(context);\n  registerContentTools(context);\n  registerMediaTools(context);\n  registerInsightTools(context);\n  registerChangeSetTools(context);\n  registerSnapshotTools(context);\n  registerResources(context);\n  registerPrompts(context);\n  return server;\n};\n","import { resolve } from 'node:path';\nimport { parseArgs } from 'node:util';\n\n/** How the server was started: the Shapio instance, its token, and the two guards. */\nexport type McpOptions = {\n  /** Shapio's base URL including any BASE_PATH (`SHAPIO_URL`). */\n  baseUrl: string;\n  /** An admin-scope API token (`SHAPIO_TOKEN`). Give its role no `changes.ship`: shipping stays with people. */\n  token: string;\n  /** Registers `change_sets_ship` (`--allow-ship`). A client-side guard only: the token's role decides. */\n  allowShip: boolean;\n  /** `media_upload` reads files only under this directory (`--media-root`, default: the working directory). */\n  mediaRoot: string;\n  /**\n   * The site key every request is about (`--site`, else `SHAPIO_SITE`), on multi-site instances. Left out:\n   * the token's site (a site token), else the primary site. A site token cannot name another site.\n   */\n  site?: string;\n};\n\n/** A site key as Shapio creates them (sites are named by key in URLs, `?site=` and config). */\nconst SITE_KEY = /^[a-z][a-z0-9-]{0,62}$/;\n\nexport const USAGE = `Usage: shapio-mcp [--allow-ship] [--media-root <dir>] [--site <key>]\n\nA Model Context Protocol server (stdio) for a Shapio instance.\n\nEnvironment:\n  SHAPIO_URL     Shapio's base URL, including any BASE_PATH (e.g. https://cms.example.com)\n  SHAPIO_TOKEN   An admin-scope API token. Give its role no \"changes.ship\" permission: agents propose\n                 change sets, people ship them.\n  SHAPIO_SITE    The site key to work on (multi-site instances); --site overrides it. Default: the\n                 token's site, else the primary site.\n\nOptions:\n  --allow-ship         Offer the change_sets_ship tool (the token's role must also allow changes.ship)\n  --media-root <dir>   Directory media_upload may read files from (default: the working directory)\n  --site <key>         The site to work on (overrides SHAPIO_SITE)\n  -h, --help           Show this help\n`;\n\nexport class OptionsError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'OptionsError';\n  }\n}\n\n/** Reads the command line and environment; throws OptionsError with a message meant for stderr. */\nexport const parseOptions = (\n  argv: readonly string[],\n  env: Readonly<Record<string, string | undefined>>,\n  cwd: string,\n): McpOptions | 'help' => {\n  let parsed;\n  try {\n    parsed = parseArgs({\n      args: [...argv],\n      options: {\n        'allow-ship': { type: 'boolean', default: false },\n        'media-root': { type: 'string' },\n        site: { type: 'string' },\n        help: { type: 'boolean', short: 'h', default: false },\n      },\n      strict: true,\n      allowPositionals: false,\n    });\n  } catch (error) {\n    throw new OptionsError(error instanceof Error ? error.message : String(error));\n  }\n  if (parsed.values.help) {\n    return 'help';\n  }\n  const baseUrl = env.SHAPIO_URL?.trim();\n  const token = env.SHAPIO_TOKEN?.trim();\n  if (!baseUrl || !/^https?:\\/\\//.test(baseUrl)) {\n    throw new OptionsError('Set SHAPIO_URL to the Shapio base URL (http:// or https://).');\n  }\n  if (!token) {\n    throw new OptionsError('Set SHAPIO_TOKEN to an admin-scope API token.');\n  }\n  const site = (parsed.values.site ?? env.SHAPIO_SITE)?.trim() || undefined;\n  if (site !== undefined && !SITE_KEY.test(site)) {\n    throw new OptionsError(`\"${site}\" is not a site key (lower case, starting with a letter).`);\n  }\n  return {\n    baseUrl: baseUrl.replace(/\\/+$/, ''),\n    token,\n    allowShip: parsed.values['allow-ship'],\n    mediaRoot: resolve(cwd, parsed.values['media-root'] ?? '.'),\n    ...(site !== undefined ? { site } : {}),\n  };\n};\n"],"mappings":";;;;;;;;;;;;;ACGA,MAAM,eAAe,UAAkB,EACrC,UAAU,CAAC;CAAE,MAAM;CAAiB,SAAS;EAAE,MAAM;EAAiB;CAAK;AAAE,CAAC,EAChF;;AAGA,MAAa,mBAAmB,EAAE,aAA0B;CAC1D,OAAO,eACL,sBACA;EACE,OAAO;EACP,aAAa;EACb,YAAY,EAAE,OAAO,EACnB,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,+CAA6C,EACnF,CAAC;CACH,IACC,EAAE,cACD,YACE,qCAAqC,QAAQ;;;4JAQ/C,CACJ;CAEA,OAAO,eACL,qBACA;EACE,OAAO;EACP,aAAa;EACb,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,mBAAmB,EAAE,CAAC;CACvF,IACC,EAAE,kBACD,YACE,4BAA4B,YAAY;;;sDAM1C,CACJ;AACF;;;;ACzCA,MAAa,cAAc,WAA4C,OAAO,MAAM,OAAO,OAAO;;AAGlG,MAAa,kBAAkB,QAAkB,QAAoC;CACnF,MAAM,QAAQ,OAAO,YAAY,MAC9B,EAAE,iBAAiB,WAAW,WAAW,OAAO,WAAW,OAAO,GACrE;CACA,IAAI,CAAC,OAAO;EACV,MAAM,QAAQ,OAAO,YAAY,KAAK,EAAE,iBAAiB,WAAW,MAAM,CAAC,CAAC,KAAK,IAAI,KAAK;EAC1F,MAAM,IAAI,MAAM,sCAAsC,IAAI,YAAY,OAAO;CAC/E;CACA,OAAO;AACT;;;;;AAMA,MAAaA,gBAAc,eAAyC;CAClE,IAAI,CAAC,kBAAkB,UAAU,GAC/B,MAAM,IAAI,MACR,IAAI,WAAW,OAAO,uEACxB;CAEF,OAAOC,WAAgB,UAAU;AACnC;;AAGA,MAAa,aAAa,EAAE,YAAY,eAAmC;CACzE,IAAI,WAAW;CACf,MAAM,WAAW;CACjB,QAAQ,WAAW;CACnB,GAAI,WAAW,SAAS,eAAe,EAAE,cAAcA,WAAgB,UAAU,EAAE,IAAI,CAAC;CACxF,OAAO,WAAW;CAClB;CACA,QAAQ,WAAW,OAAO,KAAK,WAAW;EACxC,QAAQ,MAAM;EACd,MAAM,MAAM;EACZ,UAAU,MAAM;EAChB,WAAW,MAAM;CACnB,EAAE;AACJ;;;AC/CA,MAAa,mBAAmB;;;ACKhC,MAAa,sBAAsB;AACnC,MAAa,mBAAmB;;AAGhC,MAAa,qBAAqB,EAAE,QAAQ,aAA0B;CACpE,OAAO,iBACL,UACA,IAAI,iBAAiB,qBAAqB,EACxC,MAAM,YAAY;EAEhB,OAAO,EACL,YAAW,MAFQ,WAAW,MAAM,EAAA,CAElB,YAAY,KAAK,EAAE,kBAAkB;GACrD,KAAK,mBAAmB,WAAW;GACnC,MAAM,WAAW;GACjB,OAAO,WAAW;GAClB,UAAU;EACZ,EAAE,EACJ;CACF,EACF,CAAC,GACD;EACE,OAAO;EACP,aAAa;EACb,UAAU;CACZ,GACA,OAAO,KAAK,cAAc;EACxB,MAAM,SAAS,OAAO,UAAU,MAAM;EACtC,MAAM,EAAE,eAAe,eAAe,MAAM,WAAW,MAAM,GAAG,MAAM;EACtE,OAAO,EACL,UAAU,CAAC;GAAE,KAAK,IAAI;GAAM,UAAU;GAAoB,MAAM,oBAAoB,UAAU;EAAE,CAAC,EACnG;CACF,CACF;CAEA,OAAO,iBACL,gBACA,kBACA;EACE,OAAO;EACP,aAAa;EACb,UAAU;CACZ,IACC,SAAS,EAAE,UAAU,CAAC;EAAE,KAAK,IAAI;EAAM,UAAU;EAAiB,MAAM;CAAiB,CAAC,EAAE,EAC/F;AACF;;;;AC9CA,MAAa,cAAc,WAAoC,EAC7D,SAAS,CAAC;CAAE,MAAM;CAAQ,MAAM,KAAK,UAAU,SAAS,MAAM,MAAM,CAAC;AAAE,CAAC,EAC1E;;;;;AAMA,MAAa,eAAe,UAAmC;CAC7D,MAAM,OACJ,iBAAiB,iBACb;EAAE,QAAQ,MAAM;EAAQ,MAAM,MAAM;EAAM,SAAS,MAAM;EAAS,SAAS,MAAM;CAAQ,IACzF;EAAE,MAAM;EAAe,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;CAAE;CAC7F,OAAO;EAAE,SAAS;EAAM,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,KAAK,UAAU,EAAE,OAAO,KAAK,GAAG,MAAM,CAAC;EAAE,CAAC;CAAE;AACtG;;AAGA,MAAa,UAAU,OAAO,SAA0D;CACtF,IAAI;EACF,OAAO,WAAW,MAAM,KAAK,CAAC;CAChC,SAAS,OAAO;EACd,OAAO,YAAY,KAAK;CAC1B;AACF;;;ACvBA,MAAM,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,eAAe;;;;;;AAOzD,MAAa,0BAA0B,EAAE,QAAQ,QAAQ,cAA2B;CAClF,OAAO,aACL,oBACA;EACE,OAAO;EACP,aAAa;EACb,aAAa,EAAE,OAAO;GACpB,QAAQ,EACL,OAAO,CAAC,CACR,SAAS,CAAC,CACV,SAAS,wEAAwE;GACpF,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;GAC5B,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;EACvD,CAAC;EACD,aAAa;GAAE,cAAc;GAAM,eAAe;EAAM;CAC1D,IACC,UAAU,cAAc,OAAO,MAAM,WAAW,KAAK,KAAK,CAAC,CAC9D;CAEA,OAAO,aACL,sBACA;EACE,OAAO;EACP,aAAa;EACb,aAAa,EAAE,OAAO;GACpB,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;GAChC,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,GAAI,CAAC,CAAC,SAAS;EAC7C,CAAC;EACD,aAAa;GAAE,iBAAiB;GAAO,eAAe;EAAM;CAC9D,IACC,EAAE,OAAO,kBACR,cAAc,OAAO,MAAM,WAAW,OAAO;EAAE;EAAO,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;CAAG,CAAC,CAAC,CACpG;CAEA,OAAO,aACL,yBACA;EACE,OAAO;EACP,aACE;EAEF,aAAa,EAAE,OAAO;GACpB,aAAa;GACb,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,oBAAoB;GACtD,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;GACzB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,sDAAsD;GAC7F,QAAQ,EAAE,KAAK,CAAC,WAAW,WAAW,CAAC,CAAC,CAAC,QAAQ,SAAS;EAC5D,CAAC;EACD,aAAa;GAAE,iBAAiB;GAAO,eAAe;EAAM;CAC9D,IACC,EAAE,aAAa,OAAO,SAAS,QAAQ,aACtC,cACE,OAAO,MAAM,WAAW,SAAS,aAAa;EAC5C,UAAU;EACV;EACA;EACA,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;CAC7B,CAAC,CACH,CACJ;CAEA,OAAO,aACL,sBACA;EACE,OAAO;EACP,aACE;EAEF,aAAa,EAAE,OAAO,EAAE,aAAa,OAAO,CAAC;EAC7C,aAAa;GAAE,cAAc;GAAM,eAAe;EAAM;CAC1D,IACC,EAAE,kBACD,QAAQ,YAAY;EAClB,MAAM,CAAC,KAAK,UAAU,MAAM,QAAQ,IAAI,CACtC,OAAO,MAAM,WAAW,IAAI,WAAW,GACvC,OAAO,MAAM,WAAW,OAAO,WAAW,CAC5C,CAAC;EACD,OAAO;GAAE;GAAK;EAAO;CACvB,CAAC,CACL;CAEA,IAAI,QAAQ,WACV,OAAO,aACL,oBACA;EACE,OAAO;EACP,aACE;EAGF,aAAa,EAAE,OAAO;GACpB,aAAa;GACb,iBAAiB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY;GAC9C,qBAAqB,EAAE,QAAQ,CAAC,CAAC,SAAS;GAC1C,wBAAwB,EAAE,QAAQ,CAAC,CAAC,SAAS;EAC/C,CAAC;EACD,aAAa;GAAE,iBAAiB;GAAM,eAAe;EAAM;CAC7D,IACC,EAAE,aAAa,GAAG,WAAW,cAAc,OAAO,MAAM,WAAW,KAAK,aAAa,IAAI,CAAC,CAC7F;AAEJ;;;AC1GA,MAAM,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,iDAAgD;AACzF,MAAM,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,8CAA8C;AACnG,MAAM,YAAY,EACf,QAAQ,CAAC,CACT,SAAS,CAAC,CACV,SAAS,yFAAyF;AACrG,MAAM,WAAW,EACd,OAAO,CAAC,CACR,IAAI,CAAC,CACL,YAAY,CAAC,CACb,SAAS,CAAC,CACV,SAAS,qDAAqD;AAEjE,MAAM,QAAQ,EAAE,OAAO;CACrB,OAAO;CACP,SAAS,EACN,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,CAC/B,SAAS,CAAC,CACV,SACC,sGACF;CACF,MAAM,EAAE,MAAM,EAAE,OAAO;EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EAAG,WAAW,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC;CAAE,CAAC,CAAC,CAAC,CAAC,SAAS;CACnG,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CAC3C,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;CACxD,GAAG,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,uCAAuC;CACzE,QAAQ;CACR,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,4BAA4B;CAC5E,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,2CAAyC;CAC3F,QAAQ,EACL,KAAK;EAAC;EAAS;EAAa;CAAU,CAAC,CAAC,CACxC,SAAS,CAAC,CACV,SAAS,qCAAqC;CACjD,WAAW;CACX,UAAU;AACZ,CAAC;AAED,MAAM,OAAO,EACV,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,CAC/B,SAAS,iFAAiF;;AAG7F,MAAa,wBAAwB,EAAE,QAAQ,aAA0B;CACvE,OAAO,aACL,iBACA;EACE,OAAO;EACP,aACE;EAEF,aAAa;EACb,aAAa;GAAE,cAAc;GAAM,eAAe;EAAM;CAC1D,IACC,EAAE,OAAO,WAAW,UAAU,QAAQ,SAAS,MAAM,GAAG,WACvD,QAAQ,YAAY;EAClB,MAAM,QAAQ;GACZ,GAAG;GACH,GAAI,UAAU,EAAW,QAAyB,IAAI,CAAC;GACvD,GAAI,OAAO,EAAQ,KAAsB,IAAI,CAAC;EAChD;EACA,IAAI,aAAa,aAAa,KAAA,GAAW;GACvC,MAAM,EAAE,eAAe,eAAe,MAAM,WAAW,MAAM,GAAG,KAAK;GACrE,MAAM,WAAWC,aAAW,UAAU;GACtC,OAAO,WAAW,SAAS,cACvB,OAAO,SAAS,UAAU,UAAU;IAClC,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;IAC7C,GAAI,aAAa,KAAA,IAAY,EAAE,SAAS,IAAI,CAAC;GAC/C,CAAC,IACD,OAAO,SAAS,KAAK,UAAU;IAAE,GAAG;IAAO,GAAI,aAAa,KAAA,IAAY,EAAE,SAAS,IAAI,CAAC;GAAG,CAAC;EAClG;EACA,OAAO,OAAO,MAAM,QAAQ,KAAK,OAAO;GAAE,GAAG;GAAO,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAAG,CAAC;CACrF,CAAC,CACL;CAEA,OAAO,aACL,eACA;EACE,OAAO;EACP,aACE;EAEF,aAAa,EAAE,OAAO;GACpB,OAAO;GACP,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;GACpB,QAAQ;GACR,WAAW;GACX,UAAU;EACZ,CAAC;EACD,aAAa;GAAE,cAAc;GAAM,eAAe;EAAM;CAC1D,IACC,EAAE,OAAO,IAAI,QAAQ,WAAW,eAC/B,QAAQ,YAAY;EAClB,IAAI,aAAa,aAAa,KAAA,GAAW;GACvC,MAAM,EAAE,eAAe,eAAe,MAAM,WAAW,MAAM,GAAG,KAAK;GACrE,OAAO,OAAO,SAAS,IAAIA,aAAW,UAAU,GAAG,IAAI;IACrD,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;IAC3B,GAAI,aAAa,KAAA,IAAY,EAAE,SAAS,IAAI,CAAC;GAC/C,CAAC;EACH;EACA,OAAO,OAAO,MAAM,QAAQ,IAAI,OAAO,IAAI,SAAS,EAAE,OAAO,IAAI,CAAC,CAAC;CACrE,CAAC,CACL;CAEA,OAAO,aACL,kBACA;EACE,OAAO;EACP,aACE;EAEF,aAAa,EAAE,OAAO;GAAE,OAAO;GAAO,MAAM;GAAM,QAAQ;EAAO,CAAC;EAClE,aAAa;GAAE,iBAAiB;GAAO,eAAe;EAAM;CAC9D,IACC,EAAE,OAAO,MAAM,aACd,cAAc,OAAO,MAAM,QAAQ,OAAO,OAAO;EAAE;EAAM,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;CAAG,CAAC,CAAC,CAC7F;CAEA,OAAO,aACL,kBACA;EACE,OAAO;EACP,aACE;EAGF,aAAa,EAAE,OAAO;GACpB,OAAO;GACP,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;GACpB,MAAM;GACN,iBAAiB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS;GACzD,QAAQ;EACV,CAAC;EACD,aAAa;GAAE,iBAAiB;GAAO,gBAAgB;GAAO,eAAe;EAAM;CACrF,IACC,EAAE,OAAO,IAAI,MAAM,iBAAiB,aACnC,cACE,OAAO,MAAM,QAAQ,OAAO,OAAO,IAAI;EAAE;EAAM;EAAiB,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;CAAG,CAAC,CACjG,CACJ;AACF;;;;ACzIA,MAAa,wBAAwB,EAAE,QAAQ,aAA0B;CACvE,OAAO,aACL,iBACA;EACE,OAAO;EACP,aACE;EAEF,aAAa,EAAE,OAAO;GACpB,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,oBAAoB;GACtD,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;GACpB,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;EACxC,CAAC;EACD,aAAa;GAAE,cAAc;GAAM,eAAe;EAAM;CAC1D,IACC,EAAE,OAAO,IAAI,cACZ,cAAc,OAAO,MAAM,UAAU,IAAI,OAAO,IAAI,UAAU,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC,CACnF;CAEA,OAAO,aACL,eACA;EACE,OAAO;EACP,aAAa,8CAA8C,aAAa,KAAK,IAAI,EAAE;EACnF,aAAa,EAAE,OAAO;GACpB,MAAM,EAAE,KAAK,YAAY,CAAC,CAAC,SAAS;GACpC,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,oBAAoB;GAC1D,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;GAC5B,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;EACvD,CAAC;EACD,aAAa;GAAE,cAAc;GAAM,eAAe;EAAM;CAC1D,IACC,EAAE,OAAO,GAAG,YACX,cAAc,OAAO,MAAM,cAAc,KAAK;EAAE,GAAG;EAAO,GAAI,QAAQ,EAAE,UAAU,MAAM,IAAI,CAAC;CAAG,CAAC,CAAC,CACtG;CAEA,OAAO,aACL,gBACA;EACE,OAAO;EACP,aACE;EAEF,aAAa,EAAE,OAAO;GACpB,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,oBAAoB;GACtD,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;EACtD,CAAC;EACD,aAAa;GAAE,cAAc;GAAM,eAAe;EAAM;CAC1D,IACC,EAAE,OAAO,WACR,QAAQ,YAAY;EAClB,MAAM,EAAE,eAAe,eAAe,MAAM,WAAW,MAAM,GAAG,KAAK;EACrE,OAAO,OAAO,MAAM,MAAM,OAAO;GAAE,SAAS,WAAW;GAAI,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAG,CAAC;CACxF,CAAC,CACL;AACF;;;;;;;ACnDA,MAAa,mBAAmB,OAAO,WAAmB,SAAkC;CAC1F,MAAM,OAAO,MAAM,SAAS,SAAS;CACrC,MAAM,SAAS,MAAM,SAAS,QAAQ,MAAM,IAAI,CAAC,CAAC,CAAC,YAAY;EAC7D,MAAM,IAAI,MAAM,cAAc,KAAK,+BAA+B,KAAK,EAAE;CAC3E,CAAC;CACD,MAAM,SAAS,SAAS,MAAM,MAAM;CACpC,IAAI,WAAW,MAAM,OAAO,WAAW,IAAI,KAAK,WAAW,MAAM,GAC/D,MAAM,IAAI,MACR,uDAAuD,KAAK,mDAC9D;CAEF,OAAO;AACT;;AAGA,MAAa,sBAAsB,EAAE,QAAQ,QAAQ,cAA2B;CAC9E,OAAO,aACL,cACA;EACE,OAAO;EACP,aAAa;EACb,aAAa,EAAE,OAAO;GACpB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,kDAAgD;GACvF,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,8BAA0B;GACnE,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;GAC5B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,iCAAiC;GACxE,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;EACvD,CAAC;EACD,aAAa;GAAE,cAAc;GAAM,eAAe;EAAM;CAC1D,IACC,UAAU,cAAc,OAAO,MAAM,MAAM,OAAO,KAAK,KAAK,CAAC,CAChE;CAEA,OAAO,aACL,gBACA;EACE,OAAO;EACP,aACE,oHACe,QAAQ,UAAU;EACnC,aAAa,EAAE,OAAO;GACpB,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,0DAA0D;GAC3F,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,GAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,qBAAqB;GACnE,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,+CAA+C;GACxF,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;GAC9B,YAAY,EAAE,KAAK,CAAC,UAAU,SAAS,CAAC,CAAC,CAAC,SAAS;EACrD,CAAC;EACD,aAAa;GAAE,iBAAiB;GAAO,eAAe;EAAM;CAC9D,IACC,EAAE,MAAM,KAAK,UAAU,UAAU,iBAChC,QAAQ,YAAY;EAClB,MAAM,OAAO,MAAM,iBAAiB,QAAQ,WAAW,IAAI;EAC3D,MAAM,QAAQ,MAAM,WAAW,QAAQ;GACrC,SAAS,QAAQ;GACjB,MAAM;GACN,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;GAC/B,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;GAC/B,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACrC,CAAC;EACD,OAAO,MACH,OAAO,MAAM,MAAM,OAAO,OAAO,MAAM,IAAI;GAAE,iBAAiB,MAAM;GAAS;EAAI,CAAC,IAClF;CACN,CAAC,CACL;AACF;;;ACjEA,MAAM,iBAAiB,QACrB,IAAI,MAAM,QAAQ,SAAsC,KAAK,SAAS,QAAQ;;;;;;AAOhF,MAAM,qBAAqB,YAA6B,gBAA6C;CACnG,MAAM,WAAW,UACf,OAAO,UAAU,YAAY,CAAC,WAAW,KAAK,IAAK,YAAY,IAAI,KAAK,KAAK,QAAS;CACxF,MAAM,SAAS,MAAM,QAAQ,WAAW,MAAM,IAAK,WAAW,SAAyB,CAAC;CACxF,OAAO;EACL,GAAG;EACH,QAAQ,OAAO,KAAK,UAAU;GAC5B,MAAM,WAAW,MAAM;GACvB,IAAI,CAAC,UACH,OAAO;GAET,IAAI,MAAM,SAAS,YACjB,OAAO;IAAE,GAAG;IAAO,UAAU;KAAE,GAAG;KAAU,QAAQ,QAAQ,SAAS,MAAM;IAAE;GAAE;GAEjF,IAAI,MAAM,SAAS,aACjB,OAAO;IAAE,GAAG;IAAO,UAAU;KAAE,GAAG;KAAU,WAAW,QAAQ,SAAS,SAAS;IAAE;GAAE;GAEvF,IAAI,MAAM,SAAS,iBAAiB,MAAM,QAAQ,SAAS,UAAU,GACnE,OAAO;IAAE,GAAG;IAAO,UAAU;KAAE,GAAG;KAAU,YAAY,SAAS,WAAW,IAAI,OAAO;IAAE;GAAE;GAE7F,OAAO;EACT,CAAC;CACH;AACF;;;;;;AAOA,MAAa,qBAAqB,OAChC,QACA,aACA,eACG;CACH,IAAI,OAAO,WAAW,WAAW,YAAY,OAAO,WAAW,SAAS,UACtE,MAAM,IAAI,MAAM,0FAAsF;CAExG,MAAM,CAAC,QAAQ,OAAO,MAAM,QAAQ,IAAI,CAAC,WAAW,MAAM,GAAG,OAAO,MAAM,WAAW,IAAI,WAAW,CAAC,CAAC;CACtG,MAAM,SAAS,cAAc,GAAG;CAChC,MAAM,SAAS,WAAW;CAC1B,MAAM,aAAa,OAAO,WAAW,OAAO,WAAW,WAAW,KAAK,KAAA;CACvE,MAAM,SAAS,OAAO,YAAY,MAC/B,EAAE,YAAY,gBACb,UAAU,OAAO,cAAe,CAAC,cAAc,UAAU,WAAW,MACxE;CACA,MAAM,UAAU,OAAO,MACpB,SAAS,KAAK,iBAAiB,cAAe,CAAC,cAAc,KAAK,WAAW,MAChF;CACA,MAAM,KAAK,cAAc,QAAQ,WAAW,MAAM,SAAS,gBAAgB,WAAW;CACtF,MAAM,cAAc,IAAI,IAAoB;EAC1C,GAAG,OAAO,YAAY,KAAK,EAAE,YAAY,gBAAgB,CAAC,UAAU,QAAQ,UAAU,EAAE,CAAU;EAClG,GAAG,OAAO,KAAK,SAAS,CAAC,KAAK,QAAQ,KAAK,YAAY,CAAU;EACjE,CAAC,QAAQ,EAAE;CACb,CAAC;CACD,MAAM,UAAU,kBAAkB;EAAE,GAAG;EAAY;CAAG,GAAG,WAAW;CACpE,MAAM,QAAQ,MAAM,OAAO,MAAM,WAAW,eAAe,aAAa,IAAI;EAC1E,UAAU,WAAW,SAAS,cAAc,cAAc;EAC1D,YAAY;EACZ,aAAa,QAAQ,WAAW;EAChC,GAAI,UAAU,EAAE,sBAAsB,QAAQ,aAAa,IAAI,CAAC;CAClE,CAAC;CACD,OAAO;EAAE;EAAa,cAAc;EAAI,WAAW,MAAM;EAAW,cAAc,MAAM;EAAS;CAAM;AACzG;;;AC3EA,MAAM,YAAY;CAAE,cAAc;CAAM,eAAe;AAAM;AAE7D,MAAM,yBACJ;;AAOF,MAAa,uBAAuB,EAAE,QAAQ,aAA0B;CACtE,OAAO,aACL,eACA;EACE,OAAO;EACP,aACE;EAEF,aAAa,EAAE,OAAO,CAAC,CAAC;EACxB,aAAa;CACf,SAEE,QAAQ,YAAY;EAClB,MAAM,SAAS,MAAM,WAAW,MAAM;EACtC,OAAO;GAAE,eAAe,OAAO;GAAe,aAAa,OAAO,YAAY,IAAI,SAAS;EAAE;CAC/F,CAAC,CACL;CAEA,OAAO,aACL,cACA;EACE,OAAO;EACP,aAAa;EACb,aAAa,EAAE,OAAO,EACpB,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,yCAAyC,EAC9E,CAAC;EACD,aAAa;CACf,IACC,EAAE,aAAa,QAAQ,YAAY,eAAe,MAAM,WAAW,MAAM,GAAG,MAAM,CAAC,CACtF;CAEA,OAAO,aACL,gBACA;EACE,OAAO;EACP,aACE;EAGF,aAAa,EAAE,OAAO;GACpB,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,sBAAsB;GAC7E,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,6CAA6C;GACzF,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,6BAA6B;EACrF,CAAC;EACD,aAAa;GAAE,iBAAiB;GAAO,eAAe;EAAM;CAC9D,IACC,EAAE,YAAY,aAAa,YAC1B,QAAQ,YAAY;EAClB,MAAM,SAAS,OAAO,WAAW,WAAW,WAAW,WAAW,SAAS;EAC3E,MAAM,QACJ,gBAAgB,MAAM,OAAO,MAAM,WAAW,OAAO,EAAE,OAAO,SAAS,WAAW,SAAS,CAAC,EAAA,CAAG;EACjG,OAAO,mBAAmB,QAAQ,OAAO,UAAU;CACrD,CAAC,CACL;CAEA,OAAO,aACL,gCACA;EACE,OAAO;EACP,aACE;EAEF,aAAa,EAAE,OAAO;GACpB,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;GAC7B,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,sBAAsB;EAC/E,CAAC;EACD,aAAa;GAAE,iBAAiB;GAAO,eAAe;EAAM;CAC9D,IACC,EAAE,aAAa,iBAAiB,cAAc,mBAAmB,QAAQ,aAAa,UAAU,CAAC,CACpG;AACF;;;;ACjFA,MAAa,yBAAyB,EAAE,QAAQ,aAA0B;CACxE,OAAO,aACL,kBACA;EACE,OAAO;EACP,aAAa;EACb,aAAa,EAAE,OAAO;GACpB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;GAC5B,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;EACvD,CAAC;EACD,aAAa;GAAE,cAAc;GAAM,eAAe;EAAM;CAC1D,IACC,UAAU,cAAc,OAAO,MAAM,UAAU,KAAK,KAAK,CAAC,CAC7D;CAEA,OAAO,aACL,qBACA;EACE,OAAO;EACP,aACE;EAEF,aAAa,EAAE,OAAO;GACpB,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY;GACnC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS;GAC5C,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,iCAAiC;GACvE,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;EACvD,CAAC;EACD,aAAa;GAAE,cAAc;GAAM,eAAe;EAAM;CAC1D,IACC,UAAU,cAAc,OAAO,UAAU,QAAQ,KAAK,CAAC,CAC1D;CAEA,OAAO,aACL,qBACA;EACE,OAAO;EACP,aACE;EAEF,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;EAC1D,aAAa;GAAE,iBAAiB;GAAO,eAAe;EAAM;CAC9D,IACC,EAAE,UAAU,cAAc,OAAO,MAAM,UAAU,QAAQ,GAAG,CAAC,CAChE;AACF;;;ACpCA,MAAa,kBAAkB;AAC/B,MAAa,qBAA6BC;AAE1C,MAAM,eACJ;;AAKF,MAAa,yBACX,SACA,SAAuB,aAAa;CAClC,SAAS,QAAQ;CACjB,OAAO,QAAQ;CACf,GAAI,QAAQ,SAAS,KAAA,IAAY,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;AAC7D,CAAC,MACa;CACd,MAAM,SAAS,IAAI,UACjB;EAAE,MAAM;EAAiB,SAAS;CAAmB,GACrD,EAAE,cAAc,aAAa,CAC/B;CACA,MAAM,UAAuB;EAAE;EAAQ;EAAQ;CAAQ;CACvD,oBAAoB,OAAO;CAC3B,qBAAqB,OAAO;CAC5B,mBAAmB,OAAO;CAC1B,qBAAqB,OAAO;CAC5B,uBAAuB,OAAO;CAC9B,sBAAsB,OAAO;CAC7B,kBAAkB,OAAO;CACzB,gBAAgB,OAAO;CACvB,OAAO;AACT;;;;ACxBA,MAAM,WAAW;AAEjB,MAAa,QAAQ;;;;;;;;;;;;;;;;;AAkBrB,IAAa,eAAb,cAAkC,MAAM;CACtC,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;;AAGA,MAAa,gBACX,MACA,KACA,QACwB;CACxB,IAAI;CACJ,IAAI;EACF,SAAS,UAAU;GACjB,MAAM,CAAC,GAAG,IAAI;GACd,SAAS;IACP,cAAc;KAAE,MAAM;KAAW,SAAS;IAAM;IAChD,cAAc,EAAE,MAAM,SAAS;IAC/B,MAAM,EAAE,MAAM,SAAS;IACvB,MAAM;KAAE,MAAM;KAAW,OAAO;KAAK,SAAS;IAAM;GACtD;GACA,QAAQ;GACR,kBAAkB;EACpB,CAAC;CACH,SAAS,OAAO;EACd,MAAM,IAAI,aAAa,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;CAC/E;CACA,IAAI,OAAO,OAAO,MAChB,OAAO;CAET,MAAM,UAAU,IAAI,YAAY,KAAK;CACrC,MAAM,QAAQ,IAAI,cAAc,KAAK;CACrC,IAAI,CAAC,WAAW,CAAC,eAAe,KAAK,OAAO,GAC1C,MAAM,IAAI,aAAa,8DAA8D;CAEvF,IAAI,CAAC,OACH,MAAM,IAAI,aAAa,+CAA+C;CAExE,MAAM,QAAQ,OAAO,OAAO,QAAQ,IAAI,YAAA,EAAc,KAAK,KAAK,KAAA;CAChE,IAAI,SAAS,KAAA,KAAa,CAAC,SAAS,KAAK,IAAI,GAC3C,MAAM,IAAI,aAAa,IAAI,KAAK,0DAA0D;CAE5F,OAAO;EACL,SAAS,QAAQ,QAAQ,QAAQ,EAAE;EACnC;EACA,WAAW,OAAO,OAAO;EACzB,WAAW,QAAQ,KAAK,OAAO,OAAO,iBAAiB,GAAG;EAC1D,GAAI,SAAS,KAAA,IAAY,EAAE,KAAK,IAAI,CAAC;CACvC;AACF"}

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@shapio/mcp",
+  "version": "0.2.0",
+  "description": "MCP server for Shapio: lets coding agents model content, write drafts and open change sets for review.",
+  "license": "Apache-2.0",
+  "homepage": "https://shapio.dev",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mybrokengnome/shapio.git",
+    "directory": "packages/mcp"
+  },
+  "bugs": {
+    "url": "https://github.com/mybrokengnome/shapio/issues"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=24"
+  },
+  "bin": {
+    "shapio-mcp": "./dist/bin.js"
+  },
+  "exports": {
+    ".": {
+      "@shapio/source": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@modelcontextprotocol/server": "2.2.0",
+    "@shapio/client": "0.2.0",
+    "@shapio/schema": "0.2.0",
+    "zod": "4.6.5"
+  },
+  "devDependencies": {
+    "@modelcontextprotocol/client": "2.2.0",
+    "@types/node": "24.19.1",
+    "tsdown": "0.23.0",
+    "typescript": "6.0.3",
+    "vitest": "5.0.3"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "node scripts/embedDocs.mjs && tsdown",
+    "typecheck": "tsc -p tsconfig.json"
+  }
+}