@shipstatic/mcp 1.0.0-beta.3 → 1.0.0-beta.4

package/dist/index.d.ts

@@ -1,21 +1,25 @@
 /**
  * The library entry — importing this file has NO side effects.
  *
- * That is the whole point of it: `bin.ts` is the executable, and this is what
- * a consumer imports. Today there is exactly one such consumer, the hosted
- * Streamable-HTTP transport in the platform's private `cloudflare/mcp`, which
- * takes the vocabulary below rather than re-authoring the strings an agent
- * reads. "One product, two transports" is only true if one of them can import
- * the other.
+ * `bin.ts` is the executable; this is what a consumer imports. Today there is
+ * one such consumer, the hosted Streamable-HTTP transport in the platform's
+ * private `cloudflare/mcp`, and both transports are converging on the same
+ * product: the complete toolset for authenticated callers, the anonymous
+ * deploy for everyone else. "One product, two transports" is only true if one
+ * of them can import the other.
  *
- * **The surface is curated, not swept.** Every export here is a deliberate
- * public commitment under semver; the modules behind it hold plenty that is
- * not (`toErrorResult`, `safeStringify`, the INSTRUCTIONS template, every tool
- * registration). `export *` would publish implementation detail and make the
- * next refactor a breaking change. `tests/index.test.ts` fences both
- * directions — nothing missing, nothing extra.
+ * **The surface is exactly what a SECOND TRANSPORT needs — nothing more.**
+ * That is the rule, and it is stricter than "curated". `createServer` and the
+ * configured `call` are deliberately NOT here: they are stdio's own
+ * composition, they have no consumer outside `bin.ts`, and `createServer` in
+ * particular builds a tool whose input is a filesystem PATH — a footgun to
+ * offer a Worker. Exporting them would make this package's API "stdio's
+ * internals, plus some shared bits" instead of a contract.
+ *
+ * `tests/index.test.ts` fences both directions — nothing missing, nothing
+ * extra — because adding an export is the quiet failure: everything published
+ * becomes a breaking change to remove.
  */
-export { type CallFn, type CallOptions, call, createCall, type ErrorHints } from './call.js';
-export { createServer } from './server.js';
+export { type CallFn, type CallOptions, createCall, type ErrorHints } from './call.js';
 export { registerAccountTools } from './tools.js';
-export { ANNOTATIONS, PARAM_DESCRIPTIONS } from './vocabulary.js';
+export { ANNOTATIONS, INSTRUCTION_BLOCKS, PARAM_DESCRIPTIONS } from './vocabulary.js';

package/dist/index.js

@@ -1,21 +1,25 @@
 /**
  * The library entry — importing this file has NO side effects.
  *
- * That is the whole point of it: `bin.ts` is the executable, and this is what
- * a consumer imports. Today there is exactly one such consumer, the hosted
- * Streamable-HTTP transport in the platform's private `cloudflare/mcp`, which
- * takes the vocabulary below rather than re-authoring the strings an agent
- * reads. "One product, two transports" is only true if one of them can import
- * the other.
+ * `bin.ts` is the executable; this is what a consumer imports. Today there is
+ * one such consumer, the hosted Streamable-HTTP transport in the platform's
+ * private `cloudflare/mcp`, and both transports are converging on the same
+ * product: the complete toolset for authenticated callers, the anonymous
+ * deploy for everyone else. "One product, two transports" is only true if one
+ * of them can import the other.
  *
- * **The surface is curated, not swept.** Every export here is a deliberate
- * public commitment under semver; the modules behind it hold plenty that is
- * not (`toErrorResult`, `safeStringify`, the INSTRUCTIONS template, every tool
- * registration). `export *` would publish implementation detail and make the
- * next refactor a breaking change. `tests/index.test.ts` fences both
- * directions — nothing missing, nothing extra.
+ * **The surface is exactly what a SECOND TRANSPORT needs — nothing more.**
+ * That is the rule, and it is stricter than "curated". `createServer` and the
+ * configured `call` are deliberately NOT here: they are stdio's own
+ * composition, they have no consumer outside `bin.ts`, and `createServer` in
+ * particular builds a tool whose input is a filesystem PATH — a footgun to
+ * offer a Worker. Exporting them would make this package's API "stdio's
+ * internals, plus some shared bits" instead of a contract.
+ *
+ * `tests/index.test.ts` fences both directions — nothing missing, nothing
+ * extra — because adding an export is the quiet failure: everything published
+ * becomes a breaking change to remove.
  */
-export { call, createCall } from './call.js';
-export { createServer } from './server.js';
+export { createCall } from './call.js';
 export { registerAccountTools } from './tools.js';
-export { ANNOTATIONS, PARAM_DESCRIPTIONS } from './vocabulary.js';
+export { ANNOTATIONS, INSTRUCTION_BLOCKS, PARAM_DESCRIPTIONS } from './vocabulary.js';

package/dist/server.js

@@ -3,24 +3,29 @@ import { IDEMPOTENCY_KEY_CONSTRAINTS } from '@shipstatic/ship';
 import { z } from 'zod';
 import { call } from './call.js';
 import { registerAccountTools } from './tools.js';
-import { ANNOTATIONS, PARAM_DESCRIPTIONS } from './vocabulary.js';
+import { ANNOTATIONS, INSTRUCTION_BLOCKS, PARAM_DESCRIPTIONS } from './vocabulary.js';
 // Destructured so the fifteen registrations below read as they always have.
 // The definitions live in `vocabulary.ts` because the hosted transport speaks
 // the same ones — that file records what is shared, what is not, and why.
 const { CREATE } = ANNOTATIONS;
-const INSTRUCTIONS = `ShipStatic deploys static websites instantly. Free, no account required.
+const B = INSTRUCTION_BLOCKS;
+// Composed from the shared blocks plus the two sentences that are genuinely
+// stdio's: how files arrive (a filesystem path) and how a caller
+// authenticates (`SHIP_TOKEN`). The hosted transport composes the same blocks
+// around its own two.
+const INSTRUCTIONS = `${B.opening}
 
-To deploy: call deployments_upload with the build output directory path. The site is live immediately. To make the site private, pass \`password\` — visitors must unlock before viewing, including on any custom domains pointing at it.
+To deploy: call deployments_upload with the build output directory path. ${B.liveAndPassword}
 
-Without SHIP_TOKEN, deployments are public and expire in 3 days. The response includes a claim URL — always show the deployment URL and the claim URL to the user so they can keep the site permanently.
+Without SHIP_TOKEN, deployments are public and expire in 3 days. ${B.claim}
 
 With SHIP_TOKEN configured, deployments go to the user's account and never expire. Listing, managing, and domain operations also require SHIP_TOKEN.
 
-Concepts:
-- Deployment: an immutable set of files with an instant URL (e.g. happy-cat-abc1234.shipstatic.com). No setup needed.
-- Domain: a custom domain (e.g. www.example.com) pointing to a deployment. Optional. Subdomains only — not apex domains.
+${B.conceptsHeader}
+${B.deploymentConcept}
+${B.domainConcept}
 
-To add a custom domain: domains_validate → domains_set → domains_records (show DNS records to user) → user configures DNS → domains_verify.`;
+${B.domainWorkflow}`;
 /**
  * Builds the stdio server's full 15-tool surface over an injected client.
  *

package/dist/vocabulary.d.ts

@@ -73,6 +73,28 @@ export declare const ANNOTATIONS: {
  * without anyone editing prose — the same reason the API and the SDK import
  * them instead of restating them.
  */
+/**
+ * INSTRUCTIONS sentences both transports say.
+ *
+ * `initialize`'s instructions are the other half of what an agent reads
+ * before acting (the catalogue is the first). Each transport composes its own
+ * from these blocks plus the two things that are genuinely its own: how files
+ * arrive, and how a caller authenticates.
+ *
+ * Three of these are duplicated prose TODAY, kept equal by review. The last
+ * two are stdio-only only because the hosted transport has no domain tools
+ * yet — when it gains them with OAuth they become shared too, which is
+ * precisely when someone would otherwise copy them across.
+ */
+export declare const INSTRUCTION_BLOCKS: {
+    readonly opening: "ShipStatic deploys static websites instantly. Free, no account required.";
+    readonly liveAndPassword: "The site is live immediately. To make the site private, pass `password` — visitors must unlock before viewing, including on any custom domains pointing at it.";
+    readonly claim: "The response includes a claim URL — always show the deployment URL and the claim URL to the user so they can keep the site permanently.";
+    readonly conceptsHeader: "Concepts:";
+    readonly deploymentConcept: "- Deployment: an immutable set of files with an instant URL (e.g. happy-cat-abc1234.shipstatic.com). No setup needed.";
+    readonly domainConcept: "- Domain: a custom domain (e.g. www.example.com) pointing to a deployment. Optional. Subdomains only — not apex domains.";
+    readonly domainWorkflow: "To add a custom domain: domains_validate → domains_set → domains_records (show DNS records to user) → user configures DNS → domains_verify.";
+};
 export declare const PARAM_DESCRIPTIONS: {
     readonly labels: "Labels for organizing deployments (e.g. [\"production\", \"v1.2\"]). Lowercase, 3-25 chars, allows . _ - separators. Up to 10.";
     readonly password: "Optional password to gate the deployment behind an unlock prompt (6–128 characters; whitespace significant). Visitors must enter this password before viewing the site, including on any custom domains pointing at it.";

package/dist/vocabulary.js

@@ -56,6 +56,28 @@ export const ANNOTATIONS = {
  * without anyone editing prose — the same reason the API and the SDK import
  * them instead of restating them.
  */
+/**
+ * INSTRUCTIONS sentences both transports say.
+ *
+ * `initialize`'s instructions are the other half of what an agent reads
+ * before acting (the catalogue is the first). Each transport composes its own
+ * from these blocks plus the two things that are genuinely its own: how files
+ * arrive, and how a caller authenticates.
+ *
+ * Three of these are duplicated prose TODAY, kept equal by review. The last
+ * two are stdio-only only because the hosted transport has no domain tools
+ * yet — when it gains them with OAuth they become shared too, which is
+ * precisely when someone would otherwise copy them across.
+ */
+export const INSTRUCTION_BLOCKS = {
+    opening: 'ShipStatic deploys static websites instantly. Free, no account required.',
+    liveAndPassword: 'The site is live immediately. To make the site private, pass `password` — visitors must unlock before viewing, including on any custom domains pointing at it.',
+    claim: 'The response includes a claim URL — always show the deployment URL and the claim URL to the user so they can keep the site permanently.',
+    conceptsHeader: 'Concepts:',
+    deploymentConcept: '- Deployment: an immutable set of files with an instant URL (e.g. happy-cat-abc1234.shipstatic.com). No setup needed.',
+    domainConcept: '- Domain: a custom domain (e.g. www.example.com) pointing to a deployment. Optional. Subdomains only — not apex domains.',
+    domainWorkflow: 'To add a custom domain: domains_validate → domains_set → domains_records (show DNS records to user) → user configures DNS → domains_verify.',
+};
 export const PARAM_DESCRIPTIONS = {
     labels: `Labels for organizing deployments (e.g. ["production", "v1.2"]). Lowercase, ${LABEL_CONSTRAINTS.MIN_LENGTH}-${LABEL_CONSTRAINTS.MAX_LENGTH} chars, allows . _ - separators. Up to ${LABEL_CONSTRAINTS.MAX_COUNT}.`,
     password: `Optional password to gate the deployment behind an unlock prompt (${PASSWORD_CONSTRAINTS.MIN_LENGTH}–${PASSWORD_CONSTRAINTS.MAX_LENGTH} characters; whitespace significant). Visitors must enter this password before viewing the site, including on any custom domains pointing at it.`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shipstatic/mcp",
-  "version": "1.0.0-beta.3",
+  "version": "1.0.0-beta.4",
   "mcpName": "com.shipstatic/mcp",
   "description": "ShipStatic MCP — deploy static websites from AI agents. Full toolset incl. custom domains. Free hosted endpoint at mcp.shipstatic.com — no install.",
   "type": "module",