@shipstatic/mcp 1.0.0-beta.6 → 1.0.0-beta.8

package/dist/bin.js

@@ -29,7 +29,8 @@ async function main() {
     // bearer) and the server classifies it. MCP never has to know which kind it
     // holds.
     const ship = new Ship({ token: process.env.SHIP_TOKEN });
-    const server = createServer(ship, version);
+    // No `via` — this executable IS the `mcp` origin, which is the default.
+    const server = createServer(ship, { version });
     const transport = new StdioServerTransport();
     await server.connect(transport);
     console.error('ShipStatic MCP Server running on stdio');

package/dist/call.d.ts

@@ -25,12 +25,16 @@ export type CallFn = <T>(fn: () => Promise<T>) => Promise<CallToolResult>;
 export interface CallOptions {
     hints: ErrorHints;
     /**
-     * Attach a plain-object result as `structuredContent` beside the text.
-     * Hosted-only today: it is what feeds the Apps-SDK widget, and the MCP spec
+     * Attach a plain-object SUCCESS result as `structuredContent` beside the
+     * text. Hosted-only: it is what feeds the Apps-SDK widget, and the MCP spec
      * pairs it with an `outputSchema`, which is a hand-maintained zod twin of a
      * published type. One such twin is worth it for a widget; fifteen would be a
      * drift surface with no consumer asking for it. See
      * `cloudflare/mcp/CLAUDE.md`, "What deliberately differs".
+     *
+     * It does NOT gate the ERROR envelope, which every transport carries — see
+     * `toErrorResult`. The objection above is about fifteen success shapes; a
+     * failure has exactly one published shape, and no schema to keep in step.
      */
     structuredContent?: boolean;
 }

package/dist/call.js

@@ -35,6 +35,34 @@ export function createCall(options) {
 function isPlainObject(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
+/**
+ * The failure envelope: authoritative prose, with the wire's own structure
+ * riding beside it.
+ *
+ * The TEXT is unchanged and stays the contract — hints included. It has to be:
+ * the API authors its messages for the end user at the throw site
+ * (`cloudflare/api/CLAUDE.md`, "Message authoring law"), so the sentence
+ * always contains what the agent needs, and a client that ignores everything
+ * else still works.
+ *
+ * `structuredContent` carries `ShipError.toResponse()` verbatim — the same
+ * `ErrorResponse` the wire itself uses. Until 1.0.0-beta.8 the typed contract
+ * terminated here: `status`, `ErrorType`, and every `details` payload except
+ * the Validation arm's were dropped, so the platform's own law — *clients
+ * branch on error type and status, never on message strings* — held for every
+ * consumer EXCEPT the one best equipped to obey it. The recorded bite was a
+ * 429: `details.expires` died at this boundary, leaving the caller most in
+ * need of a precise backoff to parse "try again in 9 minutes" out of English.
+ *
+ * Safe on every arm, and checked rather than assumed: the MCP SDK validates
+ * `structuredContent` only when a tool declares an `outputSchema`, and returns
+ * early again when `isError` is set. No tool here declares one. So this is
+ * additive for every client and invisible to any that does not look.
+ *
+ * It is deliberately NOT behind `CallOptions.structuredContent` — that flag
+ * governs success shapes, where the schema-twin objection lives. A failure has
+ * one published shape on every transport.
+ */
 function toErrorResult(error, hints) {
     if (isShipError(error)) {
         let message = error.message;
@@ -49,9 +77,12 @@ function toErrorResult(error, hints) {
         }
         return {
             content: [{ type: 'text', text: message }],
+            structuredContent: { ...error.toResponse() },
             isError: true,
         };
     }
+    // No structure for a non-ShipError: there is no wire shape to report, and
+    // inventing one would tell an agent this failure came from the platform.
     const fallback = error instanceof Error ? error.message : 'An unexpected error occurred';
     return {
         content: [{ type: 'text', text: fallback }],

package/dist/index.d.ts

@@ -1,34 +1,64 @@
 /**
  * The library entry — importing this file has NO side effects.
  *
- * `bin.ts` is the executable; this is what a consumer imports. Today there is
- * one such consumer, the hosted Streamable-HTTP transport in the platform's
- * private `cloudflare/mcp`, and both transports are converging on the same
- * product: the complete toolset for authenticated callers, the anonymous
- * deploy for everyone else. "One product, two transports" is only true if one
- * of them can import the other.
+ * `bin.ts` is the executable; this is what a consumer imports. There are two
+ * such consumers: the hosted Streamable-HTTP transport in the platform's
+ * private `cloudflare/mcp`, and the VS Code extension
+ * (`integrations/vscode`), which bundles a stdio server into its `.vsix`.
+ * Both transports are converging on the same product — the complete toolset
+ * for authenticated callers, the anonymous deploy for everyone else — and
+ * "one product, two transports" is only true if one of them can import the
+ * other.
  *
- * **The surface is exactly what a SECOND TRANSPORT needs — nothing more.**
- * That is the rule, and it is stricter than "curated". `createServer` and the
- * configured `call` are deliberately NOT here: they are stdio's own
- * composition, they have no consumer outside `bin.ts`, and `createServer` in
- * particular builds a tool whose input is a filesystem PATH — a footgun to
- * offer a Worker. Exporting them would make this package's API "stdio's
- * internals, plus some shared bits" instead of a contract.
+ * **The surface is exactly what a SECOND CONSUMER needs — nothing more.**
+ * That is the rule, and it is stricter than "curated". It read "a second
+ * TRANSPORT" until 1.0.0-beta.7, when the VS Code extension arrived as a
+ * consumer that is not a transport: it wants stdio's own composition,
+ * verbatim, running on the user's machine. The wording widened; the strictness
+ * did not.
  *
- * Every name below answers a question the second transport must otherwise
- * answer for itself, and each admission was a restatement deleted, not a
- * convenience added: `SERVER_NAME` and `UPLOAD_TOOL_NAME` were literals in two
- * repos (the first also correlates the Apps-SDK widget to the connector),
- * `PUBLIC_EXPIRY` was the same duration written out eight times,
- * `DESCRIPTION_BLOCKS` the fragments two tool descriptions genuinely share,
- * and `ACCOUNT_TOOL_NAMES` is what lets the hosted catalogue fence name the
- * fourteen without counting them again.
+ * Every name below answers a question a consumer must otherwise answer for
+ * itself, and each admission was a restatement deleted, not a convenience
+ * added: `SERVER_NAME` and `UPLOAD_TOOL_NAME` were literals in two repos (the
+ * first also correlates the Apps-SDK widget to the connector), `PUBLIC_EXPIRY`
+ * was the same duration written out eight times, `DESCRIPTION_BLOCKS` the
+ * fragments two tool descriptions genuinely share, `ACCOUNT_TOOL_NAMES` is
+ * what lets the hosted catalogue fence name the fourteen without counting them
+ * again, and `createServer` deleted three regexes in another repo's build (see
+ * below).
+ *
+ * **`createServer` is exported; the configured `call` is not.** The extension
+ * previously reached stdio's composition by REGEX-PATCHING this package's
+ * compiled `dist/` at bundle time — stripping `bin`'s shebang, and rewriting
+ * the `createRequire(import.meta.url)('../package.json')` line inside
+ * `server.js` to inline a version literal. Three hacks against another
+ * package's build output, each of which the 1.x library split broke. A short
+ * entry point calling `createServer(ship, { version, via })` replaces all of
+ * them, which is a restatement deleted rather than a convenience added.
+ * `call` stays internal because a consumer configures its own hints through
+ * `createCall`, and stdio's instance is not a contract anyone needs.
+ *
+ * Its second argument is the HOST's own facts — the version it reports and the
+ * deploy origin its uploads carry — because a library has no manifest to read
+ * and no idea which product it was installed inside. A `startStdio` absorbing
+ * the transport as well was proposed and rejected; `CLAUDE.md` records why, and
+ * `tests/architecture/worker-safety.test.ts` is the fence that makes the reason
+ * mechanical rather than remembered.
+ *
+ * The old reason for withholding `createServer` — that its upload tool takes a
+ * filesystem PATH, a footgun to offer a Worker — is still true and is now the
+ * CALLER's judgement rather than an absence: `cloudflare/mcp` must keep
+ * authoring its own upload tool, and does. An absence cannot express "correct
+ * for one consumer, wrong for another"; a documented rule can. What makes the
+ * export safe to publish at all is that `createServer` takes its `version` as
+ * an ARGUMENT — so exporting it adds no `node:module` to the import graph of a
+ * module the Workers-hosted transport loads.
  *
  * `tests/index.test.ts` fences both directions — nothing missing, nothing
  * extra — because adding an export is the quiet failure: everything published
  * becomes a breaking change to remove.
  */
 export { type CallFn, type CallOptions, createCall, type ErrorHints } from './call.js';
+export { createServer } from './server.js';
 export { ACCOUNT_TOOL_NAMES, registerAccountTools } from './tools.js';
 export { ANNOTATIONS, DESCRIPTION_BLOCKS, INSTRUCTION_BLOCKS, PARAM_DESCRIPTIONS, PUBLIC_EXPIRY, SERVER_NAME, UPLOAD_TOOL_NAME, } from './vocabulary.js';

package/dist/index.js

@@ -1,34 +1,64 @@
 /**
  * The library entry — importing this file has NO side effects.
  *
- * `bin.ts` is the executable; this is what a consumer imports. Today there is
- * one such consumer, the hosted Streamable-HTTP transport in the platform's
- * private `cloudflare/mcp`, and both transports are converging on the same
- * product: the complete toolset for authenticated callers, the anonymous
- * deploy for everyone else. "One product, two transports" is only true if one
- * of them can import the other.
+ * `bin.ts` is the executable; this is what a consumer imports. There are two
+ * such consumers: the hosted Streamable-HTTP transport in the platform's
+ * private `cloudflare/mcp`, and the VS Code extension
+ * (`integrations/vscode`), which bundles a stdio server into its `.vsix`.
+ * Both transports are converging on the same product — the complete toolset
+ * for authenticated callers, the anonymous deploy for everyone else — and
+ * "one product, two transports" is only true if one of them can import the
+ * other.
  *
- * **The surface is exactly what a SECOND TRANSPORT needs — nothing more.**
- * That is the rule, and it is stricter than "curated". `createServer` and the
- * configured `call` are deliberately NOT here: they are stdio's own
- * composition, they have no consumer outside `bin.ts`, and `createServer` in
- * particular builds a tool whose input is a filesystem PATH — a footgun to
- * offer a Worker. Exporting them would make this package's API "stdio's
- * internals, plus some shared bits" instead of a contract.
+ * **The surface is exactly what a SECOND CONSUMER needs — nothing more.**
+ * That is the rule, and it is stricter than "curated". It read "a second
+ * TRANSPORT" until 1.0.0-beta.7, when the VS Code extension arrived as a
+ * consumer that is not a transport: it wants stdio's own composition,
+ * verbatim, running on the user's machine. The wording widened; the strictness
+ * did not.
  *
- * Every name below answers a question the second transport must otherwise
- * answer for itself, and each admission was a restatement deleted, not a
- * convenience added: `SERVER_NAME` and `UPLOAD_TOOL_NAME` were literals in two
- * repos (the first also correlates the Apps-SDK widget to the connector),
- * `PUBLIC_EXPIRY` was the same duration written out eight times,
- * `DESCRIPTION_BLOCKS` the fragments two tool descriptions genuinely share,
- * and `ACCOUNT_TOOL_NAMES` is what lets the hosted catalogue fence name the
- * fourteen without counting them again.
+ * Every name below answers a question a consumer must otherwise answer for
+ * itself, and each admission was a restatement deleted, not a convenience
+ * added: `SERVER_NAME` and `UPLOAD_TOOL_NAME` were literals in two repos (the
+ * first also correlates the Apps-SDK widget to the connector), `PUBLIC_EXPIRY`
+ * was the same duration written out eight times, `DESCRIPTION_BLOCKS` the
+ * fragments two tool descriptions genuinely share, `ACCOUNT_TOOL_NAMES` is
+ * what lets the hosted catalogue fence name the fourteen without counting them
+ * again, and `createServer` deleted three regexes in another repo's build (see
+ * below).
+ *
+ * **`createServer` is exported; the configured `call` is not.** The extension
+ * previously reached stdio's composition by REGEX-PATCHING this package's
+ * compiled `dist/` at bundle time — stripping `bin`'s shebang, and rewriting
+ * the `createRequire(import.meta.url)('../package.json')` line inside
+ * `server.js` to inline a version literal. Three hacks against another
+ * package's build output, each of which the 1.x library split broke. A short
+ * entry point calling `createServer(ship, { version, via })` replaces all of
+ * them, which is a restatement deleted rather than a convenience added.
+ * `call` stays internal because a consumer configures its own hints through
+ * `createCall`, and stdio's instance is not a contract anyone needs.
+ *
+ * Its second argument is the HOST's own facts — the version it reports and the
+ * deploy origin its uploads carry — because a library has no manifest to read
+ * and no idea which product it was installed inside. A `startStdio` absorbing
+ * the transport as well was proposed and rejected; `CLAUDE.md` records why, and
+ * `tests/architecture/worker-safety.test.ts` is the fence that makes the reason
+ * mechanical rather than remembered.
+ *
+ * The old reason for withholding `createServer` — that its upload tool takes a
+ * filesystem PATH, a footgun to offer a Worker — is still true and is now the
+ * CALLER's judgement rather than an absence: `cloudflare/mcp` must keep
+ * authoring its own upload tool, and does. An absence cannot express "correct
+ * for one consumer, wrong for another"; a documented rule can. What makes the
+ * export safe to publish at all is that `createServer` takes its `version` as
+ * an ARGUMENT — so exporting it adds no `node:module` to the import graph of a
+ * module the Workers-hosted transport loads.
  *
  * `tests/index.test.ts` fences both directions — nothing missing, nothing
  * extra — because adding an export is the quiet failure: everything published
  * becomes a breaking change to remove.
  */
 export { createCall } from './call.js';
+export { createServer } from './server.js';
 export { ACCOUNT_TOOL_NAMES, registerAccountTools } from './tools.js';
 export { ANNOTATIONS, DESCRIPTION_BLOCKS, INSTRUCTION_BLOCKS, PARAM_DESCRIPTIONS, PUBLIC_EXPIRY, SERVER_NAME, UPLOAD_TOOL_NAME, } from './vocabulary.js';

package/dist/server.d.ts

@@ -1,11 +1,36 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type Ship from '@shipstatic/ship';
+import { type DeploymentViaType } from '@shipstatic/types';
 /**
- * Builds the stdio server's full 15-tool surface over an injected client.
+ * What the HOST knows about itself and this library must not assume.
  *
- * `version` is a parameter rather than something this module reads for itself:
- * the executable knows its own package manifest, a library must not assume it
- * has one, and reaching for `node:module` here would put a Node builtin in the
- * import graph of a module the Workers-hosted transport also loads.
+ * Both fields are the same category of fact, which is why they travel together
+ * rather than as a growing positional tail: a library has no manifest to read
+ * and no idea which product it was installed inside.
+ */
+export interface ServerOptions {
+    /**
+     * The server's reported `serverInfo.version`. A parameter rather than
+     * something this module reads for itself: the executable knows its own
+     * package manifest, a library must not assume it has one, and reaching for
+     * `node:module` here would put a Node builtin in the import graph of a
+     * module the Workers-hosted transport also loads.
+     */
+    version: string;
+    /**
+     * The deploy origin this server's uploads are attributed to. Defaults to
+     * `mcp` — an npx install in some MCP client, which is what this package is
+     * on its own.
+     *
+     * It is a parameter because `via` names the DISTRIBUTION SURFACE, not the
+     * protocol: the GitHub Action reports `git` whatever invoked the workflow,
+     * and the web apps report `web`. The VS Code extension bundles this server
+     * into its `.vsix`, so its agent-mode deploys are the extension's — it
+     * passes `vsc`, and `mcp` goes back to meaning what it says.
+     */
+    via?: DeploymentViaType;
+}
+/**
+ * Builds the stdio server's full 15-tool surface over an injected client.
  */
-export declare function createServer(ship: Ship, version: string): McpServer;
+export declare function createServer(ship: Ship, options: ServerOptions): McpServer;

package/dist/server.js

@@ -1,4 +1,5 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { DeploymentVia } from '@shipstatic/types';
 import { z } from 'zod';
 import { call } from './call.js';
 import { registerAccountTools } from './tools.js';
@@ -28,13 +29,9 @@ ${B.domainConcept}
 ${B.domainWorkflow}`;
 /**
  * Builds the stdio server's full 15-tool surface over an injected client.
- *
- * `version` is a parameter rather than something this module reads for itself:
- * the executable knows its own package manifest, a library must not assume it
- * has one, and reaching for `node:module` here would put a Node builtin in the
- * import graph of a module the Workers-hosted transport also loads.
  */
-export function createServer(ship, version) {
+export function createServer(ship, options) {
+    const { version, via = DeploymentVia.MCP } = options;
     const server = new McpServer({
         name: SERVER_NAME,
         version,
@@ -53,7 +50,7 @@ export function createServer(ship, version) {
             password: z.string().optional().describe(PARAM_DESCRIPTIONS.password),
             idempotencyKey: z.string().optional().describe(PARAM_DESCRIPTIONS.idempotencyKey),
         },
-    }, ({ path, labels, password, idempotencyKey }) => call(() => ship.deployments.upload(path, { labels, password, idempotencyKey, via: 'mcp' })));
+    }, ({ path, labels, password, idempotencyKey }) => call(() => ship.deployments.upload(path, { labels, password, idempotencyKey, via })));
     // The other fourteen. Identical on every transport, so they live in the
     // shared package rather than here — see tools.ts for why upload is not
     // among them.

package/dist/vocabulary.d.ts

@@ -27,6 +27,23 @@
  * Everything else should be here, and adding a shared fact anywhere else is
  * how the next year's drift starts.
  */
+/**
+ * Two packages, and the split is a rule rather than an accident: **read a
+ * constant from whatever will act on it.**
+ *
+ * The label, password and idempotency-key constraints come from
+ * `@shipstatic/ship` because the SDK is what validates a value against them
+ * before it reaches the wire — describing a bound the client in the same
+ * process will not honour is the drift that matters, and reading both from one
+ * module makes it impossible. `@shipstatic/types` declares them, but ship
+ * bundles its own copy, so importing them from types here would let a describe
+ * advertise a limit the validator beside it rejects.
+ *
+ * The public-deploy lifetime is the other kind of fact. Ship never reads it —
+ * the API stamps it — so there is no validator to agree with, and taking it
+ * from the package that merely forwards it would mean a ship release every
+ * time the platform's own vocabulary grows.
+ */
 /**
  * The server name every transport reports in `serverInfo`.
  *
@@ -46,18 +63,25 @@ export declare const UPLOAD_TOOL_NAME = "deployments_upload";
 /**
  * How long an anonymous deployment lives, in the words an agent reads.
  *
- * **The fact is owned by `cloudflare/api` (`DEPLOYMENT.PUBLIC_TTL`), which
- * `@shipstatic/types` does not yet export** — so this is a restatement, and it
- * is deliberately the ONLY one. It previously appeared in eight places across
- * the two servers and the widget; a TTL change had to find all eight. When
- * types exports the constant, this line becomes a derivation and nothing above
- * it moves.
+ * **Derived, since `@shipstatic/types@2.5.0-beta.19`.** It was a restatement
+ * until then, and deliberately the only one — the duration had appeared in
+ * eight places across the two servers and the widget, so a TTL change had to
+ * find all eight. Both halves of the fix landed together: types declares the
+ * number and `cloudflare/api` imports it back, because exporting without the
+ * import-back would have given the fact two owners instead of ending the
+ * duplication.
  *
  * A phrase rather than a number because every consumer is prose: the value has
- * to carry its own unit, and `PUBLIC_TTL / 86400` interpolated at eight sites
- * would restate the unit eight times instead of the number.
+ * to carry its own unit, and dividing by 86400 at eight sites would restate the
+ * unit eight times instead of the number.
+ *
+ * The unit stays literal, and that is the one assumption here: this reads
+ * correctly while the TTL is a whole number of days, which it has always been.
+ * A TTL of hours would need the prose reviewed anyway — the widget's own
+ * `formatExpires` speaks in days and hours too — so the honest failure is a
+ * sentence someone must rewrite, not a number that silently rounds.
  */
-export declare const PUBLIC_EXPIRY = "3 days";
+export declare const PUBLIC_EXPIRY: string;
 /**
  * MCP tool annotations by kind of operation. An agent reads these to decide
  * whether it may call speculatively (`readOnlyHint`), whether a retry is free

package/dist/vocabulary.js

@@ -28,6 +28,24 @@
  * how the next year's drift starts.
  */
 import { IDEMPOTENCY_KEY_CONSTRAINTS, LABEL_CONSTRAINTS, PASSWORD_CONSTRAINTS, } from '@shipstatic/ship';
+import { PUBLIC_DEPLOYMENT_TTL_SECONDS } from '@shipstatic/types';
+/**
+ * Two packages, and the split is a rule rather than an accident: **read a
+ * constant from whatever will act on it.**
+ *
+ * The label, password and idempotency-key constraints come from
+ * `@shipstatic/ship` because the SDK is what validates a value against them
+ * before it reaches the wire — describing a bound the client in the same
+ * process will not honour is the drift that matters, and reading both from one
+ * module makes it impossible. `@shipstatic/types` declares them, but ship
+ * bundles its own copy, so importing them from types here would let a describe
+ * advertise a limit the validator beside it rejects.
+ *
+ * The public-deploy lifetime is the other kind of fact. Ship never reads it —
+ * the API stamps it — so there is no validator to agree with, and taking it
+ * from the package that merely forwards it would mean a ship release every
+ * time the platform's own vocabulary grows.
+ */
 /**
  * The server name every transport reports in `serverInfo`.
  *
@@ -47,18 +65,25 @@ export const UPLOAD_TOOL_NAME = 'deployments_upload';
 /**
  * How long an anonymous deployment lives, in the words an agent reads.
  *
- * **The fact is owned by `cloudflare/api` (`DEPLOYMENT.PUBLIC_TTL`), which
- * `@shipstatic/types` does not yet export** — so this is a restatement, and it
- * is deliberately the ONLY one. It previously appeared in eight places across
- * the two servers and the widget; a TTL change had to find all eight. When
- * types exports the constant, this line becomes a derivation and nothing above
- * it moves.
+ * **Derived, since `@shipstatic/types@2.5.0-beta.19`.** It was a restatement
+ * until then, and deliberately the only one — the duration had appeared in
+ * eight places across the two servers and the widget, so a TTL change had to
+ * find all eight. Both halves of the fix landed together: types declares the
+ * number and `cloudflare/api` imports it back, because exporting without the
+ * import-back would have given the fact two owners instead of ending the
+ * duplication.
  *
  * A phrase rather than a number because every consumer is prose: the value has
- * to carry its own unit, and `PUBLIC_TTL / 86400` interpolated at eight sites
- * would restate the unit eight times instead of the number.
+ * to carry its own unit, and dividing by 86400 at eight sites would restate the
+ * unit eight times instead of the number.
+ *
+ * The unit stays literal, and that is the one assumption here: this reads
+ * correctly while the TTL is a whole number of days, which it has always been.
+ * A TTL of hours would need the prose reviewed anyway — the widget's own
+ * `formatExpires` speaks in days and hours too — so the honest failure is a
+ * sentence someone must rewrite, not a number that silently rounds.
  */
-export const PUBLIC_EXPIRY = '3 days';
+export const PUBLIC_EXPIRY = `${PUBLIC_DEPLOYMENT_TTL_SECONDS / 86_400} days`;
 const OPEN_WORLD = { openWorldHint: true };
 /**
  * MCP tool annotations by kind of operation. An agent reads these to decide

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shipstatic/mcp",
-  "version": "1.0.0-beta.6",
+  "version": "1.0.0-beta.8",
   "mcpName": "com.shipstatic/mcp",
   "description": "ShipStatic MCP — deploy static websites from AI agents. Full toolset incl. custom domains. Free hosted endpoint at mcp.shipstatic.com — no install.",
   "type": "module",
@@ -64,13 +64,14 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@shipstatic/ship": "2.0.0-beta.15",
+    "@shipstatic/types": "2.5.0-beta.20",
     "zod": "^4.4.3"
   },
   "devDependencies": {
     "@biomejs/biome": "2.5.5",
-    "@shipstatic/types": "2.5.0-beta.18",
     "@types/node": "^25.9.5",
     "@vitest/coverage-v8": "4.1.10",
+    "esbuild": "^0.25.12",
     "typescript": "^6.0.3",
     "vitest": "4.1.10"
   },