@shipstatic/types 2.20.0 → 2.21.0-beta.2

package/dist/index.d.ts

@@ -26,9 +26,20 @@ export type DeploymentStatusType = (typeof DeploymentStatus)[keyof typeof Deploy
  * member here and every future one:
  *
  * - **Where the platform ships CODE, the code declares it.** `web`, `sdk`,
- *   `cli`, `git`, `n8n` and `vsc` are surfaces this platform authors, so each
- *   names itself in its own source and nothing external is needed to tell them
- *   apart.
+ *   `cli`, `git`, `n8n`, `vsc` and `gmn` are surfaces this platform authors,
+ *   so each names itself in its own source and nothing external is needed to
+ *   tell them apart. A first-party WRAPPER counts as code even when it is a
+ *   manifest: the GitHub Action and the Gemini extension each compose an
+ *   invocation of a platform executable and relabel it through
+ *   {@link SHIP_VIA_ENV}.
+ *
+ * **And only a surface that DEPLOYS gets a member — `@shipstatic/drop` is the
+ * recorded refusal.** The widget collects and validates files and hands raw
+ * `File[]` to its embedder, whose own SDK call is the deploy; drop makes no
+ * upload call anywhere, so a `drp` member would be a word nothing can emit.
+ * Those deploys read `sdk`, which is the truth: the embedder is a program
+ * embedding the SDK directly. Mint the member the day drop grows an upload
+ * arm, not before.
  * - **Where the platform ships only a URL, the URL declares it.** A
  *   marketplace listing runs somebody else's client against a bare endpoint —
  *   every one of them the same server speaking the same protocol, and
@@ -69,6 +80,8 @@ export declare const DeploymentVia: {
     readonly CLD: "cld";
     /** Channel: the Cursor marketplace listing → `mcp.<domain>/crs`. */
     readonly CRS: "crs";
+    /** The Gemini CLI extension. */
+    readonly GMN: "gmn";
     /**
      * A deploy that reached the REST API naming no origin at all — the
      * platform-wide fallback, one altitude below `mcp`'s family fallback.
@@ -1622,10 +1635,11 @@ export declare const DEFAULT_API = "https://api.shipstatic.com";
  * values — as the VS Code extension's child-process env block does — picks
  * up a grown contract at the next pin bump instead of by remembered prose.
  *
- * Browser builds read no environment at all, and the CLI-only variables
- * (`SHIP_PASSWORD`, `SHIP_VIA`) are deliberately NOT here: they are the
- * CLI's operational levers, not the SDK's ambient contract — see
- * `npm/ship/CLAUDE.md`, "CLI-only env vars".
+ * Browser builds read no environment at all, and the wrapper-tier variables
+ * are deliberately NOT here: `SHIP_PASSWORD` stays the CLI's own operational
+ * lever (see `npm/ship/CLAUDE.md`, "CLI-only env vars"), and the origin
+ * relabel slot has its own owner beside this object ({@link SHIP_VIA_ENV})
+ * because two executables read it and neither reading is the SDK's.
  */
 export declare const SHIP_ENV: {
     /** The one credential slot — any platform token. */
@@ -1633,6 +1647,22 @@ export declare const SHIP_ENV: {
     /** The API endpoint override. */
     readonly API_URL: "SHIP_API_URL";
 };
+/**
+ * The origin-relabel slot for integrations that wrap a first-party
+ * executable as a subprocess. A wrapper composes an argv and an env it does
+ * not otherwise reach, so this variable is its one way to name the surface
+ * the traffic is really from. Two executables read it through
+ * {@link normalizeVia}: the `ship` CLI (default `cli`; the GitHub Action
+ * sets `git`) and the stdio MCP bin (default `mcp`; the Gemini CLI
+ * extension sets `gmn`). In-process SDK consumers pass the programmatic
+ * `via` option instead: same destination, different mechanism.
+ *
+ * Deliberately not a member of {@link SHIP_ENV}, which is the SDK's ambient
+ * contract; the SDK never reads this. The name earned an owner the day the
+ * stdio bin became its second reader: one spelling, two executables, and a
+ * misspelling on either side drops attribution silently.
+ */
+export declare const SHIP_VIA_ENV = "SHIP_VIA";
 /**
  * Where a human creates an API key — the console deep link quoted by every
  * surface that teaches authentication (the CLI's config wizard, the VS Code

package/dist/index.js

@@ -28,9 +28,20 @@ export const DeploymentStatus = {
  * member here and every future one:
  *
  * - **Where the platform ships CODE, the code declares it.** `web`, `sdk`,
- *   `cli`, `git`, `n8n` and `vsc` are surfaces this platform authors, so each
- *   names itself in its own source and nothing external is needed to tell them
- *   apart.
+ *   `cli`, `git`, `n8n`, `vsc` and `gmn` are surfaces this platform authors,
+ *   so each names itself in its own source and nothing external is needed to
+ *   tell them apart. A first-party WRAPPER counts as code even when it is a
+ *   manifest: the GitHub Action and the Gemini extension each compose an
+ *   invocation of a platform executable and relabel it through
+ *   {@link SHIP_VIA_ENV}.
+ *
+ * **And only a surface that DEPLOYS gets a member — `@shipstatic/drop` is the
+ * recorded refusal.** The widget collects and validates files and hands raw
+ * `File[]` to its embedder, whose own SDK call is the deploy; drop makes no
+ * upload call anywhere, so a `drp` member would be a word nothing can emit.
+ * Those deploys read `sdk`, which is the truth: the embedder is a program
+ * embedding the SDK directly. Mint the member the day drop grows an upload
+ * arm, not before.
  * - **Where the platform ships only a URL, the URL declares it.** A
  *   marketplace listing runs somebody else's client against a bare endpoint —
  *   every one of them the same server speaking the same protocol, and
@@ -71,6 +82,8 @@ export const DeploymentVia = {
     CLD: 'cld',
     /** Channel: the Cursor marketplace listing → `mcp.<domain>/crs`. */
     CRS: 'crs',
+    /** The Gemini CLI extension. */
+    GMN: 'gmn',
     /**
      * A deploy that reached the REST API naming no origin at all — the
      * platform-wide fallback, one altitude below `mcp`'s family fallback.
@@ -1591,10 +1604,11 @@ export const DEFAULT_API = 'https://api.shipstatic.com';
  * values — as the VS Code extension's child-process env block does — picks
  * up a grown contract at the next pin bump instead of by remembered prose.
  *
- * Browser builds read no environment at all, and the CLI-only variables
- * (`SHIP_PASSWORD`, `SHIP_VIA`) are deliberately NOT here: they are the
- * CLI's operational levers, not the SDK's ambient contract — see
- * `npm/ship/CLAUDE.md`, "CLI-only env vars".
+ * Browser builds read no environment at all, and the wrapper-tier variables
+ * are deliberately NOT here: `SHIP_PASSWORD` stays the CLI's own operational
+ * lever (see `npm/ship/CLAUDE.md`, "CLI-only env vars"), and the origin
+ * relabel slot has its own owner beside this object ({@link SHIP_VIA_ENV})
+ * because two executables read it and neither reading is the SDK's.
  */
 export const SHIP_ENV = {
     /** The one credential slot — any platform token. */
@@ -1602,6 +1616,22 @@ export const SHIP_ENV = {
     /** The API endpoint override. */
     API_URL: 'SHIP_API_URL',
 };
+/**
+ * The origin-relabel slot for integrations that wrap a first-party
+ * executable as a subprocess. A wrapper composes an argv and an env it does
+ * not otherwise reach, so this variable is its one way to name the surface
+ * the traffic is really from. Two executables read it through
+ * {@link normalizeVia}: the `ship` CLI (default `cli`; the GitHub Action
+ * sets `git`) and the stdio MCP bin (default `mcp`; the Gemini CLI
+ * extension sets `gmn`). In-process SDK consumers pass the programmatic
+ * `via` option instead: same destination, different mechanism.
+ *
+ * Deliberately not a member of {@link SHIP_ENV}, which is the SDK's ambient
+ * contract; the SDK never reads this. The name earned an owner the day the
+ * stdio bin became its second reader: one spelling, two executables, and a
+ * misspelling on either side drops attribution silently.
+ */
+export const SHIP_VIA_ENV = 'SHIP_VIA';
 /**
  * Where a human creates an API key — the console deep link quoted by every
  * surface that teaches authentication (the CLI's config wizard, the VS Code

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shipstatic/types",
-  "version": "2.20.0",
+  "version": "2.21.0-beta.2",
   "description": "Shared types for ShipStatic platform",
   "type": "module",
   "main": "./dist/index.js",

package/src/index.ts

@@ -33,9 +33,20 @@ export type DeploymentStatusType = (typeof DeploymentStatus)[keyof typeof Deploy
  * member here and every future one:
  *
  * - **Where the platform ships CODE, the code declares it.** `web`, `sdk`,
- *   `cli`, `git`, `n8n` and `vsc` are surfaces this platform authors, so each
- *   names itself in its own source and nothing external is needed to tell them
- *   apart.
+ *   `cli`, `git`, `n8n`, `vsc` and `gmn` are surfaces this platform authors,
+ *   so each names itself in its own source and nothing external is needed to
+ *   tell them apart. A first-party WRAPPER counts as code even when it is a
+ *   manifest: the GitHub Action and the Gemini extension each compose an
+ *   invocation of a platform executable and relabel it through
+ *   {@link SHIP_VIA_ENV}.
+ *
+ * **And only a surface that DEPLOYS gets a member — `@shipstatic/drop` is the
+ * recorded refusal.** The widget collects and validates files and hands raw
+ * `File[]` to its embedder, whose own SDK call is the deploy; drop makes no
+ * upload call anywhere, so a `drp` member would be a word nothing can emit.
+ * Those deploys read `sdk`, which is the truth: the embedder is a program
+ * embedding the SDK directly. Mint the member the day drop grows an upload
+ * arm, not before.
  * - **Where the platform ships only a URL, the URL declares it.** A
  *   marketplace listing runs somebody else's client against a bare endpoint —
  *   every one of them the same server speaking the same protocol, and
@@ -76,6 +87,8 @@ export const DeploymentVia = {
   CLD: 'cld',
   /** Channel: the Cursor marketplace listing → `mcp.<domain>/crs`. */
   CRS: 'crs',
+  /** The Gemini CLI extension. */
+  GMN: 'gmn',
   /**
    * A deploy that reached the REST API naming no origin at all — the
    * platform-wide fallback, one altitude below `mcp`'s family fallback.
@@ -2463,10 +2476,11 @@ export const DEFAULT_API = 'https://api.shipstatic.com';
  * values — as the VS Code extension's child-process env block does — picks
  * up a grown contract at the next pin bump instead of by remembered prose.
  *
- * Browser builds read no environment at all, and the CLI-only variables
- * (`SHIP_PASSWORD`, `SHIP_VIA`) are deliberately NOT here: they are the
- * CLI's operational levers, not the SDK's ambient contract — see
- * `npm/ship/CLAUDE.md`, "CLI-only env vars".
+ * Browser builds read no environment at all, and the wrapper-tier variables
+ * are deliberately NOT here: `SHIP_PASSWORD` stays the CLI's own operational
+ * lever (see `npm/ship/CLAUDE.md`, "CLI-only env vars"), and the origin
+ * relabel slot has its own owner beside this object ({@link SHIP_VIA_ENV})
+ * because two executables read it and neither reading is the SDK's.
  */
 export const SHIP_ENV = {
   /** The one credential slot — any platform token. */
@@ -2475,6 +2489,23 @@ export const SHIP_ENV = {
   API_URL: 'SHIP_API_URL',
 } as const;
 
+/**
+ * The origin-relabel slot for integrations that wrap a first-party
+ * executable as a subprocess. A wrapper composes an argv and an env it does
+ * not otherwise reach, so this variable is its one way to name the surface
+ * the traffic is really from. Two executables read it through
+ * {@link normalizeVia}: the `ship` CLI (default `cli`; the GitHub Action
+ * sets `git`) and the stdio MCP bin (default `mcp`; the Gemini CLI
+ * extension sets `gmn`). In-process SDK consumers pass the programmatic
+ * `via` option instead: same destination, different mechanism.
+ *
+ * Deliberately not a member of {@link SHIP_ENV}, which is the SDK's ambient
+ * contract; the SDK never reads this. The name earned an owner the day the
+ * stdio bin became its second reader: one spelling, two executables, and a
+ * misspelling on either side drops attribution silently.
+ */
+export const SHIP_VIA_ENV = 'SHIP_VIA';
+
 /**
  * Where a human creates an API key — the console deep link quoted by every
  * surface that teaches authentication (the CLI's config wizard, the VS Code