@thenavidm/slipway 0.1.10 → 0.1.11

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 What changed in Slipway, newest first.
 
+## 0.1.11, 2026-10-05: what WordPress needed
+
+- **Records no longer advertise `propertyNames`.** Zod 4 gives every `z.record` `propertyNames: { type: "string" }`, which every JSON object key already is, and the Zod 3 converters never wrote it. Slipway leaves it out of what clients receive, as it does the safe-integer bounds, and validation still runs on the schema itself. Each one cost 8 tokens; WordPress has nine. An argument that happens to be named `propertyNames` is a name, so it stays.
+
 ## 0.1.10, 2026-10-05: what TikTok needed
 
 - **`destructiveOff: "hide"`: a server can take its irreversible tools off the list when they are off.** By default `<PREFIX>_ALLOW_DESTRUCTIVE=0` keeps them listed and refuses each call. With `defaults: { destructiveOff: "hide" }` they leave the MCP tool list and the command list, as read-only mode does with every write, and calling one anyway is refused with the setting to unset. TikTok 1.1 hid its publishing tools this way, and keeps doing so.

package/README.md

@@ -580,7 +580,9 @@ See [CHANGELOG.md](CHANGELOG.md).
 | [Substack](https://github.com/thenavidm/substack-mcp-cli) | [`@thenavidm/substack-mcp-cli`](https://www.npmjs.com/package/@thenavidm/substack-mcp-cli) 3.0.0 | Drafts, publishing and scheduling, Notes, subscribers, analytics, tags, comments and researching other publications |
 | [Teachable](https://github.com/thenavidm/teachable-mcp-cli) | [`@thenavidm/teachable-mcp-cli`](https://www.npmjs.com/package/@thenavidm/teachable-mcp-cli) 3.0.0 | Courses, users, enrollments, pricing, coupons and transactions |
 | [Threads](https://github.com/thenavidm/threads-mcp-cli) | [`@thenavidm/threads-mcp-cli`](https://www.npmjs.com/package/@thenavidm/threads-mcp-cli) 2.0.0 | Posting, threads, carousels, replies and reply approvals, insights and keyword search |
+| [TikTok](https://github.com/thenavidm/tiktok-mcp-cli) | [`@thenavidm/tiktok-mcp-cli`](https://www.npmjs.com/package/@thenavidm/tiktok-mcp-cli) 2.0.0 | Your own account's profile and videos, ranked by any metric, posting and drafts, through TikTok's official API |
 | [ThriveCart](https://github.com/thenavidm/thrivecart-mcp-cli) | [`@thenavidm/thrivecart-mcp-cli`](https://www.npmjs.com/package/@thenavidm/thrivecart-mcp-cli) 3.0.0 | Products and pricing, transactions and revenue, customers, subscriptions and affiliates, across several carts |
+| [YouTube](https://github.com/thenavidm/youtube-mcp-cli) | [`@thenavidm/youtube-mcp-cli`](https://www.npmjs.com/package/@thenavidm/youtube-mcp-cli) 3.0.0 | Transcripts of any public video, channel research against each channel's own median, and your own channels' videos, comments and analytics |
 
 Each server was measured against its previous release before it moved: startup, what a client receives, CLI exit codes, and tokens in Claude Code and Codex. Its README has the numbers.
 

package/dist/schema.js

@@ -83,25 +83,36 @@ export const CONTROL_NAMES = ["confirm", "wait_seconds"];
 export const CONFIRM_DESCRIPTION = "Set true only when the user asked for exactly this action.";
 /** The schema already carries the range and the default, so the words only say what the number is for. */
 export const WAIT_DESCRIPTION = "Seconds to wait for the job to finish before returning it to check later.";
+/** Keywords whose keys are names the author chose, not keywords. */
+const NAMED = new Set(["properties", "patternProperties", "$defs", "definitions", "dependentSchemas"]);
 /**
  * Zod 4 gives every whole number the safe-integer bounds, `maximum:
- * 9007199254740991` and its negative, unless the schema sets its own. They say
- * nothing a client can use, so they are left out of what it receives.
- * Validation still runs on the schema itself.
+ * 9007199254740991` and its negative, unless the schema sets its own, and
+ * every record `propertyNames: { type: "string" }`, which every JSON object key
+ * already is. They say nothing a client can use, so they are left out of what
+ * it receives. Validation still runs on the schema itself. An argument that
+ * happens to be named `propertyNames` or `maximum` is a name, so it stays.
  */
-function withoutSafeIntegerBounds(node) {
+function withoutNoise(node, named = false) {
     if (Array.isArray(node))
-        return node.map(withoutSafeIntegerBounds);
+        return node.map((item) => withoutNoise(item));
     if (node === null || typeof node !== "object")
         return node;
     const out = {};
     for (const [key, value] of Object.entries(node)) {
-        if ((key === "maximum" && value === Number.MAX_SAFE_INTEGER) || (key === "minimum" && value === Number.MIN_SAFE_INTEGER))
-            continue;
-        out[key] = withoutSafeIntegerBounds(value);
+        if (!named) {
+            if ((key === "maximum" && value === Number.MAX_SAFE_INTEGER) || (key === "minimum" && value === Number.MIN_SAFE_INTEGER))
+                continue;
+            if (key === "propertyNames" && isPlainString(value))
+                continue;
+        }
+        out[key] = withoutNoise(value, !named && NAMED.has(key));
     }
     return out;
 }
+function isPlainString(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 1 && value.type === "string";
+}
 /**
  * A schema as clients receive it, without the `$schema` line that names its
  * dialect. A client reads JSON Schema 2020-12 when no dialect is named, so
@@ -111,7 +122,7 @@ export function advertised(schema) {
     const std = schema["~standard"];
     const plain = (json) => {
         const { $schema: _dialect, ...rest } = json;
-        return withoutSafeIntegerBounds(rest);
+        return withoutNoise(rest);
     };
     return {
         "~standard": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thenavidm/slipway",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "Slipway, the TypeScript framework for MCP servers and agent-native CLIs. One tool definition ships an MCP server and a CLI, with write safety, typed results and release checks built in.",
   "type": "module",
   "license": "Apache-2.0",