hostinger-api-mcp 3.10.3 → 3.11.0

package/CHANGELOG.md

@@ -4,6 +4,23 @@ Generated at release time from the diff between the previous and current
 build. Tool changes are listed individually; everything else is summarised
 by area.
 
+## v3.11.0 — 2026-10-27
+
+### Also in this release
+
+- Bundled agent skills: 7 files
+- Request handling and authentication: `src/core/catalog.js`, `src/core/catalog.ts`
+- Server instructions: 4 files
+- Other files: `src/core/skills.js`, `src/core/skills.ts`
+
+## v3.10.4 — 2026-10-27
+
+### Also in this release
+
+- Dependencies: `package-lock.json`
+- Bundled agent skills: `skills/headless/steps/05-design/SKILL.md`, `skills/headless/steps/05-design/logo-kit.mjs`, `skills/headless/steps/06-frontend/SKILL.md`
+- Other files: `src/core/skills.js`, `src/core/skills.ts`
+
 ## v3.10.3 — 2026-10-26
 
 No changes to the published artifact.

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "hostinger-api-mcp",
-  "version": "3.10.3",
+  "version": "3.11.0",
   "description": "Hostinger API — manage domains, DNS, hosting, VPS, billing and more from Gemini CLI.",
   "mcpServers": {
     "hostinger": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hostinger-api-mcp",
-  "version": "3.10.3",
+  "version": "3.11.0",
   "mcpName": "io.github.hostinger/hostinger-api-mcp",
   "description": "MCP server for Hostinger API",
   "repository": {

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/hostinger/api-mcp-server",
     "source": "github"
   },
-  "version": "3.10.3",
+  "version": "3.11.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@hostinger/mcp",
-      "version": "3.10.3",
+      "version": "3.11.0",
       "transport": {
         "type": "stdio"
       },

package/skills/audit-hosting/SKILL.md

@@ -30,7 +30,7 @@ Tell the user the size (plans, websites, WordPress installs) before the checks.
 Per Shared and Cloud website (skip `builder` and `horizons`):
 
 - `hosting_ssl_status` — flag `failed` (with `last_error`), `expired`, `not_installed` on a custom domain, `is_https_redirect_enabled: false`, and `expires_at` within 30 days when `is_lifetime` is false. Lifetime certificates renew on their own.
-- Node.js sites: `hosting_get-deployment` (latest build failed? `build.state`; on the hosted server use `hosting_nodejs_list-builds` with `per_page: 1`) and `hosting_nodejs_list-vulnerabilities` with `severities: ["critical", "high"]`.
+- Node.js sites: `hosting_get-deployment` (latest build failed? `build.state`) and `hosting_nodejs_list-vulnerabilities` with `severities: ["critical", "high"]`.
 
 Per hosting account (`username`): `hosting_databases_list` — flag `disk_usage_mb` above 80% of `max_size_mb`.
 

package/skills/deploy-to-hosting/SKILL.md

@@ -45,9 +45,9 @@ Archive rules for Agency (name archives `name_YYYYMMDD_HHMMSS.zip`) and for arch
 - **Static:** build locally first. `index.html` must be at the archive root, not inside a folder: `cd dist && zip -r ../site_20260101_120000.zip .`
 - **Node.js source:** no `node_modules/`, no build output (`dist/`, `.next/`, `build/`), no `.env*`, nothing matched by `.gitignore`; 50 MB at most. `git archive --format=zip -o app_20260101_120000.zip HEAD` produces exactly the committed files — mention that uncommitted changes are left out.
 
-`hosting_deploy` and the `agency-hosting_deploy-*` operations read files from this machine, so only the local server has them. On the hosted server (`mcp.hostinger.com`) `search` does not find them — upload the files yourself as below.
+`hosting_deploy` with `path` and the `agency-hosting_deploy-*` operations read files from this machine, so only the local server has them. The hosted server (`mcp.hostinger.com`) has `hosting_deploy` for Git repositories only (step 4) and `hosting_get-deployment` (step 3); to deploy files from this machine there, upload them yourself as below.
 
-### Without the local deploy operations (hosted server; on the local server only for Agency)
+### Without the local deploy operations (local files on the hosted server; Agency on either server)
 
 1. Get upload credentials: `hosting_files_generate-upload-url` (`username`, `domain`); Agency: `agency-hosting_files_generate-upload-url` (`website_uid`). Both return `url`, `auth_key` and `rest_auth_key`, which authenticate the upload instead of the API token.
 2. Upload each file with TUS, where `DEST` is its path in the website's storage:
@@ -72,35 +72,24 @@ curl -sS -X PATCH "$URL/$DEST?override=true" -H "X-Auth: $AUTH_KEY" -H "X-Auth-R
 
 ## 3. Node.js builds
 
-`hosting_deploy` returns a `buildUuid` at once; the build runs on the server and takes minutes. Track it with `hosting_get-deployment` (`domain`, optionally `buildUuid`; the latest build by default), polling every 10–20 s until `build.state` is `completed` or `failed`. It returns the build, its log and the stored build settings; pass the previous `logs.lines` as `fromLine` to read only new output.
+`hosting_deploy` returns a `buildUuid` at once; the build runs on the server and takes minutes. Track it — and a build started with `hosting_nodejs_start-build` after an upload — with `hosting_get-deployment` (`domain`, optionally `buildUuid`; the latest build by default), polling every 10–20 s until `build.state` is `completed` or `failed`. It returns the build, its log and the stored build settings; pass the previous `logs.lines` as `fromLine` to read only new output.
 
 - Failed build: the response already carries `analysis` (fetched once per build; the API allows 5 a minute).
 - Wrong detection (framework, `output_directory`, or an entry file inside the build output, such as `dist/server.js` for a compiled app): deploy again with `appType`, `outputDirectory`, `buildScript` or `entryFile` set. An archive deploy sends its settings with the request and leaves the stored ones alone; a Git deploy also stores these values, so later pushes build with them.
 
-On the hosted server, which has no `hosting_deploy` or `hosting_get-deployment`:
+Local files on the hosted server, deployed from an upload (step 2):
 
-- After the upload steps below, start the build and track it with `hosting_nodejs_list-builds` and `hosting_nodejs_build` (by `uuid`), polling every 10–20 s.
-- Failed build: `hosting_nodejs_analyse-failed-build` once per build (5 calls a minute), then `hosting_nodejs_build-logs` if the analysis is empty.
-- Wrong detection: run `hosting_nodejs_start-build` with explicit values, `source_type: "archive"` and `source_options.archive_path` set to the archive's file name in the document root (check it is there with `hosting_files_list-website-and-directories`). Store the same values with `hosting_nodejs_update-build-settings`.
+- Wrong detection: run `hosting_nodejs_start-build` again with explicit values, `source_type: "archive"` and `source_options.archive_path` set to the archive's file name in the document root (check it is there with `hosting_files_list-website-and-directories`). Store the same values with `hosting_nodejs_update-build-settings`.
 - To review detected settings before any build: upload the archive with `hosting_files_generate-upload-url` (the TUS steps are in its description), then `hosting_nodejs_build-settings-from-archive`.
 
 ## 4. Auto-deploy from Git
 
-On the local server, `hosting_deploy` with `git: { repository: "owner/name", branch }` does all of it: it finds the Git installation that can reach the repository and deploys it as the `type` you give. Always pass `type: "static"` or `"nodejs"` unless the site already runs a Node.js app (or you pass Node.js settings such as `appType`): a new site is not detected as Node.js, and a Node.js repository deployed as static would publish its source. Then:
+On both the local and the hosted server, `hosting_deploy` with `git: { repository: "owner/name", branch }` does all of it: it finds the Git installation that can reach the repository and deploys it as the `type` you give. Always pass `type: "static"` or `"nodejs"` unless the site already runs a Node.js app (or you pass Node.js settings such as `appType`): a new site is not detected as Node.js, and a Node.js repository deployed as static would publish its source. Then:
 - **PHP and static sites:** saves the auto-deployment settings, which deploys the branch immediately and again on every push;
 - **Node.js sites:** starts a build of the branch with the stored build settings; later pushes build the same way. A Git deploy has nothing to detect from, so when none are stored pass `appType` and `nodeVersion` (from `engines` in `package.json`), plus `outputDirectory` and `buildScript` if the app has a build step; they are stored for those pushes.
 
 With no active installation it stops and says so: the user connects GitHub or GitLab once in hPanel under Websites → Manage → Advanced → Git; there is no API for that step. Confirm with `hosting_get-deployment`, which returns the stored `gitAutoDeployment`.
 
-On the hosted server, by hand:
-
-1. `hosting_git_list-installations`. With no `active` installation (check `status: "pending"` and `"suspended"` too), the user connects GitHub or GitLab once in hPanel, as above.
-2. `hosting_git_list-installation-repositories` with the installation `uuid` gives `owner`, `name` and `default_branch` (10 calls a minute).
-3. `hosting_git_update-auto-deployment-settings` with `installation_uuid`, `owner`, `repository`, `branch` and optional `directory`.
-   - PHP and static sites deploy the branch immediately and again on every push.
-   - Node.js sites clone nothing on save: start the first build with `hosting_nodejs_start-build`, `source_type: "git"` and the same `source_options`. Later pushes build with the stored settings, so keep `hosting_nodejs_update-build-settings` correct.
-4. Confirm with `hosting_git_auto-deployment-settings`.
-
 Agency Plan sites have no Git operations; deploy archives.
 
 ## 5. Environment variables (Node.js)

package/skills/headless/steps/05-design/SKILL.md

@@ -307,14 +307,14 @@ palette (base and surface colours count).
 ### Build it with the logo kit
 
 The kit (`logo-kit.mjs`, next to this file) does the error-prone parts: it outlines letters into
-vector paths, sets text on a circle, draws the outline-and-shadow treatment, measures, and validates
-the output. You write the composition. Copy the kit into `brand/` so the build is self-contained
-and a redesign can re-run it:
+vector paths, sets text on a circle, draws the outline-and-shadow treatment, measures, validates
+the output, checks the sizes and renders a preview. You write the composition. Copy the kit into
+`brand/` so the build is self-contained and a redesign can re-run it:
 
 ```bash
 mkdir -p ~/.hostinger/<domain>/brand && cd ~/.hostinger/<domain>/brand
 cp <the folder this SKILL.md is in>/logo-kit.mjs .
-npm init -y >/dev/null && npm i opentype.js @fontsource/<display-slug>
+npm init -y >/dev/null && npm i opentype.js @resvg/resvg-js @fontsource/<display-slug>
 ```
 
 Write `brand/logo-build.mjs`, import from `./logo-kit.mjs`, and always run it from `brand/`
@@ -329,7 +329,13 @@ Write `brand/logo-build.mjs`, import from `./logo-kit.mjs`, and always run it fr
 | `arcText(font, text, { cx, cy, r, size })` | Letters around a circle, for seals |
 | `sticker(d, { fill, ink, strokeWidth, shadow, shadowColor, transform })` | Ink outline + hard offset shadow, for outlined directions. On dark backgrounds give the outline and shadow a palette colour that shows (`shadowColor` defaults to `ink`) |
 | `svgDoc({ width, height, title, body })` | Root SVG with `role="img"` and a `<title>` |
-| `check(svg)` | Throws on `NaN`, live `<text>`, a missing title or viewBox. Run it on every file before writing |
+| `check(svg)` | Throws on `NaN`, live `<text>`, a missing title or viewBox, or an `&` that isn't an XML entity. Run it on every file before writing |
+| `tile(size, fill)` | The rounded tile for the mark and favicon; draw the symbol after it |
+| `widthBudget(letterHeight, height)` | The widest viewBox that still fits 192 px on small screens, for a logo of that height; see below |
+| `checkLogo({ logo, mark, favicon, letterHeight, background })` | Runs `check()` on all three files, checks their sizes and renders `brand/logo-preview.png`; see below |
+
+Wrap every file in `svgDoc()`, never a hand-written `<svg>` or `<title>`: it escapes the site name,
+and one bare `&` (as in "Salt & Pepper") makes the browser show nothing.
 
 Never call opentype's `path.toPathData()` directly; the kit's serializer exists because opentype.js
 2.0 writes `NaN` into some paths, and browsers silently stop drawing at the first `NaN`.
@@ -339,27 +345,48 @@ Never call opentype's `path.toPathData()` directly; the kit's serializer exists
 | File | What | Must read clearly at |
 |---|---|---|
 | `brand/logo.svg` | The primary, mostly horizontal logo for the header | Its header display heights (desktop and small screens) |
-| `brand/logo-mark.svg` | A square icon from the same idea (initial, monogram or the swapped symbol) on a solid rounded tile (corner radius ≈ ¼ of the side) in a palette colour | 32 px |
+| `brand/logo-mark.svg` | A square icon from the same idea (initial, monogram or the swapped symbol) on a `tile()` in a palette colour | 32 px |
 | `brand/favicon.svg` | The simplest form of the mark: same tile, no shadow, no thin details, outlines thickened if it has any | 16 px, on both light and dark browser tab bars |
 | `brand/logo-build.mjs` | The script that built them, with `package.json`, kept so a redesign can adjust it | — |
 
 Add `brand/logo-seal.svg` only if the direction uses a seal as a secondary mark. Delete
 `brand/node_modules` when you're done; a redesign runs `npm i` in `brand/` first.
 
-**Check the sizes.** Display heights are multiples of 8, with one for desktop and one for small
-screens (they may be equal). Work them out from the viewBox:
-
-- **Letter size:** letter height on screen = letter height ÷ viewBox height × display height, and it
-  must be ≥ 16 px. Use `xHeight` when the logo is mostly lowercase and `capHeight` when it's mostly
-  capitals; for mixed fonts, take the smaller word. A two-line lockup usually needs 64 px.
-- **Headroom:** `pathBox` covers the letters, not what you add. Leave room above for accents (Ė, Ž, Å sit above cap height) and below for descenders, plus whatever bounce, tilt, outline and shadow add, so nothing touches the viewBox edge.
-- **Width:** width on screen = viewBox width ÷ viewBox height × display height. At the small-screen
-  height it must be **≤ 192 px**, which leaves room for the menu button in a 320 px header. If it
-  doesn't fit, lower the small-screen height (letters still ≥ 16 px), simplify the logo, or show
-  `logo-mark.svg` with the name beside it on small screens.
-- **Look at it.** If you have a browser, render the files at both header heights, 32 px and 16 px,
-  the favicon on a light and a dark background, and fix anything that reads wrong. Without a
-  browser, rely on the numbers and list "logo not visually checked" under gaps in the final report.
+**Compose within the budget, so the first build passes.** The small-screen logo is at most 192 px
+wide with letters at least 16 px tall, so the whole logo can be only about 10–12 times as wide as
+its smallest letters are tall, whatever its height. On one line that's about ten letters plus a
+symbol; a longer name stacks or tags, and a second word set at half size halves the room. Size the
+viewBox in `logo-build.mjs` against `widthBudget(letterHeight, viewBoxHeight)`, the exact limit at
+the heights the kit picks; with your own `heights`, the FAIL line gives the limit. Draw the mark's
+symbol from simple, recognisable shapes that still read at 32 px; fine natural forms like petals or
+leaves turn to mush.
+
+**Check the sizes and look at it after every build.** `letterHeight` is in viewBox units: the
+`xHeight` from `layout()` when the logo is mostly lowercase, `capHeight` when it's mostly capitals;
+for mixed fonts, the smaller word's. End `logo-build.mjs` with:
+
+```js
+checkLogo({ logo, mark, favicon, letterHeight, background: '<page background colour>' });
+```
+
+It picks the header heights for you: `--logo-h-sm` is the smallest multiple of 8 that makes the
+letters 16 px, and `--logo-h` the same but at least 48 px, both at most 80 px, so a stacked lockup
+keeps its words large or sets the mark beside them. Pass `heights: { desktop, small }` only when the
+direction needs a larger header logo. It first prints `--logo-h`, `--logo-h-sm` and the **Measured**
+line for `design.md`, then PASS or FAIL for the logo's letters ≥ 16 px at both
+heights, width ≤ 192 px on small screens, headroom around everything drawn and heights in multiples
+of 8; for the mark and favicon sitting on a `tile()` with nothing clipped and room around
+the symbol; and for no shadow on the favicon. Every FAIL names its fixes and the number to reach. It
+then renders `logo-preview.png` (the logo at both heights on the page background, the mark at 32 px
+and favicon at 16 px on light and dark strips, each also enlarged), and throws if anything failed.
+
+Then read `logo-preview.png`; don't search for another renderer or read the SVG source. Rebuild only
+for a FAIL line or something in the preview that reads wrong, such as collisions, a clipped or
+clearly off-centre mark, or a favicon detail that turns to mush, and fix everything you saw in one
+rebuild. Optical nudges of a few pixels and the header height aren't reasons to rebuild. A symbol
+gets one redraw: if it still reads wrong, replace it with a simpler form of the idea, such as the
+initial, in the next build. If the kit says "preview not rendered", rely on the size check and list
+"logo not visually checked" under gaps in the final report.
 
 The logo is exempt from text-contrast minimums, but the header link around it needs `alt` = the site
 name and a target of at least 24 px.

package/skills/headless/steps/05-design/logo-kit.mjs

@@ -6,18 +6,27 @@
 //
 // Workflow (from ~/.hostinger/<domain>/brand/, so packages and this kit sit next to the build):
 //   cp <installed skill>/steps/05-design/logo-kit.mjs .
-//   npm init -y && npm i opentype.js @fontsource/<display-family-slug>
+//   npm init -y && npm i opentype.js @resvg/resvg-js @fontsource/<display-family-slug>
 //   node logo-build.mjs          // your script: import { … } from './logo-kit.mjs'
+//                                // then read logo-preview.png
 //   rm -rf node_modules          // package.json keeps the deps; a redesign runs `npm i` again
 //
 // Packages resolve from the current working directory, so run the build from brand/.
 
 import { createRequire } from 'node:module';
-import { readFileSync } from 'node:fs';
+import { readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 
 const requireFromCwd = createRequire(join(process.cwd(), 'logo-build.js'));
 const opentype = requireFromCwd('opentype.js');
+// Optional: without resvg the kit still builds logos, it just can't measure what's drawn or render.
+const Resvg = (() => {
+  try {
+    return requireFromCwd('@resvg/resvg-js').Resvg;
+  } catch {
+    return null;
+  }
+})();
 
 // @fontsource splits each weight into unicode subsets; `latin` alone has no ą č ę ė į š ų ū ž,
 // ő, ł, đ… so load every subset that exists and look each character up across them.
@@ -62,6 +71,8 @@ export function loadFont(slug, weight = 400, style = 'normal') {
   return primary;
 }
 
+const VIEWBOX = /viewBox="0 0 ([\d.]+) ([\d.]+)"/;
+
 const num = (v) => {
   if (!Number.isFinite(v)) throw new Error(`logo-kit: non-finite coordinate ${v}`);
   return +v.toFixed(2);
@@ -174,11 +185,16 @@ export function arcText(font, text, { cx, cy, r, size, startDeg = -90, fill = tr
 export function sticker(d, { fill, ink = '#000', strokeWidth = 8, shadow = 8, shadowColor = ink, transform = '' }) {
   const t = transform ? ` transform="${transform}"` : '';
   const shade = shadow
-    ? `<path d="${d}" fill="${shadowColor}" stroke="${shadowColor}" stroke-width="${strokeWidth}" stroke-linejoin="round" transform="translate(${shadow} ${shadow})"/>`
+    ? `<path data-kit="shadow" d="${d}" fill="${shadowColor}" stroke="${shadowColor}" stroke-width="${strokeWidth}" stroke-linejoin="round" transform="translate(${shadow} ${shadow})"/>`
     : '';
   return `<g${t}>${shade}<path d="${d}" fill="${fill}" stroke="${ink}" stroke-width="${strokeWidth}" stroke-linejoin="round" paint-order="stroke"/></g>`;
 }
 
+/** The solid rounded tile behind `logo-mark.svg` and `favicon.svg`; draw the symbol after it. */
+export function tile(size, fill) {
+  return `<rect data-kit="tile" width="${num(size)}" height="${num(size)}" rx="${num(size / 4)}" fill="${fill}"/>`;
+}
+
 /** Root SVG with an accessible name. Pass a distinct `id` if two logos are inlined on one page. */
 export function svgDoc({ width, height, title, body, id = 'logo-title' }) {
   const esc = String(title).replace(/&/g, '&amp;').replace(/</g, '&lt;');
@@ -187,15 +203,228 @@ export function svgDoc({ width, height, title, body, id = 'logo-title' }) {
 
 /**
  * Validate a finished SVG string before writing it. Throws on: NaN/undefined/Infinity in the
- * markup, live <text> (the logo must be outlined), a missing <title>, or a missing viewBox.
+ * markup, live <text> (the logo must be outlined), a missing <title>, a missing viewBox, or an "&" that
+ * doesn't start an XML entity (a browser shows nothing for an SVG file that isn't well-formed XML).
  * @returns {{ bytes: number }}
  */
 export function check(svg) {
+  const problems = markupProblems(svg);
+  if (problems.length) throw new Error(`logo-kit check failed: ${problems.join('; ')}`);
+  return { bytes: Buffer.byteLength(svg) };
+}
+
+function markupProblems(svg) {
   const problems = [];
   if (/NaN|undefined|Infinity/.test(svg)) problems.push('contains NaN/undefined/Infinity');
+  if (/&(?!(?:amp|lt|gt|quot|apos|#\d+|#x[\dA-Fa-f]+);)/.test(svg)) {
+    problems.push('contains a bare "&" or an HTML-only entity such as &nbsp;; build the file with svgDoc(), which escapes the title');
+  }
   if (/<text[\s>]/.test(svg)) problems.push('contains <text>; outline the letters with textPath/glyphPath');
   if (!/<title[^>]*>[^<]+<\/title>/.test(svg)) problems.push('missing <title>');
-  if (!/viewBox="0 0 [\d.]+ [\d.]+"/.test(svg)) problems.push('missing or invalid viewBox');
-  if (problems.length) throw new Error(`logo-kit check failed: ${problems.join('; ')}`);
-  return { bytes: Buffer.byteLength(svg) };
+  if (!VIEWBOX.test(svg)) problems.push('missing or invalid viewBox');
+  return problems;
+}
+
+const MIN_LETTER_PX = 16;
+const MAX_SMALL_WIDTH_PX = 192;
+const MIN_DESKTOP_PX = 48;
+const MAX_HEADER_PX = 80; // automatic heights only: taller header logos crowd the nav, and stacked lockups reached 144
+const HEADROOM = 0.02; // of the viewBox height, on every edge
+const CLIP_SLACK = 0.5; // viewBox units of anti-aliasing a "nothing outside the viewBox" check allows
+
+function viewBoxOf(svg) {
+  const m = svg.match(VIEWBOX);
+  if (!m) throw new Error('logo-kit: missing or invalid viewBox');
+  return { width: +m[1], height: +m[2] };
+}
+
+/** Gap between everything drawn (strokes, shadows, transforms) and each viewBox edge, smallest first. */
+function edgeGaps(svg, vb) {
+  const b = new Resvg(svg).getBBox();
+  if (!b) return [];
+  const gaps = { top: b.y, bottom: vb.height - b.y - b.height, left: b.x, right: vb.width - b.x - b.width };
+  return Object.entries(gaps).sort((a, b) => a[1] - b[1]);
+}
+
+const px = (v) => +v.toFixed(1);
+const ceil1 = (v) => Math.ceil(v * 10) / 10;
+const ceil8 = (v) => Math.ceil(v / 8) * 8;
+const floor8 = (v) => Math.floor(v / 8) * 8;
+
+const minHeaderPx = (letterHeight, height) => ceil8((MIN_LETTER_PX * height) / letterHeight);
+const maxWidthAt = (height, smallPx) => Math.floor((MAX_SMALL_WIDTH_PX * height) / smallPx);
+
+function autoHeights(letterHeight, height) {
+  const small = Math.min(minHeaderPx(letterHeight, height), MAX_HEADER_PX);
+  return { desktop: Math.max(small, MIN_DESKTOP_PX), small };
+}
+
+/**
+ * The widest viewBox a logo of this height can have and still fit 192 px on small screens at the
+ * height `checkLogo` picks. Call it while composing, before the first build: it is roughly
+ * 10–12 × `letterHeight`, so a long name stacks or tags instead of running on one line.
+ * @param {number} letterHeight viewBox units, as passed to `checkLogo`
+ * @param {number} height the viewBox height
+ */
+export function widthBudget(letterHeight, height) {
+  return maxWidthAt(height, autoHeights(letterHeight, height).small);
+}
+
+/** Collects PASS/FAIL/SKIP lines; `print` returns how many failed. */
+function sizeReport(label, vb) {
+  const lines = [];
+  return {
+    rule(ok, text, fix) {
+      lines.push(ok ? `PASS ${text}` : `FAIL ${text} → ${fix}`);
+    },
+    skip(text) {
+      lines.push(`SKIP ${text}`);
+    },
+    headroom(svg, of) {
+      if (!Resvg) return this.skip('headroom: install @resvg/resvg-js to measure it');
+      const [edge, gap] = edgeGaps(svg, vb)[0] ?? [];
+      if (edge === undefined) return this.skip(`headroom: nothing drawn on ${of}`);
+      const min = HEADROOM * vb.height;
+      this.rule(gap >= min, `headroom ${px(gap)} at the ${edge} of ${of} (≥ ${px(min)} viewBox units)`,
+        `add ${ceil1(min - gap)} viewBox units at the ${edge}: grow the viewBox on that side or move the drawing in; accents, descenders, tilt, outline and shadow all need room`);
+    },
+    print() {
+      console.log(`${label} (viewBox ${px(vb.width)} × ${px(vb.height)}):`);
+      for (const line of lines) console.log(`  ${line}`);
+      return lines.filter((l) => l.startsWith('FAIL')).length;
+    },
+  };
+}
+
+function logoSizes(svg, { letterHeight, heights }) {
+  if (!letterHeight || (heights && (!heights.desktop || !heights.small))) {
+    throw new TypeError('logo-kit checkLogo: pass letterHeight, and heights: { desktop, small } only to set both');
+  }
+  const vb = viewBoxOf(svg);
+  const report = sizeReport('logo.svg', vb);
+  const minHeaderH = minHeaderPx(letterHeight, vb.height);
+  const maxSmall = floor8((MAX_SMALL_WIDTH_PX * vb.height) / vb.width);
+  const { desktop, small } = heights ?? autoHeights(letterHeight, vb.height);
+  const lettersAt = (h) => (letterHeight / vb.height) * h;
+  const width = (vb.width / vb.height) * small;
+  const canLowerSmall = small > minHeaderH && minHeaderH <= maxSmall;
+  const widthFixes = [
+    ...(canLowerSmall ? [`--logo-h-sm ${minHeaderH === maxSmall ? minHeaderH : `${minHeaderH}–${maxSmall}`} px passes both`] : []),
+    `make the viewBox at most ${maxWidthAt(vb.height, small)} units wide (now ${px(vb.width)}) at this height: stack or tag the words, tighten gaps, or show logo-mark.svg with the name beside it on small screens`,
+  ];
+
+  report.rule(desktop % 8 === 0 && small % 8 === 0, `heights ${desktop} / ${small} px are multiples of 8`, 'round them to multiples of 8');
+  const capped = !heights && minHeaderH > MAX_HEADER_PX;
+  const minLetterAtCap = ceil1((MIN_LETTER_PX * vb.height) / MAX_HEADER_PX);
+  const maxHeightAtCap = Math.floor((letterHeight * MAX_HEADER_PX) / MIN_LETTER_PX);
+  const lettersFixes = (name) => capped
+    ? [`the header logo stops at ${MAX_HEADER_PX} px: make letterHeight at least ${minLetterAtCap} viewBox units (now ${px(letterHeight)})`,
+      `make the viewBox at most ${maxHeightAtCap} units tall (now ${px(vb.height)}): trim empty space or set the mark beside the words instead of above them`]
+    : [`raise ${name} to ${minHeaderH} px or more`, 'enlarge the letters inside the viewBox', 'trim empty viewBox space'];
+  const letterChecks = desktop === small ? [['--logo-h and --logo-h-sm', small]] : [['--logo-h', desktop], ['--logo-h-sm', small]];
+  for (const [name, h] of letterChecks) {
+    report.rule(lettersAt(h) >= MIN_LETTER_PX, `letters ${px(lettersAt(h))} px tall at ${name} ${h} px (≥ ${MIN_LETTER_PX})`,
+      lettersFixes(name).join(', or '));
+  }
+  report.rule(width <= MAX_SMALL_WIDTH_PX, `width ${px(width)} px at --logo-h-sm ${small} px (≤ ${MAX_SMALL_WIDTH_PX})`,
+    widthFixes.join(', or '));
+  report.headroom(svg, 'the viewBox');
+  const measured = `- **Measured:** letters ${px(lettersAt(small))} px tall at \`--logo-h-sm\`; width ${px(width)} px at \`--logo-h-sm\``;
+  return { report, heights: { desktop, small }, measured };
+}
+
+function tileChecks(svg, { favicon = false } = {}) {
+  const vb = viewBoxOf(svg);
+  const report = sizeReport(favicon ? 'favicon.svg' : 'logo-mark.svg', vb);
+  const tileTag = svg.match(/<rect data-kit="tile"[^>]*\/>/)?.[0];
+  report.rule(Boolean(tileTag), 'drawn on a tile()', "draw the tile with the kit's tile(size, fill)");
+  if (!Resvg) report.skip('clipping: install @resvg/resvg-js to measure it');
+  else {
+    const gap = edgeGaps(svg, vb)[0]?.[1] ?? 0;
+    report.rule(gap >= -CLIP_SLACK, 'nothing drawn outside the viewBox', 'shrink or move the drawing in; the tile already fills the viewBox');
+  }
+  if (tileTag) report.headroom(svg.replace(tileTag, ''), 'the tile');
+  if (favicon) {
+    report.rule(!/data-kit="shadow"|<filter|drop-shadow/.test(svg), 'no shadow', 'pass shadow: 0 to sticker() and draw no other shadow');
+  }
+  return report;
+}
+
+function renderPreview({ logo, mark, favicon, heights, background, out }) {
+  const render = (svg, h, zoom) => {
+    const img = new Resvg(svg, { fitTo: { mode: 'height', value: h } }).render();
+    return { w: img.width * zoom, h: img.height * zoom, href: `data:image/png;base64,${img.asPng().toString('base64')}` };
+  };
+  const tiles = (fill) => ({ fill, items: [render(mark, 32, 1), render(mark, 32, 4), render(favicon, 16, 1), render(favicon, 16, 8)] });
+  const bands = [
+    {
+      label: `logo.svg at --logo-h ${heights.desktop} px and --logo-h-sm ${heights.small} px, then 2×, on the page background`,
+      fill: background,
+      items: [render(logo, heights.desktop, 1), render(logo, heights.small, 1), render(logo, heights.desktop, 2), render(logo, heights.small, 2)],
+    },
+    { label: 'light: logo-mark.svg at 32 px and 4×, favicon.svg at 16 px and 8×', ...tiles('#f1f3f4') },
+    { label: 'dark: the same', ...tiles('#202124') },
+  ];
+  const PAD = 16;
+  const LABEL = 28;
+  let body = '';
+  let y = 0;
+  let width = 480;
+  for (const { label, fill, items } of bands) {
+    const rowH = Math.max(...items.map((i) => i.h)) + PAD * 2;
+    body += `<text x="${PAD}" y="${y + 19}" font-family="sans-serif" font-size="13" fill="#555">${label}</text>`;
+    y += LABEL;
+    body += `<rect y="${y}" width="100%" height="${rowH}" fill="${fill}"/>`;
+    let x = PAD;
+    for (const i of items) {
+      body += `<image href="${i.href}" x="${x}" y="${y + (rowH - i.h) / 2}" width="${i.w}" height="${i.h}" image-rendering="optimizeSpeed"/>`;
+      x += i.w + PAD * 2;
+    }
+    width = Math.max(width, x - PAD);
+    y += rowH;
+  }
+  const sheet = `<svg xmlns="http://www.w3.org/2000/svg" width="${width}" height="${y}"><rect width="100%" height="100%" fill="#fff"/>${body}</svg>`;
+  writeFileSync(out, new Resvg(sheet).render().asPng());
+}
+
+/**
+ * Check the three finished files and render one PNG to look at instead of the SVG source.
+ * Throws first if any file fails `check()`.
+ * - logo.svg: letters ≥ 16 px at both header heights, width ≤ 192 px on small screens, 2% headroom
+ *   around everything drawn, heights in multiples of 8. Without `heights`, `--logo-h-sm` is the
+ *   smallest multiple of 8 that makes the letters 16 px, and `--logo-h` the same but at least 48 px;
+ *   both stop at 80 px, so letters too small for 80 px fail.
+ * - logo-mark.svg, favicon.svg: drawn on a `tile()`, nothing outside the viewBox, 2% headroom
+ *   around the symbol; the favicon has no shadow.
+ * - logo-preview.png: the logo at both heights on the page background, the mark at 32 px and the
+ *   favicon at 16 px on a light and a dark strip, each also enlarged with hard pixels.
+ * Prints the heights and the Measured line first, then every PASS/FAIL line, each failure with its
+ * fixes, renders the preview, then throws if anything failed.
+ * @param {object} o
+ * @param {number} o.letterHeight viewBox units: `layout().xHeight` (mostly lowercase) or
+ *   `.capHeight` (capitals) of the smaller word
+ * @param {{ desktop: number, small: number }} [o.heights] set both header heights yourself
+ * @param {string} [o.background] the page background colour
+ * @returns {{ heights: { desktop: number, small: number }, measured: string }} heights for
+ *   `--logo-h` / `--logo-h-sm`, and the design.md → Logo → **Measured** line
+ */
+export function checkLogo({ logo, mark, favicon, letterHeight, heights, background = '#ffffff', out = 'logo-preview.png' }) {
+  // resvg can't measure or render a file check() rejects, so these fail before any size line.
+  const broken = Object.entries({ 'logo.svg': logo, 'logo-mark.svg': mark, 'favicon.svg': favicon })
+    .flatMap(([name, svg]) => markupProblems(svg).map((p) => `${name}: ${p}`));
+  if (broken.length) throw new Error(`logo-kit checkLogo: ${broken.join('; ')}`);
+  const sizes = logoSizes(logo, { letterHeight, heights });
+  // First, so piping the output through `head` can't cut them off.
+  console.log(`--logo-h: ${sizes.heights.desktop}px; --logo-h-sm: ${sizes.heights.small}px`);
+  console.log(sizes.measured);
+  const reports = [sizes.report, tileChecks(mark), tileChecks(favicon, { favicon: true })];
+  const failed = reports.reduce((n, r) => n + r.print(), 0);
+  if (Resvg) {
+    renderPreview({ logo, mark, favicon, heights: sizes.heights, background, out });
+    console.log(`preview: read ${out}`);
+  } else {
+    console.log('preview not rendered: @resvg/resvg-js is not installed; list "logo not visually checked" under gaps');
+  }
+  if (failed) throw new Error(`logo-kit checkLogo: ${failed} check(s) failed, see the FAIL lines above`);
+  return { heights: sizes.heights, measured: sizes.measured };
 }

package/skills/headless/steps/06-frontend/SKILL.md

@@ -103,6 +103,12 @@ Read the backend from `site.json`:
   `yoast_head_json` into the page `<head>` (title, description, Open Graph, JSON-LD schema) — Yoast is
   installed by default at provision (`site.json → seo.enabled: true`). If `seo.enabled` is `false`
   (Yoast absent), fall back to generating per-page title/description/OG tags from each item's content.
+  - **Decode WordPress text.** WordPress returns titles and names HTML-encoded (`Tea &#038; Cake`,
+    `don&#8217;t`). Add the `entities` package and, in the one data module, run every title, name
+    and SEO field you render as plain text (posts, pages, terms, Yoast, Store API products and
+    categories) through `decodeHTML` once; strip an excerpt's tags first if you show it as text.
+    Leave HTML fields (`content.rendered`, an excerpt shown as HTML) as they are, and never inject a
+    decoded field as raw HTML.
   - **Contact form** (`site.json → contact_form.enabled: true`, any WordPress backend) → render the
     contact page's form and submit it **client-side** to Contact Form 7's public feedback endpoint. Put a
     `submitContactForm(data)` helper in the one data module: build a `FormData` with the field names from

package/skills/headless/steps/08-deploy/SKILL.md

@@ -12,6 +12,11 @@ serves the result. **Out:** `deploy.json`.
 This is an **instance-barrier** step: run it only after `provision.status == "completed"` and validate
 (if run) has passed. All operations go through the connector (`execute`).
 
+> **Connected to the hosted server (`mcp.hostinger.com`)?** Its `hosting_deploy` deploys Git
+> repositories only and cannot read a local `path`. Run this step through the local
+> `hostinger-api-mcp` server instead (see the connect step:
+> `npx --yes --package=@hostinger/mcp@latest hostinger-api-mcp`).
+
 **In:** the project in `~/.hostinger/<domain>/src/`, `site.json` (`username`, `urls`), `state.json`
 (`frontend.framework`, `frontend.rendering`).
 
@@ -188,7 +193,7 @@ Update `state.json` (`stage` → `done`), then continue to Step 9 (done).
 
 ## Note — one deploy path, and never `type: "static"`
 
-`hosting_deploy` is the only path: give its `path` either the source **directory** (it archives it for
+`hosting_deploy` on the local server is the only path: give its `path` either the source **directory** (it archives it for
 you) or a local **archive** (`zip`, `tar`, `tar.gz`, `tgz`, `7z`) — there is no separate upload or build
 step to fall back to. Either way pass the explicit `appType`/`outputDirectory`/`nodeVersion`/
 `buildScript`/`packageManager`/`rootDirectory` from the table. Never deploy a headless site with

package/skills/migrate-to-hosting/SKILL.md

@@ -41,7 +41,7 @@ Create the Hostinger website on the domain being migrated, not on a free subdoma
 
 ## 3. Import
 
-`hosting_deploy` and `agency-hosting_deploy-php-application` read files from this machine and exist only in the local `hostinger-api-mcp` server. On the hosted server (`mcp.hostinger.com`), upload the files first as described in the `deploy-to-hosting` skill ("Without the local deploy operations") and use the operation named in brackets below.
+`hosting_deploy` with `path` and `agency-hosting_deploy-php-application` read files from this machine, so only the local `hostinger-api-mcp` server has them; the hosted server's `hosting_deploy` deploys Git repositories only. On the hosted server (`mcp.hostinger.com`), upload the files first as described in the `deploy-to-hosting` skill ("Without the local deploy operations") and use the operation named in brackets below.
 
 **WordPress, Shared and Cloud:** `hosting_deploy` with `domain`, `path` (the site directory or its archive), `databaseDump` and `type: "wordpress-site"` uploads both, extracts the files and imports the database; large sites take several minutes. Always pass `type`: left to detection, a directory without `wp-config.php` or `wp-content` at its top level is taken for a plain site and the dump is not imported. [Upload `site.zip` and `dump.sql`, then `wordpress_installations_import-website` with `archive_path` and `sql_path`.] Then `wordpress_installations_detect` with `username` and poll `wordpress_installations_list` with `domain` until the install appears with `is_valid: true`.
 

package/skills/troubleshoot-website/SKILL.md

@@ -44,9 +44,9 @@ dig +short NS DOMAIN; dig +short A DOMAIN; dig +short CAA DOMAIN
 
 ### Node.js (`nodejs`)
 
-Batch `hosting_get-deployment` (the latest build with its log, failure analysis and stored settings), `hosting_nodejs_runtime-logs` (`period: "1h"`, `levels: ["ERROR", "WARN"]`) and `hosting_nodejs_list-environment-variables` (keys only; values always come back masked). On the hosted server, which has no `hosting_get-deployment`, use `hosting_nodejs_list-builds` (`per_page: 3`) in its place.
+Batch `hosting_get-deployment` (the latest build with its log, failure analysis and stored settings), `hosting_nodejs_runtime-logs` (`period: "1h"`, `levels: ["ERROR", "WARN"]`) and `hosting_nodejs_list-environment-variables` (keys only; values always come back masked).
 
-- Latest build `failed`: `hosting_get-deployment` already holds the `analysis` (fetched once per build — the API re-runs it on every call and allows 5 a minute). A wrongly detected framework, output directory or missing `entry_file` is the usual cause: compare the returned `buildSettings` with the project and deploy again with corrected `appType`, `outputDirectory`, `buildScript` or `entryFile`; a Git deploy stores them, so pushes build correctly too. On the hosted server: `hosting_nodejs_analyse-failed-build` once for that build, then `hosting_nodejs_build-logs`; compare `hosting_nodejs_build-settings`, rebuild through `hosting_nodejs_start-build` and store the values with `hosting_nodejs_update-build-settings`.
+- Latest build `failed`: `hosting_get-deployment` already holds the `analysis` (fetched once per build — the API re-runs it on every call and allows 5 a minute). A wrongly detected framework, output directory or missing `entry_file` is the usual cause: compare the returned `buildSettings` with the project and deploy again with corrected `appType`, `outputDirectory`, `buildScript` or `entryFile`; a Git deploy stores them, so pushes build correctly too. A site deployed on the hosted server from uploaded files has no `hosting_deploy` to repeat: rebuild through `hosting_nodejs_start-build` with the corrected values and store them with `hosting_nodejs_update-build-settings`.
 - Build `completed` but the app errors: read the runtime logs; entries older than `last_deployed_at` belong to the previous deploy. A variable the code reads but the key list lacks is fixed with the `deploy-to-hosting` skill's environment step. `Access denied for user '…'@'::1'` means the app connects to `localhost` — `DB_HOST` must be `127.0.0.1`.
 - Hung process: `hosting_nodejs_restart-application` (restarts without rebuilding).
 

package/src/core/catalog.js

@@ -2,7 +2,8 @@
 // multi-execute over a catalog of API operations. Pure functions only; the
 // runtime supplies the catalog and the function that performs a call.
 // Keep in sync with catalog.ts and with api-remote-mcp's PHP implementation.
-// `hidden` is stdio-only: the hosted server hides nothing, so the PHP side has no such flag.
+// Both servers honour `hidden`: search skips the entry, execute and multi-execute still run
+// it. Each server has its own list (generators.mcp.hidden and generators.remote-mcp.hidden).
 
 export const DEFAULT_SEARCH_LIMIT = 5;
 export const MAX_SEARCH_LIMIT = 20;

package/src/core/catalog.ts

@@ -1,6 +1,7 @@
 // Typed mirror of catalog.js. Keep both files, and api-remote-mcp's PHP
-// implementation, behaviourally identical. `hidden` is stdio-only: the hosted server hides
-// nothing, so the PHP side has no such flag.
+// implementation, behaviourally identical. Both servers honour `hidden`: search skips the
+// entry, execute and multi-execute still run it. Each server has its own list
+// (generators.mcp.hidden and generators.remote-mcp.hidden in the API manifest).
 
 export const DEFAULT_SEARCH_LIMIT = 5;
 export const MAX_SEARCH_LIMIT = 20;

package/src/core/instructions.agency-hosting.js

@@ -1,2 +1,2 @@
 // Auto-generated server instructions
-export default "Hostinger API notes for agents. Find operations with search; the inputSchema it returns is authoritative for request shapes. Run one with execute, or chain several with multi-execute.\n\nDatabases (web hosting, hosting_* operations)\n- MySQL runs on the same server as the website. From the deployed app connect to host 127.0.0.1, port 3306. PHP may also use localhost (Unix socket). Node.js should use 127.0.0.1: localhost can resolve to IPv6 (::1) and not every database user has that grant.\n- The `host` from hosting_databases_list (srvNNNN.hstgr.io) is only for connections from outside Hostinger, after hosting_databases_create-remote-connection. Never use it from the app.\n- Agency Plan (agency-hosting_* operations) database users are created for localhost; the PHP app connects there.\n\nAsynchronous operations\n- A success response often means \"queued\", not \"done\". Poll the matching read operation with backoff (seconds, then minutes). Never re-send the write.\n- hosting_websites_create -> poll hosting_websites_list-setups with the domain until status is completed (a few minutes); file, deploy and database calls return 404/409 before that.\n- hosting_nodejs_start-build -> hosting_nodejs_build; logs via hosting_nodejs_build-logs; on failure hosting_nodejs_analyse-failed-build.\n- wordpress_installations_install and WordPress plugin/theme/core jobs -> poll wordpress_installations_list.\n- agency-hosting_website-setups_create -> poll agency-hosting_website-setups_status with setup_uuid; other Agency Plan jobs -> agency-hosting_websites_list-processes.\n- Website deletion, database repair and domain contact changes finish in the background.\n\nCredentials\n- Never write database passwords or API tokens into source code, client-side JavaScript or committed .env files.\n- Node.js apps read them from environment variables: set the full set with hosting_nodejs_replace-environment-variables (full replace; values are masked on read). Build-time variables (Next.js) need a new build afterwards.\n- PHP apps read them from a config file on the server, outside the repository.\n- Generate strong passwords and do not echo them back once stored.\n\nFor end-to-end site builds install the headless skill: npx skills add hostinger/api-mcp-server";
+export default "Hostinger API notes for agents. Find operations with search; the inputSchema it returns is authoritative for request shapes. Run one with execute, or chain several with multi-execute.\n\nDatabases (web hosting, hosting_* operations)\n- MySQL runs on the same server as the website. From the deployed app connect to host 127.0.0.1, port 3306. PHP may also use localhost (Unix socket). Node.js should use 127.0.0.1: localhost can resolve to IPv6 (::1) and not every database user has that grant.\n- The `host` from hosting_databases_list (srvNNNN.hstgr.io) is only for connections from outside Hostinger, after hosting_databases_create-remote-connection. Never use it from the app.\n- Agency Plan (agency-hosting_* operations) database users are created for localhost; the PHP app connects there.\n\nAsynchronous operations\n- A success response often means \"queued\", not \"done\". Poll the matching read operation with backoff (seconds, then minutes). Never re-send the write.\n- hosting_websites_create -> poll hosting_websites_list-setups with the domain until status is completed (a few minutes); file, deploy and database calls return 404/409 before that.\n- A Node.js deploy or hosting_nodejs_start-build -> poll hosting_get-deployment with the domain until the build state is completed or failed; a failed build comes back with its logs and failure analysis.\n- wordpress_installations_install and WordPress plugin/theme/core jobs -> poll wordpress_installations_list.\n- agency-hosting_website-setups_create -> poll agency-hosting_website-setups_status with setup_uuid; other Agency Plan jobs -> agency-hosting_websites_list-processes.\n- Website deletion, database repair and domain contact changes finish in the background.\n\nCredentials\n- Never write database passwords or API tokens into source code, client-side JavaScript or committed .env files.\n- Node.js apps read them from environment variables: set the full set with hosting_nodejs_replace-environment-variables (full replace; values are masked on read). Build-time variables (Next.js) need a new build afterwards.\n- PHP apps read them from a config file on the server, outside the repository.\n- Generate strong passwords and do not echo them back once stored.\n\nFor end-to-end site builds install the headless skill: npx skills add hostinger/api-mcp-server";