hostinger-api-mcp 3.10.4 → 3.11.1

package/CHANGELOG.md

@@ -4,6 +4,30 @@ Generated at release time from the diff between the previous and current
 build. Tool changes are listed individually; everything else is summarised
 by area.
 
+## v3.11.1 — 2026-10-27
+
+### Operations
+
+- Hid 1 operation from search (it still runs through `execute`): `hosting_nodejs_build-settings-from-repository`
+- Changed the description and input schema of `hosting_deploy`
+
+### Also in this release
+
+- Documentation: `README.md`
+- Bundled agent skills: `skills/deploy-to-hosting/SKILL.md`
+- Request handling and authentication: `src/core/runtime.js`, `src/core/runtime.ts`
+- Other files: `src/core/skills.js`, `src/core/skills.ts`
+- Build and packaging: `types.d.ts`
+
+## v3.11.0 — 2026-10-27
+
+### Also in this release
+
+- Bundled agent skills: 7 files
+- Request handling and authentication: `src/core/catalog.js`, `src/core/catalog.ts`
+- Server instructions: 4 files
+- Other files: `src/core/skills.js`, `src/core/skills.ts`
+
 ## v3.10.4 — 2026-10-27
 
 ### Also in this release

package/README.md

@@ -69,7 +69,7 @@ pnpm update -g @hostinger/mcp
 
 This package installs the following MCP server commands:
 
-- `hostinger-api-mcp` — unified server over every operation (410 total)
+- `hostinger-api-mcp` — unified server over every operation (409 total)
 - `hostinger-agency-hosting-mcp` — 42 operations for agency-hosting
 - `hostinger-agent-readiness-mcp` — 3 operations for agent-readiness
 - `hostinger-billing-mcp` — 9 operations for billing
@@ -77,7 +77,7 @@ This package installs the following MCP server commands:
 - `hostinger-domains-mcp` — 42 operations for domains
 - `hostinger-ecommerce-mcp` — 29 operations for ecommerce
 - `hostinger-horizons-mcp` — 6 operations for horizons
-- `hostinger-hosting-mcp` — 67 operations for hosting
+- `hostinger-hosting-mcp` — 66 operations for hosting
 - `hostinger-mail-mcp` — 38 operations for mail
 - `hostinger-reach-mcp` — 62 operations for reach
 - `hostinger-vps-mcp` — 67 operations for vps
@@ -1816,7 +1816,7 @@ interface in the provided website URL.
 
 #### hosting_deploy
 
-Deploy, publish or upload a website to Hostinger web hosting (Shared, Cloud): static HTML, PHP, a nodejs (Node.js) app, a whole WordPress site, or a WordPress plugin or theme, from a local directory, an archive or a GitHub or GitLab repository. It detects what the project is and does the upload, build and Git setup itself: do not call upload or build operations, and do not archive the directory yourself. WARNING: it overwrites the website's contents and cannot be undone; confirm the domain with the user before deploying to a site that already has content. A Node.js build runs on the server: this returns a buildUuid at once, then call hosting_get-deployment until the build state is completed or failed. A plugin or theme goes into the site's WordPress installation, also when WordPress is in a folder of the document root (headless). Static, PHP, plugin and theme deploys are done when this returns; a WordPress site import only starts, and its files are extracted a few minutes later. From Git, pass type (static or nodejs) unless the site already runs a Node.js app or you pass Node.js settings; a static or PHP site deploys the branch now and again on every push; a Node.js site builds the branch now and on every later push, with the settings stored for the site (when none are stored, pass appType and nodeVersion from the project's engines, plus outputDirectory and buildScript if the app has a build step). Git needs GitHub or GitLab connected once in hPanel.
+Deploy, publish or upload a website to Hostinger web hosting (Shared, Cloud): static HTML, PHP, a nodejs (Node.js) app, a whole WordPress site, or a WordPress plugin or theme, from a local directory, an archive or a GitHub or GitLab repository. It detects what the project is and does the upload, build and Git setup itself: do not call upload or build operations, and do not archive the directory yourself. WARNING: it overwrites the website's contents and cannot be undone; confirm the domain with the user before deploying to a site that already has content. A Node.js build runs on the server: this returns a buildUuid at once, then call hosting_get-deployment until the build state is completed or failed. A plugin or theme goes into the site's WordPress installation, also when WordPress is in a folder of the document root (headless). Static, PHP, plugin and theme deploys are done when this returns; a WordPress site import only starts, and its files are extracted a few minutes later. From Git, pass type (static or nodejs) unless the site already runs a Node.js app or you pass Node.js settings; a static or PHP site deploys the branch now and again on every push; a Node.js site builds the branch now and on every later push, with the settings stored for the site (when none are stored, they are detected from the branch's package.json; pass appType, nodeVersion, outputDirectory, buildScript or entryFile to override them). Git needs GitHub or GitLab connected once in hPanel.
 
 - **Method**: `custom`
 - **Path**: `custom`
@@ -2248,21 +2248,6 @@ to it.
 - **Method**: `POST`
 - **Path**: `/api/hosting/v1/headless/agent-reports`
 
-#### hosting_nodejs_build-settings-from-repository
-
-Determine the build settings for a Node.js application from the package.json file of a branch
-in a Git repository. Use before starting a Git-source build to find out the auto-detected
-settings instead of guessing them.
-
-The repository is read through a Git installation: take `installation_uuid` from
-`List Git installations` and `owner` and `repository` from `List Git installation repositories`.
-
-Returns 422 when the installation is not found, the repository or branch is not found, or
-the branch has no package.json.
-
-- **Method**: `GET`
-- **Path**: `/api/hosting/v1/accounts/{username}/websites/{domain}/nodejs/builds/settings/from-repository`
-
 #### hosting_nodejs_list-environment-variables
 
 Lists the Node.js environment variables currently set for the website. Values are always

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "hostinger-api-mcp",
-  "version": "3.10.4",
+  "version": "3.11.1",
   "description": "Hostinger API — manage domains, DNS, hosting, VPS, billing and more from Gemini CLI.",
   "mcpServers": {
     "hostinger": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hostinger-api-mcp",
-  "version": "3.10.4",
+  "version": "3.11.1",
   "mcpName": "io.github.hostinger/hostinger-api-mcp",
   "description": "MCP server for Hostinger API",
   "repository": {

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/hostinger/api-mcp-server",
     "source": "github"
   },
-  "version": "3.10.4",
+  "version": "3.11.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@hostinger/mcp",
-      "version": "3.10.4",
+      "version": "3.11.1",
       "transport": {
         "type": "stdio"
       },

package/skills/audit-hosting/SKILL.md

@@ -30,7 +30,7 @@ Tell the user the size (plans, websites, WordPress installs) before the checks.
 Per Shared and Cloud website (skip `builder` and `horizons`):
 
 - `hosting_ssl_status` — flag `failed` (with `last_error`), `expired`, `not_installed` on a custom domain, `is_https_redirect_enabled: false`, and `expires_at` within 30 days when `is_lifetime` is false. Lifetime certificates renew on their own.
-- Node.js sites: `hosting_get-deployment` (latest build failed? `build.state`; on the hosted server use `hosting_nodejs_list-builds` with `per_page: 1`) and `hosting_nodejs_list-vulnerabilities` with `severities: ["critical", "high"]`.
+- Node.js sites: `hosting_get-deployment` (latest build failed? `build.state`) and `hosting_nodejs_list-vulnerabilities` with `severities: ["critical", "high"]`.
 
 Per hosting account (`username`): `hosting_databases_list` — flag `disk_usage_mb` above 80% of `max_size_mb`.
 

package/skills/deploy-to-hosting/SKILL.md

@@ -45,9 +45,9 @@ Archive rules for Agency (name archives `name_YYYYMMDD_HHMMSS.zip`) and for arch
 - **Static:** build locally first. `index.html` must be at the archive root, not inside a folder: `cd dist && zip -r ../site_20260101_120000.zip .`
 - **Node.js source:** no `node_modules/`, no build output (`dist/`, `.next/`, `build/`), no `.env*`, nothing matched by `.gitignore`; 50 MB at most. `git archive --format=zip -o app_20260101_120000.zip HEAD` produces exactly the committed files — mention that uncommitted changes are left out.
 
-`hosting_deploy` and the `agency-hosting_deploy-*` operations read files from this machine, so only the local server has them. On the hosted server (`mcp.hostinger.com`) `search` does not find them — upload the files yourself as below.
+`hosting_deploy` with `path` and the `agency-hosting_deploy-*` operations read files from this machine, so only the local server has them. The hosted server (`mcp.hostinger.com`) has `hosting_deploy` for Git repositories only (step 4) and `hosting_get-deployment` (step 3); to deploy files from this machine there, upload them yourself as below.
 
-### Without the local deploy operations (hosted server; on the local server only for Agency)
+### Without the local deploy operations (local files on the hosted server; Agency on either server)
 
 1. Get upload credentials: `hosting_files_generate-upload-url` (`username`, `domain`); Agency: `agency-hosting_files_generate-upload-url` (`website_uid`). Both return `url`, `auth_key` and `rest_auth_key`, which authenticate the upload instead of the API token.
 2. Upload each file with TUS, where `DEST` is its path in the website's storage:
@@ -72,35 +72,24 @@ curl -sS -X PATCH "$URL/$DEST?override=true" -H "X-Auth: $AUTH_KEY" -H "X-Auth-R
 
 ## 3. Node.js builds
 
-`hosting_deploy` returns a `buildUuid` at once; the build runs on the server and takes minutes. Track it with `hosting_get-deployment` (`domain`, optionally `buildUuid`; the latest build by default), polling every 10–20 s until `build.state` is `completed` or `failed`. It returns the build, its log and the stored build settings; pass the previous `logs.lines` as `fromLine` to read only new output.
+`hosting_deploy` returns a `buildUuid` at once; the build runs on the server and takes minutes. Track it — and a build started with `hosting_nodejs_start-build` after an upload — with `hosting_get-deployment` (`domain`, optionally `buildUuid`; the latest build by default), polling every 10–20 s until `build.state` is `completed` or `failed`. It returns the build, its log and the stored build settings; pass the previous `logs.lines` as `fromLine` to read only new output.
 
 - Failed build: the response already carries `analysis` (fetched once per build; the API allows 5 a minute).
 - Wrong detection (framework, `output_directory`, or an entry file inside the build output, such as `dist/server.js` for a compiled app): deploy again with `appType`, `outputDirectory`, `buildScript` or `entryFile` set. An archive deploy sends its settings with the request and leaves the stored ones alone; a Git deploy also stores these values, so later pushes build with them.
 
-On the hosted server, which has no `hosting_deploy` or `hosting_get-deployment`:
+Local files on the hosted server, deployed from an upload (step 2):
 
-- After the upload steps below, start the build and track it with `hosting_nodejs_list-builds` and `hosting_nodejs_build` (by `uuid`), polling every 10–20 s.
-- Failed build: `hosting_nodejs_analyse-failed-build` once per build (5 calls a minute), then `hosting_nodejs_build-logs` if the analysis is empty.
-- Wrong detection: run `hosting_nodejs_start-build` with explicit values, `source_type: "archive"` and `source_options.archive_path` set to the archive's file name in the document root (check it is there with `hosting_files_list-website-and-directories`). Store the same values with `hosting_nodejs_update-build-settings`.
+- Wrong detection: run `hosting_nodejs_start-build` again with explicit values, `source_type: "archive"` and `source_options.archive_path` set to the archive's file name in the document root (check it is there with `hosting_files_list-website-and-directories`). Store the same values with `hosting_nodejs_update-build-settings`.
 - To review detected settings before any build: upload the archive with `hosting_files_generate-upload-url` (the TUS steps are in its description), then `hosting_nodejs_build-settings-from-archive`.
 
 ## 4. Auto-deploy from Git
 
-On the local server, `hosting_deploy` with `git: { repository: "owner/name", branch }` does all of it: it finds the Git installation that can reach the repository and deploys it as the `type` you give. Always pass `type: "static"` or `"nodejs"` unless the site already runs a Node.js app (or you pass Node.js settings such as `appType`): a new site is not detected as Node.js, and a Node.js repository deployed as static would publish its source. Then:
+On both the local and the hosted server, `hosting_deploy` with `git: { repository: "owner/name", branch }` does all of it: it finds the Git installation that can reach the repository and deploys it as the `type` you give. Always pass `type: "static"` or `"nodejs"` unless the site already runs a Node.js app (or you pass Node.js settings such as `appType`): a new site is not detected as Node.js, and a Node.js repository deployed as static would publish its source. Then:
 - **PHP and static sites:** saves the auto-deployment settings, which deploys the branch immediately and again on every push;
-- **Node.js sites:** starts a build of the branch with the stored build settings; later pushes build the same way. A Git deploy has nothing to detect from, so when none are stored pass `appType` and `nodeVersion` (from `engines` in `package.json`), plus `outputDirectory` and `buildScript` if the app has a build step; they are stored for those pushes.
+- **Node.js sites:** starts a build of the branch with the stored build settings; later pushes build the same way. When none are stored, they are detected from the branch's `package.json` and stored for those pushes; pass `appType`, `nodeVersion`, `outputDirectory`, `buildScript` or `entryFile` to override them (a compiled app still needs `entryFile`).
 
 With no active installation it stops and says so: the user connects GitHub or GitLab once in hPanel under Websites → Manage → Advanced → Git; there is no API for that step. Confirm with `hosting_get-deployment`, which returns the stored `gitAutoDeployment`.
 
-On the hosted server, by hand:
-
-1. `hosting_git_list-installations`. With no `active` installation (check `status: "pending"` and `"suspended"` too), the user connects GitHub or GitLab once in hPanel, as above.
-2. `hosting_git_list-installation-repositories` with the installation `uuid` gives `owner`, `name` and `default_branch` (10 calls a minute).
-3. `hosting_git_update-auto-deployment-settings` with `installation_uuid`, `owner`, `repository`, `branch` and optional `directory`.
-   - PHP and static sites deploy the branch immediately and again on every push.
-   - Node.js sites clone nothing on save: start the first build with `hosting_nodejs_start-build`, `source_type: "git"` and the same `source_options`. Later pushes build with the stored settings, so keep `hosting_nodejs_update-build-settings` correct.
-4. Confirm with `hosting_git_auto-deployment-settings`.
-
 Agency Plan sites have no Git operations; deploy archives.
 
 ## 5. Environment variables (Node.js)

package/skills/headless/steps/05-design/SKILL.md

@@ -307,14 +307,14 @@ palette (base and surface colours count).
 ### Build it with the logo kit
 
 The kit (`logo-kit.mjs`, next to this file) does the error-prone parts: it outlines letters into
-vector paths, sets text on a circle, draws the outline-and-shadow treatment, measures, and validates
-the output. You write the composition. Copy the kit into `brand/` so the build is self-contained
-and a redesign can re-run it:
+vector paths, sets text on a circle, draws the outline-and-shadow treatment, measures, validates
+the output, checks the sizes and renders a preview. You write the composition. Copy the kit into
+`brand/` so the build is self-contained and a redesign can re-run it:
 
 ```bash
 mkdir -p ~/.hostinger/<domain>/brand && cd ~/.hostinger/<domain>/brand
 cp <the folder this SKILL.md is in>/logo-kit.mjs .
-npm init -y >/dev/null && npm i opentype.js @fontsource/<display-slug>
+npm init -y >/dev/null && npm i opentype.js @resvg/resvg-js @fontsource/<display-slug>
 ```
 
 Write `brand/logo-build.mjs`, import from `./logo-kit.mjs`, and always run it from `brand/`
@@ -330,6 +330,9 @@ Write `brand/logo-build.mjs`, import from `./logo-kit.mjs`, and always run it fr
 | `sticker(d, { fill, ink, strokeWidth, shadow, shadowColor, transform })` | Ink outline + hard offset shadow, for outlined directions. On dark backgrounds give the outline and shadow a palette colour that shows (`shadowColor` defaults to `ink`) |
 | `svgDoc({ width, height, title, body })` | Root SVG with `role="img"` and a `<title>` |
 | `check(svg)` | Throws on `NaN`, live `<text>`, a missing title or viewBox, or an `&` that isn't an XML entity. Run it on every file before writing |
+| `tile(size, fill)` | The rounded tile for the mark and favicon; draw the symbol after it |
+| `widthBudget(letterHeight, height)` | The widest viewBox that still fits 192 px on small screens, for a logo of that height; see below |
+| `checkLogo({ logo, mark, favicon, letterHeight, background })` | Runs `check()` on all three files, checks their sizes and renders `brand/logo-preview.png`; see below |
 
 Wrap every file in `svgDoc()`, never a hand-written `<svg>` or `<title>`: it escapes the site name,
 and one bare `&` (as in "Salt & Pepper") makes the browser show nothing.
@@ -342,27 +345,48 @@ Never call opentype's `path.toPathData()` directly; the kit's serializer exists
 | File | What | Must read clearly at |
 |---|---|---|
 | `brand/logo.svg` | The primary, mostly horizontal logo for the header | Its header display heights (desktop and small screens) |
-| `brand/logo-mark.svg` | A square icon from the same idea (initial, monogram or the swapped symbol) on a solid rounded tile (corner radius ≈ ¼ of the side) in a palette colour | 32 px |
+| `brand/logo-mark.svg` | A square icon from the same idea (initial, monogram or the swapped symbol) on a `tile()` in a palette colour | 32 px |
 | `brand/favicon.svg` | The simplest form of the mark: same tile, no shadow, no thin details, outlines thickened if it has any | 16 px, on both light and dark browser tab bars |
 | `brand/logo-build.mjs` | The script that built them, with `package.json`, kept so a redesign can adjust it | — |
 
 Add `brand/logo-seal.svg` only if the direction uses a seal as a secondary mark. Delete
 `brand/node_modules` when you're done; a redesign runs `npm i` in `brand/` first.
 
-**Check the sizes.** Display heights are multiples of 8, with one for desktop and one for small
-screens (they may be equal). Work them out from the viewBox:
-
-- **Letter size:** letter height on screen = letter height ÷ viewBox height × display height, and it
-  must be ≥ 16 px. Use `xHeight` when the logo is mostly lowercase and `capHeight` when it's mostly
-  capitals; for mixed fonts, take the smaller word. A two-line lockup usually needs 64 px.
-- **Headroom:** `pathBox` covers the letters, not what you add. Leave room above for accents (Ė, Ž, Å sit above cap height) and below for descenders, plus whatever bounce, tilt, outline and shadow add, so nothing touches the viewBox edge.
-- **Width:** width on screen = viewBox width ÷ viewBox height × display height. At the small-screen
-  height it must be **≤ 192 px**, which leaves room for the menu button in a 320 px header. If it
-  doesn't fit, lower the small-screen height (letters still ≥ 16 px), simplify the logo, or show
-  `logo-mark.svg` with the name beside it on small screens.
-- **Look at it.** If you have a browser, render the files at both header heights, 32 px and 16 px,
-  the favicon on a light and a dark background, and fix anything that reads wrong. Without a
-  browser, rely on the numbers and list "logo not visually checked" under gaps in the final report.
+**Compose within the budget, so the first build passes.** The small-screen logo is at most 192 px
+wide with letters at least 16 px tall, so the whole logo can be only about 10–12 times as wide as
+its smallest letters are tall, whatever its height. On one line that's about ten letters plus a
+symbol; a longer name stacks or tags, and a second word set at half size halves the room. Size the
+viewBox in `logo-build.mjs` against `widthBudget(letterHeight, viewBoxHeight)`, the exact limit at
+the heights the kit picks; with your own `heights`, the FAIL line gives the limit. Draw the mark's
+symbol from simple, recognisable shapes that still read at 32 px; fine natural forms like petals or
+leaves turn to mush.
+
+**Check the sizes and look at it after every build.** `letterHeight` is in viewBox units: the
+`xHeight` from `layout()` when the logo is mostly lowercase, `capHeight` when it's mostly capitals;
+for mixed fonts, the smaller word's. End `logo-build.mjs` with:
+
+```js
+checkLogo({ logo, mark, favicon, letterHeight, background: '<page background colour>' });
+```
+
+It picks the header heights for you: `--logo-h-sm` is the smallest multiple of 8 that makes the
+letters 16 px, and `--logo-h` the same but at least 48 px, both at most 80 px, so a stacked lockup
+keeps its words large or sets the mark beside them. Pass `heights: { desktop, small }` only when the
+direction needs a larger header logo. It first prints `--logo-h`, `--logo-h-sm` and the **Measured**
+line for `design.md`, then PASS or FAIL for the logo's letters ≥ 16 px at both
+heights, width ≤ 192 px on small screens, headroom around everything drawn and heights in multiples
+of 8; for the mark and favicon sitting on a `tile()` with nothing clipped and room around
+the symbol; and for no shadow on the favicon. Every FAIL names its fixes and the number to reach. It
+then renders `logo-preview.png` (the logo at both heights on the page background, the mark at 32 px
+and favicon at 16 px on light and dark strips, each also enlarged), and throws if anything failed.
+
+Then read `logo-preview.png`; don't search for another renderer or read the SVG source. Rebuild only
+for a FAIL line or something in the preview that reads wrong, such as collisions, a clipped or
+clearly off-centre mark, or a favicon detail that turns to mush, and fix everything you saw in one
+rebuild. Optical nudges of a few pixels and the header height aren't reasons to rebuild. A symbol
+gets one redraw: if it still reads wrong, replace it with a simpler form of the idea, such as the
+initial, in the next build. If the kit says "preview not rendered", rely on the size check and list
+"logo not visually checked" under gaps in the final report.
 
 The logo is exempt from text-contrast minimums, but the header link around it needs `alt` = the site
 name and a target of at least 24 px.

package/skills/headless/steps/05-design/logo-kit.mjs

@@ -6,18 +6,27 @@
 //
 // Workflow (from ~/.hostinger/<domain>/brand/, so packages and this kit sit next to the build):
 //   cp <installed skill>/steps/05-design/logo-kit.mjs .
-//   npm init -y && npm i opentype.js @fontsource/<display-family-slug>
+//   npm init -y && npm i opentype.js @resvg/resvg-js @fontsource/<display-family-slug>
 //   node logo-build.mjs          // your script: import { … } from './logo-kit.mjs'
+//                                // then read logo-preview.png
 //   rm -rf node_modules          // package.json keeps the deps; a redesign runs `npm i` again
 //
 // Packages resolve from the current working directory, so run the build from brand/.
 
 import { createRequire } from 'node:module';
-import { readFileSync } from 'node:fs';
+import { readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 
 const requireFromCwd = createRequire(join(process.cwd(), 'logo-build.js'));
 const opentype = requireFromCwd('opentype.js');
+// Optional: without resvg the kit still builds logos, it just can't measure what's drawn or render.
+const Resvg = (() => {
+  try {
+    return requireFromCwd('@resvg/resvg-js').Resvg;
+  } catch {
+    return null;
+  }
+})();
 
 // @fontsource splits each weight into unicode subsets; `latin` alone has no ą č ę ė į š ų ū ž,
 // ő, ł, đ… so load every subset that exists and look each character up across them.
@@ -62,6 +71,8 @@ export function loadFont(slug, weight = 400, style = 'normal') {
   return primary;
 }
 
+const VIEWBOX = /viewBox="0 0 ([\d.]+) ([\d.]+)"/;
+
 const num = (v) => {
   if (!Number.isFinite(v)) throw new Error(`logo-kit: non-finite coordinate ${v}`);
   return +v.toFixed(2);
@@ -174,11 +185,16 @@ export function arcText(font, text, { cx, cy, r, size, startDeg = -90, fill = tr
 export function sticker(d, { fill, ink = '#000', strokeWidth = 8, shadow = 8, shadowColor = ink, transform = '' }) {
   const t = transform ? ` transform="${transform}"` : '';
   const shade = shadow
-    ? `<path d="${d}" fill="${shadowColor}" stroke="${shadowColor}" stroke-width="${strokeWidth}" stroke-linejoin="round" transform="translate(${shadow} ${shadow})"/>`
+    ? `<path data-kit="shadow" d="${d}" fill="${shadowColor}" stroke="${shadowColor}" stroke-width="${strokeWidth}" stroke-linejoin="round" transform="translate(${shadow} ${shadow})"/>`
     : '';
   return `<g${t}>${shade}<path d="${d}" fill="${fill}" stroke="${ink}" stroke-width="${strokeWidth}" stroke-linejoin="round" paint-order="stroke"/></g>`;
 }
 
+/** The solid rounded tile behind `logo-mark.svg` and `favicon.svg`; draw the symbol after it. */
+export function tile(size, fill) {
+  return `<rect data-kit="tile" width="${num(size)}" height="${num(size)}" rx="${num(size / 4)}" fill="${fill}"/>`;
+}
+
 /** Root SVG with an accessible name. Pass a distinct `id` if two logos are inlined on one page. */
 export function svgDoc({ width, height, title, body, id = 'logo-title' }) {
   const esc = String(title).replace(/&/g, '&amp;').replace(/</g, '&lt;');
@@ -192,6 +208,12 @@ export function svgDoc({ width, height, title, body, id = 'logo-title' }) {
  * @returns {{ bytes: number }}
  */
 export function check(svg) {
+  const problems = markupProblems(svg);
+  if (problems.length) throw new Error(`logo-kit check failed: ${problems.join('; ')}`);
+  return { bytes: Buffer.byteLength(svg) };
+}
+
+function markupProblems(svg) {
   const problems = [];
   if (/NaN|undefined|Infinity/.test(svg)) problems.push('contains NaN/undefined/Infinity');
   if (/&(?!(?:amp|lt|gt|quot|apos|#\d+|#x[\dA-Fa-f]+);)/.test(svg)) {
@@ -199,7 +221,210 @@ export function check(svg) {
   }
   if (/<text[\s>]/.test(svg)) problems.push('contains <text>; outline the letters with textPath/glyphPath');
   if (!/<title[^>]*>[^<]+<\/title>/.test(svg)) problems.push('missing <title>');
-  if (!/viewBox="0 0 [\d.]+ [\d.]+"/.test(svg)) problems.push('missing or invalid viewBox');
-  if (problems.length) throw new Error(`logo-kit check failed: ${problems.join('; ')}`);
-  return { bytes: Buffer.byteLength(svg) };
+  if (!VIEWBOX.test(svg)) problems.push('missing or invalid viewBox');
+  return problems;
+}
+
+const MIN_LETTER_PX = 16;
+const MAX_SMALL_WIDTH_PX = 192;
+const MIN_DESKTOP_PX = 48;
+const MAX_HEADER_PX = 80; // automatic heights only: taller header logos crowd the nav, and stacked lockups reached 144
+const HEADROOM = 0.02; // of the viewBox height, on every edge
+const CLIP_SLACK = 0.5; // viewBox units of anti-aliasing a "nothing outside the viewBox" check allows
+
+function viewBoxOf(svg) {
+  const m = svg.match(VIEWBOX);
+  if (!m) throw new Error('logo-kit: missing or invalid viewBox');
+  return { width: +m[1], height: +m[2] };
+}
+
+/** Gap between everything drawn (strokes, shadows, transforms) and each viewBox edge, smallest first. */
+function edgeGaps(svg, vb) {
+  const b = new Resvg(svg).getBBox();
+  if (!b) return [];
+  const gaps = { top: b.y, bottom: vb.height - b.y - b.height, left: b.x, right: vb.width - b.x - b.width };
+  return Object.entries(gaps).sort((a, b) => a[1] - b[1]);
+}
+
+const px = (v) => +v.toFixed(1);
+const ceil1 = (v) => Math.ceil(v * 10) / 10;
+const ceil8 = (v) => Math.ceil(v / 8) * 8;
+const floor8 = (v) => Math.floor(v / 8) * 8;
+
+const minHeaderPx = (letterHeight, height) => ceil8((MIN_LETTER_PX * height) / letterHeight);
+const maxWidthAt = (height, smallPx) => Math.floor((MAX_SMALL_WIDTH_PX * height) / smallPx);
+
+function autoHeights(letterHeight, height) {
+  const small = Math.min(minHeaderPx(letterHeight, height), MAX_HEADER_PX);
+  return { desktop: Math.max(small, MIN_DESKTOP_PX), small };
+}
+
+/**
+ * The widest viewBox a logo of this height can have and still fit 192 px on small screens at the
+ * height `checkLogo` picks. Call it while composing, before the first build: it is roughly
+ * 10–12 × `letterHeight`, so a long name stacks or tags instead of running on one line.
+ * @param {number} letterHeight viewBox units, as passed to `checkLogo`
+ * @param {number} height the viewBox height
+ */
+export function widthBudget(letterHeight, height) {
+  return maxWidthAt(height, autoHeights(letterHeight, height).small);
+}
+
+/** Collects PASS/FAIL/SKIP lines; `print` returns how many failed. */
+function sizeReport(label, vb) {
+  const lines = [];
+  return {
+    rule(ok, text, fix) {
+      lines.push(ok ? `PASS ${text}` : `FAIL ${text} → ${fix}`);
+    },
+    skip(text) {
+      lines.push(`SKIP ${text}`);
+    },
+    headroom(svg, of) {
+      if (!Resvg) return this.skip('headroom: install @resvg/resvg-js to measure it');
+      const [edge, gap] = edgeGaps(svg, vb)[0] ?? [];
+      if (edge === undefined) return this.skip(`headroom: nothing drawn on ${of}`);
+      const min = HEADROOM * vb.height;
+      this.rule(gap >= min, `headroom ${px(gap)} at the ${edge} of ${of} (≥ ${px(min)} viewBox units)`,
+        `add ${ceil1(min - gap)} viewBox units at the ${edge}: grow the viewBox on that side or move the drawing in; accents, descenders, tilt, outline and shadow all need room`);
+    },
+    print() {
+      console.log(`${label} (viewBox ${px(vb.width)} × ${px(vb.height)}):`);
+      for (const line of lines) console.log(`  ${line}`);
+      return lines.filter((l) => l.startsWith('FAIL')).length;
+    },
+  };
+}
+
+function logoSizes(svg, { letterHeight, heights }) {
+  if (!letterHeight || (heights && (!heights.desktop || !heights.small))) {
+    throw new TypeError('logo-kit checkLogo: pass letterHeight, and heights: { desktop, small } only to set both');
+  }
+  const vb = viewBoxOf(svg);
+  const report = sizeReport('logo.svg', vb);
+  const minHeaderH = minHeaderPx(letterHeight, vb.height);
+  const maxSmall = floor8((MAX_SMALL_WIDTH_PX * vb.height) / vb.width);
+  const { desktop, small } = heights ?? autoHeights(letterHeight, vb.height);
+  const lettersAt = (h) => (letterHeight / vb.height) * h;
+  const width = (vb.width / vb.height) * small;
+  const canLowerSmall = small > minHeaderH && minHeaderH <= maxSmall;
+  const widthFixes = [
+    ...(canLowerSmall ? [`--logo-h-sm ${minHeaderH === maxSmall ? minHeaderH : `${minHeaderH}–${maxSmall}`} px passes both`] : []),
+    `make the viewBox at most ${maxWidthAt(vb.height, small)} units wide (now ${px(vb.width)}) at this height: stack or tag the words, tighten gaps, or show logo-mark.svg with the name beside it on small screens`,
+  ];
+
+  report.rule(desktop % 8 === 0 && small % 8 === 0, `heights ${desktop} / ${small} px are multiples of 8`, 'round them to multiples of 8');
+  const capped = !heights && minHeaderH > MAX_HEADER_PX;
+  const minLetterAtCap = ceil1((MIN_LETTER_PX * vb.height) / MAX_HEADER_PX);
+  const maxHeightAtCap = Math.floor((letterHeight * MAX_HEADER_PX) / MIN_LETTER_PX);
+  const lettersFixes = (name) => capped
+    ? [`the header logo stops at ${MAX_HEADER_PX} px: make letterHeight at least ${minLetterAtCap} viewBox units (now ${px(letterHeight)})`,
+      `make the viewBox at most ${maxHeightAtCap} units tall (now ${px(vb.height)}): trim empty space or set the mark beside the words instead of above them`]
+    : [`raise ${name} to ${minHeaderH} px or more`, 'enlarge the letters inside the viewBox', 'trim empty viewBox space'];
+  const letterChecks = desktop === small ? [['--logo-h and --logo-h-sm', small]] : [['--logo-h', desktop], ['--logo-h-sm', small]];
+  for (const [name, h] of letterChecks) {
+    report.rule(lettersAt(h) >= MIN_LETTER_PX, `letters ${px(lettersAt(h))} px tall at ${name} ${h} px (≥ ${MIN_LETTER_PX})`,
+      lettersFixes(name).join(', or '));
+  }
+  report.rule(width <= MAX_SMALL_WIDTH_PX, `width ${px(width)} px at --logo-h-sm ${small} px (≤ ${MAX_SMALL_WIDTH_PX})`,
+    widthFixes.join(', or '));
+  report.headroom(svg, 'the viewBox');
+  const measured = `- **Measured:** letters ${px(lettersAt(small))} px tall at \`--logo-h-sm\`; width ${px(width)} px at \`--logo-h-sm\``;
+  return { report, heights: { desktop, small }, measured };
+}
+
+function tileChecks(svg, { favicon = false } = {}) {
+  const vb = viewBoxOf(svg);
+  const report = sizeReport(favicon ? 'favicon.svg' : 'logo-mark.svg', vb);
+  const tileTag = svg.match(/<rect data-kit="tile"[^>]*\/>/)?.[0];
+  report.rule(Boolean(tileTag), 'drawn on a tile()', "draw the tile with the kit's tile(size, fill)");
+  if (!Resvg) report.skip('clipping: install @resvg/resvg-js to measure it');
+  else {
+    const gap = edgeGaps(svg, vb)[0]?.[1] ?? 0;
+    report.rule(gap >= -CLIP_SLACK, 'nothing drawn outside the viewBox', 'shrink or move the drawing in; the tile already fills the viewBox');
+  }
+  if (tileTag) report.headroom(svg.replace(tileTag, ''), 'the tile');
+  if (favicon) {
+    report.rule(!/data-kit="shadow"|<filter|drop-shadow/.test(svg), 'no shadow', 'pass shadow: 0 to sticker() and draw no other shadow');
+  }
+  return report;
+}
+
+function renderPreview({ logo, mark, favicon, heights, background, out }) {
+  const render = (svg, h, zoom) => {
+    const img = new Resvg(svg, { fitTo: { mode: 'height', value: h } }).render();
+    return { w: img.width * zoom, h: img.height * zoom, href: `data:image/png;base64,${img.asPng().toString('base64')}` };
+  };
+  const tiles = (fill) => ({ fill, items: [render(mark, 32, 1), render(mark, 32, 4), render(favicon, 16, 1), render(favicon, 16, 8)] });
+  const bands = [
+    {
+      label: `logo.svg at --logo-h ${heights.desktop} px and --logo-h-sm ${heights.small} px, then 2×, on the page background`,
+      fill: background,
+      items: [render(logo, heights.desktop, 1), render(logo, heights.small, 1), render(logo, heights.desktop, 2), render(logo, heights.small, 2)],
+    },
+    { label: 'light: logo-mark.svg at 32 px and 4×, favicon.svg at 16 px and 8×', ...tiles('#f1f3f4') },
+    { label: 'dark: the same', ...tiles('#202124') },
+  ];
+  const PAD = 16;
+  const LABEL = 28;
+  let body = '';
+  let y = 0;
+  let width = 480;
+  for (const { label, fill, items } of bands) {
+    const rowH = Math.max(...items.map((i) => i.h)) + PAD * 2;
+    body += `<text x="${PAD}" y="${y + 19}" font-family="sans-serif" font-size="13" fill="#555">${label}</text>`;
+    y += LABEL;
+    body += `<rect y="${y}" width="100%" height="${rowH}" fill="${fill}"/>`;
+    let x = PAD;
+    for (const i of items) {
+      body += `<image href="${i.href}" x="${x}" y="${y + (rowH - i.h) / 2}" width="${i.w}" height="${i.h}" image-rendering="optimizeSpeed"/>`;
+      x += i.w + PAD * 2;
+    }
+    width = Math.max(width, x - PAD);
+    y += rowH;
+  }
+  const sheet = `<svg xmlns="http://www.w3.org/2000/svg" width="${width}" height="${y}"><rect width="100%" height="100%" fill="#fff"/>${body}</svg>`;
+  writeFileSync(out, new Resvg(sheet).render().asPng());
+}
+
+/**
+ * Check the three finished files and render one PNG to look at instead of the SVG source.
+ * Throws first if any file fails `check()`.
+ * - logo.svg: letters ≥ 16 px at both header heights, width ≤ 192 px on small screens, 2% headroom
+ *   around everything drawn, heights in multiples of 8. Without `heights`, `--logo-h-sm` is the
+ *   smallest multiple of 8 that makes the letters 16 px, and `--logo-h` the same but at least 48 px;
+ *   both stop at 80 px, so letters too small for 80 px fail.
+ * - logo-mark.svg, favicon.svg: drawn on a `tile()`, nothing outside the viewBox, 2% headroom
+ *   around the symbol; the favicon has no shadow.
+ * - logo-preview.png: the logo at both heights on the page background, the mark at 32 px and the
+ *   favicon at 16 px on a light and a dark strip, each also enlarged with hard pixels.
+ * Prints the heights and the Measured line first, then every PASS/FAIL line, each failure with its
+ * fixes, renders the preview, then throws if anything failed.
+ * @param {object} o
+ * @param {number} o.letterHeight viewBox units: `layout().xHeight` (mostly lowercase) or
+ *   `.capHeight` (capitals) of the smaller word
+ * @param {{ desktop: number, small: number }} [o.heights] set both header heights yourself
+ * @param {string} [o.background] the page background colour
+ * @returns {{ heights: { desktop: number, small: number }, measured: string }} heights for
+ *   `--logo-h` / `--logo-h-sm`, and the design.md → Logo → **Measured** line
+ */
+export function checkLogo({ logo, mark, favicon, letterHeight, heights, background = '#ffffff', out = 'logo-preview.png' }) {
+  // resvg can't measure or render a file check() rejects, so these fail before any size line.
+  const broken = Object.entries({ 'logo.svg': logo, 'logo-mark.svg': mark, 'favicon.svg': favicon })
+    .flatMap(([name, svg]) => markupProblems(svg).map((p) => `${name}: ${p}`));
+  if (broken.length) throw new Error(`logo-kit checkLogo: ${broken.join('; ')}`);
+  const sizes = logoSizes(logo, { letterHeight, heights });
+  // First, so piping the output through `head` can't cut them off.
+  console.log(`--logo-h: ${sizes.heights.desktop}px; --logo-h-sm: ${sizes.heights.small}px`);
+  console.log(sizes.measured);
+  const reports = [sizes.report, tileChecks(mark), tileChecks(favicon, { favicon: true })];
+  const failed = reports.reduce((n, r) => n + r.print(), 0);
+  if (Resvg) {
+    renderPreview({ logo, mark, favicon, heights: sizes.heights, background, out });
+    console.log(`preview: read ${out}`);
+  } else {
+    console.log('preview not rendered: @resvg/resvg-js is not installed; list "logo not visually checked" under gaps');
+  }
+  if (failed) throw new Error(`logo-kit checkLogo: ${failed} check(s) failed, see the FAIL lines above`);
+  return { heights: sizes.heights, measured: sizes.measured };
 }

package/skills/headless/steps/08-deploy/SKILL.md

@@ -12,6 +12,11 @@ serves the result. **Out:** `deploy.json`.
 This is an **instance-barrier** step: run it only after `provision.status == "completed"` and validate
 (if run) has passed. All operations go through the connector (`execute`).
 
+> **Connected to the hosted server (`mcp.hostinger.com`)?** Its `hosting_deploy` deploys Git
+> repositories only and cannot read a local `path`. Run this step through the local
+> `hostinger-api-mcp` server instead (see the connect step:
+> `npx --yes --package=@hostinger/mcp@latest hostinger-api-mcp`).
+
 **In:** the project in `~/.hostinger/<domain>/src/`, `site.json` (`username`, `urls`), `state.json`
 (`frontend.framework`, `frontend.rendering`).
 
@@ -188,7 +193,7 @@ Update `state.json` (`stage` → `done`), then continue to Step 9 (done).
 
 ## Note — one deploy path, and never `type: "static"`
 
-`hosting_deploy` is the only path: give its `path` either the source **directory** (it archives it for
+`hosting_deploy` on the local server is the only path: give its `path` either the source **directory** (it archives it for
 you) or a local **archive** (`zip`, `tar`, `tar.gz`, `tgz`, `7z`) — there is no separate upload or build
 step to fall back to. Either way pass the explicit `appType`/`outputDirectory`/`nodeVersion`/
 `buildScript`/`packageManager`/`rootDirectory` from the table. Never deploy a headless site with

package/skills/migrate-to-hosting/SKILL.md

@@ -41,7 +41,7 @@ Create the Hostinger website on the domain being migrated, not on a free subdoma
 
 ## 3. Import
 
-`hosting_deploy` and `agency-hosting_deploy-php-application` read files from this machine and exist only in the local `hostinger-api-mcp` server. On the hosted server (`mcp.hostinger.com`), upload the files first as described in the `deploy-to-hosting` skill ("Without the local deploy operations") and use the operation named in brackets below.
+`hosting_deploy` with `path` and `agency-hosting_deploy-php-application` read files from this machine, so only the local `hostinger-api-mcp` server has them; the hosted server's `hosting_deploy` deploys Git repositories only. On the hosted server (`mcp.hostinger.com`), upload the files first as described in the `deploy-to-hosting` skill ("Without the local deploy operations") and use the operation named in brackets below.
 
 **WordPress, Shared and Cloud:** `hosting_deploy` with `domain`, `path` (the site directory or its archive), `databaseDump` and `type: "wordpress-site"` uploads both, extracts the files and imports the database; large sites take several minutes. Always pass `type`: left to detection, a directory without `wp-config.php` or `wp-content` at its top level is taken for a plain site and the dump is not imported. [Upload `site.zip` and `dump.sql`, then `wordpress_installations_import-website` with `archive_path` and `sql_path`.] Then `wordpress_installations_detect` with `username` and poll `wordpress_installations_list` with `domain` until the install appears with `is_valid: true`.
 

package/skills/troubleshoot-website/SKILL.md

@@ -44,9 +44,9 @@ dig +short NS DOMAIN; dig +short A DOMAIN; dig +short CAA DOMAIN
 
 ### Node.js (`nodejs`)
 
-Batch `hosting_get-deployment` (the latest build with its log, failure analysis and stored settings), `hosting_nodejs_runtime-logs` (`period: "1h"`, `levels: ["ERROR", "WARN"]`) and `hosting_nodejs_list-environment-variables` (keys only; values always come back masked). On the hosted server, which has no `hosting_get-deployment`, use `hosting_nodejs_list-builds` (`per_page: 3`) in its place.
+Batch `hosting_get-deployment` (the latest build with its log, failure analysis and stored settings), `hosting_nodejs_runtime-logs` (`period: "1h"`, `levels: ["ERROR", "WARN"]`) and `hosting_nodejs_list-environment-variables` (keys only; values always come back masked).
 
-- Latest build `failed`: `hosting_get-deployment` already holds the `analysis` (fetched once per build — the API re-runs it on every call and allows 5 a minute). A wrongly detected framework, output directory or missing `entry_file` is the usual cause: compare the returned `buildSettings` with the project and deploy again with corrected `appType`, `outputDirectory`, `buildScript` or `entryFile`; a Git deploy stores them, so pushes build correctly too. On the hosted server: `hosting_nodejs_analyse-failed-build` once for that build, then `hosting_nodejs_build-logs`; compare `hosting_nodejs_build-settings`, rebuild through `hosting_nodejs_start-build` and store the values with `hosting_nodejs_update-build-settings`.
+- Latest build `failed`: `hosting_get-deployment` already holds the `analysis` (fetched once per build — the API re-runs it on every call and allows 5 a minute). A wrongly detected framework, output directory or missing `entry_file` is the usual cause: compare the returned `buildSettings` with the project and deploy again with corrected `appType`, `outputDirectory`, `buildScript` or `entryFile`; a Git deploy stores them, so pushes build correctly too. A site deployed on the hosted server from uploaded files has no `hosting_deploy` to repeat: rebuild through `hosting_nodejs_start-build` with the corrected values and store them with `hosting_nodejs_update-build-settings`.
 - Build `completed` but the app errors: read the runtime logs; entries older than `last_deployed_at` belong to the previous deploy. A variable the code reads but the key list lacks is fixed with the `deploy-to-hosting` skill's environment step. `Access denied for user '…'@'::1'` means the app connects to `localhost` — `DB_HOST` must be `127.0.0.1`.
 - Hung process: `hosting_nodejs_restart-application` (restarts without rebuilding).