fix(mcp): Stop npm from dropping the bin entry on publish

[korya]

Problem

npx @frontsail-ai/qr-mcp would have installed fine and then done nothing — npm drops the bin entry when publishing this package.

npm rejects a bin path written as "./dist/index.mjs", and instead of failing it silently strips the entry: npm warn publish "bin[qr-mcp]" script name dist/index.mjs was invalid and removed. It is a warning, not an error, and it only appears on npm publish — installing the packed tarball links the bin correctly either way, which is exactly why PR #14's end-to-end install check went green on a package that could not have shipped. Separately, the package still carried the tentative name from PR #14.

Solution

Rename to the owned scope, stop the build from rewriting the manifest, and add a release checklist that catches this class of problem.

The ./ prefix was not hand-written, which is why fixing package.json alone would not have held. vp pack with pack.exports: true rewrites exports and bin on every build, generating precisely the rejected form — so any correction would be undone by the next build, including the build the publish flow itself runs. Dropping exports: true and declaring the entry explicitly stops the build touching package.json at all:

Field	Required form	Why
exports["."]	./dist/index.mjs	the spec requires the ./ prefix on subpath values
bin["qr-mcp"]	dist/index.mjs	npm strips the entry if it has one

Two adjacent fields with opposite rules, one of them failing silently, is what makes this worth a regression test rather than a one-line fix. tests/manifest.test.ts pins both forms, the file list, public access, and the invariants that core stays a devDependency (so it gets bundled) and node-canvas never becomes a dependency.

Verified publish shape

npm publish --dry-run --access public — zero warnings, three files:

2.5kB   README.md
32.2kB  dist/index.mjs
1.5kB   package.json
→ @frontsail-ai/qr-mcp@0.1.0, 9.9 kB packed

The packed tarball was then installed into a clean directory: node_modules/.bin/qr-mcp links to dist/index.mjs, and the binary answers a raw JSON-RPC initialize with {"name":"qr-code-generator","version":"0.1.0"}.

Dogfooding turned up two real schema problems

Everything before this was SDK-client integration tests. Pointing an actual agent session at the built server surfaced two things those tests could not, because both are about what a reader of the schema concludes:

1. corner_square_type: "extra-rounded" is what the web UI labels plain "Rounded". dot_type has both rounded and extra-rounded, so an agent reasonably guesses rounded exists for corners too and gets a validation error.
2. The two linear gradient names are rotated relative to what they render. linear-bl-tr ("Bottom-left to top-right") emits x1=0 y1=0 → x2=280 y2=280, which in SVG coordinates is top-left to bottom-right; linear-tl-br renders top-right to bottom-left. Independently confirmed by rendering with distinct start/end colours and sampling each quadrant.

The gradient bug lives in packages/core and predates this package — the MCP server faithfully exposes core's values, and the web app has always rendered them this way. Correcting the rotations would change the site's output and re-render every existing share link, so it is documented, not fixed. Both facts now appear in the tool descriptions, which is the in-scope half: an agent that reads them stops guessing. A follow-up PR should decide whether to correct the rotations and accept the share-link churn.

No visual change — apps/web is untouched.

Other Changes

• RELEASING section in the package README: bump the version in both places (package.json and SERVER_VERSION, which is what the MCP handshake reports), run the tests, read the dry-run for warnings, publish with --access public (scoped packages default to restricted), tag, and smoke-test the published npx.
• README gains the verified client config under the new name plus the Claude Code one-liner: claude mcp add qr -- npx -y @frontsail-ai/qr-mcp.
• Removed a _comment_test key from the package's scripts — npm scripts are a task namespace, and it was showing up as a runnable task in vp run.
• Test count 146 → 154 (37 core + 70 mcp + 47 e2e); nothing was removed.
• The private @frontsail/qr-core keeps its name. It is bundled into the published artifact and never published itself, so its scope is invisible externally; renaming it would churn apps/web for no outside benefit.
• The blueprint's body keeps the old name as written — only its Outcome section records the resolution, so the plan stays a record of what was planned rather than a retcon.

Related:

• feat(mcp): Add the @frontsail/qr-mcp stdio server #14

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
qr-code-generator	Ready	Preview	Aug 1, 2026 4:02am