@cairnvibe/indexer 0.2.7 → 0.2.8

package/dist/cli.js

@@ -16,6 +16,7 @@ const llm_1 = require("./llm");
 const manifest_1 = require("./manifest");
 const diff_1 = require("./diff");
 const docs_1 = require("./docs");
+const webmcp_1 = require("./webmcp");
 const init_1 = require("./init");
 const setup_1 = require("./setup");
 /**
@@ -180,6 +181,29 @@ async function main() {
         console.error(`wrote ${outPath}`);
         return;
     }
+    if (command === "webmcp") {
+        const manifestPath = node_path_1.default.join(node_path_1.default.resolve(dir), "ui-manifest.json");
+        if (!node_fs_1.default.existsSync(manifestPath)) {
+            console.error(`cairn webmcp: no ${manifestPath} — run \`cairn build ${dir}\` first.`);
+            process.exit(1);
+        }
+        const manifest = core_1.ManifestSchema.parse(JSON.parse(node_fs_1.default.readFileSync(manifestPath, "utf8")));
+        const component = (0, webmcp_1.generateWebMcpComponent)(manifest);
+        if (!component) {
+            console.error("cairn webmcp: no real, traced actions (apiCall-backed elements) found in this manifest — nothing safe to register. Nothing written.");
+            return;
+        }
+        const outPath = node_path_1.default.join(node_path_1.default.resolve(dir), "components", "CairnWebMcpTools.tsx");
+        node_fs_1.default.mkdirSync(node_path_1.default.dirname(outPath), { recursive: true });
+        node_fs_1.default.writeFileSync(outPath, component);
+        console.error(`wrote ${outPath}`);
+        console.error("");
+        console.error("Next step: add it once, near your Copilot widget (e.g. app/layout.tsx):");
+        console.error('  import { CairnWebMcpTools } from "./components/CairnWebMcpTools";');
+        console.error("  <CairnWebMcpTools />");
+        console.error("Re-run `cairn webmcp` after a fresh `cairn build` whenever this app's real actions change.");
+        return;
+    }
     console.error("usage:");
     console.error("  cairn setup [dir]   (the one-command path: installs deps, asks for keys — skippable, wires the widget in, builds once, auto-rebuilds on future `npm run build`)");
     console.error("  cairn init <dir>   (scaffolds the API route/server + .env.example, detects your framework — no prompts, no installs)");
@@ -188,6 +212,7 @@ async function main() {
     console.error("  cairn build <url> [--provider anthropic|groq] [--out <dir>] [--storage-state <file>]   (any framework — crawls a running app; --storage-state replays a saved logged-in session for auth-gated apps)");
     console.error("  cairn diff <old-manifest.json> <new-manifest.json>");
     console.error("  cairn docs <dir>   (reads <dir>/ui-manifest.json, writes <dir>/CAIRN_DOCS.md)");
+    console.error("  cairn webmcp <dir>   (reads <dir>/ui-manifest.json, writes <dir>/components/CairnWebMcpTools.tsx — registers this app's real, traced actions as WebMCP tools any agent can call, not just Cairn)");
     process.exit(command ? 1 : 0);
 }
 main().catch((err) => {

package/dist/webmcp.js

@@ -0,0 +1,134 @@
+"use strict";
+// Cairn as a WebMCP *producer*, not just a consumer
+// (https://webmachinelearning.github.io/webmcp/). The indexer already
+// traces real, safe, mutating actions statically (l1-scan.ts's
+// findApiCallIn — a real POST/PUT/PATCH/DELETE call an element's own
+// handler already makes, never invented; GET is deliberately excluded, per
+// ApiCallSchema's own doc comment, since a read-only call isn't an
+// "action"). This turns that same traced set into real
+// document.modelContext.registerTool() calls — so running `cairn build`
+// doesn't just make a site usable by Cairn's own runtime, it also makes it
+// agent-ready for any future agent that understands the standard, with zero
+// Cairn lock-in (the generated component has no Cairn import at all).
+//
+// Pure formatting/codegen from an already-built manifest, no LLM call — same
+// shape as docs.ts's generateDocsMarkdown.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateWebMcpComponent = generateWebMcpComponent;
+/** Turns a route into a name-safe prefix — "/" (home) has no segments to
+ * join, "/invoices" -> "invoices", "/agents/new" -> "agents-new". */
+function routePrefix(route) {
+    const slug = route
+        .split("/")
+        .filter(Boolean)
+        .join("-")
+        .replace(/[^a-zA-Z0-9-]/g, "-");
+    return slug || "home";
+}
+/**
+ * Collects every real apiCall-backed element across the whole manifest into
+ * one flat, deduped tool list. Deduped by (id, method, url) together, not
+ * id alone — id is only ever guaranteed unique WITHIN a page (l1-scan
+ * assigns them per-page), so two different page-scoped elements can share
+ * an id by coincidence and must stay two separate tools; a genuinely
+ * global element (e.g. a layout nav action) instead appears on every
+ * page's own `elements` array with the IDENTICAL apiCall each time
+ * (assembleManifest spreads globalElements onto every page) — matching on
+ * the full key is what tells "really the same action, seen N times" apart
+ * from "two different actions that happen to share an id".
+ */
+function collectTools(manifest) {
+    const seen = new Map();
+    const pages = [...manifest.pages].sort((a, b) => a.route.localeCompare(b.route));
+    for (const page of pages) {
+        for (const el of page.elements) {
+            if (!el.apiCall)
+                continue;
+            const key = `${el.id}::${el.apiCall.method}::${el.apiCall.url}`;
+            if (seen.has(key))
+                continue;
+            seen.set(key, {
+                name: `${routePrefix(page.route)}-${el.id}`,
+                description: el.does,
+                apiCall: el.apiCall,
+            });
+        }
+    }
+    return [...seen.values()];
+}
+function jsStringLiteral(value) {
+    return JSON.stringify(value);
+}
+/**
+ * Generates a real, self-contained TSX component ("use client") that
+ * registers every real apiCall-backed action in the manifest as a WebMCP
+ * tool, on mount, at the app root — one component, added once, covers every
+ * page (each tool's execute() fires the same same-origin fetch the client-
+ * side `do` verb's own apiCall fallback already does — see verb-executor.ts's
+ * executeApiCall — real session cookies via credentials: "same-origin", no
+ * request body since static tracing only ever captures method+url). Returns
+ * null when the manifest has no real apiCall-backed elements — nothing
+ * safe to register, so nothing to scaffold.
+ */
+function generateWebMcpComponent(manifest) {
+    const tools = collectTools(manifest);
+    if (tools.length === 0)
+        return null;
+    const registrations = tools
+        .map((tool) => `    register({
+      name: ${jsStringLiteral(tool.name)},
+      description: ${jsStringLiteral(tool.description)},
+      inputSchema: { type: "object", properties: {} },
+      execute: async () => {
+        const res = await fetch(${jsStringLiteral(tool.apiCall.url)}, { method: ${jsStringLiteral(tool.apiCall.method)}, credentials: "same-origin" });
+        return { ok: res.ok, status: res.status };
+      },
+    });`)
+        .join("\n\n");
+    return `// Generated by \`cairn webmcp\` from commit ${jsStringLiteral(manifest.commit)} at ${manifest.generatedAt}.
+// Do not edit by hand — regenerate instead (\`npx cairn webmcp <dir>\` after
+// a fresh \`cairn build\`, whenever the app's real actions change).
+//
+// Registers this app's own real, traced actions
+// (https://webmachinelearning.github.io/webmcp/) so ANY agent that
+// understands the standard — not just Cairn — can discover and call them
+// directly. No Cairn import here on purpose: this keeps working even in an
+// app that later removes Cairn entirely, and costs nothing on a browser
+// that doesn't implement WebMCP yet (the overwhelming majority right now —
+// registerTool() is checked for and simply skipped if absent).
+"use client";
+
+import { useEffect } from "react";
+
+export function CairnWebMcpTools() {
+  useEffect(() => {
+    const modelContext = (document as unknown as { modelContext?: any }).modelContext;
+    if (!modelContext?.registerTool) return;
+
+    let unregistered = false;
+    const handles: { remove?: () => void }[] = [];
+    const register = (tool: unknown) => {
+      void modelContext
+        .registerTool(tool)
+        .then((registered: { remove?: () => void }) => {
+          if (unregistered) registered?.remove?.();
+          else handles.push(registered);
+        })
+        .catch(() => {
+          // A page without a real WebMCP implementation, or a tool name
+          // this app already registered some other way — nothing to do.
+        });
+    };
+
+${registrations}
+
+    return () => {
+      unregistered = true;
+      for (const handle of handles) handle?.remove?.();
+    };
+  }, []);
+
+  return null;
+}
+`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cairnvibe/indexer",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "description": "Cairn's analyzer and installer (the `cairn` CLI) — scans Next.js source or crawls any running app, and scaffolds the backend either way.",
   "license": "MIT",
   "publishConfig": { "access": "public" },