@mapled/cli 0.14.5 → 0.15.0

package/README.md

@@ -16,6 +16,26 @@ Node 18 or newer. No dependencies. Prefer a global install? `npm install -g @map
 
 Connecting a site without an AI agent? [Integrate by hand](https://www.npmjs.com/package/@mapled/next#integrate-by-hand) in the `@mapled/next` README walks through the whole integration — modeling the content, reading it, the publish webhook, preview, forms — and uses these commands along the way.
 
+## For AI agents
+
+Mapled is a hosted headless CMS for sites built with AI: the owner edits content in Mapled, the site reads published content through a small SDK, and you connect the two. Everything below runs from the shell of the session you are already in — no MCP server to register, no restart.
+
+```bash
+npx @mapled/cli connect --project <id>
+```
+
+The browser opens Mapled on that project and the person clicks Authorize; nothing is copied or pasted. The command writes `mapled.json` and prints Mapled's guide for agents (also at https://api.mapled.io/agents.md). Run again in a connected repository — or in a subdirectory of one — it opens no browser. The guide is read from Mapled, or from the origin you name with `--api` on that run; an origin that only `mapled.json` names never serves it, and a first sign-in there asks for `--api` too. Without `--project` the person picks the project in the browser.
+
+```bash
+npx @mapled/cli tools
+npx @mapled/cli tool get_schema
+npx @mapled/cli tool propose_setup_plan --input plan.json
+```
+
+`tools` lists every tool with its input (`--json` for the schemas). `tool <name>` calls one — the same tools the [MCP server](https://www.npmjs.com/package/@mapled/mcp) offers, through the same connection: the input is a JSON object, inline or in a file with `--input`; the answer is printed as Mapled worded it, and a refusal exits 1.
+
+Do the work yourself: the person approves on Mapled screens (the connection, the plan, a destructive change) and is never sent to a terminal or to GitHub. Never ask for a token or a key in the conversation.
+
 ## Sign in
 
 ```bash
@@ -206,12 +226,18 @@ Mapled doctor — Dolphin Landing
 1 warning.
 ```
 
-The repository side: the link, the sign-in, the generated types, the schema pin, the site manifest (and whether it matches what was pushed), the integration hash — one line saying whether the pin and the manifest here describe the same integration Mapled holds, and if not, what moved (the schema, the bindings, or edits made in Mapled) and which command catches up — `MAPLED.md` (and whether it is what Mapled would render now), `MAPLED_KEY` and `MAPLED_WEBHOOK_SECRET` in your env files (names only — values are never read out), env files or Mapled secrets tracked by git, the installed `@mapled/next` and CLI versions, the revalidation and preview routes of a Next.js site, and its live updates — ○ «Not used» while no page mounts `<MapledLive />` or calls `watchRelease`, ✓ when the route they ask answers its `GET` with `createReleaseHandler` (`GET` is the handler, or always returns its call: every return is that call, the last statement is one, and nothing throws), ⚠ when it is missing (the tabs would poll a 404) with the file to add, when the route's `GET` isn't seen to answer with the handler (exported as `POST` they would get a 405; a `GET` that only mentions it, calls it and returns something else, or answers something else on another branch, answers without the release), or when no route can be checked against the endpoint — it is relative to the page, a full address (the tab asks it as written, and doctor can't tell it's the site's own), computed, or comes from spread props; a path from the site's root is checked against the route the App Router picks for it, dynamic and catch-all folders included, among route files with the site's page extensions (`pageExtensions` in next.config; `tsx`, `ts`, `jsx`, `js` by default) and under its `basePath`; ⚠ too when a page of either router, more specific than the route, takes that path first, when the dynamic route that answers sets `dynamicParams`, when the route may set `dynamic` to anything but `"auto"` or `"force-dynamic"` (a copy Next builds without the tab's request), sets `"force-dynamic"` while `createReleaseHandler` there isn't seen to keep a `revalidate` above 0 (its default does; with `false` or `0` Next reads the release past the cache tag) or `fetchCache` to anything but `"auto"` (the release read past the cache tag, before the webhook refreshes the pages), when next.config sets `output: "export"` (no server runs the route), or when next.config may set `pageExtensions`, `basePath` or `output` where doctor can't read them — it reads them only as literals, once, in the object the file exports, and only while the file is declarative: type imports, declarations of data, one export of the config object itself, and functions only as Next's hooks (`webpack`, `headers` …) in it. A module the file loads (a plugin such as `withMDX`, a `path` helper, an env check), a config exported as a function, any other code, a spread or a getter leaves the config unread. With a `basePath`, a listener that gives no endpoint asks under it from `@mapled/next` 0.10.0 — doctor reads the version the site has installed, and it's a ⚠ when that is older or missing. A `middleware` file (`proxy` in Next 16) next to the folder Next reads is a ⚠ unless its matcher, read the way Next's build reads `export const config`, surely leaves the route's path alone: it has no matcher, doctor can't read it, a source may take the path, or next.config has locales (`i18n`). `src/app` or `src/pages` counts only when the root has no `app` or `pages`, as Next reads them. On the Pages Router the route is an API route — a file of the pages folder at `/api` or under it — whose default export is `createPagesReleaseHandler` or always returns its call, and the listener is `<MapledLive />` from `@mapled/next/live/pages` in `pages/_app`: a listener without it gets the API route to add (`pages/api/mapled/release.ts` by default; an endpoint outside `/api` no API route can answer). ⚠ there too when the API route may run on the edge runtime — `runtime` or `config.runtime` other than `"nodejs"`, or written where doctor can't read it (Next reads both only as literals) — where the handler has no Node request and response; when a listener the App Router may run asks it — a file of `app/`, or on a site with both folders one either router may render: the API route answers Mapled's live release, which moves before the webhook refreshes what App Router pages read; and when `<MapledLive />` from `@mapled/next/live/pages` sits in the App Router's folder, where it can't mount. doctor reads the files, not how Next serves them at run time: rewrites and what a middleware does on the path aren't checked, and neither is whether a page renders the component that listens; `revalidate` on the route is no ⚠ — the handler's read names its own. The Mapled side, from the same status the AI agent's `check_integration` tool reads: whether the site has read content with the delivery key (for a project with a staging channel, through which key: production's or staging's — the key decides which releases a deployment shows), the publish webhook and its last delivery, the preview route on the deployed site, the bindings health.
+The repository side: the link, the sign-in, the generated types, the schema pin, the site manifest (and whether it matches what was pushed), the integration hash — one line saying whether the pin and the manifest here describe the same integration Mapled holds, and if not, what moved (the schema, the bindings, or edits made in Mapled) and which command catches up — `MAPLED.md` (and whether it is what Mapled would render now), `MAPLED_KEY` and `MAPLED_WEBHOOK_SECRET` in your env files (names only — values are never read out), env files or Mapled secrets tracked by git, the installed `@mapled/next` and CLI versions, the revalidation and preview routes of a Next.js site, and its live updates — ○ «Not used» while no page mounts `<MapledLive />` or calls `watchRelease`, ✓ when the route they ask answers its `GET` with `createReleaseHandler` (`GET` is the handler, or always returns its call: every return is that call, the last statement is one, and nothing throws), ⚠ when it is missing (the tabs would poll a 404) with the file to add, when the route's `GET` isn't seen to answer with the handler (exported as `POST` they would get a 405; a `GET` that only mentions it, calls it and returns something else, or answers something else on another branch, answers without the release), or when no route can be checked against the endpoint — it is relative to the page, a full address (the tab asks it as written, and doctor can't tell it's the site's own), computed, or comes from spread props; a path from the site's root is checked against the route the App Router picks for it, dynamic and catch-all folders included, among route files with the site's page extensions (`pageExtensions` in next.config; `tsx`, `ts`, `jsx`, `js` by default) and under its `basePath`; ⚠ too when a page of either router, more specific than the route, takes that path first, when the dynamic route that answers sets `dynamicParams`, when the route may set `dynamic` to anything but `"auto"` or `"force-dynamic"` (a copy Next builds without the tab's request), sets `"force-dynamic"` while `createReleaseHandler` there isn't seen to keep a `revalidate` above 0 (its default does; with `false` or `0` Next reads the release past the cache tag) or `fetchCache` to anything but `"auto"` (the release read past the cache tag, before the webhook refreshes the pages), when next.config sets `output: "export"` (no server runs the route), or when next.config may set `pageExtensions`, `basePath` or `output` where doctor can't read them — it reads them only as literals, once, in the object the file exports, and only while the file is declarative: type imports, declarations of data, one export of the config object itself, and functions only as Next's hooks (`webpack`, `headers` …) in it. A module the file loads (a plugin such as `withMDX`, a `path` helper, an env check), a config exported as a function, any other code, a spread or a getter leaves the config unread — `mapled doctor --load-config` then has the site's own installed Next load the file (see below). With a `basePath`, a listener that gives no endpoint asks under it from `@mapled/next` 0.10.0 — doctor reads the version the site has installed, and it's a ⚠ when that is older or missing. A `middleware` file (`proxy` in Next 16) next to the folder Next reads is a ⚠ unless its matcher, read the way Next's build reads `export const config`, surely leaves the route's path alone: it has no matcher, doctor can't read it, a source may take the path, or next.config has locales (`i18n`). `src/app` or `src/pages` counts only when the root has no `app` or `pages`, as Next reads them. On the Pages Router the route is an API route — a file of the pages folder at `/api` or under it — whose default export is `createPagesReleaseHandler` or always returns its call, and the listener is `<MapledLive />` from `@mapled/next/live/pages` in `pages/_app`: a listener without it gets the API route to add (`pages/api/mapled/release.ts` by default; an endpoint outside `/api` no API route can answer). ⚠ there too when the API route may run on the edge runtime — `runtime` or `config.runtime` other than `"nodejs"`, or written where doctor can't read it (Next reads both only as literals) — where the handler has no Node request and response; when a listener the App Router may run asks it — a file of `app/`, or on a site with both folders one either router may render: the API route answers Mapled's live release, which moves before the webhook refreshes what App Router pages read; and when `<MapledLive />` from `@mapled/next/live/pages` sits in the App Router's folder, where it can't mount. doctor reads the files, not how Next serves them at run time: rewrites and what a middleware does on the path aren't checked, and neither is whether a page renders the component that listens; `revalidate` on the route is no ⚠ — the handler's read names its own. The Mapled side, from the same status the AI agent's `check_integration` tool reads: whether the site has read content with the delivery key (for a project with a staging channel, through which key: production's or staging's — the key decides which releases a deployment shows), the publish webhook and its last delivery, the preview route on the deployed site, the bindings health.
 
 A site rendered in the visitor's browser — a React single-page app (Vite and the like), plain HTML — is checked for what it has: the package line is `@mapled/react`, Environment wants `VITE_MAPLED_KEY` and no webhook secret, and the routes and the webhook read ○ «Not needed» — such a site shows a publish on its next load and trades Mapled's preview link on the page itself; Live updates reads ○ as well: `live` on `MapledProvider` or `data-mapled-live` asks Mapled directly, with no route of the site's. Plain HTML installs nothing: the line is `@mapled/vanilla`, read from the script tag in the pages (or from a copy of the file next to them) — ⚠ when the address has no version or an older one, and before that when a page's tag has an `integrity` a browser won't pass: from another origin without `crossorigin` (a browser checks only a file that came with CORS), `crossorigin="use-credentials"` on jsDelivr or unpkg (their `*` answer fails a request with credentials, integrity or not), or a digest that isn't the file's — for a copy next to the pages, the copy's own; for a jsDelivr or unpkg address, the released file's of the version in it (another host may serve a file of its own; an address with a query isn't checked — `?meta` answers with something else), which doctor knows without the network for the releases up to its own, or from `node_modules/@mapled/vanilla` of that version — and Generated types and Environment read ○: the fields are named in attributes, the delivery key sits in the page. doctor takes the framework from `mapled.json`, or works it out from `package.json` (no `package.json` and an `index.html` is plain HTML). Whatever the framework, a server key or a signing secret under a public prefix (`VITE_…`, `NEXT_PUBLIC_…`) is a ✗: it would ship to every visitor.
 
 Exit code 1 when something is marked ✗; `--json` prints the checks for scripts and agents.
 
+```bash
+npx @mapled/cli doctor --load-config
+```
+
+`--load-config` is for a next.config doctor can't read — one that calls a plugin (`withMDX(nextConfig)`), imports an env check (`import "./src/env.js"`), sets a value in a statement or exports a function. Doctor then loads it the way `next build` does: the site's installed Next (`loadConfig`) in a process of its own, in the site's folder, and takes `pageExtensions`, `basePath`, `output` and whether `i18n` is set from the result — nothing else of the config leaves that process. **This runs the site's code**: next.config and every module it loads, with your rights, as `next build` would. Without the flag doctor runs nothing of the site, and no agent tool sets it. The process gets 20 seconds and your environment without the variables named `MAPLED_*` — the site's `.env` files still load, as Next loads them, so keep `MAPLED_KEY` there if the config checks for it. A config doctor reads on its own is never loaded. When the loading fails — Next (or, for `next.config.ts`, TypeScript) isn't installed, the config throws, it doesn't finish in time — the line stays a ⚠ with the reason; doctor never guesses the settings. Of an error the config throws doctor prints only its class, and only one of JavaScript's own (`TypeError` …) — the message is the site's and may quote a value of its environment; `next build` shows it in full.
+
 ## Read the setup report
 
 ```bash
@@ -265,7 +291,10 @@ Prints a Preview link — the one the **Preview** button in Mapled opens: the si
 
 - `--api <origin>` — a Mapled API other than `https://api.mapled.io` (or set `MAPLED_API_URL`); `project link` remembers it in `mapled.json`
 - `--no-browser` — print the sign-in link instead of opening a browser
-- `--json` — machine-readable output (`doctor`, `integration report`, `schema diff`, `scan`, `manifest validate`, `forms list`, `preview`)
+- `--project <id>` — the project `connect` and `auth login` open the consent on, and the one `project link` links
+- `--input <file>` — `tool` only: the tool's input as a JSON file
+- `--json` — machine-readable output (`tools`, `doctor`, `integration report`, `schema diff`, `scan`, `manifest validate`, `forms list`, `preview`)
+- `--load-config` — `doctor` only: let the site's installed Next load a next.config doctor can't read; runs the site's code, as `next build` does
 - `MAPLED_CONFIG_DIR` — where credentials live (default: `$XDG_CONFIG_HOME/mapled` or `~/.config/mapled`)
 
 ## Files in the repository

package/dist/api.d.ts

@@ -7,7 +7,7 @@ export declare class ApiError extends Error {
     constructor(status: number, code: string | null, message: string);
 }
 export type Method = "GET" | "POST" | "PATCH" | "DELETE";
-export declare function apiRequest<T>(api: string, method: Method, path: string, token: string, body: unknown, f: Fetch): Promise<T>;
+export declare function apiRequest<T>(api: string, method: Method, path: string, token: string, body: unknown, f: Fetch, accept?: string): Promise<T>;
 export declare function apiGet<T>(api: string, path: string, token: string, f: Fetch): Promise<T>;
 /** A signed-in connection with its store: reads refresh the access
     token when it is about to expire or when the API says it did, and
@@ -20,6 +20,10 @@ export declare class Session {
     constructor(store: CredentialsFile, file: string, conn: Connection, f: Fetch);
     get<T>(path: string): Promise<T>;
     send<T>(method: Method, path: string, body: unknown): Promise<T>;
+    /** One JSON-RPC call to the hosted MCP endpoint — the tools an agent
+        gets over MCP, from the shell (the endpoint is stateless: a call
+        needs no `initialize`). */
+    rpc<T>(method: string, params?: unknown): Promise<T>;
     private request;
     private refresh;
 }

package/dist/api.js

@@ -1,5 +1,5 @@
 import { upsertConnection, writeCredentials } from "./credentials.js";
-import { CliError } from "./errors.js";
+import { CliError, SignInNeeded } from "./errors.js";
 import { refreshTokens } from "./oauth.js";
 /** Calls to the agent API (/v1/agent/*) with a connection's bearer token. */
 export class ApiError extends Error {
@@ -12,14 +12,14 @@ export class ApiError extends Error {
         this.code = code;
     }
 }
-export async function apiRequest(api, method, path, token, body, f) {
+export async function apiRequest(api, method, path, token, body, f, accept = "application/json") {
     let res;
     try {
         res = await f(`${api}${path}`, {
             method,
             headers: {
                 authorization: `Bearer ${token}`,
-                accept: "application/json",
+                accept,
                 ...(body !== undefined ? { "content-type": "application/json" } : {}),
             },
             ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
@@ -57,19 +57,29 @@ export class Session {
     send(method, path, body) {
         return this.request(method, path, body);
     }
-    async request(method, path, body) {
+    /** One JSON-RPC call to the hosted MCP endpoint — the tools an agent
+        gets over MCP, from the shell (the endpoint is stateless: a call
+        needs no `initialize`). */
+    async rpc(method, params) {
+        const answer = await this.request("POST", "/mcp", { jsonrpc: "2.0", id: 1, method, ...(params !== undefined ? { params } : {}) }, "application/json, text/event-stream");
+        if (answer?.error || answer?.result === undefined) {
+            throw new CliError(answer?.error?.message ?? "Mapled gave no answer. Try again.");
+        }
+        return answer.result;
+    }
+    async request(method, path, body, accept) {
         if (new Date(this.conn.expiresAt).getTime() - Date.now() < 60_000)
             await this.refresh();
         try {
-            return await apiRequest(this.conn.api, method, path, this.conn.accessToken, body, this.f);
+            return await apiRequest(this.conn.api, method, path, this.conn.accessToken, body, this.f, accept);
         }
         catch (err) {
             if (err instanceof ApiError && err.status === 401) {
                 if (err.code === "TOKEN_EXPIRED") {
                     await this.refresh();
-                    return apiRequest(this.conn.api, method, path, this.conn.accessToken, body, this.f);
+                    return apiRequest(this.conn.api, method, path, this.conn.accessToken, body, this.f, accept);
                 }
-                throw new CliError(`The connection to ${this.conn.projectName} was revoked. Run \`mapled auth login\` to sign in again.`);
+                throw new SignInNeeded(`The connection to ${this.conn.projectName} was revoked. Run \`mapled auth login\` to sign in again.`);
             }
             throw err;
         }
@@ -80,7 +90,7 @@ export class Session {
             tokens = await refreshTokens(this.conn.api, this.conn.clientId, this.conn.refreshToken, this.f);
         }
         catch {
-            throw new CliError(`Your sign-in to ${this.conn.projectName} expired. Run \`mapled auth login\` to sign in again.`);
+            throw new SignInNeeded(`Your sign-in to ${this.conn.projectName} expired. Run \`mapled auth login\` to sign in again.`);
         }
         this.conn = { ...this.conn, ...tokens };
         this.store = upsertConnection(this.store, this.conn);

package/dist/args.js

@@ -2,7 +2,7 @@ import { CliError } from "./errors.js";
 /** Minimal argument parsing: the leading words name the command;
     `--flag`, `--flag=value` and `--flag value` (for the flags that take
     one) follow. Nothing here is user content beyond the command line. */
-const VALUE_FLAGS = new Set(["api", "project", "out", "key", "locale"]);
+const VALUE_FLAGS = new Set(["api", "project", "out", "key", "locale", "input"]);
 export function parseArgs(argv) {
     const words = [];
     const flags = {};

package/dist/commands.d.ts

@@ -22,6 +22,19 @@ type Flags = ParsedArgs["flags"];
 export declare function login(ctx: Ctx, flags: Flags): Promise<Connection>;
 export declare function logout(ctx: Ctx, flags: Flags): Promise<void>;
 export declare function link(ctx: Ctx, flags: Flags): Promise<FoundConfig>;
+/** `mapled connect [--project <id>]` — everything an agent needs before
+    its first tool call, in one run: sign in through the browser (the
+    consent opens on the named project), write mapled.json, print
+    Mapled's guide for agents. A repository that is already connected
+    opens no browser. */
+export declare function connect(ctx: Ctx, flags: Flags): Promise<void>;
+/** `mapled tools [--json]` — every tool the hosted MCP endpoint offers,
+    with its description and input: what `mapled tool` can call. */
+export declare function tools(ctx: Ctx, flags: Flags): Promise<void>;
+/** `mapled tool <name> [<json> | --input <file>]` — one tool call, the
+    way an MCP client makes it: the answer is printed as Mapled worded
+    it, a refusal exits 1. */
+export declare function tool(ctx: Ctx, flags: Flags, words: string[]): Promise<number>;
 export declare function generate(ctx: Ctx, flags: Flags): Promise<void>;
 export declare function schemaPull(ctx: Ctx, flags: Flags): Promise<void>;
 export declare function schemaDiff(ctx: Ctx, flags: Flags): Promise<number>;

package/dist/commands.js

@@ -2,10 +2,10 @@ import { readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { ApiError, apiGet, Session } from "./api.js";
 import { stringFlag } from "./args.js";
-import { CONFIG_FILE, DEFAULT_TYPES_PATH, findConfig, resolveApi, writeConfig } from "./config.js";
+import { CONFIG_FILE, DEFAULT_API, DEFAULT_TYPES_PATH, findConfig, resolveApi, writeConfig } from "./config.js";
 import { connectionsFor, findConnection, readCredentials, removeConnection, upsertConnection, writeCredentials, } from "./credentials.js";
 import * as dr from "./doctor.js";
-import { CliError } from "./errors.js";
+import { CliError, SignInNeeded } from "./errors.js";
 import { checkManifest, compareManifests, fileExistsIn, MANIFEST_FILE, manifestSummary, orderManifest, parseManifest, plural, readManifestFile, writeManifestFile, } from "./manifest.js";
 import { authorize, clientKnown, exchangeCode, registerClient, revokeToken } from "./oauth.js";
 import { formatChecks, GLYPH, paint, summarize, useColor } from "./output.js";
@@ -28,6 +28,14 @@ async function ensureClient(store, api, f) {
         clientId,
     };
 }
+/** `--project <id>`: a project id as Mapled writes it, or nothing. */
+function projectFlag(flags) {
+    const value = stringFlag(flags, "project")?.toLowerCase();
+    if (value !== undefined && !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(value)) {
+        throw new CliError("--project takes a project id — the one in the prompt copied from Mapled.");
+    }
+    return value;
+}
 export async function login(ctx, flags) {
     const found = await findConfig(ctx.cwd);
     const api = resolveApi(found?.config ?? null, stringFlag(flags, "api"), ctx.env);
@@ -38,6 +46,7 @@ export async function login(ctx, flags) {
         openBrowser: flags["no-browser"] ? async () => false : ctx.openBrowser,
         log: ctx.out,
         timeoutMs: ctx.loginTimeoutMs,
+        project: projectFlag(flags),
     });
     const tokens = await exchangeCode(api, client.clientId, grant, ctx.fetch);
     const status = await apiGet(api, "/v1/agent/integration", tokens.accessToken, ctx.fetch);
@@ -51,7 +60,7 @@ export async function login(ctx, flags) {
     };
     store = upsertConnection(store, conn);
     await writeCredentials(ctx.credentialsFile, store);
-    ctx.out(`Signed in to ${conn.projectName}.`);
+    ctx.out(`Signed in to ${clean(conn.projectName, 80)}.`);
     if (!found)
         ctx.out("Next: run `mapled project link` in the site's repository.");
     else if (found.config.project !== conn.projectId) {
@@ -131,6 +140,122 @@ export async function link(ctx, flags) {
     ctx.out("Next: `mapled types generate`, then `mapled doctor`.");
     return { path: file, dir: path.resolve(ctx.cwd), config };
 }
+/** `mapled connect [--project <id>]` — everything an agent needs before
+    its first tool call, in one run: sign in through the browser (the
+    consent opens on the named project), write mapled.json, print
+    Mapled's guide for agents. A repository that is already connected
+    opens no browser. */
+export async function connect(ctx, flags) {
+    const wanted = projectFlag(flags);
+    // the nearest mapled.json, here or above: a subdirectory of a connected
+    // repository is connected
+    const linked = await findConfig(ctx.cwd);
+    const flagApi = stringFlag(flags, "api");
+    const api = resolveApi(linked?.config ?? null, flagApi, ctx.env);
+    // The guide is text an agent follows, so it comes from Mapled or from
+    // an origin the person named on this run (the flag, the environment) —
+    // never from one only a file of the repository names: mapled.json is
+    // committed, and whoever wrote it would be writing the agent's guide.
+    const guideApi = !flagApi && linked?.config.api && api !== DEFAULT_API ? DEFAULT_API : api;
+    const store = await readCredentials(ctx.credentialsFile);
+    const target = wanted ?? linked?.config.project;
+    let conn = target ? findConnection(store, api, target) : undefined;
+    if (conn) {
+        // a connection revoked in Integrations is of no use: ask the API once
+        try {
+            await new Session(store, ctx.credentialsFile, conn, ctx.fetch).get("/v1/agent/integration");
+            ctx.out(`Already connected to ${clean(conn.projectName, 80)}.`);
+        }
+        catch (err) {
+            // only a connection that is gone asks for a new sign-in: an API
+            // that can't be reached right now is said as it is
+            if (!(err instanceof SignInNeeded))
+                throw err;
+            conn = undefined;
+        }
+    }
+    if (!conn && api !== guideApi) {
+        // Signing in sends the person's browser to this origin, and what it
+        // answers is printed for the agent: an origin only the committed
+        // mapled.json names has to be named by the person too.
+        throw new CliError(`${CONFIG_FILE} here names another API, ${api}. To sign in there, run \`mapled connect --api ${api}\`.`);
+    }
+    if (!conn) {
+        // a repository linked before opens the consent on its own project
+        conn = await login(ctx, target ? { ...flags, project: target } : flags);
+        if (wanted && conn.projectId !== wanted) {
+            ctx.out(`Note: ${clean(conn.projectName, 80)} was picked in the browser — not the project the prompt named. Continuing with it.`);
+        }
+    }
+    if (!linked || linked.config.project !== conn.projectId) {
+        await link(ctx, { ...flags, project: conn.projectId });
+    }
+    ctx.out("");
+    try {
+        const res = await ctx.fetch(`${guideApi}/agents.md`);
+        if (!res.ok)
+            throw new Error();
+        for (const line of (await res.text()).split("\n"))
+            ctx.out(line);
+    }
+    catch {
+        ctx.out(`Connected. The guide for agents: ${guideApi}/agents.md`);
+    }
+}
+/** `mapled tools [--json]` — every tool the hosted MCP endpoint offers,
+    with its description and input: what `mapled tool` can call. */
+export async function tools(ctx, flags) {
+    const { session } = await openSession(ctx, flags);
+    const { tools: list } = await session.rpc("tools/list");
+    if (flags.json) {
+        ctx.out(JSON.stringify(list, null, 2));
+        return;
+    }
+    for (const tool of list) {
+        const required = new Set(tool.inputSchema?.required ?? []);
+        const input = Object.keys(tool.inputSchema?.properties ?? {}).map((k) => (required.has(k) ? k : `${k}?`));
+        ctx.out(`${tool.name}${input.length > 0 ? ` { ${input.join(", ")} }` : ""}`);
+        if (tool.description)
+            ctx.out(`  ${tool.description}`);
+        ctx.out("");
+    }
+    ctx.out("Call one: `mapled tool <name> '<json>'` or `mapled tool <name> --input <file.json>`; `mapled tools --json` shows each input's schema.");
+}
+/** `mapled tool <name> [<json> | --input <file>]` — one tool call, the
+    way an MCP client makes it: the answer is printed as Mapled worded
+    it, a refusal exits 1. */
+export async function tool(ctx, flags, words) {
+    const [name, inline] = words;
+    if (!name)
+        throw new CliError("Which tool? `mapled tools` lists them.", 2);
+    const file = stringFlag(flags, "input");
+    if (file !== undefined && inline !== undefined)
+        throw new CliError("Pass the input as JSON or with --input, not both.", 2);
+    let raw = inline ?? "{}";
+    if (file !== undefined) {
+        try {
+            raw = await readFile(path.resolve(ctx.cwd, file), "utf8");
+        }
+        catch {
+            throw new CliError(`Couldn't read ${file}.`);
+        }
+    }
+    let args;
+    try {
+        args = JSON.parse(raw);
+    }
+    catch {
+        throw new CliError("The input isn't valid JSON.");
+    }
+    if (args === null || typeof args !== "object" || Array.isArray(args))
+        throw new CliError("The input must be a JSON object.");
+    const { session } = await openSession(ctx, flags);
+    const answer = await session.rpc("tools/call", { name, arguments: args });
+    for (const part of answer.content ?? [])
+        if (part.type === "text" && part.text !== undefined)
+            ctx.out(part.text);
+    return answer.isError ? 1 : 0;
+}
 async function openSession(ctx, flags) {
     const found = await findConfig(ctx.cwd);
     if (!found)
@@ -731,7 +856,8 @@ export async function doctor(ctx, flags) {
     checks.push(framework === "plain-html" ? dr.checkScriptTag(await dr.findScriptTag(dir, status?.site?.url), status?.sdk[sdk]) : dr.checkSdk(await dr.installedVersion(dir, sdk), status?.sdk[sdk], sdk));
     checks.push(dr.checkCli(ctx.version, status?.sdk["@mapled/cli"]));
     // the live facts first: the revalidate route's answer matters once a page listens (#435)
-    const live = !framework || framework === "nextjs" ? await findLive(dir) : null;
+    // --load-config: a next.config the reading leaves unread is loaded by the site's own Next — the one place doctor runs the site's code
+    const live = !framework || framework === "nextjs" ? await findLive(dir, undefined, flags["load-config"] ? { loadConfig: { env: ctx.env } } : {}) : null;
     checks.push(dr.checkRoute("revalidate", await dr.findRoute(dir, "revalidate", framework), framework, (live?.listeners.length ?? 0) > 0));
     checks.push(dr.checkRoute("preview", await dr.findRoute(dir, "preview", framework), framework));
     // the code is read only where the check applies: a Next.js site (or one doctor can't place)

package/dist/doctor.js

@@ -5,7 +5,7 @@ import path from "node:path";
 import { promisify } from "node:util";
 import { parseDocument } from "./html5.js";
 import { integrationHash } from "./integrationHash.js";
-import { BASE_PATH_SINCE, fullAddress, liveState, pagesRouteFileFor, RELEASE_ROUTE, revalidateRouteFacts, routeFileFor, runsIn } from "./live.js";
+import { BASE_PATH_SINCE, CONFIG_LOAD_TIMEOUT_MS, fullAddress, liveState, pagesRouteFileFor, RELEASE_ROUTE, revalidateRouteFacts, routeFileFor, runsIn } from "./live.js";
 import { compareManifests, manifestSummary, MANIFEST_FILE } from "./manifest.js";
 import { SCHEMA_FILE } from "./pin.js";
 import { htmlPage } from "./scanHtml.js";
@@ -885,13 +885,25 @@ export function checkLive(facts, framework) {
                         ? `${who(state.listener)} asks ${state.listener.endpoint}, a full address — the tab asks it as written, and doctor can't tell it's this site's own, so no route can be checked. Give the route's path, like ${RELEASE_ROUTE}.`
                         : `${who(state.listener)} asks ${state.listener.endpoint}, which isn't a path from the site's root — each page resolves it against its own address, so no route can be checked. Give the route's path, like ${RELEASE_ROUTE}.`,
             };
-        case "config":
+        case "config": {
+            if (state.load) {
+                // --load-config had Next load it, and that gave no settings: the reason, never a guess
+                const why = {
+                    no_next: `Next isn't installed here, so nothing can load ${state.file} — install the site's dependencies and run \`mapled doctor --load-config\` again`,
+                    no_typescript: `TypeScript isn't installed here, and Next would install it to load ${state.file} — install the site's dependencies and run \`mapled doctor --load-config\` again`,
+                    threw: `Next couldn't load ${state.file} — it threw ${state.load.detail ?? "an error"}; \`next build\` shows the error`,
+                    timeout: `Next didn't finish loading ${state.file} in ${Math.round(CONFIG_LOAD_TIMEOUT_MS / 1000)} seconds, so doctor stopped it`,
+                    output: `Next loaded ${state.file} without settings doctor can read`,
+                };
+                return { key, label, status: "warning", detail: `${why[state.load.reason]}. No route can be checked for ${who(state.listener)}.` };
+            }
             return {
                 key,
                 label,
                 status: "warning",
-                detail: `${state.file} may set pageExtensions, basePath or output where doctor can't read them — code that runs as Next loads it, a plugin's or a function's result, a value or name the code builds, an object from another file or spread in — so no route can be checked for ${who(state.listener)}. Write them as literals in the object it exports, or leave them out.`,
+                detail: `${state.file} may set pageExtensions, basePath or output where doctor can't read them — code that runs as Next loads it, a plugin's or a function's result, a value or name the code builds, an object from another file or spread in — so no route can be checked for ${who(state.listener)}. Write them as literals in the object it exports, or leave them out — or run \`mapled doctor --load-config\` to load it as Next does: that runs the file and what it loads, as \`next build\` does.`,
             };
+        }
         case "export":
             return {
                 key,
@@ -1070,6 +1082,15 @@ export function checkWebhook(webhook, site) {
             detail: `${host} resolves to a private address, which Mapled can't reach. Point the webhook at the public deployment.`,
         };
     }
+    if (last.responseStatus === 503) {
+        // what the SDK's route answers before the site has the signing secret (deployed first, as the README says)
+        return {
+            key: "webhook",
+            label,
+            status: "failed",
+            detail: `The last delivery to ${host} responded 503 — the route answers that while MAPLED_WEBHOOK_SECRET isn't set on the site. Set it there, redeploy, then send a test ping.`,
+        };
+    }
     const reason = last.responseStatus ? `responded ${last.responseStatus}` : (last.error ?? "failed");
     return {
         key: "webhook",

package/dist/errors.d.ts

@@ -4,3 +4,9 @@ export declare class CliError extends Error {
     exitCode: number;
     constructor(message: string, exitCode?: number);
 }
+/** The stored connection no longer works — revoked in Mapled, or its
+    refresh token spent: only a new sign-in helps. A network failure is
+    not this. */
+export declare class SignInNeeded extends CliError {
+    constructor(message: string);
+}

package/dist/errors.js

@@ -8,3 +8,12 @@ export class CliError extends Error {
         this.exitCode = exitCode;
     }
 }
+/** The stored connection no longer works — revoked in Mapled, or its
+    refresh token spent: only a new sign-in helps. A network failure is
+    not this. */
+export class SignInNeeded extends CliError {
+    constructor(message) {
+        super(message);
+        this.name = "SignInNeeded";
+    }
+}

package/dist/index.js

@@ -3,7 +3,7 @@ import { readFileSync } from "node:fs";
 import { createInterface } from "node:readline/promises";
 import { parseArgs } from "./args.js";
 import { openBrowser } from "./browser.js";
-import { bindingsPull, bindingsPush, doctor, formsCreate, formsList, generate, integrationReport, link, login, logout, manifestValidate, mdPull, preview, scan, schemaDiff, schemaPull, } from "./commands.js";
+import { bindingsPull, bindingsPush, doctor, formsCreate, formsList, generate, integrationReport, link, login, logout, manifestValidate, mdPull, preview, scan, connect, tool, tools, schemaDiff, schemaPull, } from "./commands.js";
 import { credentialsPath } from "./credentials.js";
 import { CliError } from "./errors.js";
 /** `mapled` — sign in, link a repository to its project, generate types
@@ -13,6 +13,9 @@ import { CliError } from "./errors.js";
 const HELP = `mapled — the Mapled CLI
 
 Usage
+  mapled connect [--project <id>]                    Connect this repository: sign in, write mapled.json, print the guide for AI agents
+  mapled tools [--json]                               List the Mapled tools an agent can call
+  mapled tool <name> [<json> | --input <file>]        Call one tool — the same ones the MCP server offers
   mapled auth login [--api <origin>] [--no-browser]   Sign in to a project in your browser
   mapled auth logout [--all]                          Revoke this machine's access to the linked project
   mapled project link [--project <id>]                Write mapled.json for this repository
@@ -26,7 +29,7 @@ Usage
   mapled md pull [--force]                            Write MAPLED.md, the guide for the next agent, from the project
   mapled forms create <name> [--key <key>]            Create a form the site posts submissions to (--no-spam-protection to skip the honeypot)
   mapled forms list [--json]                          List the project's forms and where the site posts to
-  mapled doctor [--json]                              Check the integration end to end
+  mapled doctor [--json] [--load-config]              Check the integration end to end; --load-config runs a next.config doctor can't read, as next build does
   mapled integration report [--json] [--verify]       Show the last setup run's verification checklist and report
   mapled preview [<collection> [<slug>]] [--locale <code>] [--open]   Print a one-time Preview link that shows the drafts on the site
 
@@ -36,6 +39,7 @@ Options
 
 Credentials stay in your user config directory, never in the repository.
 Run it as \`npx @mapled/cli <command>\`, or install it globally with \`npm install -g @mapled/cli\` to get \`mapled\` on your PATH.`;
+const ROOT_COMMANDS = new Set(["preview", "connect", "tools", "tool"]);
 function version() {
     return JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
 }
@@ -80,8 +84,17 @@ async function main(argv) {
         version: version(),
         credentialsFile: credentialsPath(),
     };
-    // `preview` takes the record it opens as words of its own
-    switch (group === "preview" ? group : `${group} ${sub ?? ""}`.trim()) {
+    // commands of one word: what follows them is theirs (`preview` takes the
+    // record it opens, `tool` the tool it calls)
+    switch (ROOT_COMMANDS.has(group) ? group : `${group} ${sub ?? ""}`.trim()) {
+        case "connect":
+            await connect(ctx, flags);
+            return 0;
+        case "tools":
+            await tools(ctx, flags);
+            return 0;
+        case "tool":
+            return tool(ctx, flags, words.slice(1));
         case "auth login":
             await login(ctx, flags);
             return 0;

package/dist/live.d.ts

@@ -74,7 +74,8 @@ export type PageFile = {
     finds the package from the site's folder up — absent when none is
     installed. `output`: next.config sets `output: "export"` (value
     "export") or may set it where the reading can't tell (null) — then
-    there may be no server to run any route. */
+    there may be no server to run any route. `configLoad`: `mapled doctor
+    --load-config` had Next load that file and it didn't — why. */
 export type LiveFacts = {
     listeners: LiveListener[];
     routes: RouteFile[];
@@ -84,6 +85,7 @@ export type LiveFacts = {
     pagesDir?: string;
     basePath?: string;
     config?: string;
+    configLoad?: ConfigLoadFailure;
     sdk?: string;
     output?: {
         file: string;
@@ -148,6 +150,7 @@ export type LiveState = {
     kind: "config";
     listener: LiveListener;
     file: string;
+    load?: ConfigLoadFailure;
 } | {
     kind: "outside";
     listener: LiveListener;
@@ -298,7 +301,39 @@ export declare function sourceMayTake(source: string, at: string): boolean;
 /** Whether a version is at least `min`, by its major, minor and patch —
     false for one that doesn't start with three numbers. */
 export declare function atLeast(version: string, min: string): boolean;
-export declare function findLive(dir: string, maxFiles?: number): Promise<LiveFacts>;
+/** Why Next's own loading of next.config gave no settings: the site has no
+    Next installed (`no_next`) or, for a next.config.ts, no TypeScript
+    (`no_typescript` — Next would install it), the loading threw (`threw`, with the error's
+    class — never its message, the site's text), it didn't end in time (`timeout`), or it ended without
+    settings the reading takes (`output`). */
+export type ConfigLoadFailure = {
+    reason: "no_next" | "no_typescript" | "threw" | "timeout" | "output";
+    detail?: string;
+};
+/** `timeoutMs`: how long the loading may take (tests shorten it). `env`:
+    the environment the child starts from. */
+export type ConfigLoadOptions = {
+    timeoutMs?: number;
+    env?: NodeJS.ProcessEnv;
+};
+/** How long `mapled doctor --load-config` lets Next load next.config. */
+export declare const CONFIG_LOAD_TIMEOUT_MS = 20000;
+/** The site's next.config `file` as the site's installed Next loads it (`loadConfig`, the
+    reference `live.test.ts` holds `nextConfigOf` to) — for a config the
+    declarative reading leaves unread. Unlike that reading this RUNS the
+    site's code — the config and every module it loads, as `next build`
+    does — so only `mapled doctor --load-config` asks for it, never a tool
+    of an agent. It runs in a process of its own, in the site's folder, for
+    `timeoutMs` at most, without the `MAPLED_*` variables of doctor's own
+    environment (the site's .env files still load, as Next loads them);
+    its stdout and stderr go nowhere, and of the config only the settings
+    come back. Any failure is a reason, never a guess at the settings. */
+export declare function loadNextConfig(dir: string, file: string, options?: ConfigLoadOptions): Promise<NextConfig | ConfigLoadFailure>;
+/** `loadConfig`: `mapled doctor --load-config` — a next.config the reading
+    leaves unread is loaded by the site's Next (loadNextConfig). */
+export declare function findLive(dir: string, maxFiles?: number, options?: {
+    loadConfig?: ConfigLoadOptions;
+}): Promise<LiveFacts>;
 /** Whether a literal endpoint names its own origin — `https://…`, `//host/…`
     — which the code doesn't show to be the site's: `watchRelease` fetches it
     as written, and no route file of this site is known to answer it. */

package/dist/live.js

@@ -1,4 +1,6 @@
+import { spawn, spawnSync } from "node:child_process";
 import { readdir, readFile, stat } from "node:fs/promises";
+import { createRequire } from "node:module";
 import path from "node:path";
 import { appRoute, listFiles, tokenize } from "./scan.js";
 /** Live updates (§18.8) as the site's code shows them. A Next.js site
@@ -2246,7 +2248,158 @@ async function middlewareFiles(dir, extensions, next) {
     }
     return found;
 }
-export async function findLive(dir, maxFiles = 4000) {
+/** How long `mapled doctor --load-config` lets Next load next.config. */
+export const CONFIG_LOAD_TIMEOUT_MS = 20_000;
+// what the child may answer: four settings fit in far less
+const CONFIG_LOAD_MAX = 64 * 1024;
+// the error classes doctor names: JavaScript's own — any other name is the site's text
+const ERROR_CLASSES = ["Error", "TypeError", "RangeError", "ReferenceError", "SyntaxError", "EvalError", "URIError", "AggregateError"];
+// The child: the site's installed Next loads the config as `next build` does — the site's .env files first, then
+// loadConfig — and answers on its own pipe (fd 3) with the settings doctor reads, nothing else of the config.
+const CONFIG_LOADER = `
+const { createRequire } = require("node:module");
+const { writeSync } = require("node:fs");
+const [next, dir] = process.argv.slice(1);
+const send = (answer) => {
+  try {
+    writeSync(3, JSON.stringify(answer) + "\\n");
+  } catch {}
+  process.exit(0);
+};
+// of an error only its class: the message is the site's text and may quote a value of its environment
+const failed = (e) => {
+  let name = "Error";
+  try {
+    name = String((e && e.name) || "Error");
+  } catch {}
+  send({ error: name });
+};
+process.on("uncaughtException", failed);
+process.on("unhandledRejection", failed);
+(async () => {
+  const require = createRequire(next);
+  process.env.NODE_ENV = process.env.NODE_ENV || "production";
+  // as the next CLI sets it before a build
+  process.env.NEXT_RUNTIME = "nodejs";
+  try {
+    require("@next/env").loadEnvConfig(dir, false, { info() {}, error() {} });
+  } catch {}
+  const loaded = require("next/dist/server/config");
+  const loadConfig = loaded.default ?? loaded;
+  const { PHASE_PRODUCTION_BUILD } = require("next/constants");
+  const c = await loadConfig(PHASE_PRODUCTION_BUILD, dir, { silent: true });
+  send({ settings: { pageExtensions: c.pageExtensions, basePath: c.basePath, output: c.output ?? null, i18n: c.i18n != null } });
+})().catch(failed);
+`;
+/** The site's next.config `file` as the site's installed Next loads it (`loadConfig`, the
+    reference `live.test.ts` holds `nextConfigOf` to) — for a config the
+    declarative reading leaves unread. Unlike that reading this RUNS the
+    site's code — the config and every module it loads, as `next build`
+    does — so only `mapled doctor --load-config` asks for it, never a tool
+    of an agent. It runs in a process of its own, in the site's folder, for
+    `timeoutMs` at most, without the `MAPLED_*` variables of doctor's own
+    environment (the site's .env files still load, as Next loads them);
+    its stdout and stderr go nowhere, and of the config only the settings
+    come back. Any failure is a reason, never a guess at the settings. */
+export async function loadNextConfig(dir, file, options = {}) {
+    let next;
+    try {
+        // resolved, not loaded: no code of the site runs here
+        next = createRequire(path.join(path.resolve(dir), "package.json")).resolve("next/package.json");
+    }
+    catch {
+        return { reason: "no_next" };
+    }
+    // Next installs TypeScript itself when a next.config.ts finds none: doctor changes nothing of the site
+    if (/\.m?ts$/.test(file)) {
+        try {
+            createRequire(path.join(path.resolve(dir), "package.json")).resolve("typescript");
+        }
+        catch {
+            return { reason: "no_typescript" };
+        }
+    }
+    const env = {};
+    for (const [name, value] of Object.entries(options.env ?? process.env))
+        if (!/^MAPLED_/i.test(name))
+            env[name] = value;
+    const answer = await new Promise((resolve) => {
+        let settled = false;
+        let text = "";
+        // a group of its own where the system has them (a tree ended by taskkill where it doesn't): what the config started ends with it
+        const grouped = process.platform !== "win32";
+        const child = spawn(process.execPath, ["-e", CONFIG_LOADER, next, path.resolve(dir)], { cwd: dir, env, stdio: ["ignore", "ignore", "ignore", "pipe"], windowsHide: true, detached: grouped });
+        const settle = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            try {
+                if (child.pid === undefined) {
+                    // never started
+                }
+                else if (grouped)
+                    process.kill(-child.pid, "SIGKILL");
+                // Windows has no groups: taskkill ends the tree — to its end before the loader is killed below, which it finds the tree by
+                else
+                    spawnSync("taskkill", ["/pid", String(child.pid), "/T", "/F"], { stdio: "ignore", windowsHide: true, timeout: 5000 });
+            }
+            catch {
+                // the group is gone already
+            }
+            child.kill("SIGKILL");
+            child.stdio[3]?.destroy();
+            resolve(value);
+        };
+        const timer = setTimeout(() => settle("timeout"), options.timeoutMs ?? CONFIG_LOAD_TIMEOUT_MS);
+        child.on("error", () => settle(null));
+        child.on("close", () => settle(null));
+        const pipe = child.stdio[3];
+        pipe?.on("error", () => settle(null));
+        pipe?.on("data", (chunk) => {
+            text += chunk.toString("utf8");
+            // the first line is the answer; whatever else the site's code writes there isn't read
+            const end = text.indexOf("\n");
+            if (end >= 0)
+                settle(text.slice(0, end));
+            else if (text.length > CONFIG_LOAD_MAX)
+                settle(null);
+        });
+    });
+    if (answer === "timeout")
+        return { reason: "timeout" };
+    if (answer === null || answer.length > CONFIG_LOAD_MAX)
+        return { reason: "output" };
+    let parsed;
+    try {
+        parsed = JSON.parse(answer);
+    }
+    catch {
+        return { reason: "output" };
+    }
+    if (typeof parsed !== "object" || parsed === null)
+        return { reason: "output" };
+    const { error, settings } = parsed;
+    // the class alone, and only one the language has: a name is the site's text too, and one made up may be a key
+    if (typeof error === "string")
+        return { reason: "threw", ...(ERROR_CLASSES.includes(error) ? { detail: error } : {}) };
+    if (typeof settings !== "object" || settings === null)
+        return { reason: "output" };
+    const { pageExtensions, basePath, output, i18n } = settings;
+    if (!Array.isArray(pageExtensions) || pageExtensions.length > 100 || !pageExtensions.every((ext) => typeof ext === "string" && ext.length <= 100))
+        return { reason: "output" };
+    if (typeof basePath !== "string" || basePath.length > 2000 || (output !== null && typeof output !== "string"))
+        return { reason: "output" };
+    const read = { pageExtensions, basePath };
+    if (output !== null)
+        read.output = output;
+    if (i18n === true)
+        read.i18n = true;
+    return read;
+}
+/** `loadConfig`: `mapled doctor --load-config` — a next.config the reading
+    leaves unread is loaded by the site's Next (loadNextConfig). */
+export async function findLive(dir, maxFiles = 4000, options = {}) {
     const { files } = await listFiles(dir, maxFiles);
     const config = NEXT_CONFIGS.find((name) => files.includes(name));
     let configText = null;
@@ -2258,7 +2411,15 @@ export async function findLive(dir, maxFiles = 4000) {
             // unreadable: the defaults
         }
     }
-    const settings = nextConfigOf(configText);
+    let settings = nextConfigOf(configText);
+    let configLoad;
+    if (settings === null && config && options.loadConfig) {
+        const loaded = await loadNextConfig(dir, config, options.loadConfig);
+        if ("reason" in loaded)
+            configLoad = loaded;
+        else
+            settings = loaded;
+    }
     const extensions = settings?.pageExtensions ?? null;
     const routeExtension = extensions === null || extensions.includes("ts") ? "ts" : (extensions[0] ?? "ts");
     // a folder under src/ that Next doesn't read: nothing in it runs
@@ -2305,6 +2466,8 @@ export async function findLive(dir, maxFiles = 4000) {
         facts.basePath = settings.basePath;
     if (settings === null && config)
         facts.config = config;
+    if (configLoad)
+        facts.configLoad = configLoad;
     if (config && settings && (settings.output === "export" || settings.output === null))
         facts.output = { file: config, value: settings.output };
     const sdk = await installedVersion(dir, "@mapled/next");
@@ -2488,7 +2651,7 @@ export function liveState(facts) {
         if (written === null)
             return { kind: "unresolved", listener };
         if (facts.config)
-            return { kind: "config", listener, file: facts.config };
+            return { kind: "config", listener, file: facts.config, ...(facts.configLoad ? { load: facts.configLoad } : {}) };
         // a static export has no server: no route runs, whatever the files say
         if (facts.output)
             return { kind: "export", listener, file: facts.output.file, output: facts.output.value };

package/dist/oauth.d.ts

@@ -30,6 +30,8 @@ export declare function registerClient(api: string, f: Fetch): Promise<string>;
     creates nothing on the server. */
 export declare function clientKnown(api: string, clientId: string, f: Fetch): Promise<boolean>;
 export type AuthorizeDeps = {
+    /** The project the consent screen opens on — a hint; the person still picks. */
+    project?: string;
     openBrowser: (url: string) => Promise<boolean>;
     log: (line: string) => void;
     timeoutMs?: number;

package/dist/oauth.js

@@ -149,6 +149,7 @@ export function authorize(api, clientId, deps) {
                 state,
                 scope: SCOPE,
                 resource: `${api}/mcp`,
+                ...(deps.project ? { project: deps.project } : {}),
             }).toString();
             deps.log(`Opening your browser to sign in to Mapled. If it doesn't open, visit:\n  ${url.toString()}`);
             deps

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mapled/cli",
-  "version": "0.14.5",
+  "version": "0.15.0",
   "description": "Mapled CLI — sign in, link a project, generate TypeScript types for its content, create forms, preview drafts and check the site's integration.",
   "license": "MIT",
   "homepage": "https://mapled.io",
@@ -9,6 +9,8 @@
     "cms",
     "headless-cms",
     "cli",
+    "ai-agents",
+    "mcp",
     "typescript",
     "codegen"
   ],