@rsc-kit/mcp 0.22.9 → 0.24.0

package/guides/backend-answered-pages.md

@@ -152,7 +152,8 @@ A global the renderer installs in its own process, not something you import:
 carrying `{ "function": "Orders.recent", "args": [5] }`, the shared secret,
 and the visitor's cookie — so the backend's session and auth are the
 visitor's — answered with the function's return value as JSON, typed by the
-`T` you give it (the `rsc-env.d.ts` the build writes declares it). A refusal
+`T` you give it. The build declares it in `.rsc-kit/rsc-env.d.ts`, so there is
+nothing to import and no `declare` to write. A refusal
 comes back as itself — a validation error, unauthenticated, unauthorized, a
 redirect — and reaches the page as that kind, never as a 500. Calls made by
 sibling components in the same tick travel as one batch and are answered in
@@ -166,6 +167,72 @@ no database driver, no ORM, no auth library in it, because the backend owns
 those, which is why the built server for a Laravel or Go app is a fraction of
 the size of the same pages with their data layer in JavaScript.
 
+### What the backend tells the build
+
+The backend writes `rsc-host.json` at the project root, beside
+`vite.config.ts`:
+
+```json title="rsc-host.json"
+{
+  "actions": { "ordersCreate": "Orders.create" },
+  "functions": ["Orders.create", "Orders.recent"]
+}
+```
+
+`actions` are its server actions, by the name the app imports them under; the
+build writes a `"use server"` stub for each in `src/server-actions.generated.ts`.
+`functions` are the names `rpc()` may be called with, and become the type of
+its first argument, so `rpc('Orders.recnet')` fails the typecheck.
+
+Have Vite write it, so it cannot go stale. `hostManifest` runs the backend's
+command as `vite` and `vite build` start:
+
+```ts title="vite.config.ts"
+rscKit({ hostManifest: { command: ['go', 'run', '.', '-manifest', '../rsc-host.json'], cwd: 'backend' } })
+rscKit({ hostManifest: { command: ['php', 'artisan', 'rsc:host-manifest'] } })
+```
+
+A build fails if the command does. Under dev it is reported, and the file
+already there is used. A dev server restarts when the file changes.
+
+### Testing it
+
+`createTestApp` answers the backend in the test, through the same client the
+app uses against a real one, so nothing has to be running:
+
+```ts title="tests/app.test.ts"
+import { createTestApp, hostReply, HOST_MIDDLEWARE } from '@rsc-kit/core/testing'
+
+const app = await createTestApp({
+  host: {
+    'Orders.recent': ({ args }) => [{ id: 1, total: Number(args[0]) * 100 }],
+    'Orders.create': ({ args }) => (args[0] ? { created: args[0] } : hostReply.invalid({ name: ['Required.'] })),
+    // The guards middleware.ts names: true lets the page render.
+    [HOST_MIDDLEWARE]: ({ headers }) =>
+      headers.get('cookie')?.includes('session=') ? true : hostReply.unauthenticated(),
+  },
+})
+
+expect((await app.fetch('/admin')).status).toBe(401)
+```
+
+Each handler gets the call's `args` and the visitor `headers` the renderer
+forwarded. Return a value for the result, or one of the protocol's answers:
+`hostReply.unauthenticated()`, `unauthorized()`, `redirect(to)`,
+`refuse(status, message)`, `invalid(errors)`, or `revalidating(result,
+...regions)`. A name with no handler fails the call, naming it.
+
+A url the app does not own, such as a Go route or `/login`, is forwarded to the
+backend, and in a test that is a 502. `backend` answers those instead, handed
+the request as the backend would receive it:
+
+```ts
+const app = await createTestApp({
+  host: { /* … */ },
+  backend: (request) => new Response('the login page', { headers: { 'content-type': 'text/html' } }),
+})
+```
+
 **Guards are the backend's, named in `middleware.ts`.** The backend decides
 whether a route may render, in its own vocabulary, and the renderer asks
 before anything at or below that directory renders — including a page frozen

package/guides/domains.md

@@ -52,20 +52,53 @@ address bar, and a link to `/billing` on that page goes to
 
 ## A tenant tree
 
-```tsx title="src/app/[domain]/layout.tsx"
+Whether the tenant exists is a guard, so it goes in `middleware.ts`. It runs
+before anything is sent, on every path, and its `notFound()` is a real 404.
+Its argument is the route's params:
+
+```ts title="src/app/[domain]/middleware.ts"
 import { notFound } from '@rsc-kit/core/not-found';
 import { tenantByDomain } from '@/lib/tenants';
 
-export default async function TenantLayout({ params, children }) {
+export default async function knownTenant({ domain }) {
+  if (!(await tenantByDomain(domain))) notFound(); // "acme" or "acme.com", as stored
+}
+```
+
+The layout is handed the same params, as a promise. A route that lists no
+urls is stored as one shell for every tenant, so what reads the tenant goes
+under `<Suspense>`; awaited above every boundary, there is no value to store
+the shell with, and the build says so and names the layout:
+
+```tsx title="src/app/[domain]/layout.tsx"
+import { Suspense } from 'react';
+import { tenantByDomain } from '@/lib/tenants';
+
+async function TenantName({ params }) {
   const { domain } = await params;
-  const tenant = await tenantByDomain(domain); // "acme" or "acme.com", as stored
 
-  if (!tenant) notFound();
+  return (await tenantByDomain(domain))!.name;
+}
 
-  return <TenantProvider tenant={tenant}>{children}</TenantProvider>;
+export default function TenantLayout({ params, children }) {
+  return (
+    <>
+      <header>
+        <Suspense fallback={null}>
+          <TenantName params={params} />
+        </Suspense>
+      </header>
+      {children}
+    </>
+  );
 }
 ```
 
+A layout sees its own segments' params and those above it, never a deeper
+one's, and it is rendered again when one of its own values changes:
+`acme.example.com/settings` to `globex.example.com/settings` renders the
+tenant layout for globex, while the root layout above it stays mounted.
+
 `[domain]` is an ordinary dynamic segment: `params.domain` in every page and
 layout below it, `route('/[domain]/settings', { domain })` typed, `loading.tsx`
 and `error.tsx` where you put them. A directory named for a host,

package/guides/forms.md

@@ -61,6 +61,11 @@ prop, in a component of its own, with shadcn or without:
 - **`error('title')`** — the field's message, or `undefined`. Show it, or test
   it: `!!error('title')` is "invalid". Nested fields are paths:
   `error('address.city')`, `error('items[0].name')`.
+- **`formError`** — the refusal that is not about a field: the action's
+  `serverError`, such as a payment required or a slot just taken, or a
+  validation message for the whole form. `{formError && <p role="alert">{formError}</p>}`.
+  It clears with the field errors. A failure thrown on the way, such as the
+  network, still goes to `onError`.
 - **`field('title')`** — a binding to spread onto a control, for the few fields
   whose value this component has to hold. Most fields need nothing: they are
   uncontrolled, the DOM holds the value, and it is read back on submit.

package/guides/go.md

@@ -59,6 +59,34 @@ the renderer's origin too.
 
 ## Reading from Go
 
+Register an ordinary Go function with `Handle`, and its types reach the app:
+
+```go
+reg.Handle("Orders.recent", func(ctx context.Context, limit int) ([]Order, error) {
+    // The visitor's cookie, forwarded from the page request: this runs as
+    // them, not as nobody.
+    return db.RecentOrders(ctx, rsckit.HeadersFrom(ctx).Get("Cookie"), limit)
+})
+```
+
+```tsx title="src/app/orders/page.tsx"
+const orders = await rpc('Orders.recent', 5)   // Order[]; rpc('Orders.recent', 'five') fails the typecheck
+```
+
+- **Any parameters, in order.** `rpc()`'s arguments are bound to the
+  function's parameters positionally, whatever JSON can carry: numbers,
+  strings, structs, slices, maps. A leading `context.Context` is the call's.
+- **Optional and variadic.** A trailing pointer parameter may be left out
+  and is `nil`; a variadic one takes the rest.
+- **What it returns.** A value and an error, only an error, or only a value.
+- **Types for the app.** The parameter and result types are written to
+  `rsc-host.json` as JSON Schema. The build turns each struct into a
+  TypeScript interface in the `RscHost` namespace, by its `json` tags:
+  `omitempty` is optional, a pointer is `| null`, `time.Time` is a string.
+  A type with its own `MarshalJSON` is `unknown`, since its shape is its own.
+
+`Register` still takes the untyped form, binding by hand:
+
 ```go
 reg.Register("Orders.recent", func(ctx context.Context, args rsckit.Args) (any, error) {
     var limit int
@@ -84,7 +112,8 @@ export default async function Orders() {
 
 `args.Bind` decodes the positional arguments `rpc()` was given; too few is an
 error, extra ones are ignored. Whatever the function returns is encoded as
-JSON and decoded on the other side as whatever `rpc<T>()` was told.
+JSON and decoded on the other side as whatever `rpc<T>()` was told: an
+untyped function is `unknown` until you say.
 
 ### Refusing
 
@@ -136,23 +165,18 @@ does not happen is the failure this exists to prevent.
 ## Server actions
 
 ```go
-reg.RegisterAction("ordersCancel", "Orders.cancel", func(ctx context.Context, args rsckit.Args) (any, error) {
-    var id int
-    if err := args.Bind(&id); err != nil {
-        return nil, err
-    }
-
+reg.HandleAction("ordersCancel", "Orders.cancel", func(ctx context.Context, id int) error {
     if err := orders.Cancel(ctx, id); err != nil {
-        return nil, err
+        return err
     }
 
     rsckit.Revalidate(ctx, "orders")
 
-    return nil, nil
+    return nil
 })
 
-// Before each build. The build reads it and writes the stubs.
-reg.WriteActionManifest("rsc-host-actions.json")
+// The actions and every function, for the build: stubs, and rpc()'s type.
+reg.WriteManifest("rsc-host.json")
 ```
 
 ```tsx title="src/app/orders/CancelButton.tsx"
@@ -164,12 +188,27 @@ export function CancelButton({ id }: { id: number }) {
 }
 ```
 
+The stub is typed from the Go function: `ordersCancel(id: number): Promise<void>`.
+A form can post to an action directly, `<Form action={ordersCreate}>`, and its
+fields arrive as the first parameter: a struct, with numbers and booleans
+coerced by its types and a repeated field a slice.
+
 `Revalidate` names a [section](/guides/sections) or `page`, and the answer to
 the action carries it re-rendered rather than the browser being told to ask
-again. Write the manifest as part of the build — the example's `build`
-script runs the Go program with `-manifest-only` first — because a stale map
-names a function that has since been renamed, and nothing fails until the
-browser calls it.
+again.
+
+Have Vite write the manifest, so it cannot go stale: give the program a flag
+that writes it and exits, and name the command in the config. It runs as dev
+and every build start, and a build fails if it does:
+
+```ts title="vite.config.ts"
+rscKit({ hostManifest: { command: ['go', 'run', '.', '-manifest', '../rsc-host.json'], cwd: 'backend' } })
+```
+
+The manifest also lists every registered function, so `rpc()` is typed by
+the names Go holds and `rpc('Orders.recnet')` fails the typecheck. Tests
+answer these functions without Go running:
+[Testing it](/hosts/backend-answered-pages#testing-it).
 
 ## Production
 

package/guides/installation.md

@@ -14,7 +14,8 @@ bun create rsc-kit@latest my-app
 ```
 
 It asks where it will run (Bun, Node or Cloudflare Workers), whether you want the
-React Compiler and which implementation, whether to include Tailwind, and
+React Compiler and which implementation, whether to include Tailwind and, if
+so, shadcn/ui, and
 whether the app should be installable — offline, a manifest and starter icons
 ([`--pwa`](/guides/pwa#starting-one-installable)). Every answer has a flag, so it
 also runs unattended:
@@ -23,6 +24,36 @@ also runs unattended:
 bun create rsc-kit@latest my-app --host=bun --compiler=oxc --tailwind
 ```
 
+| Flag | What it does |
+| --- | --- |
+| `--host=bun\|node\|worker` | Where it runs, which picks the Nitro preset. |
+| `--compiler=none\|oxc\|babel` | The React Compiler. The prompt offers oxc. |
+| `--tailwind`, `--no-tailwind` | Include Tailwind. |
+| `--lint`, `--no-lint` | Include oxlint. |
+| `--validation=zod\|valibot\|arktype\|none` | The schema library forms, actions and env use. |
+| `--env`, `--no-env` | Typed environment variables. |
+| `--pwa`, `--no-pwa` | Installable: offline, a manifest and starter icons. Off by default. |
+| `--shadcn` | shadcn/ui, set up for RSC. Needs Tailwind. See below. |
+| `--source-dir <dir>` | Where `app/` lives. Default `src`. |
+| `--backend=<url>` | A backend answering `rpc()`, such as a Go server. Writes `.env` with a secret. |
+| `--no-install`, `--no-git` | Skip installing dependencies, or `git init`. |
+| `--yes` | Accept every default and ask nothing. |
+
+shadcn/ui is asked about only after Tailwind is chosen, because its
+components are styled with it; `--shadcn` with `--no-tailwind` is refused.
+Either way, it runs shadcn's own `init` once dependencies are installed, so it
+asks its own questions, such as the component library; with `--yes` it takes
+its defaults. Then it sets `"rsc": true` in `components.json`. shadcn sees a
+plain Vite project and writes `false`, and the components it adds that need
+the browser, a dialog or a dropdown, would then lack `"use client"`. In an
+existing app, `rsc-kit init` asks the same question when the project has or
+adds Tailwind, and when `components.json` is already there it asks only
+whether to set the flag. Running `shadcn init` yourself
+leaves it `false`; set it to `true` by hand.
+
+Use `--yes`, not `-y`, with `bun create`: Bun reads `-y` as its own flag and
+refuses it. `bunx create-rsc-kit my-app -y` accepts either.
+
 What comes out builds, prerenders, typechecks and serves before you edit it.
 
 The rest of this page is for adding rsc-kit to an app you already have.

package/guides/laravel.md

@@ -83,6 +83,7 @@ export default defineConfig({
       sourceDir: 'resources/js',
       outDir: 'bootstrap/rsc/vite',
       hotFile: 'public/rsc-hot',
+      hostManifest: { command: ['php', 'artisan', 'rsc:host-manifest'] },
     }),
     react(),
   ],
@@ -98,19 +99,21 @@ dev server — read below.
 ```json title="package.json"
 {
   "scripts": {
-    "dev": "php artisan rsc:action-manifest && vite",
-    "build": "php artisan rsc:action-manifest && vite build",
+    "dev": "vite",
+    "build": "vite build",
     "start": "bun .output/server/index.mjs"
   }
 }
 ```
 
-`rsc:action-manifest` runs first on purpose. Your server actions are found by
-reflection through Composer's autoloader — the only thing that sees what a
-class inherits from its parents and traits — so PHP writes the map to
-`rsc-host-actions.json` and the build reads it. Part of the command rather
-than a step to remember: a stale map names a method that has since been
-renamed, and nothing fails until the browser calls it.
+`vite.config.ts` runs `php artisan rsc:host-manifest` as dev and every build
+start (`hostManifest`). Your server actions are found by reflection through
+Composer's autoloader — the only thing that sees what a class inherits from
+its parents and traits — so PHP writes them to `rsc-host.json` and the build
+reads it. It lists every callable too, which types `rpc()`'s first argument.
+Part of starting Vite rather than a step to remember: a stale manifest names a
+method that has since been renamed, and nothing fails until the browser calls
+it.
 
 If you had customised `dev` or `build` yourself, `init` leaves them alone and
 puts the renderer's at `rsc:dev` and `rsc:build`, and says so.
@@ -208,6 +211,34 @@ session bound is theirs.
 `.rsc-kit/rsc-env.d.ts`. It exists in server components during a render and
 nowhere else — a client component reaches PHP through a server action.
 
+### Typed from the PHP signature
+
+`rsc:host-manifest` writes what each method takes and returns, so the call
+is typed without a type argument:
+
+```php
+public function find(int $id, ?FindOptions $options = null): OrderData
+```
+
+```tsx
+const order = await rpc('Orders.find', 7)   // OrderData; rpc('Orders.find', 'seven') fails the typecheck
+```
+
+- **Parameters** are positional, as the call is made: `int`, `float`,
+  `string` and `bool` are typed, a nullable one adds `| null`, one with a
+  default may be left out, and a variadic one takes the rest.
+- **A form request** in front is the call's one argument, typed from its
+  `rules()`: `integer`, `numeric`, `boolean` and `array` as such, the rest as
+  strings, `required` ones required.
+- **A result** is typed when PHP can say what `json_encode` will write: a
+  scalar, a backed enum (its values), or a plain class with public typed
+  properties — a data object — which becomes an interface named for it.
+- **Left open** as `unknown`: `array`, a model, a collection, anything
+  `JsonSerializable`, and an untyped parameter. Their shape is decided at
+  runtime, so say it at the call: `rpc<Order[]>('Orders.recent')`.
+
+Action stubs are typed the same way, and accept the posting `FormData` too.
+
 ### Refusing
 
 Attributes on the class or the method, and the refusal travels as itself
@@ -240,8 +271,8 @@ method runs, which is where `ValidationException` usually comes from.
 
 ## Server actions
 
-A class under `app/Rsc/Actions/` is a server action. `rsc:action-manifest`
-writes the map, and the build writes a `"use server"` module beside your pages
+A class under `app/Rsc/Actions/` is a server action. `rsc:host-manifest`
+writes it to the manifest, and the build writes a `"use server"` module beside your pages
 exporting one function per method, named `classMethod`.
 
 Make one with its guards already on it:
@@ -258,11 +289,11 @@ under `app/Rsc` instead. A slash nests: `Billing/Invoices`, discovered like
 any other. The attributes it writes are the ones the registry reads, so what
 you asked for at the prompt is what runs.
 
-It writes the map as well, and a dev server that is running starts again
-when the map changes — so the export is there to import the moment the
+It writes the manifest as well, and a dev server that is running starts again
+when the manifest changes — so the export is there to import the moment the
 command returns, with nothing to restart by hand. A class you write yourself
-is picked up the next time `rsc:action-manifest` runs, which the `dev` and
-`build` scripts do first.
+is picked up the next time `rsc:host-manifest` runs, which starting Vite
+does.
 
 ```php title="app/Rsc/Actions/Orders.php"
 namespace App\Rsc\Actions;
@@ -321,7 +352,7 @@ composer install --no-dev --optimize-autoloader
 npm ci && npm run build
 ```
 
-The build runs `rsc:action-manifest`, so PHP has to boot on the build
+The build runs `rsc:host-manifest`, so PHP has to boot on the build
 machine. It writes `.output/` — the server, the engine, the frozen pages and
 the assets — which travels with the deployment; nothing in it is read from the
 source tree at runtime.

package/guides/ppr.md

@@ -187,9 +187,88 @@ Work with it rather than around it:
 - **Leave out `animate-pulse` for anything that is usually gone quickly.** A
   pulse is what makes a short fallback look like a flash.
 
-## loading.tsx instead
+## The default: a page that paints, and slots that wait
 
-Rather than wrapping every page by hand, put a `loading.tsx` beside it. The
+Write the page as a synchronous component. Everything it knows without
+asking — the title, the copy, the card frames, a button that needs nothing —
+is in the stored shell. Each read lives in its own async component, under its
+own `<Suspense>`, with a skeleton the shape of what it stands for:
+
+```tsx title="src/app/integrations/shopify/page.tsx"
+import { Suspense } from 'react';
+import { ConnectButtonSlot } from './connect-button-slot';
+import { ConnectionSlot } from './connection-slot';
+import { ConnectionsSkeleton } from '../connections-skeleton';
+
+export default function ShopifyPage() {
+  return (
+    <Card>
+      <CardHeader>
+        {/* Fixed copy: in the shell, painted at once. */}
+        <CardTitle>Shopify</CardTitle>
+        <CardDescription>Connect your store so your agent can look up orders.</CardDescription>
+        {/* Nothing to show until it knows: no fallback. */}
+        <Suspense>
+          <ConnectButtonSlot />
+        </Suspense>
+      </CardHeader>
+      <CardContent>
+        <Suspense fallback={<ConnectionsSkeleton rows={1} />}>
+          <ConnectionSlot />
+        </Suspense>
+      </CardContent>
+    </Card>
+  );
+}
+```
+
+```tsx title="src/app/integrations/shopify/connection-slot.tsx"
+export async function ConnectionSlot() {
+  const agent = await currentAgent(); // its own read, its own check
+  const connection = await shopifyConnection(agent.id);
+
+  return connection ? <ConnectionRow connection={connection} /> : <EmptyState />;
+}
+```
+
+What that buys:
+
+- **The visitor sees the page, not a placeholder of it.** The shell is the
+  real heading and copy, and only the parts that wait show a skeleton.
+- **Each part arrives when it is ready.** A fast read is not held back by a
+  slow one beside it; each boundary fills on its own.
+- **The skeleton can be exact.** It stands for one known thing — a list of
+  one row, a button — so nothing moves when the content lands.
+- **A slot is self-contained.** It does its own read and its own permission
+  check, so it can move to another page, or be revalidated as a
+  [section](/guides/sections), without the page around it.
+
+## When loading.tsx is the wrong tool
+
+`loading.tsx` wraps the whole page in one boundary. It is a fit for a page
+that is one read and nothing else, such as a detail page whose skeleton really
+is the page. Elsewhere it costs more than it saves:
+
+- **It hides what the page already knows.** The heading, the copy and the
+  frames wait with the data, so the shell is a guess at the page rather than
+  the page.
+- **The slowest read decides for all of them.** Everything under the one
+  boundary paints when the last of it is ready.
+- **A status decided inside it is not the response's.** A page under
+  `loading.tsx` that calls `notFound()` or `redirect()`, or reads a backend
+  that answers 404, may already have sent its shell with a 200. Whether a page
+  exists for this visitor is a check for [`middleware.ts`](/guides/authorization),
+  which runs before anything is sent.
+- **It does not cover its layout.** It sits below the layout beside it, so a
+  layout that waits — on its params, on the session — needs a `<Suspense>` of
+  its own inside the layout.
+- **At the root it catches mistakes.** A root `loading.tsx` wraps every page,
+  so a page waiting in the wrong place is stored behind the app-wide
+  fallback, and the build can only warn. See below.
+
+## loading.tsx, when it fits
+
+Rather than wrapping a page by hand, put a `loading.tsx` beside it. The
 build wraps the page in `<Suspense fallback={<Loading />}>` for you, and the
 page can await at its top level:
 

package/guides/sections.md

@@ -56,6 +56,16 @@ The rest of the page is untouched — not re-rendered and not re-fetched. Whatev
 state lives outside the section, including a half-filled form beside it, stays
 exactly as it was.
 
+### From an action called on another page
+
+An action says what it changed, not which page called it. A backend's
+action cannot know at all: Go's `rsckit.Revalidate(ctx, "orders")` and
+Laravel's `Rsc::revalidate('orders')` name the data. When the page that
+called the action has no `orders` section, there is nothing on screen to
+refresh, and the name is skipped; the action still answers. A name no page
+in the app has is a mistake, and the action fails, naming the sections and
+slots the calling page does have.
+
 ## The name is scoped to the module, not the app
 
 Two pages may both call their section `orders`. The name is resolved through the

package/guides/url-validation.md

@@ -19,12 +19,14 @@ export const searchParams = z.object({
   tag: z.array(z.string()).default([]),
 })
 
-export default async function PostPage({ params, searchParams }: PageProps<
+// Renamed as they are destructured: `typeof params` must name the schema
+// exported above, not the prop.
+export default async function PostPage({ params: p, searchParams: q }: PageProps<
   typeof params,
   typeof searchParams
 >) {
-  const { slug } = await params        // string
-  const { page, tag } = await searchParams  // number, string[]
+  const { slug } = await p        // string
+  const { page, tag } = await q   // number, string[]
 }
 ```
 

package/guides/your-own-backend.md

@@ -195,19 +195,34 @@ guard saying no means the inner one should never have been asked.
 ## Server actions
 
 A `"use server"` function the browser can call is a name the renderer forwards
-to you. Write the map to `rsc-host-actions.json` at the project root before
-each build — the JavaScript name to whatever your side dispatches on:
+to you. Write `rsc-host.json` at the project root, beside `vite.config.ts`:
+`actions` maps the JavaScript name to whatever your side dispatches on, and
+`functions` lists every name `rpc()` may call.
+
+```json title="rsc-host.json"
+{
+  "actions": { "ordersCancel": "Orders.cancel", "profileUpdate": "Profile.update" },
+  "functions": ["Orders.cancel", "Orders.recent", "Profile.update"]
+}
+```
+
+A function can also carry its types, so the app's `rpc()` and the stubs are
+typed: `types` maps a name to its positional `params`, how many trailing ones
+are `optional`, a variadic `rest`, and its `result`, each a JSON Schema;
+`defs` holds the named object types they refer to by `"$ref": "#/defs/Name"`.
 
-```json title="rsc-host-actions.json"
-{ "ordersCancel": "Orders.cancel", "profileUpdate": "Profile.update" }
+```json
+"types": { "Orders.recent": { "params": [{ "type": "integer" }], "result": { "type": "array", "items": { "$ref": "#/defs/Order" } } } },
+"defs": { "Order": { "type": "object", "properties": { "id": { "type": "integer" } }, "required": ["id"] } }
 ```
 
 The build writes `server-actions.generated.ts` in the source directory
-exporting each as an action, so a client component imports `ordersCancel`
-and calls it. Regenerate the file as part of `build` rather than by hand: a
-stale map names a method that has since been renamed, and nothing fails until
-the browser calls it. Laravel's `rsc:action-manifest` is this step; a Go
-registry writes the same file from the names it holds.
+exporting each action, so a client component imports `ordersCancel` and
+calls it, and types `rpc()`'s first argument with the functions. Have Vite
+run the command that writes it, `rscKit({ hostManifest: { command } })`, so
+it cannot go stale: a stale one names a method since renamed, and nothing
+fails until the browser calls it. Laravel's `rsc:host-manifest` is this
+step; a Go registry's `WriteManifest` writes the same file.
 
 ## Urls you own
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rsc-kit/mcp",
-  "version": "0.22.9",
+  "version": "0.24.0",
   "description": "An MCP server over what an rsc-kit build decided: the routes, why each one is static or not, and what it costs the browser.",
   "type": "module",
   "license": "MIT",