kizlo 0.20.2 → 0.21.0

package/dist/cli/mcp/server.js

@@ -0,0 +1,157 @@
+import { log } from "../daemon/logger.js";
+import { callRoute, describeRoute, listRoutes } from "./tools.js";
+import z from "zod/v4";
+import { createServer } from "node:http";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+
+//#region src/cli/mcp/server.ts
+/** The only interface the server is ever bound to. Never `0.0.0.0`: this is a developer's machine. */
+const MCP_HOST = "127.0.0.1";
+/** The one path the server answers on, so a harness config is a URL rather than a URL and a note. */
+const MCP_PATH = "/mcp";
+/** Hosts an `Origin` may name. Everything the loopback interface is reachable as, and nothing else. */
+const LOOPBACK_HOSTS = new Set([
+	"127.0.0.1",
+	"::1",
+	"[::1]",
+	"localhost"
+]);
+/**
+* Whether a request's `Origin` may be served.
+*
+* Binding to loopback keeps other machines out, but not the developer's own browser: a page on any
+* site can `fetch` `http://127.0.0.1`, and while CORS stops it reading the reply, a request that
+* changes WordPress has already happened by then. The MCP specification requires HTTP transports to
+* check `Origin` for exactly this, so a page that names itself is refused before it reaches a tool.
+*
+* No `Origin` is allowed, because that is what a native MCP client sends. Browsers attach the header
+* to cross-origin requests themselves and cannot forge it, so its absence is not something an attacking
+* page can arrange.
+*/
+function isAllowedOrigin(origin) {
+	if (origin === void 0 || origin === "") return true;
+	if (origin === "null") return false;
+	try {
+		return LOOPBACK_HOSTS.has(new URL(origin).hostname);
+	} catch {
+		return false;
+	}
+}
+/** Render a tool's answer as the MCP content block a client reads, failures included. */
+function toolContent(result) {
+	if (!result.ok) return {
+		content: [{
+			type: "text",
+			text: result.error
+		}],
+		isError: true
+	};
+	return { content: [{
+		type: "text",
+		text: JSON.stringify(result.value, null, 2)
+	}] };
+}
+/**
+* Three dispatchers rather than a tool per route. The contract a seeded WordPress serves runs to well
+* over a hundred routes, and putting their schemas in front of a model up front would cost tens of
+* thousands of tokens in every message. These cost a few hundred and reach all of them — and because
+* they read the document per call, a route registered while `kizlo dev` runs is callable without
+* re-registering anything.
+*/
+function createMcpServer(state) {
+	const server = new McpServer({
+		name: "kizlo",
+		version: "1.0.0"
+	}, { instructions: "Read and call the WordPress REST routes of the Kizlo project this server was started in." });
+	server.registerTool("kizlo_list_routes", {
+		title: "List WordPress routes",
+		description: "List every REST route this project's WordPress serves, with its method and summary. Start here: the route names it returns are what `kizlo_describe_route` and `kizlo_call` take.",
+		inputSchema: { namespace: z.string().optional().describe("Only routes in this REST namespace, e.g. \"wp/v2\" or \"kizlo/v1\".") }
+	}, async ({ namespace }) => toolContent(listRoutes(state, namespace === void 0 ? {} : { namespace })));
+	server.registerTool("kizlo_describe_route", {
+		title: "Describe a WordPress route",
+		description: "The JSON Schema for one route's arguments, plus which of them are interpolated into its path.",
+		inputSchema: { route: z.string().describe("A route name from `kizlo_list_routes`, e.g. `postTypes.book.list`.") }
+	}, async ({ route }) => toolContent(describeRoute(state, { route })));
+	server.registerTool("kizlo_call", {
+		title: "Call a WordPress route",
+		description: "Run one route against this project's WordPress and return its response. Path parameters, query parameters, and body fields all go in `input`; `kizlo_describe_route` says which are which.",
+		inputSchema: {
+			route: z.string().describe("A route name from `kizlo_list_routes`."),
+			input: z.record(z.string(), z.unknown()).optional().describe("The route's arguments, as described by `kizlo_describe_route`.")
+		}
+	}, async ({ route, input }) => toolContent(await callRoute(state, input === void 0 ? { route } : {
+		route,
+		input
+	})));
+	return server;
+}
+/**
+* Bind the MCP server for this session.
+*
+* It binds once and stays bound. The contract watcher restarts whenever `.env` or a config file
+* changes, and tying the socket to that cycle would drop the harness's connection on every save and
+* race the rebind against a port the previous listener had not finished releasing. Nothing here is
+* captured from the watcher either: `state` is read per tool call, so a reload that changes the
+* WordPress connection takes effect on the next call without rebinding anything.
+*/
+async function startMcpServer(state, options) {
+	const server = createServer((request, response) => {
+		if (!isAllowedOrigin(request.headers.origin)) {
+			response.writeHead(403, { "content-type": "application/json" });
+			response.end(JSON.stringify({ error: `Refused an MCP request from origin ${request.headers.origin}.` }));
+			return;
+		}
+		const { pathname } = new URL(request.url ?? "/", `http://${MCP_HOST}`);
+		if (pathname !== MCP_PATH) {
+			response.writeHead(404, { "content-type": "application/json" });
+			response.end(JSON.stringify({ error: `Nothing is served at ${pathname}. The MCP endpoint is ${MCP_PATH}.` }));
+			return;
+		}
+		dispatch(request, response, state);
+	});
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(options.port, MCP_HOST, () => {
+			server.removeListener("error", reject);
+			server.on("error", (error) => log.error("MCP server error:", error));
+			resolve();
+		});
+	});
+	const address = server.address();
+	const port = typeof address === "object" && address !== null ? address.port : options.port;
+	return {
+		url: `http://${MCP_HOST}:${port}${MCP_PATH}`,
+		port,
+		stop: () => stopServer(server)
+	};
+}
+/**
+* Answer one request with a server and transport of its own.
+*
+* Stateless, with plain JSON replies: a dev session has exactly one harness attached and nothing to
+* remember between its calls, so there is no session to track and no reason to hold an event stream
+* open. Per request rather than shared, because a stateless transport carries the state of the one
+* exchange it was built for and cannot answer a second. Building three tools again each time costs
+* nothing next to the request, and it is what keeps the tools reading the current `state`.
+*/
+async function dispatch(request, response, state) {
+	const mcp = createMcpServer(state);
+	const transport = new StreamableHTTPServerTransport({ enableJsonResponse: true });
+	response.on("close", () => {
+		transport.close();
+		mcp.close();
+	});
+	await mcp.connect(transport);
+	await transport.handleRequest(request, response);
+}
+async function stopServer(server) {
+	await new Promise((resolve) => {
+		server.close(() => resolve());
+		server.closeAllConnections();
+	});
+}
+
+//#endregion
+export { MCP_HOST, MCP_PATH, isAllowedOrigin, startMcpServer };

package/dist/cli/mcp/state.js

@@ -0,0 +1,7 @@
+//#region src/cli/mcp/state.ts
+function createMcpState() {
+	return {};
+}
+
+//#endregion
+export { createMcpState };

package/dist/cli/mcp/tools.js

@@ -0,0 +1,103 @@
+import { buildWordPressRequest } from "../../wordpress/endpoint.js";
+import { WordPressTransport } from "../../wordpress/transport.js";
+import { routesOf, sortRoutes } from "./routes.js";
+import { toJsonSchema } from "./schema.js";
+
+//#region src/cli/mcp/tools.ts
+/** The document is fetched by the watcher, so the only reason it is missing is that none has arrived yet. */
+const NO_DOCUMENT = "The WordPress contract has not been fetched yet. Retry in a moment; `kizlo dev` refreshes it every few seconds.";
+/** Summaries only. The schemas behind these routes are far too large to put in front of a model at once. */
+function listRoutes(state, input = {}) {
+	if (!state.document) return {
+		ok: false,
+		error: NO_DOCUMENT
+	};
+	const all = sortRoutes(routesOf(state.document).values());
+	const routes = input.namespace ? all.filter((route) => route.namespace === input.namespace) : all;
+	if (input.namespace && routes.length === 0) {
+		const known = [...new Set(all.map((route) => route.namespace))].sort();
+		return {
+			ok: false,
+			error: `No routes in namespace "${input.namespace}". This WordPress serves: ${known.join(", ")}.`
+		};
+	}
+	return {
+		ok: true,
+		value: {
+			count: routes.length,
+			routes: routes.map((route) => ({
+				name: route.name,
+				namespace: route.namespace,
+				method: route.method,
+				path: route.path,
+				...route.summary !== void 0 ? { summary: route.summary } : {},
+				...route.deprecated ? { deprecated: true } : {}
+			}))
+		}
+	};
+}
+/** The full argument schema for one route, which is what a caller needs before it can build a call. */
+function describeRoute(state, input) {
+	if (!state.document) return {
+		ok: false,
+		error: NO_DOCUMENT
+	};
+	const route = routesOf(state.document).get(input.route);
+	if (!route) return {
+		ok: false,
+		error: unknownRoute(input.route)
+	};
+	return {
+		ok: true,
+		value: {
+			name: route.name,
+			namespace: route.namespace,
+			method: route.method,
+			path: route.path,
+			...route.summary !== void 0 ? { summary: route.summary } : {},
+			...route.description !== void 0 ? { description: route.description } : {},
+			...route.deprecated ? { deprecated: true } : {},
+			pathParameters: route.definition.pathParameters,
+			input: toJsonSchema(route.operation.input, state.document)
+		}
+	};
+}
+/** Run one route against the connected WordPress and hand back what it answered. */
+async function callRoute(state, input) {
+	if (!state.document) return {
+		ok: false,
+		error: NO_DOCUMENT
+	};
+	if (!state.credentials) return {
+		ok: false,
+		error: "No WordPress connection is configured, so nothing can be called. Check the connection settings in `.env`."
+	};
+	const route = routesOf(state.document).get(input.route);
+	if (!route) return {
+		ok: false,
+		error: unknownRoute(input.route)
+	};
+	const built = buildWordPressRequest(route.definition, input.input ?? {});
+	if (built.error) return {
+		ok: false,
+		error: built.error.message
+	};
+	const response = await new WordPressTransport({ credentials: state.credentials }).request(built.request);
+	if (response.error) return {
+		ok: false,
+		error: `${route.method} ${route.path} failed (${response.status || "no response"}): ${response.error.code} — ${response.error.message}`
+	};
+	return {
+		ok: true,
+		value: {
+			status: response.status,
+			data: response.data
+		}
+	};
+}
+function unknownRoute(name) {
+	return `No route named "${name}" in this WordPress contract. Call \`kizlo_list_routes\` for the routes it serves.`;
+}
+
+//#endregion
+export { callRoute, describeRoute, listRoutes };

package/dist/config.d.ts

@@ -120,6 +120,16 @@ interface KizloLocalConfig {
   /** The test stack run by `kizlo test`. Inherits `version` and `fixtures` from {@link KizloLocalConfig.dev}. */
   test?: KizloTestConfig;
 }
+interface KizloMcpConfig {
+  /**
+   * Port the server binds on `127.0.0.1`. Unset, it starts at the Kizlo default and steps off a
+   * collision, which is why nothing has to be configured to run two projects at once. Set it when a
+   * harness config has to name the port: an explicitly set port is never auto-reassigned, and
+   * `kizlo dev` stops rather than serving on one you did not choose.
+   * @default 8300
+   */
+  port?: number;
+}
 interface KizloGlobalConfig {
   /**
    * Where Kizlo generates, and what it watches. A string names the home directory Kizlo owns the
@@ -139,7 +149,13 @@ interface KizloGlobalConfig {
    * stack name, the per-branch `worktrees` toggle, and the two stacks live.
    */
   local?: boolean | KizloLocalConfig;
+  /**
+   * The MCP server `kizlo dev` serves on loopback, exposing this project's WordPress routes to an AI
+   * harness. It runs whenever `kizlo dev` can resolve a WordPress connection; this block only tunes it.
+   * It is never part of a built app: the server lives in the CLI, so nothing about it can be deployed.
+   */
+  mcp?: KizloMcpConfig;
 }
 declare function defineConfig(config: KizloGlobalConfig): KizloGlobalConfig;
 //#endregion
-export { KizloDevConfig, KizloDir, KizloGlobalConfig, KizloLocalConfig, KizloTestConfig, defineConfig };
+export { KizloDevConfig, KizloDir, KizloGlobalConfig, KizloLocalConfig, KizloMcpConfig, KizloTestConfig, defineConfig };

package/dist/index.d.ts

@@ -28,7 +28,7 @@ import { AnyEventSchema, AnyEvents, EventHandler, EventHandlerFn, InferEventUnio
 import { COMMON_ERRORS, CommonErrorCode, CommonErrorLiteral, CommonErrorMap, DefinedErrorMapLike, ErrorDefinition, KizloError, KizloErrorOptions, ThrowableErrorFn, ThrowableErrorMap, WithCommonErrorMap, createThrowableErrorMap, defineErrorMap, isKizloError, toKizloError } from "./shared/error.js";
 import { AnyMiddleware, ExtractMiddlewareContextOutput, InferMiddlewares, Middleware, MiddlewareHandler, MiddlewareNextFn, MiddlewareOptions, MiddlewareResult, createMiddleware } from "./shared/middleware.js";
 import { AnyProcedure, AnyProcedureTree, BaseHandlerOptions, ExtractParams, ExtractProcedureByScope, InvocationScope, OpenapiPart, Procedure, ProcedureErrors, ProcedureHandler, ProcedureOptions, ProcedureTreeDepthTuple, ResolveParamsPart, ResolvedSchemaInput, ResolvedSchemaOutput, SchemaIO, buildProcedure, combineDetailed, createProcedure, handleUnexpectedError, schemaType } from "./shared/procedure.js";
-import { AnyIntegration, EnvReader, EnvRecord, EnvSource, ExtractIntegrationProcedures, InferIntegrationProcedures, Integration, IntegrationRequirements, KizloEnv, WordPressEnv, assertIntegrationEndpoints, assertIntegrationEnv, createIntegration, missingEndpoints, missingEnv, readEnv } from "./shared/integration.js";
+import { AnyIntegration, EnvReader, EnvRecord, EnvSource, ExtractIntegrationProcedures, InferIntegrationProcedures, Integration, IntegrationRequirements, KizloEnv, WordPressEnv, assertIntegrationEndpoints, assertIntegrationEnv, createIntegration, missingEndpoints, missingEnv, readEnv, sortIntegrations } from "./shared/integration.js";
 import { InferProcedureData, InferProcedureError, InferProcedureInput, InferProcedureResult, KizloErrorUnion, KizloResult, MaybeCallerOptions, ProcedureMethod, ResultClient, createResultClient } from "./shared/result.js";
 import { AnyKizloConfig, CreateKizloOptions, Kizlo, KizloConfig, RootProcedures, S2SClient, createKizlo, integrationEnv, resolveKizloConfig, resolveWordPressConnection, wordPressConnectionComplete } from "./kizlo.js";
 import { WEB_MANIFEST_ROUTE, WebManifest, buildWebManifest, createManifestRoute } from "./brand/manifest.js";
@@ -43,4 +43,4 @@ import { ShaAlgorithm, compare, hash, hmac } from "./shared/crypto.js";
 import { Identifier, parseIdentifier } from "./shared/identifier.js";
 import { createOrpcRouter } from "./shared/router.js";
 import { deserializeCurrencyFormat, deserializeListMetadata, emptyList, serializeCurrencyFormat } from "./shared/serialize.js";
-export { ActiveWordPressClient, AnyContext, AnyEventSchema, AnyEvents, AnyIntegration, AnyKizloConfig, AnyMiddleware, AnyNestedClient, AnyProcedure, AnyProcedureTree, AuthAdapter, AuthGetSession, AuthUser, AuthorsSettings, AuthorsSettingsInput, BaseHandlerOptions, BrandSettings, BrandSettingsInput, COMMON_ERRORS, CONTENT_TYPES, CORE_PROCEDURES, CaptchaAdapter, type Category, type CategoryCustomFields, CategoryCustomFieldsSchema, CommonErrorCode, CommonErrorLiteral, CommonErrorMap, ConnInfo, ConnInfoFn, ConsoleLogAdapterOptions, ContentType, Context, ContextConfig, Contract, ContractProcedure, CookiesAdapter, CookiesDeleteAll, CookiesGetAll, CookiesSetAll, CookiesStorage, CoreProcedures, CrawlingSettings, CrawlingSettingsInput, CreateKizloOptions, CreateSitemapRouteOptions, CurrencyFormat, DefinedErrorMapLike, DevPluginSource, EnvReader, EnvRecord, EnvSource, ErrorDefinition, EventHandler, EventHandlerFn, ExtractIntegrationProcedures, ExtractMiddlewareContextOutput, ExtractParams, ExtractProcedureByScope, Fixture, FixtureCleanupFn, FixtureSeedFn, FixtureSettleFn, GeoAdapter, GeoGetConnInfo, HTTPMethod, HeadlessSettings, HeadlessSettingsInput, IconDescriptor, Identifier, IdentifierInput, IdentitySettings, IdentitySettingsInput, InferEventUnion, InferIntegrationProcedures, InferMiddlewares, InferProcedureData, InferProcedureError, InferProcedureInput, InferProcedureResult, Integration, IntegrationRequirements, InvocationScope, JsonValue, Kizlo, KizloClient, KizloClientConfig, KizloConfig, KizloEnv, KizloError, KizloErrorOptions, KizloErrorUnion, KizloResult, LIST_ORDER, List, ListMetadata, ListOrder, ListSitemapUrlInput, ListSitemapUrlInputBase, LocalPlugin, LogLevel, LogPayload, Logger, LoggerAdapter, ManifestIcon, MaybeCallerOptions, MaybeOptionalOptions, Middleware, MiddlewareHandler, MiddlewareNextFn, MiddlewareOptions, MiddlewareResult, OpenapiPart, OrganizationFounder, OrganizationSettings, OrganizationSettingsInput, type Page, type PageCustomFields, PageCustomFieldsSchema, PersonSettings, PersonSettingsInput, PluginSource, type Post, type PostCustomFields, PostCustomFieldsSchema, PostStatusDefinition, PostTypeSettings, PostTypeSettingsInput, PreviewTokenData, PreviewTokenPayload, Procedure, ProcedureContext, ProcedureErrors, ProcedureHandler, ProcedureMethod, ProcedureOptions, ProcedureTreeDepthTuple, RedirectInput, RedirectStatus, ResolveParamsPart, ResolvedIcons, ResolvedSchemaInput, ResolvedSchemaOutput, ResultClient, Robots, RobotsRule, RootProcedures, S2SClient, SITEMAP_BASE, SITEMAP_INDEX_SLUG, SchemaIO, SeedContext, Seo, SeoHead, SeoSchema, ServiceAdapters, SessionFn, Settings, SettingsService, SettleContext, ShaAlgorithm, SiteSettings, SiteSettingsInput, Sitemap, SitemapIndex, SitemapIndexEntry, SitemapList, SitemapRouteExtra, SitemapUrl, SitemapUrlImage, SitemapUrlList, SocialProfile, type Tag, type TagCustomFields, TagCustomFieldsSchema, TaxonomySettings, TaxonomySettingsInput, TestAdminUser, TestCredentials, TestUser, ThrowableErrorFn, ThrowableErrorMap, UploadsSettings, UploadsSettingsInput, VerifyCaptchaFn, VerifyPreviewTokenFn, WEB_MANIFEST_ROUTE, WPK_RobotRule, WPK_Robots, WPK_Seo, WPK_Sitemap, WPK_SitemapUrl, WPK_SitemapUrlImage, WP_CallOptions, WP_Client, WP_CommonErrorCode, WP_CurrencyFormat, WP_CustomFields, WP_CustomFieldsPath, WP_Endpoint, WP_EndpointData, WP_EndpointDefinition, WP_EndpointError, WP_EndpointInput, WP_EndpointPath, WP_EndpointResult, WP_Error, WP_ErrorData, WP_Failure, WP_List, WP_ListMetadata, WP_RequestBuild, WP_RequestContentType, WP_RequestInput, WP_RequestMethod, WP_ResponseContentType, WP_Result, WP_Success, WP_TransportFailure, WP_TypedHeaders, WebManifest, WebhookOptions, WebhookSettings, WebhookSettingsInput, WithCommonErrorMap, WordPressClientRegistry, WordPressCredentials, WordPressCustomFieldsRegistry, WordPressEndpointRegistry, WordPressEnv, WordPressTransport, WordPressTransportOptions, WordPressTransportResult, altcha, arkose, assertIntegrationEndpoints, assertIntegrationEnv, authMock, buildProcedure, buildWebManifest, buildWordPressRequest, combineDetailed, compare, consoleLog, createAuthAdapter, createCaptchaAdapter, createCookiesAdapter, createEventHandler, createGeoAdapter, createIntegration, createKizlo, createKizloClient, createLoggerAdapter, createManifestRoute, createMiddleware, createOrpcRouter, createProcedure, createResultClient, createSitemapRedirectRoute, createSitemapRoute, createThrowableErrorMap, createWebhookRouter, createWordPressClient, customFieldsSchema, defineErrorMap, defineFixture, deserializeCurrencyFormat, deserializeListMetadata, deserializeSeo, emptyList, friendlyCaptcha, generateContract, geoMock, geoVercelNext, handleUnexpectedError, hash, hcaptcha, hmac, integrationEnv, isContractProcedure, isKizloError, isLocalPlugin, isWordPressResourceError, mergeServiceAdapters, missingEndpoints, missingEnv, noopAdapter, parseIdentifier, parseSitemapSlug, readEnv, recaptcha, renderJsonLd, renderSitemapIndex, renderUrlSet, resolveIcons, resolveKizloConfig, resolveWordPressConnection, restoreContract, schemaType, serializeCurrencyFormat, sitemapEntryPath, toKizloError, turnstile, wordPressConnectionComplete, wpEndpoint, xmlResponse };
+export { ActiveWordPressClient, AnyContext, AnyEventSchema, AnyEvents, AnyIntegration, AnyKizloConfig, AnyMiddleware, AnyNestedClient, AnyProcedure, AnyProcedureTree, AuthAdapter, AuthGetSession, AuthUser, AuthorsSettings, AuthorsSettingsInput, BaseHandlerOptions, BrandSettings, BrandSettingsInput, COMMON_ERRORS, CONTENT_TYPES, CORE_PROCEDURES, CaptchaAdapter, type Category, type CategoryCustomFields, CategoryCustomFieldsSchema, CommonErrorCode, CommonErrorLiteral, CommonErrorMap, ConnInfo, ConnInfoFn, ConsoleLogAdapterOptions, ContentType, Context, ContextConfig, Contract, ContractProcedure, CookiesAdapter, CookiesDeleteAll, CookiesGetAll, CookiesSetAll, CookiesStorage, CoreProcedures, CrawlingSettings, CrawlingSettingsInput, CreateKizloOptions, CreateSitemapRouteOptions, CurrencyFormat, DefinedErrorMapLike, DevPluginSource, EnvReader, EnvRecord, EnvSource, ErrorDefinition, EventHandler, EventHandlerFn, ExtractIntegrationProcedures, ExtractMiddlewareContextOutput, ExtractParams, ExtractProcedureByScope, Fixture, FixtureCleanupFn, FixtureSeedFn, FixtureSettleFn, GeoAdapter, GeoGetConnInfo, HTTPMethod, HeadlessSettings, HeadlessSettingsInput, IconDescriptor, Identifier, IdentifierInput, IdentitySettings, IdentitySettingsInput, InferEventUnion, InferIntegrationProcedures, InferMiddlewares, InferProcedureData, InferProcedureError, InferProcedureInput, InferProcedureResult, Integration, IntegrationRequirements, InvocationScope, JsonValue, Kizlo, KizloClient, KizloClientConfig, KizloConfig, KizloEnv, KizloError, KizloErrorOptions, KizloErrorUnion, KizloResult, LIST_ORDER, List, ListMetadata, ListOrder, ListSitemapUrlInput, ListSitemapUrlInputBase, LocalPlugin, LogLevel, LogPayload, Logger, LoggerAdapter, ManifestIcon, MaybeCallerOptions, MaybeOptionalOptions, Middleware, MiddlewareHandler, MiddlewareNextFn, MiddlewareOptions, MiddlewareResult, OpenapiPart, OrganizationFounder, OrganizationSettings, OrganizationSettingsInput, type Page, type PageCustomFields, PageCustomFieldsSchema, PersonSettings, PersonSettingsInput, PluginSource, type Post, type PostCustomFields, PostCustomFieldsSchema, PostStatusDefinition, PostTypeSettings, PostTypeSettingsInput, PreviewTokenData, PreviewTokenPayload, Procedure, ProcedureContext, ProcedureErrors, ProcedureHandler, ProcedureMethod, ProcedureOptions, ProcedureTreeDepthTuple, RedirectInput, RedirectStatus, ResolveParamsPart, ResolvedIcons, ResolvedSchemaInput, ResolvedSchemaOutput, ResultClient, Robots, RobotsRule, RootProcedures, S2SClient, SITEMAP_BASE, SITEMAP_INDEX_SLUG, SchemaIO, SeedContext, Seo, SeoHead, SeoSchema, ServiceAdapters, SessionFn, Settings, SettingsService, SettleContext, ShaAlgorithm, SiteSettings, SiteSettingsInput, Sitemap, SitemapIndex, SitemapIndexEntry, SitemapList, SitemapRouteExtra, SitemapUrl, SitemapUrlImage, SitemapUrlList, SocialProfile, type Tag, type TagCustomFields, TagCustomFieldsSchema, TaxonomySettings, TaxonomySettingsInput, TestAdminUser, TestCredentials, TestUser, ThrowableErrorFn, ThrowableErrorMap, UploadsSettings, UploadsSettingsInput, VerifyCaptchaFn, VerifyPreviewTokenFn, WEB_MANIFEST_ROUTE, WPK_RobotRule, WPK_Robots, WPK_Seo, WPK_Sitemap, WPK_SitemapUrl, WPK_SitemapUrlImage, WP_CallOptions, WP_Client, WP_CommonErrorCode, WP_CurrencyFormat, WP_CustomFields, WP_CustomFieldsPath, WP_Endpoint, WP_EndpointData, WP_EndpointDefinition, WP_EndpointError, WP_EndpointInput, WP_EndpointPath, WP_EndpointResult, WP_Error, WP_ErrorData, WP_Failure, WP_List, WP_ListMetadata, WP_RequestBuild, WP_RequestContentType, WP_RequestInput, WP_RequestMethod, WP_ResponseContentType, WP_Result, WP_Success, WP_TransportFailure, WP_TypedHeaders, WebManifest, WebhookOptions, WebhookSettings, WebhookSettingsInput, WithCommonErrorMap, WordPressClientRegistry, WordPressCredentials, WordPressCustomFieldsRegistry, WordPressEndpointRegistry, WordPressEnv, WordPressTransport, WordPressTransportOptions, WordPressTransportResult, altcha, arkose, assertIntegrationEndpoints, assertIntegrationEnv, authMock, buildProcedure, buildWebManifest, buildWordPressRequest, combineDetailed, compare, consoleLog, createAuthAdapter, createCaptchaAdapter, createCookiesAdapter, createEventHandler, createGeoAdapter, createIntegration, createKizlo, createKizloClient, createLoggerAdapter, createManifestRoute, createMiddleware, createOrpcRouter, createProcedure, createResultClient, createSitemapRedirectRoute, createSitemapRoute, createThrowableErrorMap, createWebhookRouter, createWordPressClient, customFieldsSchema, defineErrorMap, defineFixture, deserializeCurrencyFormat, deserializeListMetadata, deserializeSeo, emptyList, friendlyCaptcha, generateContract, geoMock, geoVercelNext, handleUnexpectedError, hash, hcaptcha, hmac, integrationEnv, isContractProcedure, isKizloError, isLocalPlugin, isWordPressResourceError, mergeServiceAdapters, missingEndpoints, missingEnv, noopAdapter, parseIdentifier, parseSitemapSlug, readEnv, recaptcha, renderJsonLd, renderSitemapIndex, renderUrlSet, resolveIcons, resolveKizloConfig, resolveWordPressConnection, restoreContract, schemaType, serializeCurrencyFormat, sitemapEntryPath, sortIntegrations, toKizloError, turnstile, wordPressConnectionComplete, wpEndpoint, xmlResponse };

package/dist/index.js

@@ -32,10 +32,10 @@ import { PageCustomFieldsSchema } from "./page/schema.js";
 import { PostCustomFieldsSchema } from "./post/schema.js";
 import { TagCustomFieldsSchema } from "./tag/schema.js";
 import { CORE_PROCEDURES } from "./procedures.js";
-import { assertIntegrationEndpoints, assertIntegrationEnv, createIntegration, missingEndpoints, missingEnv, readEnv } from "./shared/integration.js";
+import { assertIntegrationEndpoints, assertIntegrationEnv, createIntegration, missingEndpoints, missingEnv, readEnv, sortIntegrations } from "./shared/integration.js";
 import { createEventHandler, createWebhookRouter } from "./webhook/index.js";
 import { Kizlo, createKizlo, integrationEnv, resolveKizloConfig, resolveWordPressConnection, wordPressConnectionComplete } from "./kizlo.js";
 import { SITEMAP_BASE, SITEMAP_INDEX_SLUG, createSitemapRedirectRoute, createSitemapRoute } from "./seo/sitemap.js";
 import { createMiddleware } from "./shared/middleware.js";
 
-export { COMMON_ERRORS, CONTENT_TYPES, CORE_PROCEDURES, CategoryCustomFieldsSchema, ContentType, Context, CookiesStorage, CurrencyFormat, IdentifierInput, Kizlo, KizloClient, KizloError, LIST_ORDER, ListMetadata, ListOrder, ListSitemapUrlInput, ListSitemapUrlInputBase, PageCustomFieldsSchema, PostCustomFieldsSchema, PreviewTokenData, PreviewTokenPayload, Robots, RobotsRule, SITEMAP_BASE, SITEMAP_INDEX_SLUG, Seo, SeoHead, SeoSchema, SettingsService, Sitemap, SitemapIndex, SitemapList, SitemapUrl, SitemapUrlImage, SitemapUrlList, TagCustomFieldsSchema, WEB_MANIFEST_ROUTE, WP_Error, WordPressTransport, altcha, arkose, assertIntegrationEndpoints, assertIntegrationEnv, authMock, buildProcedure, buildWebManifest, buildWordPressRequest, combineDetailed, compare, consoleLog, createAuthAdapter, createCaptchaAdapter, createCookiesAdapter, createEventHandler, createGeoAdapter, createIntegration, createKizlo, createKizloClient, createLoggerAdapter, createManifestRoute, createMiddleware, createOrpcRouter, createProcedure, createResultClient, createSitemapRedirectRoute, createSitemapRoute, createThrowableErrorMap, createWebhookRouter, createWordPressClient, customFieldsSchema, defineErrorMap, defineFixture, deserializeCurrencyFormat, deserializeListMetadata, deserializeSeo, emptyList, friendlyCaptcha, generateContract, geoMock, geoVercelNext, handleUnexpectedError, hash, hcaptcha, hmac, integrationEnv, isContractProcedure, isKizloError, isLocalPlugin, isWordPressResourceError, mergeServiceAdapters, missingEndpoints, missingEnv, noopAdapter, parseIdentifier, parseSitemapSlug, readEnv, recaptcha, renderJsonLd, renderSitemapIndex, renderUrlSet, resolveIcons, resolveKizloConfig, resolveWordPressConnection, restoreContract, schemaType, serializeCurrencyFormat, sitemapEntryPath, toKizloError, turnstile, wordPressConnectionComplete, wpEndpoint, xmlResponse };
+export { COMMON_ERRORS, CONTENT_TYPES, CORE_PROCEDURES, CategoryCustomFieldsSchema, ContentType, Context, CookiesStorage, CurrencyFormat, IdentifierInput, Kizlo, KizloClient, KizloError, LIST_ORDER, ListMetadata, ListOrder, ListSitemapUrlInput, ListSitemapUrlInputBase, PageCustomFieldsSchema, PostCustomFieldsSchema, PreviewTokenData, PreviewTokenPayload, Robots, RobotsRule, SITEMAP_BASE, SITEMAP_INDEX_SLUG, Seo, SeoHead, SeoSchema, SettingsService, Sitemap, SitemapIndex, SitemapList, SitemapUrl, SitemapUrlImage, SitemapUrlList, TagCustomFieldsSchema, WEB_MANIFEST_ROUTE, WP_Error, WordPressTransport, altcha, arkose, assertIntegrationEndpoints, assertIntegrationEnv, authMock, buildProcedure, buildWebManifest, buildWordPressRequest, combineDetailed, compare, consoleLog, createAuthAdapter, createCaptchaAdapter, createCookiesAdapter, createEventHandler, createGeoAdapter, createIntegration, createKizlo, createKizloClient, createLoggerAdapter, createManifestRoute, createMiddleware, createOrpcRouter, createProcedure, createResultClient, createSitemapRedirectRoute, createSitemapRoute, createThrowableErrorMap, createWebhookRouter, createWordPressClient, customFieldsSchema, defineErrorMap, defineFixture, deserializeCurrencyFormat, deserializeListMetadata, deserializeSeo, emptyList, friendlyCaptcha, generateContract, geoMock, geoVercelNext, handleUnexpectedError, hash, hcaptcha, hmac, integrationEnv, isContractProcedure, isKizloError, isLocalPlugin, isWordPressResourceError, mergeServiceAdapters, missingEndpoints, missingEnv, noopAdapter, parseIdentifier, parseSitemapSlug, readEnv, recaptcha, renderJsonLd, renderSitemapIndex, renderUrlSet, resolveIcons, resolveKizloConfig, resolveWordPressConnection, restoreContract, schemaType, serializeCurrencyFormat, sitemapEntryPath, sortIntegrations, toKizloError, turnstile, wordPressConnectionComplete, wpEndpoint, xmlResponse };

package/dist/integrations/astro/integration.js

@@ -1,3 +1,4 @@
+import { FRAMEWORK_INTEGRATION_ORDER } from "../../shared/constants.js";
 import { createIntegration } from "../../shared/integration.js";
 import { runtimeEnv } from "../runtime-env.js";
 
@@ -6,6 +7,7 @@ import { runtimeEnv } from "../runtime-env.js";
 function astro(options) {
 	return createIntegration({
 		id: "astro",
+		order: FRAMEWORK_INTEGRATION_ORDER,
 		env: runtimeEnv(options.env, "PUBLIC_KIZLO_BASE_URL")
 	});
 }

package/dist/integrations/nextjs/integration.js

@@ -1,3 +1,4 @@
+import { FRAMEWORK_INTEGRATION_ORDER } from "../../shared/constants.js";
 import { createIntegration } from "../../shared/integration.js";
 import { runtimeEnv } from "../runtime-env.js";
 import { nextRevalidation } from "./revalidate.js";
@@ -9,6 +10,7 @@ function nextjs(options = {}) {
 	const revalidation = options.revalidate;
 	return createIntegration({
 		id: "nextjs",
+		order: FRAMEWORK_INTEGRATION_ORDER,
 		env: runtimeEnv(source, "NEXT_PUBLIC_KIZLO_BASE_URL"),
 		events: revalidation === false ? void 0 : nextRevalidation(typeof revalidation === "object" ? revalidation : void 0).events
 	});

package/dist/integrations/node/integration.js

@@ -1,3 +1,4 @@
+import { FRAMEWORK_INTEGRATION_ORDER } from "../../shared/constants.js";
 import { createIntegration } from "../../shared/integration.js";
 import { runtimeEnv } from "../runtime-env.js";
 
@@ -6,6 +7,7 @@ import { runtimeEnv } from "../runtime-env.js";
 function node(options = {}) {
 	return createIntegration({
 		id: "node",
+		order: FRAMEWORK_INTEGRATION_ORDER,
 		env: runtimeEnv(options.env ?? process.env, "KIZLO_BASE_URL")
 	});
 }

package/dist/integrations/tanstack-start/integration.js

@@ -1,3 +1,4 @@
+import { FRAMEWORK_INTEGRATION_ORDER } from "../../shared/constants.js";
 import { createIntegration } from "../../shared/integration.js";
 import { runtimeEnv } from "../runtime-env.js";
 
@@ -6,6 +7,7 @@ import { runtimeEnv } from "../runtime-env.js";
 function tanstackStart(options = {}) {
 	return createIntegration({
 		id: "tanstack-start",
+		order: FRAMEWORK_INTEGRATION_ORDER,
 		env: runtimeEnv(options.env ?? process.env, "VITE_KIZLO_BASE_URL")
 	});
 }

package/dist/kizlo.js

@@ -8,7 +8,7 @@ import { isTypescriptObject } from "./shared/utils.js";
 import { Context } from "./context.js";
 import { CORE_PROCEDURES } from "./procedures.js";
 import { isContractGeneration } from "./shared/contract-generation.js";
-import { assertIntegrationEndpoints, assertIntegrationEnv, missingEnv, readEnv } from "./shared/integration.js";
+import { assertIntegrationEndpoints, assertIntegrationEnv, missingEnv, readEnv, sortIntegrations } from "./shared/integration.js";
 import { createWebhookRouter } from "./webhook/index.js";
 import { tryCatch } from "@kizlo/shared";
 import { ORPCError, createRouterClient } from "@orpc/server";
@@ -101,7 +101,7 @@ var Kizlo = class {
 		const reservedIds = new Set([...Object.keys(CORE_PROCEDURES), "webhooks"]);
 		const integrationIds = /* @__PURE__ */ new Set();
 		const generating = isContractGeneration();
-		for (const integration of this.config.integrations ?? []) {
+		for (const integration of sortIntegrations(this.config.integrations ?? [])) {
 			if (reservedIds.has(integration.id)) throw new KizloError("INTEGRATION_ID_CONFLICT", { message: `The integration id "${integration.id}" is reserved by Kizlo. Choose a different integration id.` });
 			if (integrationIds.has(integration.id)) throw new KizloError("INTEGRATION_ID_CONFLICT", { message: `The integration id "${integration.id}" is registered more than once. Give every integration a unique id.` });
 			integrationIds.add(integration.id);
@@ -130,9 +130,10 @@ const WORDPRESS_ENV_VALUES = new Set([
 * Kizlo's active WordPress connection from the canonical `mode` value.
 */
 function integrationEnv(integrations) {
+	const mounted = sortIntegrations(integrations);
 	const composed = (name) => {
 		let value;
-		for (const integration of integrations) {
+		for (const integration of mounted) {
 			if (!integration.env) continue;
 			const contribution = readEnv(integration.env, name);
 			if (contribution !== void 0) value = contribution;

package/dist/package.js

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.20.2";
+var version = "0.21.0";
 
 //#endregion
 export { version };

package/dist/post/schema.d.ts

@@ -26,13 +26,13 @@ declare const Post: z.ZodObject<{
     private: "private";
   }>;
   format: z.ZodEnum<{
+    image: "image";
+    link: "link";
     status: "status";
     standard: "standard";
     aside: "aside";
     chat: "chat";
     gallery: "gallery";
-    link: "link";
-    image: "image";
     quote: "quote";
     video: "video";
     audio: "audio";
@@ -150,13 +150,13 @@ declare const PostList: z.ZodObject<{
       private: "private";
     }>;
     format: z.ZodEnum<{
+      image: "image";
+      link: "link";
       status: "status";
       standard: "standard";
       aside: "aside";
       chat: "chat";
       gallery: "gallery";
-      link: "link";
-      image: "image";
       quote: "quote";
       video: "video";
       audio: "audio";

package/dist/procedures.d.ts

@@ -44,7 +44,7 @@ declare const CORE_PROCEDURES: {
         include?: string | number | (string | number)[] | undefined;
         offset?: string | number | undefined;
         order?: "asc" | "desc" | undefined;
-        orderby?: "date" | "id" | "slug" | "parent" | "title" | "author" | "include" | "modified" | "relevance" | "include_slugs" | undefined;
+        orderby?: "id" | "slug" | "parent" | "title" | "author" | "date" | "include" | "include_slugs" | "modified" | "relevance" | undefined;
         searchColumns?: ("post_title" | "post_content" | "post_excerpt")[] | undefined;
         slug?: string | string[] | undefined;
         taxRelation?: "AND" | "OR" | undefined;
@@ -99,7 +99,7 @@ declare const CORE_PROCEDURES: {
         include?: string | number | (string | number)[] | undefined;
         offset?: string | number | undefined;
         order?: "asc" | "desc" | undefined;
-        orderby?: "date" | "id" | "slug" | "parent" | "title" | "author" | "include" | "modified" | "relevance" | "include_slugs" | "menu_order" | undefined;
+        orderby?: "id" | "slug" | "parent" | "title" | "author" | "date" | "include" | "include_slugs" | "modified" | "relevance" | "menu_order" | undefined;
         searchColumns?: ("post_title" | "post_content" | "post_excerpt")[] | undefined;
         slug?: string | string[] | undefined;
         parent?: string | number | (string | number)[] | undefined;
@@ -136,7 +136,7 @@ declare const CORE_PROCEDURES: {
         exclude?: string | number | (string | number)[] | undefined;
         include?: string | number | (string | number)[] | undefined;
         order?: "asc" | "desc" | undefined;
-        orderBy?: "count" | "id" | "slug" | "name" | "description" | "include" | "include_slugs" | "term_group" | undefined;
+        orderBy?: "id" | "name" | "slug" | "description" | "include" | "include_slugs" | "term_group" | "count" | undefined;
         hideEmpty?: string | boolean | undefined;
         parent?: string | number | undefined;
         post?: string | number | undefined;
@@ -172,7 +172,7 @@ declare const CORE_PROCEDURES: {
         exclude?: string | number | (string | number)[] | undefined;
         include?: string | number | (string | number)[] | undefined;
         order?: "asc" | "desc" | undefined;
-        orderBy?: "count" | "id" | "slug" | "name" | "description" | "include" | "include_slugs" | "term_group" | undefined;
+        orderBy?: "id" | "name" | "slug" | "description" | "include" | "include_slugs" | "term_group" | "count" | undefined;
         hideEmpty?: string | boolean | undefined;
         post?: string | number | undefined;
         slug?: string | string[] | undefined;
@@ -241,7 +241,7 @@ declare const CORE_PROCEDURES: {
     sitemaps: {
       list: Procedure<"internal", {}, {
         key: string;
-        type: "post_type" | "taxonomy" | "author";
+        type: "author" | "post_type" | "taxonomy";
         pages: number;
         lastmod: string;
       }[], DefinedErrorMapLike>;
@@ -249,7 +249,7 @@ declare const CORE_PROCEDURES: {
         origin: string;
         sitemaps: {
           key: string;
-          type: "post_type" | "taxonomy" | "author";
+          type: "author" | "post_type" | "taxonomy";
           pages: number;
           lastmod: string;
         }[];
@@ -292,7 +292,7 @@ declare const CORE_PROCEDURES: {
           include?: string | number | (string | number)[] | undefined;
           offset?: string | number | undefined;
           order?: "asc" | "desc" | undefined;
-          orderby?: "date" | "id" | "slug" | "parent" | "title" | "author" | "include" | "relevance" | "include_slugs" | "menu_order" | undefined;
+          orderby?: "id" | "slug" | "parent" | "title" | "author" | "date" | "include" | "include_slugs" | "relevance" | "menu_order" | undefined;
           searchColumns?: ("post_title" | "post_content" | "post_excerpt")[] | undefined;
           slug?: string | string[] | undefined;
           taxRelation?: "AND" | "OR" | undefined;
@@ -371,7 +371,7 @@ declare const CORE_PROCEDURES: {
           include?: string | number | (string | number)[] | undefined;
           offset?: string | number | undefined;
           order?: "asc" | "desc" | undefined;
-          orderby?: "date" | "id" | "slug" | "parent" | "title" | "author" | "include" | "relevance" | "include_slugs" | "menu_order" | undefined;
+          orderby?: "id" | "slug" | "parent" | "title" | "author" | "date" | "include" | "include_slugs" | "relevance" | "menu_order" | undefined;
           searchColumns?: ("post_title" | "post_content" | "post_excerpt")[] | undefined;
           slug?: string | string[] | undefined;
           taxRelation?: "AND" | "OR" | undefined;
@@ -507,7 +507,7 @@ declare const CORE_PROCEDURES: {
         include?: string | number | (string | number)[] | undefined;
         offset?: string | number | undefined;
         order?: "asc" | "desc" | undefined;
-        orderby?: "date" | "id" | "parent" | "include" | "post" | undefined;
+        orderby?: "id" | "parent" | "date" | "include" | "post" | undefined;
         parent?: string | number | (string | number)[] | undefined;
         parentExclude?: string | number | (string | number)[] | undefined;
         post?: string | number | (string | number)[] | undefined;
@@ -635,8 +635,8 @@ declare const CORE_PROCEDURES: {
     get: Procedure<"internal", {}, _kizlo_shared11.Settings, DefinedErrorMapLike>;
     site: {
       update: Procedure<"internal", {
-        url?: string | null | undefined;
         name?: string | null | undefined;
+        url?: string | null | undefined;
         backend_url?: string | null | undefined;
         secret?: string | null | undefined;
         alternate_name?: string | null | undefined;

package/dist/seo/schema.d.ts

@@ -108,17 +108,17 @@ declare const Seo: z.ZodObject<{
 type Seo = z.infer<typeof Seo>;
 declare const CONTENT_TYPES: readonly ["post_type", "taxonomy", "author"];
 declare const ContentType: z.ZodEnum<{
+  author: "author";
   post_type: "post_type";
   taxonomy: "taxonomy";
-  author: "author";
 }>;
 type ContentType = z.infer<typeof ContentType>;
 declare const Sitemap: z.ZodObject<{
   key: z.ZodString;
   type: z.ZodEnum<{
+    author: "author";
     post_type: "post_type";
     taxonomy: "taxonomy";
-    author: "author";
   }>;
   pages: z.ZodNumber;
   lastmod: z.ZodString;
@@ -127,9 +127,9 @@ type Sitemap = z.infer<typeof Sitemap>;
 declare const SitemapList: z.ZodArray<z.ZodObject<{
   key: z.ZodString;
   type: z.ZodEnum<{
+    author: "author";
     post_type: "post_type";
     taxonomy: "taxonomy";
-    author: "author";
   }>;
   pages: z.ZodNumber;
   lastmod: z.ZodString;
@@ -140,9 +140,9 @@ declare const SitemapIndex: z.ZodObject<{
   sitemaps: z.ZodArray<z.ZodObject<{
     key: z.ZodString;
     type: z.ZodEnum<{
+      author: "author";
       post_type: "post_type";
       taxonomy: "taxonomy";
-      author: "author";
     }>;
     pages: z.ZodNumber;
     lastmod: z.ZodString;
@@ -174,9 +174,9 @@ declare const SitemapUrlList: z.ZodArray<z.ZodObject<{
 type SitemapUrlList = z.infer<typeof SitemapUrlList>;
 declare const ListSitemapUrlInputBase: z.ZodObject<{
   type: z.ZodEnum<{
+    author: "author";
     post_type: "post_type";
     taxonomy: "taxonomy";
-    author: "author";
   }>;
   page: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodCoercedNumber<string | number>>>;
 }, z.core.$strip>;

package/dist/shared/constants.js

@@ -5,6 +5,8 @@ import { milliseconds } from "@kizlo/shared";
 const VERSION = version;
 const RPC_PROTOCOL_HEADER = "x-rpc-protocol";
 const SESSION_EXPIRY_MARGIN_MS = milliseconds("5 minutes");
+/** Mount order for the built-in framework integrations, ahead of app integrations that leave `order` unset. */
+const FRAMEWORK_INTEGRATION_ORDER = -100;
 
 //#endregion
-export { RPC_PROTOCOL_HEADER };
+export { FRAMEWORK_INTEGRATION_ORDER, RPC_PROTOCOL_HEADER };