kizlo 0.20.2 → 0.22.0

package/dist/cli/mcp/server.js

@@ -0,0 +1,248 @@
+import { log } from "../daemon/logger.js";
+import { callRoute, describeRoute, searchRoutes } from "./tools.js";
+import z from "zod/v4";
+import { createServer } from "node:http";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+
+//#region src/cli/mcp/server.ts
+/** The only interface the server is ever bound to. Never `0.0.0.0`: this is a developer's machine. */
+const MCP_HOST = "127.0.0.1";
+/** The one path the server answers on, so a harness config is a URL rather than a URL and a note. */
+const MCP_PATH = "/mcp";
+/** Hosts an `Origin` may name. Everything the loopback interface is reachable as, and nothing else. */
+const LOOPBACK_HOSTS = new Set([
+	"127.0.0.1",
+	"::1",
+	"[::1]",
+	"localhost"
+]);
+/**
+* Whether a request's `Origin` may be served.
+*
+* Binding to loopback keeps other machines out, but not the developer's own browser: a page on any
+* site can `fetch` `http://127.0.0.1`, and while CORS stops it reading the reply, a request that
+* changes WordPress has already happened by then. The MCP specification requires HTTP transports to
+* check `Origin` for exactly this, so a page that names itself is refused before it reaches a tool.
+*
+* No `Origin` is allowed, because that is what a native MCP client sends. Browsers attach the header
+* to cross-origin requests themselves and cannot forge it, so its absence is not something an attacking
+* page can arrange.
+*/
+function isAllowedOrigin(origin) {
+	if (origin === void 0 || origin === "") return true;
+	if (origin === "null") return false;
+	try {
+		return LOOPBACK_HOSTS.has(new URL(origin).hostname);
+	} catch {
+		return false;
+	}
+}
+/**
+* Render a tool's answer for both kinds of reader: `structuredContent` for a client that parses, and
+* a text block for one that does not.
+*
+* A failure carries no `structuredContent`. A client validates whatever it finds there against the
+* tool's declared output schema whether or not the result is an error, and a failure is not that
+* shape, so putting it there makes a client reject the answer outright instead of reading it. The
+* detail rides in a second text block, which keeps it machine-readable without breaking the contract.
+*/
+function toolContent(result, summarize = (value) => JSON.stringify(value, null, 2)) {
+	if (!result.ok) return {
+		content: [{
+			type: "text",
+			text: result.error.message
+		}, {
+			type: "text",
+			text: JSON.stringify(result.error, null, 2)
+		}],
+		isError: true
+	};
+	return {
+		content: [{
+			type: "text",
+			text: summarize(result.value)
+		}],
+		structuredContent: result.value
+	};
+}
+/**
+* The one result long enough to be worth compressing. Describe and call put their payload in the
+* text block because the payload is the answer; a ranked list is better read than parsed.
+*/
+function summarizeSearch(value) {
+	const outcome = value;
+	if (outcome.count === 0) return outcome.message ?? "No route matches that search.";
+	const lines = outcome.routes.map((route) => {
+		const evidence = route.evidence.map((item) => `${item.field}:${item.term}`).join(", ");
+		const summary = route.summary === void 0 ? "" : ` — ${route.summary}`;
+		const deprecated = route.deprecated ? " (deprecated)" : "";
+		return `${route.name} — ${route.method} ${route.path}${summary}${deprecated}${evidence === "" ? "" : ` [${evidence}]`}`;
+	});
+	const more = outcome.nextCursor === void 0 ? "" : `\n${outcome.count - outcome.routes.length} more. Pass cursor "${outcome.nextCursor}" for the next page.`;
+	return `${outcome.count} route${outcome.count === 1 ? "" : "s"} match:\n${lines.join("\n")}${more}`;
+}
+/** A ranked result, and the named part of the contract that selected it. */
+const SEARCH_OUTPUT = {
+	count: z.number().describe("Matches across the whole catalog, not just this page."),
+	routes: z.array(z.object({
+		name: z.string(),
+		namespace: z.string(),
+		method: z.string(),
+		path: z.string(),
+		summary: z.string().optional(),
+		deprecated: z.literal(true).optional(),
+		evidence: z.array(z.object({
+			field: z.string(),
+			term: z.string()
+		}))
+	})),
+	namespaces: z.array(z.string()).describe("Every REST namespace this WordPress serves."),
+	nextCursor: z.string().optional().describe("Hand back as `cursor` to read the next page."),
+	message: z.string().optional().describe("Present only when nothing matched.")
+};
+const DESCRIBE_OUTPUT = {
+	name: z.string(),
+	namespace: z.string(),
+	method: z.string(),
+	path: z.string(),
+	summary: z.string().optional(),
+	description: z.string().optional(),
+	deprecated: z.literal(true).optional(),
+	pathParameters: z.array(z.string()),
+	input: z.record(z.string(), z.unknown()).describe("JSON Schema for `{ params, query, body }`, with its `$defs`."),
+	responses: z.record(z.string(), z.unknown()).describe("Keyed by HTTP status."),
+	errors: z.array(z.string()).describe("Error codes this route declares.")
+};
+/**
+* Deliberately permissive. The SDK validates `structuredContent` against this on every successful
+* call, so anything narrower would turn a route whose response does not fit into a protocol error
+* rather than an answer.
+*/
+const CALL_OUTPUT = {
+	status: z.number(),
+	data: z.unknown().optional()
+};
+/**
+* Three dispatchers rather than a tool per route. The contract a seeded WordPress serves runs to well
+* over a hundred routes, and putting their schemas in front of a model up front would cost tens of
+* thousands of tokens in every message. These cost a few hundred and reach all of them — and because
+* they read the document per call, a route registered while `kizlo dev` runs is callable without
+* re-registering anything.
+*/
+function createMcpServer(state) {
+	const server = new McpServer({
+		name: "kizlo",
+		version: "1.0.0"
+	}, { instructions: [
+		"Read and change the WordPress of the Kizlo project this server was started in.",
+		"Every REST route that WordPress exposes is reachable here — core, Kizlo's own, and any plugin's — through three tools rather than one tool per route.",
+		"Work in that order: `kizlo_search_routes` to find a route, `kizlo_describe_route` to read its contract, `kizlo_call` to run it.",
+		"Describe a route before calling it unless you already know its contract. Arguments are grouped into `params`, `query`, and `body`, and the description says which fields belong where.",
+		"API errors are passed through unchanged: the code, message, and data are WordPress's own, not this server's summary of them."
+	].join(" ") });
+	server.registerTool("kizlo_search_routes", {
+		title: "Search WordPress routes",
+		description: "Find routes by identity or by meaning: a route name, path, or namespace, or terms from a route's arguments, response fields, description, or error codes. Start here. Omit `query` to browse the whole catalog. Each result names the evidence that selected it, and the route names it returns are what `kizlo_describe_route` and `kizlo_call` take.",
+		inputSchema: {
+			query: z.string().optional().describe("Terms to rank on. Omit or leave empty to browse every route."),
+			namespace: z.string().optional().describe("Only routes in this REST namespace, e.g. \"wp/v2\" or \"kizlo/v1\"."),
+			method: z.string().optional().describe("Only routes served with this HTTP method, e.g. \"GET\"."),
+			access: z.enum(["read", "write"]).optional().describe("Only reading routes (GET, HEAD, OPTIONS) or only writing ones."),
+			limit: z.number().int().optional().describe("Results per page. Defaults to 20, at most 100."),
+			cursor: z.string().optional().describe("The `nextCursor` from a previous search, to read the next page.")
+		},
+		outputSchema: SEARCH_OUTPUT
+	}, async (input) => toolContent(searchRoutes(state, input), summarizeSearch));
+	server.registerTool("kizlo_describe_route", {
+		title: "Describe a WordPress route",
+		description: "The complete contract for one route: the JSON Schema for its `params`, `query`, and `body`, with the definitions they reference; the response schema for each HTTP status, with content types and headers; which arguments are interpolated into the path; and the error codes the route declares.",
+		inputSchema: { route: z.string().describe("A route name from `kizlo_search_routes`, e.g. `kizlo.postTypes.book.list`.") },
+		outputSchema: DESCRIBE_OUTPUT
+	}, async ({ route }) => toolContent(describeRoute(state, { route })));
+	server.registerTool("kizlo_call", {
+		title: "Call a WordPress route",
+		description: "Run one route against this project's WordPress and return its response. Arguments go in `input` under the part they belong to: `params` for the values interpolated into the path, `query` for query parameters, and `body` for the payload. `kizlo_describe_route` says which are which.",
+		inputSchema: {
+			route: z.string().describe("A route name from `kizlo_search_routes`."),
+			input: z.object({
+				params: z.record(z.string(), z.unknown()).optional().describe("Values interpolated into the path."),
+				query: z.record(z.string(), z.unknown()).optional().describe("Query parameters."),
+				body: z.unknown().optional().describe("The request payload.")
+			}).optional().describe("The route's arguments, grouped as `kizlo_describe_route` describes them.")
+		},
+		outputSchema: CALL_OUTPUT
+	}, async ({ route, input }) => toolContent(await callRoute(state, input === void 0 ? { route } : {
+		route,
+		input
+	})));
+	return server;
+}
+/**
+* Bind the MCP server for this session.
+*
+* It binds once and stays bound. The contract watcher restarts whenever `.env` or a config file
+* changes, and tying the socket to that cycle would drop the harness's connection on every save and
+* race the rebind against a port the previous listener had not finished releasing. Nothing here is
+* captured from the watcher either: `state` is read per tool call, so a reload that changes the
+* WordPress connection takes effect on the next call without rebinding anything.
+*/
+async function startMcpServer(state, options) {
+	const server = createServer((request, response) => {
+		if (!isAllowedOrigin(request.headers.origin)) {
+			response.writeHead(403, { "content-type": "application/json" });
+			response.end(JSON.stringify({ error: `Refused an MCP request from origin ${request.headers.origin}.` }));
+			return;
+		}
+		const { pathname } = new URL(request.url ?? "/", `http://${MCP_HOST}`);
+		if (pathname !== MCP_PATH) {
+			response.writeHead(404, { "content-type": "application/json" });
+			response.end(JSON.stringify({ error: `Nothing is served at ${pathname}. The MCP endpoint is ${MCP_PATH}.` }));
+			return;
+		}
+		dispatch(request, response, state);
+	});
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(options.port, MCP_HOST, () => {
+			server.removeListener("error", reject);
+			server.on("error", (error) => log.error("MCP server error:", error));
+			resolve();
+		});
+	});
+	const address = server.address();
+	const port = typeof address === "object" && address !== null ? address.port : options.port;
+	return {
+		url: `http://${MCP_HOST}:${port}${MCP_PATH}`,
+		port,
+		stop: () => stopServer(server)
+	};
+}
+/**
+* Answer one request with a server and transport of its own.
+*
+* Stateless, with plain JSON replies: a dev session has exactly one harness attached and nothing to
+* remember between its calls, so there is no session to track and no reason to hold an event stream
+* open. Per request rather than shared, because a stateless transport carries the state of the one
+* exchange it was built for and cannot answer a second. Building three tools again each time costs
+* nothing next to the request, and it is what keeps the tools reading the current `state`.
+*/
+async function dispatch(request, response, state) {
+	const mcp = createMcpServer(state);
+	const transport = new StreamableHTTPServerTransport({ enableJsonResponse: true });
+	response.on("close", () => {
+		transport.close();
+		mcp.close();
+	});
+	await mcp.connect(transport);
+	await transport.handleRequest(request, response);
+}
+async function stopServer(server) {
+	await new Promise((resolve) => {
+		server.close(() => resolve());
+		server.closeAllConnections();
+	});
+}
+
+//#endregion
+export { MCP_HOST, MCP_PATH, isAllowedOrigin, startMcpServer };

package/dist/cli/mcp/state.js

@@ -0,0 +1,7 @@
+//#region src/cli/mcp/state.ts
+function createMcpState() {
+	return {};
+}
+
+//#endregion
+export { createMcpState };

package/dist/cli/mcp/tools.js

@@ -0,0 +1,116 @@
+import { buildWordPressRequest } from "../../wordpress/endpoint.js";
+import { WordPressTransport } from "../../wordpress/transport.js";
+import { routesOf } from "./routes.js";
+import { inputJsonSchema, toJsonSchema } from "./schema.js";
+import { searchRoutes } from "./search.js";
+
+//#region src/cli/mcp/tools.ts
+/** The document is fetched by the watcher, so the only reason it is missing is that none has arrived yet. */
+const NO_DOCUMENT = "The WordPress contract has not been fetched yet. Retry in a moment; `kizlo dev` refreshes it every few seconds.";
+function failed(message) {
+	return {
+		ok: false,
+		error: {
+			kind: "request",
+			message
+		}
+	};
+}
+/**
+* Rank the routes this WordPress serves against a query, or browse them all when there is none.
+*
+* Summaries and match evidence only. The schemas behind these routes are far too large to put in
+* front of a model at once, which is what `kizlo_describe_route` is for.
+*/
+function searchRoutes$1(state, input = {}) {
+	if (!state.document) return failed(NO_DOCUMENT);
+	const outcome = searchRoutes(state.document, input);
+	if (outcome.count === 0) {
+		const within = [
+			input.namespace !== void 0 ? `namespace "${input.namespace}"` : void 0,
+			input.method !== void 0 ? `method ${input.method.toUpperCase()}` : void 0,
+			input.access !== void 0 ? `${input.access} routes` : void 0
+		].filter((part) => part !== void 0).join(", ");
+		return {
+			ok: true,
+			value: {
+				...outcome,
+				message: `No route matches that search${within === "" ? "" : ` within ${within}`}. This WordPress serves these namespaces: ${outcome.namespaces.join(", ")}.`
+			}
+		};
+	}
+	return {
+		ok: true,
+		value: outcome
+	};
+}
+/** The full contract for one route, which is what a caller needs before it can build a call. */
+function describeRoute(state, input) {
+	if (!state.document) return failed(NO_DOCUMENT);
+	const route = routesOf(state.document).get(input.route);
+	if (!route) return failed(unknownRoute(input.route));
+	return {
+		ok: true,
+		value: {
+			name: route.name,
+			namespace: route.namespace,
+			method: route.method,
+			path: route.path,
+			...route.summary !== void 0 ? { summary: route.summary } : {},
+			...route.description !== void 0 ? { description: route.description } : {},
+			...route.deprecated ? { deprecated: true } : {},
+			pathParameters: route.definition.pathParameters,
+			input: inputJsonSchema(route.operation.input, state.document),
+			responses: responseSchemas(route.operation.responses, state.document),
+			errors: route.operation.errors
+		}
+	};
+}
+/** Run one route against the connected WordPress and hand back what it answered. */
+async function callRoute(state, input) {
+	if (!state.document) return failed(NO_DOCUMENT);
+	if (!state.credentials) return failed("No WordPress connection is configured, so nothing can be called. Check the connection settings in `.env`.");
+	const route = routesOf(state.document).get(input.route);
+	if (!route) return failed(unknownRoute(input.route));
+	const built = buildWordPressRequest(route.definition, input.input ?? {});
+	if (built.error) return failed(built.error.message);
+	const response = await new WordPressTransport({ credentials: state.credentials }).request(built.request);
+	if (response.error) return {
+		ok: false,
+		error: {
+			kind: "response",
+			message: `${route.method} ${route.path} failed (${response.status || "no response"}): ${response.error.code} — ${response.error.message}`,
+			route: route.name,
+			method: route.method,
+			path: route.path,
+			status: response.status,
+			error: {
+				code: response.error.code,
+				message: response.error.message,
+				data: response.error.data
+			}
+		}
+	};
+	return {
+		ok: true,
+		value: {
+			status: response.status,
+			data: response.data
+		}
+	};
+}
+/** The response half of the contract, converted so a caller can read a success or a failure body. */
+function responseSchemas(responses, document) {
+	return Object.fromEntries(Object.entries(responses).map(([status, response]) => [status, {
+		...response.description !== void 0 ? { description: response.description } : {},
+		...response.content_type !== void 0 ? { content_type: response.content_type } : {},
+		...response.headers ? { headers: toJsonSchema(response.headers, document) } : {},
+		...response.body ? { body: toJsonSchema(response.body, document) } : {}
+	}]));
+}
+function unknownRoute(name) {
+	return `No route named "${name}" in this WordPress contract. Call \`kizlo_search_routes\` for the routes it serves.`;
+}
+
+//#endregion
+export { callRoute, describeRoute, searchRoutes$1 as searchRoutes };

package/dist/comment/index.js

@@ -17,8 +17,8 @@ const COMMENT_PROCEDURES = {
 		output: Comment
 	}, async ({ context, errors, input }) => {
 		const response = await context.wordpress.comments.retrieve({
-			id: input.params.id,
-			password: input.query?.password
+			params: { id: input.params.id },
+			query: { password: input.query?.password }
 		});
 		if (response.error) switch (response.error.code) {
 			case "rest_comment_invalid_id":
@@ -63,7 +63,7 @@ const COMMENT_PROCEDURES = {
 			post: listed(input.query?.post),
 			search: input.query?.search
 		};
-		const response = await context.wordpress.comments.list(searchParams);
+		const response = await context.wordpress.comments.list({ query: searchParams });
 		if (response.error) switch (response.error.code) {
 			case "rest_cannot_read":
 			case "rest_cannot_read_post":
@@ -114,7 +114,7 @@ const COMMENT_PROCEDURES = {
 			author_url: input.body.authorUrl,
 			parent: input.body.parentId
 		};
-		const response = await context.wordpress.kizlo.comments.create(submission);
+		const response = await context.wordpress.kizlo.comments.create({ body: submission });
 		if (response.error) switch (response.error.code) {
 			case "require_name_email": throw errors.COMMENT_NAME_EMAIL_REQUIRED();
 			case "require_valid_email": throw errors.COMMENT_INVALID_EMAIL();

package/dist/config.d.ts

@@ -120,6 +120,16 @@ interface KizloLocalConfig {
   /** The test stack run by `kizlo test`. Inherits `version` and `fixtures` from {@link KizloLocalConfig.dev}. */
   test?: KizloTestConfig;
 }
+interface KizloMcpConfig {
+  /**
+   * Port the server binds on `127.0.0.1`. Unset, it starts at the Kizlo default and steps off a
+   * collision, which is why nothing has to be configured to run two projects at once. Set it when a
+   * harness config has to name the port: an explicitly set port is never auto-reassigned, and
+   * `kizlo dev` stops rather than serving on one you did not choose.
+   * @default 8300
+   */
+  port?: number;
+}
 interface KizloGlobalConfig {
   /**
    * Where Kizlo generates, and what it watches. A string names the home directory Kizlo owns the
@@ -139,7 +149,13 @@ interface KizloGlobalConfig {
    * stack name, the per-branch `worktrees` toggle, and the two stacks live.
    */
   local?: boolean | KizloLocalConfig;
+  /**
+   * The MCP server `kizlo dev` serves on loopback, exposing this project's WordPress routes to an AI
+   * harness. It runs whenever `kizlo dev` can resolve a WordPress connection; this block only tunes it.
+   * It is never part of a built app: the server lives in the CLI, so nothing about it can be deployed.
+   */
+  mcp?: KizloMcpConfig;
 }
 declare function defineConfig(config: KizloGlobalConfig): KizloGlobalConfig;
 //#endregion
-export { KizloDevConfig, KizloDir, KizloGlobalConfig, KizloLocalConfig, KizloTestConfig, defineConfig };
+export { KizloDevConfig, KizloDir, KizloGlobalConfig, KizloLocalConfig, KizloMcpConfig, KizloTestConfig, defineConfig };

package/dist/email/service.js

@@ -5,7 +5,7 @@ var EmailService = class {
 		this.wordpress = wordpress;
 	}
 	async send(params) {
-		const { error } = await this.wordpress.email.send(params);
+		const { error } = await this.wordpress.kizlo.email.send({ body: params });
 		if (error) throw error;
 	}
 };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { WP_Error } from "./wordpress/error.js";
-import { ActiveWordPressClient, WP_CallOptions, WP_Client, WP_CommonErrorCode, WP_CurrencyFormat, WP_CustomFields, WP_CustomFieldsPath, WP_Endpoint, WP_EndpointData, WP_EndpointDefinition, WP_EndpointError, WP_EndpointInput, WP_EndpointPath, WP_EndpointResult, WP_ErrorData, WP_Failure, WP_List, WP_ListMetadata, WP_RequestBuild, WP_RequestContentType, WP_RequestInput, WP_RequestMethod, WP_ResponseContentType, WP_Result, WP_Success, WP_TransportFailure, WP_TypedHeaders, WordPressClientRegistry, WordPressCredentials, WordPressCustomFieldsRegistry, WordPressEndpointRegistry } from "./wordpress/types.js";
+import { ActiveWordPressClient, WP_CallOptions, WP_Client, WP_CommonErrorCode, WP_CurrencyFormat, WP_CustomFields, WP_CustomFieldsPath, WP_Endpoint, WP_EndpointData, WP_EndpointDefinition, WP_EndpointError, WP_EndpointInput, WP_EndpointPath, WP_EndpointResult, WP_ErrorData, WP_Failure, WP_List, WP_ListMetadata, WP_RequestBuild, WP_RequestContentType, WP_RequestInput, WP_RequestMethod, WP_RequestParts, WP_ResponseContentType, WP_Result, WP_Success, WP_TransportFailure, WP_TypedHeaders, WordPressClientRegistry, WordPressCredentials, WordPressCustomFieldsRegistry, WordPressEndpointRegistry } from "./wordpress/types.js";
 import { WordPressTransport, WordPressTransportOptions, WordPressTransportResult } from "./wordpress/transport.js";
 import { buildWordPressRequest, createWordPressClient, wpEndpoint } from "./wordpress/endpoint.js";
 import { isWordPressResourceError } from "./wordpress/utils.js";
@@ -28,7 +28,7 @@ import { AnyEventSchema, AnyEvents, EventHandler, EventHandlerFn, InferEventUnio
 import { COMMON_ERRORS, CommonErrorCode, CommonErrorLiteral, CommonErrorMap, DefinedErrorMapLike, ErrorDefinition, KizloError, KizloErrorOptions, ThrowableErrorFn, ThrowableErrorMap, WithCommonErrorMap, createThrowableErrorMap, defineErrorMap, isKizloError, toKizloError } from "./shared/error.js";
 import { AnyMiddleware, ExtractMiddlewareContextOutput, InferMiddlewares, Middleware, MiddlewareHandler, MiddlewareNextFn, MiddlewareOptions, MiddlewareResult, createMiddleware } from "./shared/middleware.js";
 import { AnyProcedure, AnyProcedureTree, BaseHandlerOptions, ExtractParams, ExtractProcedureByScope, InvocationScope, OpenapiPart, Procedure, ProcedureErrors, ProcedureHandler, ProcedureOptions, ProcedureTreeDepthTuple, ResolveParamsPart, ResolvedSchemaInput, ResolvedSchemaOutput, SchemaIO, buildProcedure, combineDetailed, createProcedure, handleUnexpectedError, schemaType } from "./shared/procedure.js";
-import { AnyIntegration, EnvReader, EnvRecord, EnvSource, ExtractIntegrationProcedures, InferIntegrationProcedures, Integration, IntegrationRequirements, KizloEnv, WordPressEnv, assertIntegrationEndpoints, assertIntegrationEnv, createIntegration, missingEndpoints, missingEnv, readEnv } from "./shared/integration.js";
+import { AnyIntegration, EnvReader, EnvRecord, EnvSource, ExtractIntegrationProcedures, InferIntegrationProcedures, Integration, IntegrationRequirements, KizloEnv, WordPressEnv, assertIntegrationEndpoints, assertIntegrationEnv, createIntegration, missingEndpoints, missingEnv, readEnv, sortIntegrations } from "./shared/integration.js";
 import { InferProcedureData, InferProcedureError, InferProcedureInput, InferProcedureResult, KizloErrorUnion, KizloResult, MaybeCallerOptions, ProcedureMethod, ResultClient, createResultClient } from "./shared/result.js";
 import { AnyKizloConfig, CreateKizloOptions, Kizlo, KizloConfig, RootProcedures, S2SClient, createKizlo, integrationEnv, resolveKizloConfig, resolveWordPressConnection, wordPressConnectionComplete } from "./kizlo.js";
 import { WEB_MANIFEST_ROUTE, WebManifest, buildWebManifest, createManifestRoute } from "./brand/manifest.js";
@@ -43,4 +43,4 @@ import { ShaAlgorithm, compare, hash, hmac } from "./shared/crypto.js";
 import { Identifier, parseIdentifier } from "./shared/identifier.js";
 import { createOrpcRouter } from "./shared/router.js";
 import { deserializeCurrencyFormat, deserializeListMetadata, emptyList, serializeCurrencyFormat } from "./shared/serialize.js";
-export { ActiveWordPressClient, AnyContext, AnyEventSchema, AnyEvents, AnyIntegration, AnyKizloConfig, AnyMiddleware, AnyNestedClient, AnyProcedure, AnyProcedureTree, AuthAdapter, AuthGetSession, AuthUser, AuthorsSettings, AuthorsSettingsInput, BaseHandlerOptions, BrandSettings, BrandSettingsInput, COMMON_ERRORS, CONTENT_TYPES, CORE_PROCEDURES, CaptchaAdapter, type Category, type CategoryCustomFields, CategoryCustomFieldsSchema, CommonErrorCode, CommonErrorLiteral, CommonErrorMap, ConnInfo, ConnInfoFn, ConsoleLogAdapterOptions, ContentType, Context, ContextConfig, Contract, ContractProcedure, CookiesAdapter, CookiesDeleteAll, CookiesGetAll, CookiesSetAll, CookiesStorage, CoreProcedures, CrawlingSettings, CrawlingSettingsInput, CreateKizloOptions, CreateSitemapRouteOptions, CurrencyFormat, DefinedErrorMapLike, DevPluginSource, EnvReader, EnvRecord, EnvSource, ErrorDefinition, EventHandler, EventHandlerFn, ExtractIntegrationProcedures, ExtractMiddlewareContextOutput, ExtractParams, ExtractProcedureByScope, Fixture, FixtureCleanupFn, FixtureSeedFn, FixtureSettleFn, GeoAdapter, GeoGetConnInfo, HTTPMethod, HeadlessSettings, HeadlessSettingsInput, IconDescriptor, Identifier, IdentifierInput, IdentitySettings, IdentitySettingsInput, InferEventUnion, InferIntegrationProcedures, InferMiddlewares, InferProcedureData, InferProcedureError, InferProcedureInput, InferProcedureResult, Integration, IntegrationRequirements, InvocationScope, JsonValue, Kizlo, KizloClient, KizloClientConfig, KizloConfig, KizloEnv, KizloError, KizloErrorOptions, KizloErrorUnion, KizloResult, LIST_ORDER, List, ListMetadata, ListOrder, ListSitemapUrlInput, ListSitemapUrlInputBase, LocalPlugin, LogLevel, LogPayload, Logger, LoggerAdapter, ManifestIcon, MaybeCallerOptions, MaybeOptionalOptions, Middleware, MiddlewareHandler, MiddlewareNextFn, MiddlewareOptions, MiddlewareResult, OpenapiPart, OrganizationFounder, OrganizationSettings, OrganizationSettingsInput, type Page, type PageCustomFields, PageCustomFieldsSchema, PersonSettings, PersonSettingsInput, PluginSource, type Post, type PostCustomFields, PostCustomFieldsSchema, PostStatusDefinition, PostTypeSettings, PostTypeSettingsInput, PreviewTokenData, PreviewTokenPayload, Procedure, ProcedureContext, ProcedureErrors, ProcedureHandler, ProcedureMethod, ProcedureOptions, ProcedureTreeDepthTuple, RedirectInput, RedirectStatus, ResolveParamsPart, ResolvedIcons, ResolvedSchemaInput, ResolvedSchemaOutput, ResultClient, Robots, RobotsRule, RootProcedures, S2SClient, SITEMAP_BASE, SITEMAP_INDEX_SLUG, SchemaIO, SeedContext, Seo, SeoHead, SeoSchema, ServiceAdapters, SessionFn, Settings, SettingsService, SettleContext, ShaAlgorithm, SiteSettings, SiteSettingsInput, Sitemap, SitemapIndex, SitemapIndexEntry, SitemapList, SitemapRouteExtra, SitemapUrl, SitemapUrlImage, SitemapUrlList, SocialProfile, type Tag, type TagCustomFields, TagCustomFieldsSchema, TaxonomySettings, TaxonomySettingsInput, TestAdminUser, TestCredentials, TestUser, ThrowableErrorFn, ThrowableErrorMap, UploadsSettings, UploadsSettingsInput, VerifyCaptchaFn, VerifyPreviewTokenFn, WEB_MANIFEST_ROUTE, WPK_RobotRule, WPK_Robots, WPK_Seo, WPK_Sitemap, WPK_SitemapUrl, WPK_SitemapUrlImage, WP_CallOptions, WP_Client, WP_CommonErrorCode, WP_CurrencyFormat, WP_CustomFields, WP_CustomFieldsPath, WP_Endpoint, WP_EndpointData, WP_EndpointDefinition, WP_EndpointError, WP_EndpointInput, WP_EndpointPath, WP_EndpointResult, WP_Error, WP_ErrorData, WP_Failure, WP_List, WP_ListMetadata, WP_RequestBuild, WP_RequestContentType, WP_RequestInput, WP_RequestMethod, WP_ResponseContentType, WP_Result, WP_Success, WP_TransportFailure, WP_TypedHeaders, WebManifest, WebhookOptions, WebhookSettings, WebhookSettingsInput, WithCommonErrorMap, WordPressClientRegistry, WordPressCredentials, WordPressCustomFieldsRegistry, WordPressEndpointRegistry, WordPressEnv, WordPressTransport, WordPressTransportOptions, WordPressTransportResult, altcha, arkose, assertIntegrationEndpoints, assertIntegrationEnv, authMock, buildProcedure, buildWebManifest, buildWordPressRequest, combineDetailed, compare, consoleLog, createAuthAdapter, createCaptchaAdapter, createCookiesAdapter, createEventHandler, createGeoAdapter, createIntegration, createKizlo, createKizloClient, createLoggerAdapter, createManifestRoute, createMiddleware, createOrpcRouter, createProcedure, createResultClient, createSitemapRedirectRoute, createSitemapRoute, createThrowableErrorMap, createWebhookRouter, createWordPressClient, customFieldsSchema, defineErrorMap, defineFixture, deserializeCurrencyFormat, deserializeListMetadata, deserializeSeo, emptyList, friendlyCaptcha, generateContract, geoMock, geoVercelNext, handleUnexpectedError, hash, hcaptcha, hmac, integrationEnv, isContractProcedure, isKizloError, isLocalPlugin, isWordPressResourceError, mergeServiceAdapters, missingEndpoints, missingEnv, noopAdapter, parseIdentifier, parseSitemapSlug, readEnv, recaptcha, renderJsonLd, renderSitemapIndex, renderUrlSet, resolveIcons, resolveKizloConfig, resolveWordPressConnection, restoreContract, schemaType, serializeCurrencyFormat, sitemapEntryPath, toKizloError, turnstile, wordPressConnectionComplete, wpEndpoint, xmlResponse };
+export { ActiveWordPressClient, AnyContext, AnyEventSchema, AnyEvents, AnyIntegration, AnyKizloConfig, AnyMiddleware, AnyNestedClient, AnyProcedure, AnyProcedureTree, AuthAdapter, AuthGetSession, AuthUser, AuthorsSettings, AuthorsSettingsInput, BaseHandlerOptions, BrandSettings, BrandSettingsInput, COMMON_ERRORS, CONTENT_TYPES, CORE_PROCEDURES, CaptchaAdapter, type Category, type CategoryCustomFields, CategoryCustomFieldsSchema, CommonErrorCode, CommonErrorLiteral, CommonErrorMap, ConnInfo, ConnInfoFn, ConsoleLogAdapterOptions, ContentType, Context, ContextConfig, Contract, ContractProcedure, CookiesAdapter, CookiesDeleteAll, CookiesGetAll, CookiesSetAll, CookiesStorage, CoreProcedures, CrawlingSettings, CrawlingSettingsInput, CreateKizloOptions, CreateSitemapRouteOptions, CurrencyFormat, DefinedErrorMapLike, DevPluginSource, EnvReader, EnvRecord, EnvSource, ErrorDefinition, EventHandler, EventHandlerFn, ExtractIntegrationProcedures, ExtractMiddlewareContextOutput, ExtractParams, ExtractProcedureByScope, Fixture, FixtureCleanupFn, FixtureSeedFn, FixtureSettleFn, GeoAdapter, GeoGetConnInfo, HTTPMethod, HeadlessSettings, HeadlessSettingsInput, IconDescriptor, Identifier, IdentifierInput, IdentitySettings, IdentitySettingsInput, InferEventUnion, InferIntegrationProcedures, InferMiddlewares, InferProcedureData, InferProcedureError, InferProcedureInput, InferProcedureResult, Integration, IntegrationRequirements, InvocationScope, JsonValue, Kizlo, KizloClient, KizloClientConfig, KizloConfig, KizloEnv, KizloError, KizloErrorOptions, KizloErrorUnion, KizloResult, LIST_ORDER, List, ListMetadata, ListOrder, ListSitemapUrlInput, ListSitemapUrlInputBase, LocalPlugin, LogLevel, LogPayload, Logger, LoggerAdapter, ManifestIcon, MaybeCallerOptions, MaybeOptionalOptions, Middleware, MiddlewareHandler, MiddlewareNextFn, MiddlewareOptions, MiddlewareResult, OpenapiPart, OrganizationFounder, OrganizationSettings, OrganizationSettingsInput, type Page, type PageCustomFields, PageCustomFieldsSchema, PersonSettings, PersonSettingsInput, PluginSource, type Post, type PostCustomFields, PostCustomFieldsSchema, PostStatusDefinition, PostTypeSettings, PostTypeSettingsInput, PreviewTokenData, PreviewTokenPayload, Procedure, ProcedureContext, ProcedureErrors, ProcedureHandler, ProcedureMethod, ProcedureOptions, ProcedureTreeDepthTuple, RedirectInput, RedirectStatus, ResolveParamsPart, ResolvedIcons, ResolvedSchemaInput, ResolvedSchemaOutput, ResultClient, Robots, RobotsRule, RootProcedures, S2SClient, SITEMAP_BASE, SITEMAP_INDEX_SLUG, SchemaIO, SeedContext, Seo, SeoHead, SeoSchema, ServiceAdapters, SessionFn, Settings, SettingsService, SettleContext, ShaAlgorithm, SiteSettings, SiteSettingsInput, Sitemap, SitemapIndex, SitemapIndexEntry, SitemapList, SitemapRouteExtra, SitemapUrl, SitemapUrlImage, SitemapUrlList, SocialProfile, type Tag, type TagCustomFields, TagCustomFieldsSchema, TaxonomySettings, TaxonomySettingsInput, TestAdminUser, TestCredentials, TestUser, ThrowableErrorFn, ThrowableErrorMap, UploadsSettings, UploadsSettingsInput, VerifyCaptchaFn, VerifyPreviewTokenFn, WEB_MANIFEST_ROUTE, WPK_RobotRule, WPK_Robots, WPK_Seo, WPK_Sitemap, WPK_SitemapUrl, WPK_SitemapUrlImage, WP_CallOptions, WP_Client, WP_CommonErrorCode, WP_CurrencyFormat, WP_CustomFields, WP_CustomFieldsPath, WP_Endpoint, WP_EndpointData, WP_EndpointDefinition, WP_EndpointError, WP_EndpointInput, WP_EndpointPath, WP_EndpointResult, WP_Error, WP_ErrorData, WP_Failure, WP_List, WP_ListMetadata, WP_RequestBuild, WP_RequestContentType, WP_RequestInput, WP_RequestMethod, WP_RequestParts, WP_ResponseContentType, WP_Result, WP_Success, WP_TransportFailure, WP_TypedHeaders, WebManifest, WebhookOptions, WebhookSettings, WebhookSettingsInput, WithCommonErrorMap, WordPressClientRegistry, WordPressCredentials, WordPressCustomFieldsRegistry, WordPressEndpointRegistry, WordPressEnv, WordPressTransport, WordPressTransportOptions, WordPressTransportResult, altcha, arkose, assertIntegrationEndpoints, assertIntegrationEnv, authMock, buildProcedure, buildWebManifest, buildWordPressRequest, combineDetailed, compare, consoleLog, createAuthAdapter, createCaptchaAdapter, createCookiesAdapter, createEventHandler, createGeoAdapter, createIntegration, createKizlo, createKizloClient, createLoggerAdapter, createManifestRoute, createMiddleware, createOrpcRouter, createProcedure, createResultClient, createSitemapRedirectRoute, createSitemapRoute, createThrowableErrorMap, createWebhookRouter, createWordPressClient, customFieldsSchema, defineErrorMap, defineFixture, deserializeCurrencyFormat, deserializeListMetadata, deserializeSeo, emptyList, friendlyCaptcha, generateContract, geoMock, geoVercelNext, handleUnexpectedError, hash, hcaptcha, hmac, integrationEnv, isContractProcedure, isKizloError, isLocalPlugin, isWordPressResourceError, mergeServiceAdapters, missingEndpoints, missingEnv, noopAdapter, parseIdentifier, parseSitemapSlug, readEnv, recaptcha, renderJsonLd, renderSitemapIndex, renderUrlSet, resolveIcons, resolveKizloConfig, resolveWordPressConnection, restoreContract, schemaType, serializeCurrencyFormat, sitemapEntryPath, sortIntegrations, toKizloError, turnstile, wordPressConnectionComplete, wpEndpoint, xmlResponse };

package/dist/index.js

@@ -32,10 +32,10 @@ import { PageCustomFieldsSchema } from "./page/schema.js";
 import { PostCustomFieldsSchema } from "./post/schema.js";
 import { TagCustomFieldsSchema } from "./tag/schema.js";
 import { CORE_PROCEDURES } from "./procedures.js";
-import { assertIntegrationEndpoints, assertIntegrationEnv, createIntegration, missingEndpoints, missingEnv, readEnv } from "./shared/integration.js";
+import { assertIntegrationEndpoints, assertIntegrationEnv, createIntegration, missingEndpoints, missingEnv, readEnv, sortIntegrations } from "./shared/integration.js";
 import { createEventHandler, createWebhookRouter } from "./webhook/index.js";
 import { Kizlo, createKizlo, integrationEnv, resolveKizloConfig, resolveWordPressConnection, wordPressConnectionComplete } from "./kizlo.js";
 import { SITEMAP_BASE, SITEMAP_INDEX_SLUG, createSitemapRedirectRoute, createSitemapRoute } from "./seo/sitemap.js";
 import { createMiddleware } from "./shared/middleware.js";
 
-export { COMMON_ERRORS, CONTENT_TYPES, CORE_PROCEDURES, CategoryCustomFieldsSchema, ContentType, Context, CookiesStorage, CurrencyFormat, IdentifierInput, Kizlo, KizloClient, KizloError, LIST_ORDER, ListMetadata, ListOrder, ListSitemapUrlInput, ListSitemapUrlInputBase, PageCustomFieldsSchema, PostCustomFieldsSchema, PreviewTokenData, PreviewTokenPayload, Robots, RobotsRule, SITEMAP_BASE, SITEMAP_INDEX_SLUG, Seo, SeoHead, SeoSchema, SettingsService, Sitemap, SitemapIndex, SitemapList, SitemapUrl, SitemapUrlImage, SitemapUrlList, TagCustomFieldsSchema, WEB_MANIFEST_ROUTE, WP_Error, WordPressTransport, altcha, arkose, assertIntegrationEndpoints, assertIntegrationEnv, authMock, buildProcedure, buildWebManifest, buildWordPressRequest, combineDetailed, compare, consoleLog, createAuthAdapter, createCaptchaAdapter, createCookiesAdapter, createEventHandler, createGeoAdapter, createIntegration, createKizlo, createKizloClient, createLoggerAdapter, createManifestRoute, createMiddleware, createOrpcRouter, createProcedure, createResultClient, createSitemapRedirectRoute, createSitemapRoute, createThrowableErrorMap, createWebhookRouter, createWordPressClient, customFieldsSchema, defineErrorMap, defineFixture, deserializeCurrencyFormat, deserializeListMetadata, deserializeSeo, emptyList, friendlyCaptcha, generateContract, geoMock, geoVercelNext, handleUnexpectedError, hash, hcaptcha, hmac, integrationEnv, isContractProcedure, isKizloError, isLocalPlugin, isWordPressResourceError, mergeServiceAdapters, missingEndpoints, missingEnv, noopAdapter, parseIdentifier, parseSitemapSlug, readEnv, recaptcha, renderJsonLd, renderSitemapIndex, renderUrlSet, resolveIcons, resolveKizloConfig, resolveWordPressConnection, restoreContract, schemaType, serializeCurrencyFormat, sitemapEntryPath, toKizloError, turnstile, wordPressConnectionComplete, wpEndpoint, xmlResponse };
+export { COMMON_ERRORS, CONTENT_TYPES, CORE_PROCEDURES, CategoryCustomFieldsSchema, ContentType, Context, CookiesStorage, CurrencyFormat, IdentifierInput, Kizlo, KizloClient, KizloError, LIST_ORDER, ListMetadata, ListOrder, ListSitemapUrlInput, ListSitemapUrlInputBase, PageCustomFieldsSchema, PostCustomFieldsSchema, PreviewTokenData, PreviewTokenPayload, Robots, RobotsRule, SITEMAP_BASE, SITEMAP_INDEX_SLUG, Seo, SeoHead, SeoSchema, SettingsService, Sitemap, SitemapIndex, SitemapList, SitemapUrl, SitemapUrlImage, SitemapUrlList, TagCustomFieldsSchema, WEB_MANIFEST_ROUTE, WP_Error, WordPressTransport, altcha, arkose, assertIntegrationEndpoints, assertIntegrationEnv, authMock, buildProcedure, buildWebManifest, buildWordPressRequest, combineDetailed, compare, consoleLog, createAuthAdapter, createCaptchaAdapter, createCookiesAdapter, createEventHandler, createGeoAdapter, createIntegration, createKizlo, createKizloClient, createLoggerAdapter, createManifestRoute, createMiddleware, createOrpcRouter, createProcedure, createResultClient, createSitemapRedirectRoute, createSitemapRoute, createThrowableErrorMap, createWebhookRouter, createWordPressClient, customFieldsSchema, defineErrorMap, defineFixture, deserializeCurrencyFormat, deserializeListMetadata, deserializeSeo, emptyList, friendlyCaptcha, generateContract, geoMock, geoVercelNext, handleUnexpectedError, hash, hcaptcha, hmac, integrationEnv, isContractProcedure, isKizloError, isLocalPlugin, isWordPressResourceError, mergeServiceAdapters, missingEndpoints, missingEnv, noopAdapter, parseIdentifier, parseSitemapSlug, readEnv, recaptcha, renderJsonLd, renderSitemapIndex, renderUrlSet, resolveIcons, resolveKizloConfig, resolveWordPressConnection, restoreContract, schemaType, serializeCurrencyFormat, sitemapEntryPath, sortIntegrations, toKizloError, turnstile, wordPressConnectionComplete, wpEndpoint, xmlResponse };

package/dist/integrations/astro/integration.js

@@ -1,3 +1,4 @@
+import { FRAMEWORK_INTEGRATION_ORDER } from "../../shared/constants.js";
 import { createIntegration } from "../../shared/integration.js";
 import { runtimeEnv } from "../runtime-env.js";
 
@@ -6,6 +7,7 @@ import { runtimeEnv } from "../runtime-env.js";
 function astro(options) {
 	return createIntegration({
 		id: "astro",
+		order: FRAMEWORK_INTEGRATION_ORDER,
 		env: runtimeEnv(options.env, "PUBLIC_KIZLO_BASE_URL")
 	});
 }

package/dist/integrations/nextjs/integration.js

@@ -1,3 +1,4 @@
+import { FRAMEWORK_INTEGRATION_ORDER } from "../../shared/constants.js";
 import { createIntegration } from "../../shared/integration.js";
 import { runtimeEnv } from "../runtime-env.js";
 import { nextRevalidation } from "./revalidate.js";
@@ -9,6 +10,7 @@ function nextjs(options = {}) {
 	const revalidation = options.revalidate;
 	return createIntegration({
 		id: "nextjs",
+		order: FRAMEWORK_INTEGRATION_ORDER,
 		env: runtimeEnv(source, "NEXT_PUBLIC_KIZLO_BASE_URL"),
 		events: revalidation === false ? void 0 : nextRevalidation(typeof revalidation === "object" ? revalidation : void 0).events
 	});

package/dist/integrations/node/integration.js

@@ -1,3 +1,4 @@
+import { FRAMEWORK_INTEGRATION_ORDER } from "../../shared/constants.js";
 import { createIntegration } from "../../shared/integration.js";
 import { runtimeEnv } from "../runtime-env.js";
 
@@ -6,6 +7,7 @@ import { runtimeEnv } from "../runtime-env.js";
 function node(options = {}) {
 	return createIntegration({
 		id: "node",
+		order: FRAMEWORK_INTEGRATION_ORDER,
 		env: runtimeEnv(options.env ?? process.env, "KIZLO_BASE_URL")
 	});
 }

package/dist/integrations/tanstack-start/integration.js

@@ -1,3 +1,4 @@
+import { FRAMEWORK_INTEGRATION_ORDER } from "../../shared/constants.js";
 import { createIntegration } from "../../shared/integration.js";
 import { runtimeEnv } from "../runtime-env.js";
 
@@ -6,6 +7,7 @@ import { runtimeEnv } from "../runtime-env.js";
 function tanstackStart(options = {}) {
 	return createIntegration({
 		id: "tanstack-start",
+		order: FRAMEWORK_INTEGRATION_ORDER,
 		env: runtimeEnv(options.env ?? process.env, "VITE_KIZLO_BASE_URL")
 	});
 }

package/dist/kizlo.js

@@ -8,7 +8,7 @@ import { isTypescriptObject } from "./shared/utils.js";
 import { Context } from "./context.js";
 import { CORE_PROCEDURES } from "./procedures.js";
 import { isContractGeneration } from "./shared/contract-generation.js";
-import { assertIntegrationEndpoints, assertIntegrationEnv, missingEnv, readEnv } from "./shared/integration.js";
+import { assertIntegrationEndpoints, assertIntegrationEnv, missingEnv, readEnv, sortIntegrations } from "./shared/integration.js";
 import { createWebhookRouter } from "./webhook/index.js";
 import { tryCatch } from "@kizlo/shared";
 import { ORPCError, createRouterClient } from "@orpc/server";
@@ -101,7 +101,7 @@ var Kizlo = class {
 		const reservedIds = new Set([...Object.keys(CORE_PROCEDURES), "webhooks"]);
 		const integrationIds = /* @__PURE__ */ new Set();
 		const generating = isContractGeneration();
-		for (const integration of this.config.integrations ?? []) {
+		for (const integration of sortIntegrations(this.config.integrations ?? [])) {
 			if (reservedIds.has(integration.id)) throw new KizloError("INTEGRATION_ID_CONFLICT", { message: `The integration id "${integration.id}" is reserved by Kizlo. Choose a different integration id.` });
 			if (integrationIds.has(integration.id)) throw new KizloError("INTEGRATION_ID_CONFLICT", { message: `The integration id "${integration.id}" is registered more than once. Give every integration a unique id.` });
 			integrationIds.add(integration.id);
@@ -130,9 +130,10 @@ const WORDPRESS_ENV_VALUES = new Set([
 * Kizlo's active WordPress connection from the canonical `mode` value.
 */
 function integrationEnv(integrations) {
+	const mounted = sortIntegrations(integrations);
 	const composed = (name) => {
 		let value;
-		for (const integration of integrations) {
+		for (const integration of mounted) {
 			if (!integration.env) continue;
 			const contribution = readEnv(integration.env, name);
 			if (contribution !== void 0) value = contribution;

package/dist/menu/utils.js

@@ -3,7 +3,7 @@ import { listed, stringifiedMetaRecord } from "@kizlo/shared";
 //#region src/menu/utils.ts
 function deserializeListMenuInput(input) {
 	const orderby = input?.orderby === "relevance" && !input?.search || input?.orderby === "include" && input?.include === void 0 || input?.orderby === "include_slugs" && input?.slug === void 0 ? void 0 : input?.orderby;
-	return {
+	return { query: {
 		after: input?.after,
 		before: input?.before,
 		exclude: listed(input?.exclude),
@@ -21,7 +21,7 @@ function deserializeListMenuInput(input) {
 		tax_relation: input?.taxRelation,
 		search_columns: input?.searchColumns,
 		status: ["publish"]
-	};
+	} };
 }
 /**
 * The `href` a headless frontend links to. WP builds a non-custom item's `url` as an absolute same-site

package/dist/package.js

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.20.2";
+var version = "0.22.0";
 
 //#endregion
 export { version };