kizlo 0.21.0 → 0.22.1

package/dist/cli/mcp/server.js

@@ -1,5 +1,5 @@
 import { log } from "../daemon/logger.js";
-import { callRoute, describeRoute, listRoutes } from "./tools.js";
+import { callRoute, describeRoute, searchRoutes } from "./tools.js";
 import z from "zod/v4";
 import { createServer } from "node:http";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -38,21 +38,92 @@ function isAllowedOrigin(origin) {
 		return false;
 	}
 }
-/** Render a tool's answer as the MCP content block a client reads, failures included. */
-function toolContent(result) {
+/**
+* Render a tool's answer for both kinds of reader: `structuredContent` for a client that parses, and
+* a text block for one that does not.
+*
+* A failure carries no `structuredContent`. A client validates whatever it finds there against the
+* tool's declared output schema whether or not the result is an error, and a failure is not that
+* shape, so putting it there makes a client reject the answer outright instead of reading it. The
+* detail rides in a second text block, which keeps it machine-readable without breaking the contract.
+*/
+function toolContent(result, summarize = (value) => JSON.stringify(value, null, 2)) {
 	if (!result.ok) return {
 		content: [{
 			type: "text",
-			text: result.error
+			text: result.error.message
+		}, {
+			type: "text",
+			text: JSON.stringify(result.error, null, 2)
 		}],
 		isError: true
 	};
-	return { content: [{
-		type: "text",
-		text: JSON.stringify(result.value, null, 2)
-	}] };
+	return {
+		content: [{
+			type: "text",
+			text: summarize(result.value)
+		}],
+		structuredContent: result.value
+	};
 }
 /**
+* The one result long enough to be worth compressing. Describe and call put their payload in the
+* text block because the payload is the answer; a ranked list is better read than parsed.
+*/
+function summarizeSearch(value) {
+	const outcome = value;
+	if (outcome.count === 0) return outcome.message ?? "No route matches that search.";
+	const lines = outcome.routes.map((route) => {
+		const evidence = route.evidence.map((item) => `${item.field}:${item.term}`).join(", ");
+		const summary = route.summary === void 0 ? "" : ` — ${route.summary}`;
+		const deprecated = route.deprecated ? " (deprecated)" : "";
+		return `${route.name} — ${route.method} ${route.path}${summary}${deprecated}${evidence === "" ? "" : ` [${evidence}]`}`;
+	});
+	const more = outcome.nextCursor === void 0 ? "" : `\n${outcome.count - outcome.routes.length} more. Pass cursor "${outcome.nextCursor}" for the next page.`;
+	return `${outcome.count} route${outcome.count === 1 ? "" : "s"} match:\n${lines.join("\n")}${more}`;
+}
+/** A ranked result, and the named part of the contract that selected it. */
+const SEARCH_OUTPUT = {
+	count: z.number().describe("Matches across the whole catalog, not just this page."),
+	routes: z.array(z.object({
+		name: z.string(),
+		namespace: z.string(),
+		method: z.string(),
+		path: z.string(),
+		summary: z.string().optional(),
+		deprecated: z.literal(true).optional(),
+		evidence: z.array(z.object({
+			field: z.string(),
+			term: z.string()
+		}))
+	})),
+	namespaces: z.array(z.string()).describe("Every REST namespace this WordPress serves."),
+	nextCursor: z.string().optional().describe("Hand back as `cursor` to read the next page."),
+	message: z.string().optional().describe("Present only when nothing matched.")
+};
+const DESCRIBE_OUTPUT = {
+	name: z.string(),
+	namespace: z.string(),
+	method: z.string(),
+	path: z.string(),
+	summary: z.string().optional(),
+	description: z.string().optional(),
+	deprecated: z.literal(true).optional(),
+	pathParameters: z.array(z.string()),
+	input: z.record(z.string(), z.unknown()).describe("JSON Schema for `{ params, query, body }`, with its `$defs`."),
+	responses: z.record(z.string(), z.unknown()).describe("Keyed by HTTP status."),
+	errors: z.array(z.string()).describe("Error codes this route declares.")
+};
+/**
+* Deliberately permissive. The SDK validates `structuredContent` against this on every successful
+* call, so anything narrower would turn a route whose response does not fit into a protocol error
+* rather than an answer.
+*/
+const CALL_OUTPUT = {
+	status: z.number(),
+	data: z.unknown().optional()
+};
+/**
 * Three dispatchers rather than a tool per route. The contract a seeded WordPress serves runs to well
 * over a hundred routes, and putting their schemas in front of a model up front would cost tens of
 * thousands of tokens in every message. These cost a few hundred and reach all of them — and because
@@ -63,24 +134,44 @@ function createMcpServer(state) {
 	const server = new McpServer({
 		name: "kizlo",
 		version: "1.0.0"
-	}, { instructions: "Read and call the WordPress REST routes of the Kizlo project this server was started in." });
-	server.registerTool("kizlo_list_routes", {
-		title: "List WordPress routes",
-		description: "List every REST route this project's WordPress serves, with its method and summary. Start here: the route names it returns are what `kizlo_describe_route` and `kizlo_call` take.",
-		inputSchema: { namespace: z.string().optional().describe("Only routes in this REST namespace, e.g. \"wp/v2\" or \"kizlo/v1\".") }
-	}, async ({ namespace }) => toolContent(listRoutes(state, namespace === void 0 ? {} : { namespace })));
+	}, { instructions: [
+		"Read and change the WordPress of the Kizlo project this server was started in.",
+		"Every REST route that WordPress exposes is reachable here — core, Kizlo's own, and any plugin's — through three tools rather than one tool per route.",
+		"Work in that order: `kizlo_search_routes` to find a route, `kizlo_describe_route` to read its contract, `kizlo_call` to run it.",
+		"Describe a route before calling it unless you already know its contract. Arguments are grouped into `params`, `query`, and `body`, and the description says which fields belong where.",
+		"API errors are passed through unchanged: the code, message, and data are WordPress's own, not this server's summary of them."
+	].join(" ") });
+	server.registerTool("kizlo_search_routes", {
+		title: "Search WordPress routes",
+		description: "Find routes by identity or by meaning: a route name, path, or namespace, or terms from a route's arguments, response fields, description, or error codes. Start here. Omit `query` to browse the whole catalog. Each result names the evidence that selected it, and the route names it returns are what `kizlo_describe_route` and `kizlo_call` take.",
+		inputSchema: {
+			query: z.string().optional().describe("Terms to rank on. Omit or leave empty to browse every route."),
+			namespace: z.string().optional().describe("Only routes in this REST namespace, e.g. \"wp/v2\" or \"kizlo/v1\"."),
+			method: z.string().optional().describe("Only routes served with this HTTP method, e.g. \"GET\"."),
+			access: z.enum(["read", "write"]).optional().describe("Only reading routes (GET, HEAD, OPTIONS) or only writing ones."),
+			limit: z.number().int().optional().describe("Results per page. Defaults to 20, at most 100."),
+			cursor: z.string().optional().describe("The `nextCursor` from a previous search, to read the next page.")
+		},
+		outputSchema: SEARCH_OUTPUT
+	}, async (input) => toolContent(searchRoutes(state, input), summarizeSearch));
 	server.registerTool("kizlo_describe_route", {
 		title: "Describe a WordPress route",
-		description: "The JSON Schema for one route's arguments, plus which of them are interpolated into its path.",
-		inputSchema: { route: z.string().describe("A route name from `kizlo_list_routes`, e.g. `postTypes.book.list`.") }
+		description: "The complete contract for one route: the JSON Schema for its `params`, `query`, and `body`, with the definitions they reference; the response schema for each HTTP status, with content types and headers; which arguments are interpolated into the path; and the error codes the route declares.",
+		inputSchema: { route: z.string().describe("A route name from `kizlo_search_routes`, e.g. `kizlo.postTypes.book.list`.") },
+		outputSchema: DESCRIBE_OUTPUT
 	}, async ({ route }) => toolContent(describeRoute(state, { route })));
 	server.registerTool("kizlo_call", {
 		title: "Call a WordPress route",
-		description: "Run one route against this project's WordPress and return its response. Path parameters, query parameters, and body fields all go in `input`; `kizlo_describe_route` says which are which.",
+		description: "Run one route against this project's WordPress and return its response. Arguments go in `input` under the part they belong to: `params` for the values interpolated into the path, `query` for query parameters, and `body` for the payload. `kizlo_describe_route` says which are which.",
 		inputSchema: {
-			route: z.string().describe("A route name from `kizlo_list_routes`."),
-			input: z.record(z.string(), z.unknown()).optional().describe("The route's arguments, as described by `kizlo_describe_route`.")
-		}
+			route: z.string().describe("A route name from `kizlo_search_routes`."),
+			input: z.object({
+				params: z.record(z.string(), z.unknown()).optional().describe("Values interpolated into the path."),
+				query: z.record(z.string(), z.unknown()).optional().describe("Query parameters."),
+				body: z.unknown().optional().describe("The request payload.")
+			}).optional().describe("The route's arguments, grouped as `kizlo_describe_route` describes them.")
+		},
+		outputSchema: CALL_OUTPUT
 	}, async ({ route, input }) => toolContent(await callRoute(state, input === void 0 ? { route } : {
 		route,
 		input

package/dist/cli/mcp/tools.js

@@ -1,52 +1,54 @@
 import { buildWordPressRequest } from "../../wordpress/endpoint.js";
 import { WordPressTransport } from "../../wordpress/transport.js";
-import { routesOf, sortRoutes } from "./routes.js";
-import { toJsonSchema } from "./schema.js";
+import { routesOf } from "./routes.js";
+import { inputJsonSchema, toJsonSchema } from "./schema.js";
+import { searchRoutes } from "./search.js";
 
 //#region src/cli/mcp/tools.ts
 /** The document is fetched by the watcher, so the only reason it is missing is that none has arrived yet. */
 const NO_DOCUMENT = "The WordPress contract has not been fetched yet. Retry in a moment; `kizlo dev` refreshes it every few seconds.";
-/** Summaries only. The schemas behind these routes are far too large to put in front of a model at once. */
-function listRoutes(state, input = {}) {
-	if (!state.document) return {
+function failed(message) {
+	return {
 		ok: false,
-		error: NO_DOCUMENT
+		error: {
+			kind: "request",
+			message
+		}
 	};
-	const all = sortRoutes(routesOf(state.document).values());
-	const routes = input.namespace ? all.filter((route) => route.namespace === input.namespace) : all;
-	if (input.namespace && routes.length === 0) {
-		const known = [...new Set(all.map((route) => route.namespace))].sort();
+}
+/**
+* Rank the routes this WordPress serves against a query, or browse them all when there is none.
+*
+* Summaries and match evidence only. The schemas behind these routes are far too large to put in
+* front of a model at once, which is what `kizlo_describe_route` is for.
+*/
+function searchRoutes$1(state, input = {}) {
+	if (!state.document) return failed(NO_DOCUMENT);
+	const outcome = searchRoutes(state.document, input);
+	if (outcome.count === 0) {
+		const within = [
+			input.namespace !== void 0 ? `namespace "${input.namespace}"` : void 0,
+			input.method !== void 0 ? `method ${input.method.toUpperCase()}` : void 0,
+			input.access !== void 0 ? `${input.access} routes` : void 0
+		].filter((part) => part !== void 0).join(", ");
 		return {
-			ok: false,
-			error: `No routes in namespace "${input.namespace}". This WordPress serves: ${known.join(", ")}.`
+			ok: true,
+			value: {
+				...outcome,
+				message: `No route matches that search${within === "" ? "" : ` within ${within}`}. This WordPress serves these namespaces: ${outcome.namespaces.join(", ")}.`
+			}
 		};
 	}
 	return {
 		ok: true,
-		value: {
-			count: routes.length,
-			routes: routes.map((route) => ({
-				name: route.name,
-				namespace: route.namespace,
-				method: route.method,
-				path: route.path,
-				...route.summary !== void 0 ? { summary: route.summary } : {},
-				...route.deprecated ? { deprecated: true } : {}
-			}))
-		}
+		value: outcome
 	};
 }
-/** The full argument schema for one route, which is what a caller needs before it can build a call. */
+/** The full contract for one route, which is what a caller needs before it can build a call. */
 function describeRoute(state, input) {
-	if (!state.document) return {
-		ok: false,
-		error: NO_DOCUMENT
-	};
+	if (!state.document) return failed(NO_DOCUMENT);
 	const route = routesOf(state.document).get(input.route);
-	if (!route) return {
-		ok: false,
-		error: unknownRoute(input.route)
-	};
+	if (!route) return failed(unknownRoute(input.route));
 	return {
 		ok: true,
 		value: {
@@ -58,34 +60,36 @@ function describeRoute(state, input) {
 			...route.description !== void 0 ? { description: route.description } : {},
 			...route.deprecated ? { deprecated: true } : {},
 			pathParameters: route.definition.pathParameters,
-			input: toJsonSchema(route.operation.input, state.document)
+			input: inputJsonSchema(route.operation.input, state.document),
+			responses: responseSchemas(route.operation.responses, state.document),
+			errors: route.operation.errors
 		}
 	};
 }
 /** Run one route against the connected WordPress and hand back what it answered. */
 async function callRoute(state, input) {
-	if (!state.document) return {
-		ok: false,
-		error: NO_DOCUMENT
-	};
-	if (!state.credentials) return {
-		ok: false,
-		error: "No WordPress connection is configured, so nothing can be called. Check the connection settings in `.env`."
-	};
+	if (!state.document) return failed(NO_DOCUMENT);
+	if (!state.credentials) return failed("No WordPress connection is configured, so nothing can be called. Check the connection settings in `.env`.");
 	const route = routesOf(state.document).get(input.route);
-	if (!route) return {
-		ok: false,
-		error: unknownRoute(input.route)
-	};
+	if (!route) return failed(unknownRoute(input.route));
 	const built = buildWordPressRequest(route.definition, input.input ?? {});
-	if (built.error) return {
-		ok: false,
-		error: built.error.message
-	};
+	if (built.error) return failed(built.error.message);
 	const response = await new WordPressTransport({ credentials: state.credentials }).request(built.request);
 	if (response.error) return {
 		ok: false,
-		error: `${route.method} ${route.path} failed (${response.status || "no response"}): ${response.error.code} — ${response.error.message}`
+		error: {
+			kind: "response",
+			message: `${route.method} ${route.path} failed (${response.status || "no response"}): ${response.error.code} — ${response.error.message}`,
+			route: route.name,
+			method: route.method,
+			path: route.path,
+			status: response.status,
+			error: {
+				code: response.error.code,
+				message: response.error.message,
+				data: response.error.data
+			}
+		}
 	};
 	return {
 		ok: true,
@@ -95,9 +99,18 @@ async function callRoute(state, input) {
 		}
 	};
 }
+/** The response half of the contract, converted so a caller can read a success or a failure body. */
+function responseSchemas(responses, document) {
+	return Object.fromEntries(Object.entries(responses).map(([status, response]) => [status, {
+		...response.description !== void 0 ? { description: response.description } : {},
+		...response.content_type !== void 0 ? { content_type: response.content_type } : {},
+		...response.headers ? { headers: toJsonSchema(response.headers, document) } : {},
+		...response.body ? { body: toJsonSchema(response.body, document) } : {}
+	}]));
+}
 function unknownRoute(name) {
-	return `No route named "${name}" in this WordPress contract. Call \`kizlo_list_routes\` for the routes it serves.`;
+	return `No route named "${name}" in this WordPress contract. Call \`kizlo_search_routes\` for the routes it serves.`;
 }
 
 //#endregion
-export { callRoute, describeRoute, listRoutes };
+export { callRoute, describeRoute, searchRoutes$1 as searchRoutes };

package/dist/cli/wp/compose/docker-compose.test.ts

@@ -7,6 +7,7 @@ interface Service {
 	environment?: Record<string, string>
 	ports?: string[]
 	volumes?: string[]
+	healthcheck?: { test: string[] }
 }
 
 const wordpress = (): Service => parse(fs.readFileSync(COMPOSE_FILE, "utf8")).services.wordpress
@@ -41,6 +42,26 @@ describe("base compose wordpress service", () => {
 		expect(wordpress().ports).toContain("${WP_PORT:-8080}:80")
 	})
 
+	describe("healthcheck", () => {
+		const probe = (): string => wordpress().healthcheck?.test?.at(-1) ?? ""
+
+		test("requires the WordPress install wp-cli depends on", () => {
+			expect(probe()).toContain("test -f /var/www/html/wp-includes/version.php")
+		})
+
+		test("probes HTTP for liveness without asserting a successful status", () => {
+			expect(probe()).toContain("curl ")
+			expect(probe()).toContain("http://localhost/")
+			// `-f`/`--fail` turns any non-2xx into a probe failure, which is the bug being fixed:
+			// Headless Mode 404s pages by design, and a live server answering 404 is still live.
+			expect(probe().slice(probe().indexOf("curl "))).not.toMatch(/(?:^|\s)--?\S*f/)
+		})
+
+		test("references no WordPress application page, so a 404 from one can't fail it", () => {
+			expect(probe()).not.toMatch(/wp-login\.php|wp-admin|wp-json|feed|xmlrpc/)
+		})
+	})
+
 	test("mounts both local-only config assets read-only", () => {
 		const volumes = wordpress().volumes ?? []
 		expect(volumes).toContain("./uploads.ini:/usr/local/etc/php/conf.d/zz-kizlo-uploads.ini:ro")

package/dist/cli/wp/compose/docker-compose.yml

@@ -67,9 +67,14 @@ services:
       - ./uploads.ini:/usr/local/etc/php/conf.d/zz-kizlo-uploads.ini:ro
       - ./apache-listen.conf:/etc/apache2/conf-enabled/zz-kizlo-listen.conf:ro
     healthcheck:
-      # wp-login.php always returns 200 unauthenticated; /wp-json can be gated to 401
-      # by plugins, so it's not a reliable liveness probe.
-      test: ["CMD-SHELL", "curl -sf http://localhost/wp-login.php > /dev/null || exit 1"]
+      # Liveness, not a status assertion: the install is in place (what wp-cli needs before
+      # it can run anything) and the server answers HTTP at all. Deliberately status-agnostic,
+      # because Kizlo's own Headless Mode legitimately 404s the front page, the feeds and the
+      # login path. Requiring a 2xx from any WordPress page (`curl -f`) makes an install that is
+      # working as configured look dead, and every service gated on this one never starts.
+      # curl's own limit is a second under `timeout` below, so a server that accepts the connection
+      # and then stalls is reported by curl rather than killed by docker with nothing to show.
+      test: ["CMD-SHELL", "test -f /var/www/html/wp-includes/version.php && curl -s -o /dev/null -m 4 http://localhost/"]
       interval: 5s
       timeout: 5s
       retries: 60

package/dist/cli/wp/dev.js

@@ -32,6 +32,37 @@ function devUrl(port) {
 	return `http://${lanAddress() ?? "localhost"}:${port}`;
 }
 /**
+* Where the login screen actually lives, read from the raw `kizlo_settings_headless` option. Mirrors
+* the plugin's `HeadlessSettings::isLoginRenameActive()`: the master switch, the rename toggle and a
+* non-empty slug must all hold, so a half-configured feature still points at `/wp-admin`. Anything
+* unreadable (option unset, plugin absent, output not JSON) falls back the same way, which is what a
+* project that never touches the setting gets.
+*/
+function resolveAdminPath(option) {
+	if (!option) return "/wp-admin";
+	let settings;
+	try {
+		settings = JSON.parse(option);
+	} catch {
+		return "/wp-admin";
+	}
+	const slug = typeof settings?.login_slug === "string" ? settings.login_slug.trim() : "";
+	return settings?.enabled === true && settings.rename_login === true && slug !== "" ? `/${slug}` : "/wp-admin";
+}
+/** The Headless Mode option as wp-cli prints it; undefined when it's unset or wp-cli couldn't answer. */
+async function readHeadlessOption() {
+	try {
+		return await wpCli([
+			"option",
+			"get",
+			"kizlo_settings_headless",
+			"--format=json"
+		]);
+	} catch {
+		return;
+	}
+}
+/**
 * Seed `dev.fixtures` into freshly installed local WordPress, reusing the test seeding
 * primitives: seed the default subscriber so `ctx.userId` exists, then run each `seed`
 * over REST. Plugins are already active (`bootstrapDev` ensures them before seeding).
@@ -106,12 +137,14 @@ async function bootstrapDev(cfg) {
 	});
 	const seeded = !installed && cfg.fixtures.length ? await seedDevFixtures(cfg, url) : 0;
 	const appPassword = !installed ? await createAdminAppPassword("kizlo-dev") : void 0;
+	const adminPath = resolveAdminPath(await readHeadlessOption());
 	return {
 		url,
 		username: TEST_ADMIN.username,
 		dbPort: cfg.dbPort,
 		seeded,
 		appPassword,
+		adminPath,
 		adminPassword: !installed ? TEST_ADMIN.password : void 0
 	};
 }

package/dist/cli/wp/docker.js

@@ -90,6 +90,50 @@ async function stackStatus(project) {
 		return await dockerStatus() === "running" ? "unknown" : "stopped";
 	}
 }
+/**
+* How long `composeUp` waits for every service to report healthy. The `wordpress` probe's own
+* verdict lands anywhere from ~330s (a 30s start period, then 60 retries 5s apart) to ~630s when
+* every attempt burns its full 5s timeout, so this cap sits inside that range on purpose: a stack
+* that is still coming up is never cut off, while one that will never converge is reported at
+* roughly six minutes rather than eleven. Past the cap the error names each service's state at that
+* moment instead of the healthcheck's final verdict, which is the trade this bound accepts.
+*/
+const WAIT_TIMEOUT_SECONDS = 360;
+/** Cap on a healthcheck's reported output; docker keeps up to 4 KB per probe, far more than reads. */
+const PROBE_OUTPUT_LIMIT = 500;
+/**
+* Compose's per-resource progress chatter, which it writes to stderr even when the command works:
+* `Container x Created`, `Volume y Removed`. A failed `up --wait` buries its real message under a
+* dozen of these, so they are dropped and the lines that say what went wrong survive: `Container x
+* Error …`, `dependency failed to start: …`, a denied mount. An unrecognised verb just costs one
+* noise line, and anything carrying trailing text is kept, so this can only under-filter.
+*/
+const COMPOSE_PROGRESS_LINE = /^(?:Container|Network|Volume|Image)\s+\S+\s+(?:Creating|Created|Recreate|Recreated|Starting|Started|Stopping|Stopped|Removing|Removed|Waiting|Healthy|Running|Pulling|Pulled|Building|Built|Skipped)$/;
+/** Docker's own message for a failed command, with its progress chatter removed. */
+function dockerMessage(res) {
+	return (res.stderr || res.stdout).split("\n").map((line) => line.trim()).filter((line) => line !== "" && !COMPOSE_PROGRESS_LINE.test(line)).join("\n");
+}
+/**
+* Whether compose reports a container's healthcheck as passing, or as having none to report. The
+* field is empty for a service without a healthcheck and absent altogether on some compose builds,
+* and neither is a failure, so both read as healthy here.
+*/
+function isHealthy(health) {
+	return !health || health === "healthy";
+}
+/** Containers from `compose ps --format json`: one object per line, or a single array on older builds. */
+function parseComposePs(stdout) {
+	const trimmed = stdout.trim();
+	if (!trimmed) return [];
+	return (trimmed.startsWith("[") ? [trimmed] : trimmed.split("\n")).flatMap((chunk) => {
+		try {
+			const parsed = JSON.parse(chunk);
+			return Array.isArray(parsed) ? parsed : [parsed];
+		} catch {
+			return [];
+		}
+	});
+}
 function bind(stack) {
 	const base = [
 		"compose",
@@ -104,13 +148,68 @@ function bind(stack) {
 	};
 	const compose$1 = (args, opts) => run("docker", [...base, ...args], env, opts);
 	const composePull$1 = (services = []) => compose$1(["pull", ...services]);
+	/**
+	* The last line a container's healthcheck printed, as `exit <code>: <output>`. Undefined when
+	* the container declares no healthcheck, has not run one yet, or docker could not answer. In all
+	* of those the caller has nothing to add beyond the service's state.
+	*/
+	const lastProbe = async (container) => {
+		const res = await run("docker", [
+			"inspect",
+			"--format",
+			"{{json .State.Health}}",
+			container
+		], env);
+		if (res.code !== 0) return void 0;
+		let health;
+		try {
+			health = JSON.parse(res.stdout.trim());
+		} catch {
+			return;
+		}
+		const last = health?.Log?.at(-1);
+		if (!last) return void 0;
+		const output = (last.Output ?? "").trim().replace(/\s*\n\s*/g, " ").slice(0, PROBE_OUTPUT_LIMIT);
+		return output ? `exit ${last.ExitCode}: ${output}` : `exit ${last.ExitCode}`;
+	};
+	const describe = async (container) => {
+		const state = container.Health ? `${container.State} (${container.Health})` : container.State;
+		const probe = await lastProbe(container.Name);
+		return `  ${container.Service}: ${state}${probe ? `, healthcheck ${probe}` : ""}`;
+	};
+	/**
+	* Why the stack did not come up, in terms the user can act on: every service that isn't running
+	* and healthy, with the last thing its healthcheck reported. `compose up --wait` only says that
+	* waiting failed, and a probe failing quietly (a 404, a refused connection) leaves no trace in
+	* its stderr, so the container's own health log is the only place that answer exists.
+	*
+	* Never throws. This runs while a failure is already being reported, so a second fault here
+	* (docker gone, a health log shaped differently) must cost the explanation, not replace it.
+	*/
+	const diagnose = async () => {
+		try {
+			const failing = parseComposePs((await compose$1([
+				"ps",
+				"--all",
+				"--format",
+				"json"
+			])).stdout).filter((container) => container.State !== "running" || !isHealthy(container.Health));
+			return (await Promise.all(failing.map(describe))).join("\n");
+		} catch {
+			return "";
+		}
+	};
 	const composeUp$1 = async () => {
 		const res = await compose$1([
 			"up",
 			"-d",
-			"--wait"
+			"--wait",
+			"--wait-timeout",
+			String(WAIT_TIMEOUT_SECONDS)
 		]);
-		if (res.code !== 0) throw new Error(`docker compose up failed:\n${res.stderr}`);
+		if (res.code === 0) return;
+		const detail = [dockerMessage(res), await diagnose()].filter(Boolean).join("\n");
+		throw new Error(`docker compose up failed (waited up to ${WAIT_TIMEOUT_SECONDS}s for healthy services):\n${detail}`);
 	};
 	const composeDown$1 = async (opts) => {
 		const args = ["down"];

package/dist/comment/index.js

@@ -17,8 +17,8 @@ const COMMENT_PROCEDURES = {
 		output: Comment
 	}, async ({ context, errors, input }) => {
 		const response = await context.wordpress.comments.retrieve({
-			id: input.params.id,
-			password: input.query?.password
+			params: { id: input.params.id },
+			query: { password: input.query?.password }
 		});
 		if (response.error) switch (response.error.code) {
 			case "rest_comment_invalid_id":
@@ -63,7 +63,7 @@ const COMMENT_PROCEDURES = {
 			post: listed(input.query?.post),
 			search: input.query?.search
 		};
-		const response = await context.wordpress.comments.list(searchParams);
+		const response = await context.wordpress.comments.list({ query: searchParams });
 		if (response.error) switch (response.error.code) {
 			case "rest_cannot_read":
 			case "rest_cannot_read_post":
@@ -114,7 +114,7 @@ const COMMENT_PROCEDURES = {
 			author_url: input.body.authorUrl,
 			parent: input.body.parentId
 		};
-		const response = await context.wordpress.kizlo.comments.create(submission);
+		const response = await context.wordpress.kizlo.comments.create({ body: submission });
 		if (response.error) switch (response.error.code) {
 			case "require_name_email": throw errors.COMMENT_NAME_EMAIL_REQUIRED();
 			case "require_valid_email": throw errors.COMMENT_INVALID_EMAIL();

package/dist/email/service.js

@@ -5,7 +5,7 @@ var EmailService = class {
 		this.wordpress = wordpress;
 	}
 	async send(params) {
-		const { error } = await this.wordpress.email.send(params);
+		const { error } = await this.wordpress.kizlo.email.send({ body: params });
 		if (error) throw error;
 	}
 };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { WP_Error } from "./wordpress/error.js";
-import { ActiveWordPressClient, WP_CallOptions, WP_Client, WP_CommonErrorCode, WP_CurrencyFormat, WP_CustomFields, WP_CustomFieldsPath, WP_Endpoint, WP_EndpointData, WP_EndpointDefinition, WP_EndpointError, WP_EndpointInput, WP_EndpointPath, WP_EndpointResult, WP_ErrorData, WP_Failure, WP_List, WP_ListMetadata, WP_RequestBuild, WP_RequestContentType, WP_RequestInput, WP_RequestMethod, WP_ResponseContentType, WP_Result, WP_Success, WP_TransportFailure, WP_TypedHeaders, WordPressClientRegistry, WordPressCredentials, WordPressCustomFieldsRegistry, WordPressEndpointRegistry } from "./wordpress/types.js";
+import { ActiveWordPressClient, WP_CallOptions, WP_Client, WP_CommonErrorCode, WP_CurrencyFormat, WP_CustomFields, WP_CustomFieldsPath, WP_Endpoint, WP_EndpointData, WP_EndpointDefinition, WP_EndpointError, WP_EndpointInput, WP_EndpointPath, WP_EndpointResult, WP_ErrorData, WP_Failure, WP_List, WP_ListMetadata, WP_RequestBuild, WP_RequestContentType, WP_RequestInput, WP_RequestMethod, WP_RequestParts, WP_ResponseContentType, WP_Result, WP_Success, WP_TransportFailure, WP_TypedHeaders, WordPressClientRegistry, WordPressCredentials, WordPressCustomFieldsRegistry, WordPressEndpointRegistry } from "./wordpress/types.js";
 import { WordPressTransport, WordPressTransportOptions, WordPressTransportResult } from "./wordpress/transport.js";
 import { buildWordPressRequest, createWordPressClient, wpEndpoint } from "./wordpress/endpoint.js";
 import { isWordPressResourceError } from "./wordpress/utils.js";
@@ -43,4 +43,4 @@ import { ShaAlgorithm, compare, hash, hmac } from "./shared/crypto.js";
 import { Identifier, parseIdentifier } from "./shared/identifier.js";
 import { createOrpcRouter } from "./shared/router.js";
 import { deserializeCurrencyFormat, deserializeListMetadata, emptyList, serializeCurrencyFormat } from "./shared/serialize.js";
-export { ActiveWordPressClient, AnyContext, AnyEventSchema, AnyEvents, AnyIntegration, AnyKizloConfig, AnyMiddleware, AnyNestedClient, AnyProcedure, AnyProcedureTree, AuthAdapter, AuthGetSession, AuthUser, AuthorsSettings, AuthorsSettingsInput, BaseHandlerOptions, BrandSettings, BrandSettingsInput, COMMON_ERRORS, CONTENT_TYPES, CORE_PROCEDURES, CaptchaAdapter, type Category, type CategoryCustomFields, CategoryCustomFieldsSchema, CommonErrorCode, CommonErrorLiteral, CommonErrorMap, ConnInfo, ConnInfoFn, ConsoleLogAdapterOptions, ContentType, Context, ContextConfig, Contract, ContractProcedure, CookiesAdapter, CookiesDeleteAll, CookiesGetAll, CookiesSetAll, CookiesStorage, CoreProcedures, CrawlingSettings, CrawlingSettingsInput, CreateKizloOptions, CreateSitemapRouteOptions, CurrencyFormat, DefinedErrorMapLike, DevPluginSource, EnvReader, EnvRecord, EnvSource, ErrorDefinition, EventHandler, EventHandlerFn, ExtractIntegrationProcedures, ExtractMiddlewareContextOutput, ExtractParams, ExtractProcedureByScope, Fixture, FixtureCleanupFn, FixtureSeedFn, FixtureSettleFn, GeoAdapter, GeoGetConnInfo, HTTPMethod, HeadlessSettings, HeadlessSettingsInput, IconDescriptor, Identifier, IdentifierInput, IdentitySettings, IdentitySettingsInput, InferEventUnion, InferIntegrationProcedures, InferMiddlewares, InferProcedureData, InferProcedureError, InferProcedureInput, InferProcedureResult, Integration, IntegrationRequirements, InvocationScope, JsonValue, Kizlo, KizloClient, KizloClientConfig, KizloConfig, KizloEnv, KizloError, KizloErrorOptions, KizloErrorUnion, KizloResult, LIST_ORDER, List, ListMetadata, ListOrder, ListSitemapUrlInput, ListSitemapUrlInputBase, LocalPlugin, LogLevel, LogPayload, Logger, LoggerAdapter, ManifestIcon, MaybeCallerOptions, MaybeOptionalOptions, Middleware, MiddlewareHandler, MiddlewareNextFn, MiddlewareOptions, MiddlewareResult, OpenapiPart, OrganizationFounder, OrganizationSettings, OrganizationSettingsInput, type Page, type PageCustomFields, PageCustomFieldsSchema, PersonSettings, PersonSettingsInput, PluginSource, type Post, type PostCustomFields, PostCustomFieldsSchema, PostStatusDefinition, PostTypeSettings, PostTypeSettingsInput, PreviewTokenData, PreviewTokenPayload, Procedure, ProcedureContext, ProcedureErrors, ProcedureHandler, ProcedureMethod, ProcedureOptions, ProcedureTreeDepthTuple, RedirectInput, RedirectStatus, ResolveParamsPart, ResolvedIcons, ResolvedSchemaInput, ResolvedSchemaOutput, ResultClient, Robots, RobotsRule, RootProcedures, S2SClient, SITEMAP_BASE, SITEMAP_INDEX_SLUG, SchemaIO, SeedContext, Seo, SeoHead, SeoSchema, ServiceAdapters, SessionFn, Settings, SettingsService, SettleContext, ShaAlgorithm, SiteSettings, SiteSettingsInput, Sitemap, SitemapIndex, SitemapIndexEntry, SitemapList, SitemapRouteExtra, SitemapUrl, SitemapUrlImage, SitemapUrlList, SocialProfile, type Tag, type TagCustomFields, TagCustomFieldsSchema, TaxonomySettings, TaxonomySettingsInput, TestAdminUser, TestCredentials, TestUser, ThrowableErrorFn, ThrowableErrorMap, UploadsSettings, UploadsSettingsInput, VerifyCaptchaFn, VerifyPreviewTokenFn, WEB_MANIFEST_ROUTE, WPK_RobotRule, WPK_Robots, WPK_Seo, WPK_Sitemap, WPK_SitemapUrl, WPK_SitemapUrlImage, WP_CallOptions, WP_Client, WP_CommonErrorCode, WP_CurrencyFormat, WP_CustomFields, WP_CustomFieldsPath, WP_Endpoint, WP_EndpointData, WP_EndpointDefinition, WP_EndpointError, WP_EndpointInput, WP_EndpointPath, WP_EndpointResult, WP_Error, WP_ErrorData, WP_Failure, WP_List, WP_ListMetadata, WP_RequestBuild, WP_RequestContentType, WP_RequestInput, WP_RequestMethod, WP_ResponseContentType, WP_Result, WP_Success, WP_TransportFailure, WP_TypedHeaders, WebManifest, WebhookOptions, WebhookSettings, WebhookSettingsInput, WithCommonErrorMap, WordPressClientRegistry, WordPressCredentials, WordPressCustomFieldsRegistry, WordPressEndpointRegistry, WordPressEnv, WordPressTransport, WordPressTransportOptions, WordPressTransportResult, altcha, arkose, assertIntegrationEndpoints, assertIntegrationEnv, authMock, buildProcedure, buildWebManifest, buildWordPressRequest, combineDetailed, compare, consoleLog, createAuthAdapter, createCaptchaAdapter, createCookiesAdapter, createEventHandler, createGeoAdapter, createIntegration, createKizlo, createKizloClient, createLoggerAdapter, createManifestRoute, createMiddleware, createOrpcRouter, createProcedure, createResultClient, createSitemapRedirectRoute, createSitemapRoute, createThrowableErrorMap, createWebhookRouter, createWordPressClient, customFieldsSchema, defineErrorMap, defineFixture, deserializeCurrencyFormat, deserializeListMetadata, deserializeSeo, emptyList, friendlyCaptcha, generateContract, geoMock, geoVercelNext, handleUnexpectedError, hash, hcaptcha, hmac, integrationEnv, isContractProcedure, isKizloError, isLocalPlugin, isWordPressResourceError, mergeServiceAdapters, missingEndpoints, missingEnv, noopAdapter, parseIdentifier, parseSitemapSlug, readEnv, recaptcha, renderJsonLd, renderSitemapIndex, renderUrlSet, resolveIcons, resolveKizloConfig, resolveWordPressConnection, restoreContract, schemaType, serializeCurrencyFormat, sitemapEntryPath, sortIntegrations, toKizloError, turnstile, wordPressConnectionComplete, wpEndpoint, xmlResponse };
+export { ActiveWordPressClient, AnyContext, AnyEventSchema, AnyEvents, AnyIntegration, AnyKizloConfig, AnyMiddleware, AnyNestedClient, AnyProcedure, AnyProcedureTree, AuthAdapter, AuthGetSession, AuthUser, AuthorsSettings, AuthorsSettingsInput, BaseHandlerOptions, BrandSettings, BrandSettingsInput, COMMON_ERRORS, CONTENT_TYPES, CORE_PROCEDURES, CaptchaAdapter, type Category, type CategoryCustomFields, CategoryCustomFieldsSchema, CommonErrorCode, CommonErrorLiteral, CommonErrorMap, ConnInfo, ConnInfoFn, ConsoleLogAdapterOptions, ContentType, Context, ContextConfig, Contract, ContractProcedure, CookiesAdapter, CookiesDeleteAll, CookiesGetAll, CookiesSetAll, CookiesStorage, CoreProcedures, CrawlingSettings, CrawlingSettingsInput, CreateKizloOptions, CreateSitemapRouteOptions, CurrencyFormat, DefinedErrorMapLike, DevPluginSource, EnvReader, EnvRecord, EnvSource, ErrorDefinition, EventHandler, EventHandlerFn, ExtractIntegrationProcedures, ExtractMiddlewareContextOutput, ExtractParams, ExtractProcedureByScope, Fixture, FixtureCleanupFn, FixtureSeedFn, FixtureSettleFn, GeoAdapter, GeoGetConnInfo, HTTPMethod, HeadlessSettings, HeadlessSettingsInput, IconDescriptor, Identifier, IdentifierInput, IdentitySettings, IdentitySettingsInput, InferEventUnion, InferIntegrationProcedures, InferMiddlewares, InferProcedureData, InferProcedureError, InferProcedureInput, InferProcedureResult, Integration, IntegrationRequirements, InvocationScope, JsonValue, Kizlo, KizloClient, KizloClientConfig, KizloConfig, KizloEnv, KizloError, KizloErrorOptions, KizloErrorUnion, KizloResult, LIST_ORDER, List, ListMetadata, ListOrder, ListSitemapUrlInput, ListSitemapUrlInputBase, LocalPlugin, LogLevel, LogPayload, Logger, LoggerAdapter, ManifestIcon, MaybeCallerOptions, MaybeOptionalOptions, Middleware, MiddlewareHandler, MiddlewareNextFn, MiddlewareOptions, MiddlewareResult, OpenapiPart, OrganizationFounder, OrganizationSettings, OrganizationSettingsInput, type Page, type PageCustomFields, PageCustomFieldsSchema, PersonSettings, PersonSettingsInput, PluginSource, type Post, type PostCustomFields, PostCustomFieldsSchema, PostStatusDefinition, PostTypeSettings, PostTypeSettingsInput, PreviewTokenData, PreviewTokenPayload, Procedure, ProcedureContext, ProcedureErrors, ProcedureHandler, ProcedureMethod, ProcedureOptions, ProcedureTreeDepthTuple, RedirectInput, RedirectStatus, ResolveParamsPart, ResolvedIcons, ResolvedSchemaInput, ResolvedSchemaOutput, ResultClient, Robots, RobotsRule, RootProcedures, S2SClient, SITEMAP_BASE, SITEMAP_INDEX_SLUG, SchemaIO, SeedContext, Seo, SeoHead, SeoSchema, ServiceAdapters, SessionFn, Settings, SettingsService, SettleContext, ShaAlgorithm, SiteSettings, SiteSettingsInput, Sitemap, SitemapIndex, SitemapIndexEntry, SitemapList, SitemapRouteExtra, SitemapUrl, SitemapUrlImage, SitemapUrlList, SocialProfile, type Tag, type TagCustomFields, TagCustomFieldsSchema, TaxonomySettings, TaxonomySettingsInput, TestAdminUser, TestCredentials, TestUser, ThrowableErrorFn, ThrowableErrorMap, UploadsSettings, UploadsSettingsInput, VerifyCaptchaFn, VerifyPreviewTokenFn, WEB_MANIFEST_ROUTE, WPK_RobotRule, WPK_Robots, WPK_Seo, WPK_Sitemap, WPK_SitemapUrl, WPK_SitemapUrlImage, WP_CallOptions, WP_Client, WP_CommonErrorCode, WP_CurrencyFormat, WP_CustomFields, WP_CustomFieldsPath, WP_Endpoint, WP_EndpointData, WP_EndpointDefinition, WP_EndpointError, WP_EndpointInput, WP_EndpointPath, WP_EndpointResult, WP_Error, WP_ErrorData, WP_Failure, WP_List, WP_ListMetadata, WP_RequestBuild, WP_RequestContentType, WP_RequestInput, WP_RequestMethod, WP_RequestParts, WP_ResponseContentType, WP_Result, WP_Success, WP_TransportFailure, WP_TypedHeaders, WebManifest, WebhookOptions, WebhookSettings, WebhookSettingsInput, WithCommonErrorMap, WordPressClientRegistry, WordPressCredentials, WordPressCustomFieldsRegistry, WordPressEndpointRegistry, WordPressEnv, WordPressTransport, WordPressTransportOptions, WordPressTransportResult, altcha, arkose, assertIntegrationEndpoints, assertIntegrationEnv, authMock, buildProcedure, buildWebManifest, buildWordPressRequest, combineDetailed, compare, consoleLog, createAuthAdapter, createCaptchaAdapter, createCookiesAdapter, createEventHandler, createGeoAdapter, createIntegration, createKizlo, createKizloClient, createLoggerAdapter, createManifestRoute, createMiddleware, createOrpcRouter, createProcedure, createResultClient, createSitemapRedirectRoute, createSitemapRoute, createThrowableErrorMap, createWebhookRouter, createWordPressClient, customFieldsSchema, defineErrorMap, defineFixture, deserializeCurrencyFormat, deserializeListMetadata, deserializeSeo, emptyList, friendlyCaptcha, generateContract, geoMock, geoVercelNext, handleUnexpectedError, hash, hcaptcha, hmac, integrationEnv, isContractProcedure, isKizloError, isLocalPlugin, isWordPressResourceError, mergeServiceAdapters, missingEndpoints, missingEnv, noopAdapter, parseIdentifier, parseSitemapSlug, readEnv, recaptcha, renderJsonLd, renderSitemapIndex, renderUrlSet, resolveIcons, resolveKizloConfig, resolveWordPressConnection, restoreContract, schemaType, serializeCurrencyFormat, sitemapEntryPath, sortIntegrations, toKizloError, turnstile, wordPressConnectionComplete, wpEndpoint, xmlResponse };

package/dist/menu/utils.js

@@ -3,7 +3,7 @@ import { listed, stringifiedMetaRecord } from "@kizlo/shared";
 //#region src/menu/utils.ts
 function deserializeListMenuInput(input) {
 	const orderby = input?.orderby === "relevance" && !input?.search || input?.orderby === "include" && input?.include === void 0 || input?.orderby === "include_slugs" && input?.slug === void 0 ? void 0 : input?.orderby;
-	return {
+	return { query: {
 		after: input?.after,
 		before: input?.before,
 		exclude: listed(input?.exclude),
@@ -21,7 +21,7 @@ function deserializeListMenuInput(input) {
 		tax_relation: input?.taxRelation,
 		search_columns: input?.searchColumns,
 		status: ["publish"]
-	};
+	} };
 }
 /**
 * The `href` a headless frontend links to. WP builds a non-custom item's `url` as an absolute same-site