kizlo 0.10.0 → 0.11.0

package/README.md

@@ -23,16 +23,16 @@ Kizlo is an open-source framework for building content-driven applications with
 
 ## Quick start
 
-Set up Kizlo in your project:
+Scaffold a new project with Kizlo already wired:
 
 ```bash
-npx kizlo@latest init
+npx kizlo@latest create
 ```
 
-Start the local WordPress stack:
+Or add Kizlo to an existing project:
 
 ```bash
-npx kizlo dev
+npx kizlo@latest init
 ```
 
 See the [docs](https://kizlo.io/docs) for the full guide.

package/dist/cli/commands/_setup.js

@@ -7,6 +7,7 @@ import { bootstrapDev } from "../wp/dev.js";
 import { removeProjectContainers } from "../wp/session.js";
 import { syncSiteSettings } from "../wp/settings.js";
 import { devStack } from "../wp/stack.js";
+import { isPluginVersionSupported, pluginUpdateMessage } from "@kizlo/shared";
 import z from "zod/v4";
 import path from "node:path";
 import fs from "node:fs";
@@ -80,7 +81,11 @@ function managedEnv(envKeys, conn) {
 	};
 }
 const requiredString = z.string().trim().min(1, "Required");
-const urlString = requiredString.pipe(z.url("Must be a valid URL (e.g. https://example.com)"));
+const urlString = requiredString.pipe(z.url({
+	protocol: /^https?$/,
+	hostname: /^(localhost|(\d{1,3}\.){3}\d{1,3}|([a-zA-Z0-9-]+\.)+[a-zA-Z]{2,})$/,
+	error: "Must be a valid http(s) URL with a real host (e.g. https://example.com)"
+}));
 const dirPath = requiredString.refine((value) => !value.endsWith(".ts"), "Enter a directory, not a file");
 function validate(schema) {
 	return (value) => {
@@ -382,7 +387,11 @@ async function syncRemote(conn) {
 		siteUrl: conn.siteUrl,
 		backendUrl: conn.baseUrl
 	});
-	if (!sync.ok) p.log.warn(`Could not sync the site settings to WordPress (${sync.error}) — make sure the kizlo plugin is active, then set them from the Kizlo settings.`);
+	if (!sync.ok) {
+		p.log.warn(`Could not sync the site settings to WordPress (${sync.error}) — make sure the kizlo plugin is active, then set them from the Kizlo settings.`);
+		return;
+	}
+	if (!isPluginVersionSupported(sync.pluginVersion)) p.log.warn(pluginUpdateMessage(sync.pluginVersion));
 }
 /** The "Next steps" lines. `kizlo dev` is the single entry point for development. */
 function nextStepsLines(conn, prefix = "") {

package/dist/cli/commands/create.js

@@ -1,7 +1,7 @@
 import { availablePackageManagers, detectInvokingPackageManager, ensureGitignored, frameworkCreateArgs, installArgs, runCommandAsync, runCommandCaptured } from "../utils.js";
 import { getPreset } from "../presets/index.js";
 import { fetchTemplate } from "../presets/source.js";
-import { adaptFile, changesFor, fileEntries, isExample, minCliError, patchEntries, readManifest, resolveDependencies } from "../presets/template.js";
+import { adaptFile, changesFor, fileEntries, minCliError, patchEntries, readManifest, resolveDependencies } from "../presets/template.js";
 import { collectConnectionInteractively, nextStepsLines, orCancel, pickAppPort, readEnvExample, resolveEnvKeys, setupLocalWordPress, syncRemote, validate, withApiPath, writeEnv } from "./_setup.js";
 import { applyLayoutPatches, buildScaffoldContext, kizloConfigTemplate, reportScaffold, scaffoldFile, writeGeneratedContract } from "./_wiring.js";
 import z from "zod/v4";
@@ -63,8 +63,8 @@ function bootstrapArgs(manifest, pm, name) {
 * Layer Kizlo's wiring onto a freshly bootstrapped app in `dir`, from an already-fetched template
 * directory + manifest. The framework CLI has produced the base project (package.json, config,
 * tsconfig, the root layout); this drives the manifest — the same engine `init` uses — to record the
-* `kizlo` dependency, write `kizlo.config.ts`, scaffold the manifest's files (the `base` plumbing and
-* the `create` layout/styles always, the `example`-flagged demo pages only when `includeExamples`),
+* `kizlo` dependency, write `kizlo.config.ts`, scaffold the manifest's files (core wiring from `base`
+* and `create` always, the `example`-flagged demo pages only when `includeExamples`),
 * seed the generated contract, and ignore `.env` and the `.kizlo/` working dir (which holds the local WordPress install). On a fresh app Kizlo owns the layout, so `create`
 * writes it whole (already SEO-wired) rather than patching — `applyLayoutPatches` runs over `create`'s
 * patches, which are none today. The target directory layout comes straight from the manifest's
@@ -80,7 +80,7 @@ async function applyManifestWiring(dir, templateDir, manifest, opts) {
 		clientUrl: void 0
 	});
 	recordDependencies(dir, manifest);
-	const changes = changesFor(manifest, "create").filter((change) => opts.includeExamples || !isExample(change));
+	const changes = changesFor(manifest, "create", { includeExamples: opts.includeExamples });
 	const files = [{
 		label: "Kizlo config",
 		relPath: "kizlo.config.ts",

package/dist/cli/commands/dev.js

@@ -1,4 +1,6 @@
 import { createStack, dockerHint, dockerStatus } from "../wp/docker.js";
+import { findConfigDir } from "../wp/utils.js";
+import { log } from "../daemon/logger.js";
 import { DEFAULT_ENV_KEYS, ensureGitignored, envGroups, groupDefault, mergeEnv, pickStackPort, withSpinner } from "../utils.js";
 import { resolveDevConfig, usesLocalWordPress } from "../daemon/config.js";
 import { bootstrapDev } from "../wp/dev.js";
@@ -6,6 +8,7 @@ import { reapOrphans, registerSession, removeProjectContainers, spawnWatchdog, u
 import { syncSiteSettings } from "../wp/settings.js";
 import { devStack } from "../wp/stack.js";
 import { palette } from "../banner.js";
+import { watchReload } from "../daemon/reload.js";
 import { startWatcher } from "../daemon/watch.js";
 import { join } from "node:path";
 import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
@@ -166,13 +169,13 @@ function armForegroundTeardown(cfg) {
 	}
 }
 /**
-* Boot local WordPress and run in the foreground until exit — the path behind bare
-* `kizlo dev`. Arms teardown first (so a mid-startup cancel still
-* stops partial containers), shows a timed spinner, prints the summary + stop hint, then
-* parks. A referenced timer holds the event loop open — an unresolved promise alone would
-* not, so without it Node would empty its loop and exit straight after printing.
+* Bring the dev stack's containers up for `cfg`: clear any stale containers, resolve the published
+* ports (stepping off a collision unless the port is pinned in config), write the compose files, and
+* note any port that moved. Returns `cfg` with the resolved ports — the shape the rest of the boot
+* and the teardown work against. Shared by the first boot and every reload reboot, so a changed
+* `dev.port` in `kizlo.config.ts` is re-resolved the same way each time.
 */
-async function startForeground(cfg) {
+async function prepareStack(cfg) {
 	await removeProjectContainers(cfg.project);
 	const port = await pickStackPort(cfg.port, {
 		fixed: cfg.portExplicit,
@@ -191,11 +194,17 @@ async function startForeground(cfg) {
 	createStack(devStack(ready));
 	if (port !== cfg.port) note(`Port ${cfg.port} is in use — serving on ${port} instead.`);
 	if (dbPort !== cfg.dbPort) note(`Database port ${cfg.dbPort} is in use — using ${dbPort} instead.`);
-	armForegroundTeardown(ready);
-	const start = Date.now();
-	const creds = await withSpinner("Starting local WordPress", () => bootstrapDev(ready));
+	return ready;
+}
+/**
+* After a boot, sync the fresh credentials (or the current LAN URL) into `.env` and the plugin, print
+* the connection summary, and print the timed ready line. `reloaded` swaps the wording and drops the
+* one-time Ctrl+C hint. `start` is when the boot began, so the timing spans the whole reboot including
+* the spinner. The `.env` writes here are why the caller pauses the reload watcher around a reboot.
+*/
+async function report(cfg, creds, reloaded, start) {
 	if (creds.appPassword) {
-		const env = updateWpEnv(ready, creds);
+		const env = updateWpEnv(cfg, creds);
 		note("Updated .env with the new WordPress credentials");
 		if (env) {
 			const sync = await syncSiteSettings({
@@ -209,34 +218,118 @@ async function startForeground(cfg) {
 			});
 			if (!sync.ok) note(`Could not sync the site settings to WordPress (${sync.error}) — make sure the kizlo plugin is active, then set them from the Kizlo settings.`);
 		}
-	} else if (syncLocalUrl(ready, creds.url)) note("Updated .env WordPress URL to the current network address — restart your app to pick it up");
+	} else if (syncLocalUrl(cfg, creds.url)) note("Updated .env WordPress URL to the current network address — restart your app to pick it up");
 	printSummary(creds);
 	const { green, dim, bold, reset } = palette();
 	const ms = Date.now() - start;
 	const took = ms < 1e3 ? `${ms}ms` : `${(ms / 1e3).toFixed(1)}s`;
-	process.stdout.write(`\n   ${dim}Press ${reset}${bold}Ctrl+C${reset}${dim} (or close the terminal) to stop local WordPress${reset}\n`);
-	process.stdout.write(`\n ${green}✓${reset} Ready in ${took}\n\n`);
-	const stopWatcher = await startWatcher(ready.configDir);
-	if (stopWatcher) process.on("exit", stopWatcher);
+	if (!reloaded) process.stdout.write(`\n   ${dim}Press ${reset}${bold}Ctrl+C${reset}${dim} (or close the terminal) to stop local WordPress${reset}\n`);
+	process.stdout.write(`\n ${green}✓${reset} ${reloaded ? "Reloaded" : "Ready"} in ${took}\n\n`);
+}
+/**
+* Boot local WordPress for an already-prepared `cfg` (ports resolved, teardown armed) behind a spinner,
+* then report. The first-boot path only — reboots go through {@link rebootStack}, which also folds the
+* prepare step under the spinner.
+*/
+async function bootAndReport(cfg) {
+	const start = Date.now();
+	await report(cfg, await withSpinner("Starting local WordPress", () => bootstrapDev(cfg)), false, start);
+}
+/**
+* Reboot the whole stack in place after a config/env change: re-resolve the config, recreate the
+* containers, and boot WordPress — all behind a single spinner labelled with the file that changed, so
+* there's no loaderless gap between detecting the change and the boot. Teardown is already armed from
+* the first boot, so this never re-arms. Returns the freshly resolved config (ports may have moved) so
+* the caller can re-target its watchers.
+*/
+async function rebootStack(cwd, label) {
+	const start = Date.now();
+	const { ready, creds } = await withSpinner(label, async () => {
+		const ready$1 = await prepareStack(await resolveDevConfig(cwd));
+		return {
+			ready: ready$1,
+			creds: await bootstrapDev(ready$1)
+		};
+	});
+	await report(ready, creds, true, start);
+	return ready;
+}
+/**
+* Boot local WordPress and run in the foreground until exit — the path behind bare `kizlo dev`. Arms
+* teardown first (so a mid-startup cancel still stops partial containers), boots and prints the
+* summary, then parks. While parked it watches `.env` and `kizlo.config.*`: a change reboots the whole
+* stack in place so a new port, connection, or fixture takes effect without rerunning the command. The
+* reboot runs in the same process — the watchdog and session keep watching this PID throughout — and is
+* guarded so the credential/URL writes it makes to `.env` don't trigger another reboot. A referenced
+* timer holds the event loop open — an unresolved promise alone would not, so without it Node would
+* empty its loop and exit straight after printing.
+*/
+async function startForeground(cfg) {
+	const cwd = process.cwd();
+	let ready = await prepareStack(cfg);
+	armForegroundTeardown(ready);
+	await bootAndReport(ready);
+	let stopContract = await startWatcher(ready.configDir);
+	let reloading = false;
+	const reload = async (changed) => {
+		if (reloading) return;
+		reloading = true;
+		try {
+			stopContract?.();
+			ready = await rebootStack(cwd, `${changed} changed — restarting the session`);
+			stopContract = await startWatcher(ready.configDir);
+		} catch (error) {
+			log.error("Failed to reload the dev session:", error);
+		} finally {
+			setTimeout(() => {
+				reloading = false;
+			}, 500);
+		}
+	};
+	const stopReload = watchReload(ready.configDir, (changed) => void reload(changed));
+	process.on("exit", () => {
+		stopContract?.();
+		stopReload();
+	});
 	setInterval(() => {}, 1 << 30);
 	await new Promise(() => {});
 }
 /**
 * Run the contract watcher in the foreground until exit — the path bare `kizlo dev` takes when local
 * WordPress isn't configured (a project pointing at its own WordPress). Generates once, then watches
-* the server files and regenerates on save. Returns immediately when another watcher already holds
-* the lock; otherwise the persistent watcher keeps the process alive on its own.
+* the server files and regenerates on save. It also watches `.env` and `kizlo.config.*` and restarts
+* the watcher on a change, so a new server dir or env value is picked up the same way the local path
+* reboots its stack. Returns immediately when another watcher already holds the lock; otherwise the
+* persistent watcher keeps the process alive on its own.
 */
 async function watchOnly(cwd) {
-	const stop = await startWatcher(cwd);
+	let stop = await startWatcher(cwd);
 	if (!stop) return;
-	process.on("exit", stop);
+	let reloading = false;
+	const reload = async () => {
+		if (reloading) return;
+		reloading = true;
+		try {
+			stop?.();
+			stop = await startWatcher(cwd);
+		} finally {
+			setTimeout(() => {
+				reloading = false;
+			}, 300);
+		}
+	};
+	const stopReload = watchReload(findConfigDir(cwd), () => void reload());
+	const shutdown = () => {
+		stop?.();
+		stopReload();
+	};
+	process.on("exit", shutdown);
 	for (const signal of [
 		"SIGINT",
 		"SIGTERM",
 		"SIGHUP"
 	]) process.on(signal, () => {
-		stop();
+		shutdown();
 		process.exit(0);
 	});
 }

package/dist/cli/commands/init.js

@@ -185,6 +185,10 @@ const init = defineCommand({
 			});
 			if (args.alias !== void 0) setup.alias = String(args.alias).trim();
 			setup.alias = aliasWithSlash(setup.alias);
+			const includeExamples = manifest && fetched ? yes ? true : orCancel(await p.confirm({
+				message: "Add example pages?",
+				initialValue: true
+			})) : false;
 			if (!hasKizlo) {
 				const spec = `kizlo@${manifest?.dependencies?.kizlo ?? `^${getVersion()}`}`;
 				const s = p.spinner();
@@ -217,7 +221,7 @@ const init = defineCommand({
 			}];
 			if (manifest && fetched) {
 				await alignDependencies(cwd, pm, pkg, manifest);
-				for (const entry of fileEntries(changesFor(manifest, "init"))) files.push(adaptFile(fetched.dir, entry, manifest.conventions, scaffold));
+				for (const entry of fileEntries(changesFor(manifest, "init", { includeExamples }))) files.push(adaptFile(fetched.dir, entry, manifest.conventions, scaffold));
 			} else if (preset.scaffolds) files.push(...preset.scaffolds(scaffold));
 			const scaffolded = [];
 			for (const file of files) scaffolded.push({

package/dist/cli/daemon/config.js

@@ -154,4 +154,4 @@ async function resolveDevConfig(cwd) {
 }
 
 //#endregion
-export { DEFAULT_DEV_DB_PORT, DEFAULT_DEV_PORT, resolveConfig, resolveDevConfig, resolveStackName, resolveTestConfig, usesLocalWordPress };
+export { CONFIG_FILES, DEFAULT_DEV_DB_PORT, DEFAULT_DEV_PORT, resolveConfig, resolveDevConfig, resolveStackName, resolveTestConfig, usesLocalWordPress };

package/dist/cli/daemon/logger.js

@@ -2,7 +2,7 @@ import { consola } from "consola";
 
 //#region src/cli/daemon/logger.ts
 /** Tagged logger for the daemon — every line is prefixed with `kizlo`. */
-const log = consola.withTag("kizlo");
+const log = consola;
 log.options.formatOptions.date = false;
 
 //#endregion

package/dist/cli/daemon/reload.js

@@ -0,0 +1,66 @@
+import { CONFIG_FILES } from "./config.js";
+import path from "node:path";
+import { readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { FSWatcher } from "chokidar";
+
+//#region src/cli/daemon/reload.ts
+/** Env files `loadEnvFiles` reads, in the same order — the runtime values a reload must pick up. */
+const ENV_FILES = [".env", ".env.local"];
+/** A combined hash of the watched files' contents; a missing file counts as empty. */
+function fingerprint(files) {
+	const hash = createHash("sha1");
+	for (const file of files) {
+		hash.update(file);
+		hash.update("\0");
+		try {
+			hash.update(readFileSync(file));
+		} catch {}
+		hash.update("\0");
+	}
+	return hash.digest("hex");
+}
+/**
+* Watch the project's `.env` files and `kizlo.config.*` and call `onReload` with the changed file's
+* basename when their *contents* change. `kizlo dev` uses this to restart its whole session — rebooting
+* local WordPress and regenerating the contract — so a changed port, connection, or fixture takes
+* effect without stopping and rerunning the command by hand. Debounced so an editor's multi-write save
+* fires once, and gated on a content hash so a no-op save (`touch`, or writing the file back unchanged)
+* is ignored rather than triggering a pointless reboot. Returns a synchronous `stop()` that closes the
+* watcher.
+*
+* `dev` rewrites `.env` itself while booting (fresh credentials, the current LAN URL); the caller
+* pauses its reload handler around a reboot so that self-write doesn't trigger another reload. The hash
+* is still refreshed for it here, so once the reboot settles the new content is the baseline and won't
+* re-fire.
+*/
+function watchReload(configDir, onReload) {
+	const files = [...ENV_FILES, ...CONFIG_FILES].map((name) => path.join(configDir, name));
+	const watcher = new FSWatcher({
+		persistent: true,
+		ignoreInitial: true
+	});
+	let last = fingerprint(files);
+	let timer;
+	const schedule = (changed) => {
+		clearTimeout(timer);
+		timer = setTimeout(() => {
+			const next = fingerprint(files);
+			if (next === last) return;
+			last = next;
+			onReload(path.basename(changed));
+		}, 300);
+	};
+	watcher.add(files);
+	watcher.on("all", (_event, changed) => schedule(changed));
+	let stopped = false;
+	return () => {
+		if (stopped) return;
+		stopped = true;
+		clearTimeout(timer);
+		watcher.close();
+	};
+}
+
+//#endregion
+export { watchReload };

package/dist/cli/daemon/watch.js

@@ -30,7 +30,6 @@ async function watch(cfg) {
 	});
 	const onChange = debounce(() => regenerate(cfg), 300);
 	watcher.add(path.resolve(cfg.cwd, cfg.serverDir));
-	watcher.on("ready", () => log.start("Watching for contract changes..."));
 	watcher.on("all", () => void onChange());
 	return watcher;
 }

package/dist/cli/presets/template.js

@@ -8,17 +8,25 @@ import fs from "node:fs";
 /**
 * The template's `template.json`. It is the single declaration of what Kizlo lays onto a project and
 * how — the same engine drives both `create` (onto a fresh app the framework CLI just bootstrapped)
-* and `init` (onto the user's existing project). Changes are grouped into three sections so a command
-* only ever applies what is safe for it:
+* and `init` (onto the user's existing project). Changes are grouped into three sections by the one
+* question that decides whether a command may safely apply them — *where is this safe to land?* — and
+* no command ever reads another command's section:
 *
-* - `base` — applied by both commands: the Kizlo plumbing (server entry, client, routes). Every
-*   change here must be safe on an existing project, so it is limited to files Kizlo owns, which
-*   never collide with the user's pages.
-* - `create` — applied only by `create`, onto a freshly bootstrapped app it may freely overwrite:
-*   the root layout (written whole, already SEO-wired) and its styles as core wiring, plus the demo
-*   pages flagged `example`, which are written only when the user asks for example pages.
-* - `init` — applied only by `init`, onto the user's existing project. The root-layout SEO wiring
-*   lands here as a `patch` so it merges into the layout the user already owns instead of replacing it.
+* - `base` — safe on any project: additive, Kizlo-owned paths that never collide with the user's own
+*   files (the server entry, client, routes, and additive demo pages like a new blog route). Applied
+*   by both commands.
+* - `create` — safe only on a freshly bootstrapped app `create` may freely overwrite: the files the
+*   framework CLI already scaffolded, like the root layout (written whole, SEO-wired) and the homepage
+*   showcase. Applied only by `create`, never `init` — overwriting these on a real project would
+*   clobber the user's work.
+* - `init` — the non-destructive counterpart for the user's existing project: the root-layout SEO
+*   wiring lands here as a `patch` that merges into the layout the user already owns.
+*
+* Cutting across all three is the orthogonal `example` flag: opt-in demo content, applied only when the
+* user answers yes to "Add example pages?". A cross-cutting example (e.g. a blog) files each of its
+* pieces in the section that matches its safety — the additive new route in `base`, the homepage
+* showcase that overwrites an app-owned file in `create` — so `init` picks up only the additive half and
+* never touches a file the user owns, while `create` gets the whole demo. See {@link changesFor}.
 *
 * Each section is a list of changes, every one a member of a small closed set — deliberately no
 * "patch an arbitrary source file" kind, so a dangerous strategy is unrepresentable:
@@ -162,12 +170,16 @@ function minCliError(manifest) {
 	return `This template needs the kizlo CLI >= ${manifest.minCli} (you have ${running}). Run \`npx kizlo@latest\` and try again.`;
 }
 /**
-* The changes a command applies: the shared `base` set plus the command's own section. `create` gets
-* `base + create` (plumbing plus the demo pages); `init` gets `base + init` (plumbing plus any
-* init-only surgical patches). `base` is applied first so a later section can override it.
+* The changes a command applies: the shared `base` set plus the command's own section (`base` first, so
+* a later section can override it). Section placement is the *safety* axis — `base` is additive and safe
+* on any project, `create`/`init` carry the fresh-app-vs-existing-project halves — while the `example`
+* flag is the orthogonal *opt-in* axis. Example changes are dropped unless `includeExamples`, so the same
+* call serves both "core wiring only" and "plus the demo pages", and each command only ever sees its own
+* section: init's opt-in examples are the additive ones in `base`, never create's homepage overwrite.
 */
-function changesFor(manifest, command) {
-	return [...manifest.base, ...manifest[command]];
+function changesFor(manifest, command, opts = {}) {
+	const changes = [...manifest.base, ...manifest[command]];
+	return opts.includeExamples ? changes : changes.filter((change) => !isExample(change));
 }
 /** The whole-file changes in a resolved change list. */
 function fileEntries(changes) {
@@ -177,7 +189,7 @@ function fileEntries(changes) {
 function patchEntries(changes) {
 	return changes.filter((change) => change.kind === "patch");
 }
-/** Whether a change is opt-in demo content — written by `create` only when example pages are requested. */
+/** Whether a change is opt-in demo content — applied only when example pages are requested. */
 function isExample(change) {
 	return change.kind === "file" && change.example === true;
 }
@@ -267,4 +279,4 @@ function rendersHtml(file) {
 }
 
 //#endregion
-export { adaptFile, changesFor, fileEntries, findRootLayout, isExample, isOlderVersion, minCliError, patchEntries, readManifest, resolveDependencies, resolvePatch };
+export { adaptFile, changesFor, fileEntries, findRootLayout, isOlderVersion, minCliError, patchEntries, readManifest, resolveDependencies, resolvePatch };

package/dist/cli/wp/settings.js

@@ -1,5 +1,6 @@
 import { WP_KIZLO_BASE } from "../../wordpress/constants.js";
 import { WordPressService } from "../../wordpress/service.js";
+import { PLUGIN_VERSION_HEADER } from "@kizlo/shared";
 
 //#region src/cli/wp/settings.ts
 /** Loopback hosts that, from inside the dev Docker stack, must be rewritten to reach the host. */
@@ -52,11 +53,16 @@ async function syncSiteSettings(credentials, settings) {
 		base: WP_KIZLO_BASE,
 		body
 	});
+	const pluginVersion = response.headers.get(PLUGIN_VERSION_HEADER);
 	if (response.error) return {
 		ok: false,
-		error: describeError(response.status, response.error)
+		error: describeError(response.status, response.error),
+		pluginVersion
+	};
+	return {
+		ok: true,
+		pluginVersion
 	};
-	return { ok: true };
 }
 /**
 * A short, log-friendly summary of a failed request. A transport failure has no HTTP status (`0`), so

package/dist/comment/schema.js

@@ -1,5 +1,5 @@
-import { ListMetadata, ListOrder, Media } from "../shared/schema.js";
-import { NumberLike, arrayable } from "@kizlo/shared";
+import { ListMetadata, ListOrder } from "../shared/schema.js";
+import { Media, NumberLike, arrayable } from "@kizlo/shared";
 import z from "zod/v4";
 
 //#region src/comment/schema.ts

package/dist/context.d.ts

@@ -60,6 +60,15 @@ declare class Context {
   private readonly settings;
   private readonly email;
   constructor(config: ContextConfig);
+  /**
+   * Warn when the WordPress plugin is older than {@link isPluginVersionSupported} allows, read from the
+   * `X-Kizlo-Version` header the plugin stamps on every response. A version mismatch is a serious
+   * contract break, so this fires on every WordPress response rather than once — the header rides
+   * responses the runtime already makes, so it costs no extra request. Emitted through `console.warn`
+   * rather than the logger adapter on purpose: the adapter is optional (it defaults to a no-op), and
+   * this is a setup problem every user must see regardless of whether they've wired up logging.
+   */
+  private warnIfPluginOutdated;
   createRestContext(request: Request): {
     headers: Headers;
     request: Request;

package/dist/context.js

@@ -5,7 +5,7 @@ import { CookiesStorage } from "./cookie.js";
 import { WordPressService } from "./wordpress/service.js";
 import { EmailService } from "./email/service.js";
 import { SettingsService } from "./settings/service.js";
-import { base64Decode, tryCatchSync } from "@kizlo/shared";
+import { PLUGIN_VERSION_HEADER, base64Decode, isPluginVersionSupported, pluginUpdateMessage, tryCatchSync } from "@kizlo/shared";
 import { serialize } from "cookie";
 
 //#region src/context.ts
@@ -17,11 +17,29 @@ var Context = class {
 	email;
 	constructor(config) {
 		this.config = config;
-		this.wordpress = new WordPressService(config);
+		this.wordpress = new WordPressService({
+			...config,
+			onResponse: (headers) => this.warnIfPluginOutdated(headers)
+		});
 		this.settings = new SettingsService(this.wordpress);
 		this.email = new EmailService(this.wordpress);
 		this.logger = this.createLogger();
 	}
+	/**
+	* Warn when the WordPress plugin is older than {@link isPluginVersionSupported} allows, read from the
+	* `X-Kizlo-Version` header the plugin stamps on every response. A version mismatch is a serious
+	* contract break, so this fires on every WordPress response rather than once — the header rides
+	* responses the runtime already makes, so it costs no extra request. Emitted through `console.warn`
+	* rather than the logger adapter on purpose: the adapter is optional (it defaults to a no-op), and
+	* this is a setup problem every user must see regardless of whether they've wired up logging.
+	*/
+	warnIfPluginOutdated(headers) {
+		const installed = headers.get(PLUGIN_VERSION_HEADER);
+		if (isPluginVersionSupported(installed)) return;
+		const inner = ` ${pluginUpdateMessage(installed)} `;
+		const border = "-".repeat(inner.length + 2);
+		console.warn(`\n\x1b[1m\x1b[33m${border}\n|${inner}|\n${border}\x1b[0m\n`);
+	}
 	createRestContext(request) {
 		const headers = new Headers();
 		return {

package/dist/index.d.ts

@@ -22,7 +22,7 @@ import "./wordpress/index.js";
 import { DevPluginSource, Fixture, FixtureCleanupFn, FixtureSeedFn, JsonValue, LocalPlugin, PluginSource, SeedContext, TestAdminUser, TestCredentials, TestUser, defineFixture, isLocalPlugin } from "./cli/wp/types.js";
 import { AuthAdapter, AuthGetUser, AuthUser, authMock, createAuthAdapter } from "./adapters/auth.js";
 import { CaptchaAdapter, altcha, arkose, createCaptchaAdapter, friendlyCaptcha, hcaptcha, recaptcha, turnstile } from "./adapters/captcha.js";
-import { CurrencyFormat, IdentifierInput, LIST_ORDER, ListMetadata, ListOrder, Media, PreviewTokenData, PreviewTokenPayload } from "./shared/schema.js";
+import { CurrencyFormat, IdentifierInput, LIST_ORDER, ListMetadata, ListOrder, PreviewTokenData, PreviewTokenPayload } from "./shared/schema.js";
 import { AnyContext, AnyNestedClient, CookiesAdapter, CookiesDeleteAll, CookiesGetAll, CookiesSetAll, HTTPMethod, List, MaybeOptionalOptions, RedirectInput, RedirectStatus } from "./shared/types.js";
 import { createCookiesAdapter } from "./adapters/cookies.js";
 import { ConnInfo, GeoAdapter, GeoGetConnInfo, createGeoAdapter, geoMock } from "./adapters/geo.js";
@@ -52,4 +52,4 @@ import { ShaAlgorithm, compare, hash, hmac } from "./shared/crypto.js";
 import { Identifier, parseIdentifier } from "./shared/identifier.js";
 import { createOrpcRouter } from "./shared/router.js";
 import { deserializeCurrencyFormat, deserializeListMetadata, emptyList, serializeCurrencyFormat } from "./shared/serialize.js";
-export { AnyContext, AnyEventSchema, AnyEvents, AnyExtension, AnyKizloConfig, AnyMiddleware, AnyNestedClient, AnyProcedure, AnyProcedureRouter, AuthAdapter, AuthGetUser, AuthUser, AuthUserFn, AuthorsSettings, AuthorsSettingsInput, BaseHandlerOptions, BrandSettings, BrandSettingsInput, CART_HASH_HEADER_KEY, COMMON_ERRORS, CONTENT_TYPES, CaptchaAdapter, CategoryService, CommentService, CommonErrorCode, CommonErrorLiteral, CommonErrorMap, ConnInfo, ConnInfoFn, ConsoleLogAdapterOptions, ContentType, Context, ContextConfig, Contract, ContractProcedure, CookiesAdapter, CookiesDeleteAll, CookiesGetAll, CookiesSetAll, CookiesStorage, CrawlingSettings, CrawlingSettingsInput, CreateKizloOptions, CreateSitemapRouteOptions, CurrencyFormat, DefinedErrorMapLike, DevPluginSource, Environment, ErrorDefinition, EventHandler, EventHandlerFn, Extension, ExtensionInitFn, ExtensionInitOptions, ExtensionInitResult, ExtractExtensionRouter, ExtractMiddlewareContextOutput, ExtractParams, ExtractProcedureByScope, Fixture, FixtureCleanupFn, FixtureSeedFn, GeoAdapter, GeoGetConnInfo, HTTPMethod, IconDescriptor, Identifier, IdentifierInput, IdentitySettings, IdentitySettingsInput, InferEventUnion, InferExtensionRouter, InferMiddlewares, InvocationScope, JsonValue, Kizlo, KizloClient, KizloClientConfig, KizloConfig, KizloConnect, KizloError, KizloErrorOptions, LIST_ORDER, List, ListMetadata, ListOrder, ListSitemapUrlInput, ListSitemapUrlInputBase, LocalPlugin, LogLevel, LogPayload, Logger, LoggerAdapter, ManifestIcon, MaybeOptionalOptions, Media, MenuItemService, MenuService, Middleware, MiddlewareHandler, MiddlewareNextFn, MiddlewareOptions, MiddlewareResult, OpenapiPart, OrganizationFounder, OrganizationSettings, OrganizationSettingsInput, PageService, PersonSettings, PersonSettingsInput, PluginSource, PostService, PostStatusDefinition, PostTypeSettings, PostTypeSettingsInput, PreviewTokenData, PreviewTokenPayload, Procedure, ProcedureContext, ProcedureErrors, ProcedureHandler, ProcedureOptions, ROUTER_MAP, RedirectInput, RedirectStatus, ResolveParamsPart, ResolvedIcons, ResolvedSchemaInput, ResolvedSchemaOutput, Robots, RobotsRule, RootRouter, RouterDepthTuple, RouterMap, S2SClient, SAFE_REQUEST_TIMEOUT, SITEMAP_BASE, SITEMAP_INDEX_SLUG, SchemaIO, SeedContext, Seo, SeoHead, SeoSchema, ServiceAdapters, Settings, SettingsService, ShaAlgorithm, SiteSettings, SiteSettingsInput, Sitemap, SitemapIndex, SitemapIndexEntry, SitemapList, SitemapRouteExtra, SitemapUrl, SitemapUrlImage, SitemapUrlList, SocialProfile, TaxonomySettings, TaxonomySettingsInput, TestAdminUser, TestCredentials, TestUser, ThrowableErrorFn, ThrowableErrorMap, UNEXPECTED_BODY_SNIPPET_LENGTH, UploadsSettings, UploadsSettingsInput, UserService, VerifyCaptchaFn, VerifyPreviewTokenFn, WC_CORE_BASE, WC_STORE_BASE, WEB_MANIFEST_ROUTE, WPK_RobotRule, WPK_Robots, WPK_Seo, WPK_Sitemap, WPK_SitemapContentType, WPK_SitemapIndex, WPK_SitemapUrl, WPK_SitemapUrlImage, WP_AUTH_HEADER_KEY, WP_AUTH_TYPE, WP_CATEGORY_ORDER_BYS, WP_CORE_BASE, WP_Category, WP_CategoryCreateErrorCode, WP_CategoryCreateInput, WP_CategoryDeleteErrorCode, WP_CategoryDeleteInput, WP_CategoryDeleteResponse, WP_CategoryLinks, WP_CategoryListErrorCode, WP_CategoryListInput, WP_CategoryOrderBy, WP_CategoryRetrieveErrorCode, WP_CategoryRetrieveInput, WP_CategoryTaxonomy, WP_CategoryUpdateErrorCode, WP_CategoryUpdateInput, WP_Comment, WP_CommentAvatarUrls, WP_CommentContent, WP_CommentContentInput, WP_CommentCreateErrorCode, WP_CommentCreateInput, WP_CommentDeleteErrorCode, WP_CommentDeleteInput, WP_CommentDeleteResponse, WP_CommentLinks, WP_CommentListErrorCode, WP_CommentListInput, WP_CommentOrderBy, WP_CommentRetrieveErrorCode, WP_CommentRetrieveInput, WP_CommentStatus, WP_CommentStatusFilter, WP_CommentStatusInput, WP_CommentType, WP_CommentUpdateErrorCode, WP_CommentUpdateInput, WP_CommonErrorCode, WP_Context, WP_CurrencyFormat, WP_Error, WP_ErrorData, WP_KIZLO_BASE, WP_Link, WP_List, WP_ListMetadata, WP_ListOrder, WP_MENU_ITEM_ORDER_BYES, WP_MENU_ITEM_TARGETS, WP_MENU_ITEM_TAX_RELATIONS, WP_Menu, WP_MenuCreateErrorCode, WP_MenuCreateInput, WP_MenuDeleteErrorCode, WP_MenuDeleteInput, WP_MenuDeleteResponse, WP_MenuItem, WP_MenuItemCreateErrorCode, WP_MenuItemCreateInput, WP_MenuItemDeleteErrorCode, WP_MenuItemDeleteInput, WP_MenuItemDeleteResponse, WP_MenuItemLinks, WP_MenuItemListErrorCode, WP_MenuItemListInput, WP_MenuItemOrderBy, WP_MenuItemRetrieveErrorCode, WP_MenuItemRetrieveInput, WP_MenuItemStatus, WP_MenuItemStatusFilter, WP_MenuItemTarget, WP_MenuItemTaxRelation, WP_MenuItemTitle, WP_MenuItemTitleInput, WP_MenuItemType, WP_MenuItemUpdateErrorCode, WP_MenuItemUpdateInput, WP_MenuLinks, WP_MenuListErrorCode, WP_MenuListInput, WP_MenuOrderBy, WP_MenuRetrieveErrorCode, WP_MenuRetrieveInput, WP_MenuUpdateErrorCode, WP_MenuUpdateInput, WP_PAGE_ORDER_BYES, WP_PAGE_STATUSES, WP_POST_FORMATS, WP_POST_ORDER_BYES, WP_POST_STATUSES, WP_POST_TAX_RELATIONS, WP_Page, WP_PageCommentStatus, WP_PageContent, WP_PageContentInput, WP_PageCreateErrorCode, WP_PageCreateInput, WP_PageDeleteErrorCode, WP_PageDeleteInput, WP_PageDeleteResponse, WP_PageExcerpt, WP_PageExcerptInput, WP_PageGuid, WP_PageLinks, WP_PageListErrorCode, WP_PageListInput, WP_PageOrderBy, WP_PageRetrieveErrorCode, WP_PageRetrieveInput, WP_PageStatus, WP_PageStatusFilter, WP_PageTitle, WP_PageTitleInput, WP_PageUpdateErrorCode, WP_PageUpdateInput, WP_Post, WP_PostCommentStatus, WP_PostContent, WP_PostContentInput, WP_PostCreateErrorCode, WP_PostCreateInput, WP_PostDeleteErrorCode, WP_PostDeleteInput, WP_PostDeleteResponse, WP_PostExcerpt, WP_PostExcerptInput, WP_PostFormat, WP_PostGuid, WP_PostLinks, WP_PostListErrorCode, WP_PostListInput, WP_PostOrderBy, WP_PostRetrieveErrorCode, WP_PostRetrieveInput, WP_PostStatus, WP_PostStatusFilter, WP_PostTaxRelation, WP_PostTitle, WP_PostTitleInput, WP_PostUpdateErrorCode, WP_PostUpdateInput, WP_RequestInput, WP_Result, WP_TAG_ORDER_BYS, WP_Tag, WP_TagCreateErrorCode, WP_TagCreateInput, WP_TagDeleteErrorCode, WP_TagDeleteInput, WP_TagDeleteResponse, WP_TagLinks, WP_TagListErrorCode, WP_TagListInput, WP_TagOrderBy, WP_TagRetrieveErrorCode, WP_TagRetrieveInput, WP_TagTaxonomy, WP_TagUpdateErrorCode, WP_TagUpdateInput, WP_User, WP_UserAvatarUrls, WP_UserCapabilities, WP_UserCreateErrorCode, WP_UserCreateInput, WP_UserDeleteErrorCode, WP_UserDeleteInput, WP_UserDeleteMeErrorCode, WP_UserDeleteMeInput, WP_UserDeleteMeResponse, WP_UserDeleteResponse, WP_UserLinks, WP_UserListErrorCode, WP_UserListInput, WP_UserOrderBy, WP_UserRetrieveErrorCode, WP_UserRetrieveInput, WP_UserRetrieveMeErrorCode, WP_UserRetrieveMeInput, WP_UserUpdateErrorCode, WP_UserUpdateInput, WP_UserUpdateMeErrorCode, WP_UserUpdateMeInput, WP_UserWho, WebManifest, WebhookOptions, WebhookSettings, WebhookSettingsInput, WithCommonErrorMap, WordPressCredentials, WordPressService, altcha, arkose, authMock, buildProcedure, buildWebManifest, combineDetailed, compare, consoleLog, createAuthAdapter, createCaptchaAdapter, createCookiesAdapter, createEventHandler, createExtension, createGeoAdapter, createKizlo, createKizloClient, createLoggerAdapter, createManifestRoute, createMiddleware, createOrpcRouter, createProcedure, createSitemapRedirectRoute, createSitemapRoute, createThrowableErrorMap, createWebhookRouter, defineErrorMap, defineFixture, deserializeCurrencyFormat, deserializeListMetadata, deserializeSeo, emptyList, friendlyCaptcha, generateContract, geoMock, geoVercelNext, handleUnexpectedError, hash, hcaptcha, hmac, isContractProcedure, isKizloError, isLocalPlugin, isWordPressResourceError, noopAdapter, parseIdentifier, parseSitemapSlug, recaptcha, renderSitemapIndex, renderUrlSet, resolveIcons, resolveKizloConfig, restoreContract, schemaType, serializeCurrencyFormat, sitemapEntryPath, toKizloError, turnstile, xmlResponse };
+export { AnyContext, AnyEventSchema, AnyEvents, AnyExtension, AnyKizloConfig, AnyMiddleware, AnyNestedClient, AnyProcedure, AnyProcedureRouter, AuthAdapter, AuthGetUser, AuthUser, AuthUserFn, AuthorsSettings, AuthorsSettingsInput, BaseHandlerOptions, BrandSettings, BrandSettingsInput, CART_HASH_HEADER_KEY, COMMON_ERRORS, CONTENT_TYPES, CaptchaAdapter, CategoryService, CommentService, CommonErrorCode, CommonErrorLiteral, CommonErrorMap, ConnInfo, ConnInfoFn, ConsoleLogAdapterOptions, ContentType, Context, ContextConfig, Contract, ContractProcedure, CookiesAdapter, CookiesDeleteAll, CookiesGetAll, CookiesSetAll, CookiesStorage, CrawlingSettings, CrawlingSettingsInput, CreateKizloOptions, CreateSitemapRouteOptions, CurrencyFormat, DefinedErrorMapLike, DevPluginSource, Environment, ErrorDefinition, EventHandler, EventHandlerFn, Extension, ExtensionInitFn, ExtensionInitOptions, ExtensionInitResult, ExtractExtensionRouter, ExtractMiddlewareContextOutput, ExtractParams, ExtractProcedureByScope, Fixture, FixtureCleanupFn, FixtureSeedFn, GeoAdapter, GeoGetConnInfo, HTTPMethod, IconDescriptor, Identifier, IdentifierInput, IdentitySettings, IdentitySettingsInput, InferEventUnion, InferExtensionRouter, InferMiddlewares, InvocationScope, JsonValue, Kizlo, KizloClient, KizloClientConfig, KizloConfig, KizloConnect, KizloError, KizloErrorOptions, LIST_ORDER, List, ListMetadata, ListOrder, ListSitemapUrlInput, ListSitemapUrlInputBase, LocalPlugin, LogLevel, LogPayload, Logger, LoggerAdapter, ManifestIcon, MaybeOptionalOptions, MenuItemService, MenuService, Middleware, MiddlewareHandler, MiddlewareNextFn, MiddlewareOptions, MiddlewareResult, OpenapiPart, OrganizationFounder, OrganizationSettings, OrganizationSettingsInput, PageService, PersonSettings, PersonSettingsInput, PluginSource, PostService, PostStatusDefinition, PostTypeSettings, PostTypeSettingsInput, PreviewTokenData, PreviewTokenPayload, Procedure, ProcedureContext, ProcedureErrors, ProcedureHandler, ProcedureOptions, ROUTER_MAP, RedirectInput, RedirectStatus, ResolveParamsPart, ResolvedIcons, ResolvedSchemaInput, ResolvedSchemaOutput, Robots, RobotsRule, RootRouter, RouterDepthTuple, RouterMap, S2SClient, SAFE_REQUEST_TIMEOUT, SITEMAP_BASE, SITEMAP_INDEX_SLUG, SchemaIO, SeedContext, Seo, SeoHead, SeoSchema, ServiceAdapters, Settings, SettingsService, ShaAlgorithm, SiteSettings, SiteSettingsInput, Sitemap, SitemapIndex, SitemapIndexEntry, SitemapList, SitemapRouteExtra, SitemapUrl, SitemapUrlImage, SitemapUrlList, SocialProfile, TaxonomySettings, TaxonomySettingsInput, TestAdminUser, TestCredentials, TestUser, ThrowableErrorFn, ThrowableErrorMap, UNEXPECTED_BODY_SNIPPET_LENGTH, UploadsSettings, UploadsSettingsInput, UserService, VerifyCaptchaFn, VerifyPreviewTokenFn, WC_CORE_BASE, WC_STORE_BASE, WEB_MANIFEST_ROUTE, WPK_RobotRule, WPK_Robots, WPK_Seo, WPK_Sitemap, WPK_SitemapContentType, WPK_SitemapIndex, WPK_SitemapUrl, WPK_SitemapUrlImage, WP_AUTH_HEADER_KEY, WP_AUTH_TYPE, WP_CATEGORY_ORDER_BYS, WP_CORE_BASE, WP_Category, WP_CategoryCreateErrorCode, WP_CategoryCreateInput, WP_CategoryDeleteErrorCode, WP_CategoryDeleteInput, WP_CategoryDeleteResponse, WP_CategoryLinks, WP_CategoryListErrorCode, WP_CategoryListInput, WP_CategoryOrderBy, WP_CategoryRetrieveErrorCode, WP_CategoryRetrieveInput, WP_CategoryTaxonomy, WP_CategoryUpdateErrorCode, WP_CategoryUpdateInput, WP_Comment, WP_CommentAvatarUrls, WP_CommentContent, WP_CommentContentInput, WP_CommentCreateErrorCode, WP_CommentCreateInput, WP_CommentDeleteErrorCode, WP_CommentDeleteInput, WP_CommentDeleteResponse, WP_CommentLinks, WP_CommentListErrorCode, WP_CommentListInput, WP_CommentOrderBy, WP_CommentRetrieveErrorCode, WP_CommentRetrieveInput, WP_CommentStatus, WP_CommentStatusFilter, WP_CommentStatusInput, WP_CommentType, WP_CommentUpdateErrorCode, WP_CommentUpdateInput, WP_CommonErrorCode, WP_Context, WP_CurrencyFormat, WP_Error, WP_ErrorData, WP_KIZLO_BASE, WP_Link, WP_List, WP_ListMetadata, WP_ListOrder, WP_MENU_ITEM_ORDER_BYES, WP_MENU_ITEM_TARGETS, WP_MENU_ITEM_TAX_RELATIONS, WP_Menu, WP_MenuCreateErrorCode, WP_MenuCreateInput, WP_MenuDeleteErrorCode, WP_MenuDeleteInput, WP_MenuDeleteResponse, WP_MenuItem, WP_MenuItemCreateErrorCode, WP_MenuItemCreateInput, WP_MenuItemDeleteErrorCode, WP_MenuItemDeleteInput, WP_MenuItemDeleteResponse, WP_MenuItemLinks, WP_MenuItemListErrorCode, WP_MenuItemListInput, WP_MenuItemOrderBy, WP_MenuItemRetrieveErrorCode, WP_MenuItemRetrieveInput, WP_MenuItemStatus, WP_MenuItemStatusFilter, WP_MenuItemTarget, WP_MenuItemTaxRelation, WP_MenuItemTitle, WP_MenuItemTitleInput, WP_MenuItemType, WP_MenuItemUpdateErrorCode, WP_MenuItemUpdateInput, WP_MenuLinks, WP_MenuListErrorCode, WP_MenuListInput, WP_MenuOrderBy, WP_MenuRetrieveErrorCode, WP_MenuRetrieveInput, WP_MenuUpdateErrorCode, WP_MenuUpdateInput, WP_PAGE_ORDER_BYES, WP_PAGE_STATUSES, WP_POST_FORMATS, WP_POST_ORDER_BYES, WP_POST_STATUSES, WP_POST_TAX_RELATIONS, WP_Page, WP_PageCommentStatus, WP_PageContent, WP_PageContentInput, WP_PageCreateErrorCode, WP_PageCreateInput, WP_PageDeleteErrorCode, WP_PageDeleteInput, WP_PageDeleteResponse, WP_PageExcerpt, WP_PageExcerptInput, WP_PageGuid, WP_PageLinks, WP_PageListErrorCode, WP_PageListInput, WP_PageOrderBy, WP_PageRetrieveErrorCode, WP_PageRetrieveInput, WP_PageStatus, WP_PageStatusFilter, WP_PageTitle, WP_PageTitleInput, WP_PageUpdateErrorCode, WP_PageUpdateInput, WP_Post, WP_PostCommentStatus, WP_PostContent, WP_PostContentInput, WP_PostCreateErrorCode, WP_PostCreateInput, WP_PostDeleteErrorCode, WP_PostDeleteInput, WP_PostDeleteResponse, WP_PostExcerpt, WP_PostExcerptInput, WP_PostFormat, WP_PostGuid, WP_PostLinks, WP_PostListErrorCode, WP_PostListInput, WP_PostOrderBy, WP_PostRetrieveErrorCode, WP_PostRetrieveInput, WP_PostStatus, WP_PostStatusFilter, WP_PostTaxRelation, WP_PostTitle, WP_PostTitleInput, WP_PostUpdateErrorCode, WP_PostUpdateInput, WP_RequestInput, WP_Result, WP_TAG_ORDER_BYS, WP_Tag, WP_TagCreateErrorCode, WP_TagCreateInput, WP_TagDeleteErrorCode, WP_TagDeleteInput, WP_TagDeleteResponse, WP_TagLinks, WP_TagListErrorCode, WP_TagListInput, WP_TagOrderBy, WP_TagRetrieveErrorCode, WP_TagRetrieveInput, WP_TagTaxonomy, WP_TagUpdateErrorCode, WP_TagUpdateInput, WP_User, WP_UserAvatarUrls, WP_UserCapabilities, WP_UserCreateErrorCode, WP_UserCreateInput, WP_UserDeleteErrorCode, WP_UserDeleteInput, WP_UserDeleteMeErrorCode, WP_UserDeleteMeInput, WP_UserDeleteMeResponse, WP_UserDeleteResponse, WP_UserLinks, WP_UserListErrorCode, WP_UserListInput, WP_UserOrderBy, WP_UserRetrieveErrorCode, WP_UserRetrieveInput, WP_UserRetrieveMeErrorCode, WP_UserRetrieveMeInput, WP_UserUpdateErrorCode, WP_UserUpdateInput, WP_UserUpdateMeErrorCode, WP_UserUpdateMeInput, WP_UserWho, WebManifest, WebhookOptions, WebhookSettings, WebhookSettingsInput, WithCommonErrorMap, WordPressCredentials, WordPressService, altcha, arkose, authMock, buildProcedure, buildWebManifest, combineDetailed, compare, consoleLog, createAuthAdapter, createCaptchaAdapter, createCookiesAdapter, createEventHandler, createExtension, createGeoAdapter, createKizlo, createKizloClient, createLoggerAdapter, createManifestRoute, createMiddleware, createOrpcRouter, createProcedure, createSitemapRedirectRoute, createSitemapRoute, createThrowableErrorMap, createWebhookRouter, defineErrorMap, defineFixture, deserializeCurrencyFormat, deserializeListMetadata, deserializeSeo, emptyList, friendlyCaptcha, generateContract, geoMock, geoVercelNext, handleUnexpectedError, hash, hcaptcha, hmac, isContractProcedure, isKizloError, isLocalPlugin, isWordPressResourceError, noopAdapter, parseIdentifier, parseSitemapSlug, recaptcha, renderSitemapIndex, renderUrlSet, resolveIcons, resolveKizloConfig, restoreContract, schemaType, serializeCurrencyFormat, sitemapEntryPath, toKizloError, turnstile, xmlResponse };

package/dist/index.js

@@ -12,7 +12,7 @@ import { COMMON_ERRORS, KizloError, createThrowableErrorMap, defineErrorMap, isK
 import { buildProcedure, combineDetailed, createProcedure, handleUnexpectedError, schemaType } from "./shared/procedure.js";
 import { createOrpcRouter } from "./shared/router.js";
 import { generateContract, isContractProcedure, restoreContract } from "./shared/contract.js";
-import { CurrencyFormat, IdentifierInput, LIST_ORDER, ListMetadata, ListOrder, Media, PreviewTokenData, PreviewTokenPayload } from "./shared/schema.js";
+import { CurrencyFormat, IdentifierInput, LIST_ORDER, ListMetadata, ListOrder, PreviewTokenData, PreviewTokenPayload } from "./shared/schema.js";
 import { KizloClient, createKizloClient } from "./client.js";
 import { CookiesStorage } from "./cookie.js";
 import { CART_HASH_HEADER_KEY, SAFE_REQUEST_TIMEOUT, UNEXPECTED_BODY_SNIPPET_LENGTH, WC_CORE_BASE, WC_STORE_BASE, WP_AUTH_HEADER_KEY, WP_AUTH_TYPE, WP_CORE_BASE, WP_KIZLO_BASE } from "./wordpress/constants.js";
@@ -44,4 +44,4 @@ import { SITEMAP_BASE, SITEMAP_INDEX_SLUG, createSitemapRedirectRoute, createSit
 import { createExtension } from "./shared/extension.js";
 import { createMiddleware } from "./shared/middleware.js";
 
-export { CART_HASH_HEADER_KEY, COMMON_ERRORS, CONTENT_TYPES, CategoryService, CommentService, ContentType, Context, CookiesStorage, CurrencyFormat, IdentifierInput, Kizlo, KizloClient, KizloError, LIST_ORDER, ListMetadata, ListOrder, ListSitemapUrlInput, ListSitemapUrlInputBase, Media, MenuItemService, MenuService, PageService, PostService, PreviewTokenData, PreviewTokenPayload, ROUTER_MAP, Robots, RobotsRule, SAFE_REQUEST_TIMEOUT, SITEMAP_BASE, SITEMAP_INDEX_SLUG, Seo, SeoHead, SeoSchema, SettingsService, Sitemap, SitemapIndex, SitemapList, SitemapUrl, SitemapUrlImage, SitemapUrlList, UNEXPECTED_BODY_SNIPPET_LENGTH, UserService, WC_CORE_BASE, WC_STORE_BASE, WEB_MANIFEST_ROUTE, WP_AUTH_HEADER_KEY, WP_AUTH_TYPE, WP_CATEGORY_ORDER_BYS, WP_CORE_BASE, WP_Error, WP_KIZLO_BASE, WP_MENU_ITEM_ORDER_BYES, WP_MENU_ITEM_TARGETS, WP_MENU_ITEM_TAX_RELATIONS, WP_PAGE_ORDER_BYES, WP_PAGE_STATUSES, WP_POST_FORMATS, WP_POST_ORDER_BYES, WP_POST_STATUSES, WP_POST_TAX_RELATIONS, WP_TAG_ORDER_BYS, WordPressService, altcha, arkose, authMock, buildProcedure, buildWebManifest, combineDetailed, compare, consoleLog, createAuthAdapter, createCaptchaAdapter, createCookiesAdapter, createEventHandler, createExtension, createGeoAdapter, createKizlo, createKizloClient, createLoggerAdapter, createManifestRoute, createMiddleware, createOrpcRouter, createProcedure, createSitemapRedirectRoute, createSitemapRoute, createThrowableErrorMap, createWebhookRouter, defineErrorMap, defineFixture, deserializeCurrencyFormat, deserializeListMetadata, deserializeSeo, emptyList, friendlyCaptcha, generateContract, geoMock, geoVercelNext, handleUnexpectedError, hash, hcaptcha, hmac, isContractProcedure, isKizloError, isLocalPlugin, isWordPressResourceError, noopAdapter, parseIdentifier, parseSitemapSlug, recaptcha, renderSitemapIndex, renderUrlSet, resolveIcons, resolveKizloConfig, restoreContract, schemaType, serializeCurrencyFormat, sitemapEntryPath, toKizloError, turnstile, xmlResponse };
+export { CART_HASH_HEADER_KEY, COMMON_ERRORS, CONTENT_TYPES, CategoryService, CommentService, ContentType, Context, CookiesStorage, CurrencyFormat, IdentifierInput, Kizlo, KizloClient, KizloError, LIST_ORDER, ListMetadata, ListOrder, ListSitemapUrlInput, ListSitemapUrlInputBase, MenuItemService, MenuService, PageService, PostService, PreviewTokenData, PreviewTokenPayload, ROUTER_MAP, Robots, RobotsRule, SAFE_REQUEST_TIMEOUT, SITEMAP_BASE, SITEMAP_INDEX_SLUG, Seo, SeoHead, SeoSchema, SettingsService, Sitemap, SitemapIndex, SitemapList, SitemapUrl, SitemapUrlImage, SitemapUrlList, UNEXPECTED_BODY_SNIPPET_LENGTH, UserService, WC_CORE_BASE, WC_STORE_BASE, WEB_MANIFEST_ROUTE, WP_AUTH_HEADER_KEY, WP_AUTH_TYPE, WP_CATEGORY_ORDER_BYS, WP_CORE_BASE, WP_Error, WP_KIZLO_BASE, WP_MENU_ITEM_ORDER_BYES, WP_MENU_ITEM_TARGETS, WP_MENU_ITEM_TAX_RELATIONS, WP_PAGE_ORDER_BYES, WP_PAGE_STATUSES, WP_POST_FORMATS, WP_POST_ORDER_BYES, WP_POST_STATUSES, WP_POST_TAX_RELATIONS, WP_TAG_ORDER_BYS, WordPressService, altcha, arkose, authMock, buildProcedure, buildWebManifest, combineDetailed, compare, consoleLog, createAuthAdapter, createCaptchaAdapter, createCookiesAdapter, createEventHandler, createExtension, createGeoAdapter, createKizlo, createKizloClient, createLoggerAdapter, createManifestRoute, createMiddleware, createOrpcRouter, createProcedure, createSitemapRedirectRoute, createSitemapRoute, createThrowableErrorMap, createWebhookRouter, defineErrorMap, defineFixture, deserializeCurrencyFormat, deserializeListMetadata, deserializeSeo, emptyList, friendlyCaptcha, generateContract, geoMock, geoVercelNext, handleUnexpectedError, hash, hcaptcha, hmac, isContractProcedure, isKizloError, isLocalPlugin, isWordPressResourceError, noopAdapter, parseIdentifier, parseSitemapSlug, recaptcha, renderSitemapIndex, renderUrlSet, resolveIcons, resolveKizloConfig, restoreContract, schemaType, serializeCurrencyFormat, sitemapEntryPath, toKizloError, turnstile, xmlResponse };

package/dist/package.js

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.10.0";
+var version = "0.11.0";
 
 //#endregion
 export { version };

package/dist/page/schema.js

@@ -1,7 +1,7 @@
-import { IdentifierInput, ListMetadata, ListOrder, Media } from "../shared/schema.js";
+import { IdentifierInput, ListMetadata, ListOrder } from "../shared/schema.js";
 import { WP_PAGE_ORDER_BYES, WP_PAGE_STATUSES } from "../wordpress/page/types.js";
 import { Seo } from "../seo/schema.js";
-import { Metadata, NumberLike, arrayable, lenient } from "@kizlo/shared";
+import { Media, Metadata, NumberLike, arrayable, lenient } from "@kizlo/shared";
 import z from "zod/v4";
 
 //#region src/page/schema.ts

package/dist/post/schema.js

@@ -1,7 +1,7 @@
-import { IdentifierInput, ListMetadata, ListOrder, Media } from "../shared/schema.js";
+import { IdentifierInput, ListMetadata, ListOrder } from "../shared/schema.js";
 import { WP_POST_FORMATS, WP_POST_ORDER_BYES, WP_POST_STATUSES, WP_POST_TAX_RELATIONS } from "../wordpress/post/types.js";
 import { Seo } from "../seo/schema.js";
-import { BooleanLike, Metadata, NumberLike, arrayable, lenient } from "@kizlo/shared";
+import { BooleanLike, Media, Metadata, NumberLike, arrayable, lenient } from "@kizlo/shared";
 import z from "zod/v4";
 
 //#region src/post/schema.ts

package/dist/shared/schema.d.ts

@@ -1,4 +1,3 @@
-import { Media } from "@kizlo/shared";
 import z from "zod/v4";
 
 //#region src/shared/schema.d.ts
@@ -46,4 +45,4 @@ declare const PreviewTokenData: z.ZodObject<{
 }, z.core.$strip>;
 type PreviewTokenData = z.infer<typeof PreviewTokenData>;
 //#endregion
-export { CurrencyFormat, IdentifierInput, LIST_ORDER, ListMetadata, ListOrder, Media, PreviewTokenData, PreviewTokenPayload };
+export { CurrencyFormat, IdentifierInput, LIST_ORDER, ListMetadata, ListOrder, PreviewTokenData, PreviewTokenPayload };

package/dist/shared/schema.js

@@ -1,4 +1,4 @@
-import { Media, NumberLike } from "@kizlo/shared";
+import { NumberLike } from "@kizlo/shared";
 import z from "zod/v4";
 
 //#region src/shared/schema.ts
@@ -34,4 +34,4 @@ const PreviewTokenData = z.object({
 });
 
 //#endregion
-export { CurrencyFormat, IdentifierInput, LIST_ORDER, ListMetadata, ListOrder, Media, PreviewTokenData, PreviewTokenPayload };
+export { CurrencyFormat, IdentifierInput, LIST_ORDER, ListMetadata, ListOrder, PreviewTokenData, PreviewTokenPayload };

package/dist/wordpress/service.d.ts

@@ -20,9 +20,13 @@ declare class WordPressService {
   private readonly siteBase;
   private readonly authHeader;
   private readonly defaultTimeout;
+  /** Called with the response headers of every non-transport-error response, so callers can observe
+   * per-response signals (e.g. the plugin version header) without threading them through every method. */
+  private readonly onResponse?;
   constructor(context: {
     credentials: WordPressCredentials;
     timeout?: Duration;
+    onResponse?: (headers: Headers) => void;
   });
   post<TData, TCode extends string = never>(path: string, input: {
     body?: unknown;

package/dist/wordpress/service.js

@@ -22,6 +22,9 @@ var WordPressService = class {
 	siteBase;
 	authHeader;
 	defaultTimeout;
+	/** Called with the response headers of every non-transport-error response, so callers can observe
+	* per-response signals (e.g. the plugin version header) without threading them through every method. */
+	onResponse;
 	constructor(context) {
 		const credentialBytes = new TextEncoder().encode(`${context.credentials.username}:${context.credentials.password}`);
 		let binary = "";
@@ -29,6 +32,7 @@ var WordPressService = class {
 		this.authHeader = `${WP_AUTH_TYPE} ${btoa(binary)}`;
 		this.siteBase = context.credentials.url.endsWith("/") ? context.credentials.url : `${context.credentials.url}/`;
 		this.defaultTimeout = context.timeout ?? SAFE_REQUEST_TIMEOUT;
+		this.onResponse = context.onResponse;
 	}
 	async post(path, input) {
 		return this.request({
@@ -103,6 +107,7 @@ var WordPressService = class {
 				message: transportErr.message
 			})
 		};
+		this.onResponse?.(response.headers);
 		const [readErr, text] = await tryCatch(response.text());
 		if (readErr) return {
 			data: null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kizlo",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "type": "module",
   "description": "A headless WordPress framework for TypeScript.",
   "keywords": [
@@ -76,7 +76,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.5.1",
-    "@kizlo/shared": "0.5.1",
+    "@kizlo/shared": "0.6.0",
     "@orpc/client": "^1.14.3",
     "@orpc/contract": "^1.14.3",
     "@orpc/openapi": "^1.14.3",