kizlo 0.2.1 → 0.3.0

package/dist/seo/sitemap.js

@@ -0,0 +1,64 @@
+import { parseSitemapSlug, renderSitemapIndex, renderUrlSet, xmlResponse } from "./utils.js";
+
+//#region src/seo/sitemap.ts
+/**
+* Every generated sitemap is served from `/sitemaps`: the index at `/sitemaps/index.xml`
+* and each collection page at `/sitemaps/{key}.xml` (later pages `-{n}`). The base is fixed
+* because the index `<loc>` entries (built by `sitemapEntryPath`) point at it, so the route
+* must be mounted there for the links to resolve. How the route is mounted is a
+* framework concern; this handler only cares about the trailing slug.
+*/
+const SITEMAP_BASE = "/sitemaps";
+/** Slug that serves the sitemap index (`/sitemaps/index.xml`) rather than a collection. */
+const SITEMAP_INDEX_SLUG = "index.xml";
+/**
+* Builds a Web `Request` -> `Response` handler that serves the sitemap index
+* (`/sitemaps/index.xml`) and every collection page, merging any `extra` sitemaps in.
+* Framework-agnostic: the slug is the last path segment of the request URL, so this runs
+* as-is on any web-standard server (Hono, a plain fetch handler, a Next route handler).
+* Mounting it at the right path is the caller's job; framework wrappers (e.g. the Next
+* integration) add mount assertions on top.
+*/
+function createSitemapRoute(client, options) {
+	const extra = options?.extra ?? [];
+	return async function GET(request) {
+		const url = new URL(request.url);
+		const slug = lastPathSegment(url);
+		if (!slug) return notFound();
+		if (slug === SITEMAP_INDEX_SLUG) {
+			const { data: data$1 } = await client.seo.sitemaps.index();
+			return xmlResponse(renderSitemapIndex([...data$1?.sitemaps ?? [], ...extra.map((item) => item.entry)], data$1?.origin ?? url.origin));
+		}
+		const parsed = parseSitemapSlug(slug);
+		if (!parsed) return notFound();
+		const custom = extra.find((item) => item.entry.key === parsed.key);
+		if (custom) {
+			if (parsed.page > custom.entry.pages) return notFound();
+			const { data: data$1 } = await client.seo.sitemaps.index();
+			return xmlResponse(renderUrlSet(await custom.urls(data$1?.origin ?? url.origin, parsed.page)));
+		}
+		const { data: sitemaps } = await client.seo.sitemaps.list();
+		if (!sitemaps) return notFound();
+		const entry = sitemaps.find((item) => item.key === parsed.key);
+		if (!entry || parsed.page > entry.pages) return notFound();
+		const { data } = await client.seo.urls(entry.type === "author" ? {
+			type: "author",
+			page: parsed.page
+		} : {
+			type: entry.type,
+			key: entry.key,
+			page: parsed.page
+		});
+		if (!data) return notFound();
+		return xmlResponse(renderUrlSet(data));
+	};
+}
+function lastPathSegment(url) {
+	return decodeURIComponent(url.pathname.split("/").filter(Boolean).pop() ?? "");
+}
+function notFound() {
+	return new Response("Not Found", { status: 404 });
+}
+
+//#endregion
+export { SITEMAP_BASE, SITEMAP_INDEX_SLUG, createSitemapRoute };

package/dist/seo/types.d.ts

@@ -62,6 +62,10 @@ interface WPK_Sitemap {
   pages: number;
   lastmod: string;
 }
+interface WPK_SitemapIndex {
+  origin: string;
+  sitemaps: WPK_Sitemap[];
+}
 interface WPK_SitemapUrlImage {
   loc: string;
   title: string;
@@ -77,4 +81,4 @@ interface WPK_ListSitemapUrlInput {
   page?: number;
 }
 //#endregion
-export { WPK_ListSitemapUrlInput, WPK_RobotRule, WPK_Robots, WPK_Seo, WPK_Sitemap, WPK_SitemapContentType, WPK_SitemapUrl, WPK_SitemapUrlImage };
+export { WPK_ListSitemapUrlInput, WPK_RobotRule, WPK_Robots, WPK_Seo, WPK_Sitemap, WPK_SitemapContentType, WPK_SitemapIndex, WPK_SitemapUrl, WPK_SitemapUrlImage };

package/dist/seo/utils.d.ts

@@ -0,0 +1,6 @@
+import { Sitemap } from "./schema.js";
+
+//#region src/seo/utils.d.ts
+type SitemapIndexEntry = Pick<Sitemap, "key" | "pages" | "lastmod">;
+//#endregion
+export { SitemapIndexEntry };

package/dist/seo/utils.js

@@ -39,6 +39,38 @@ function deserializeSeo(data) {
 		schema: data.schema
 	};
 }
+function sitemapEntryPath(key, page) {
+	return `/sitemaps/${key}${page > 1 ? `-${page}` : ""}.xml`;
+}
+function parseSitemapSlug(slug) {
+	const match = /^(.+?)(?:-(\d+))?\.xml$/.exec(slug);
+	if (!match) return null;
+	const [, key, rawPage] = match;
+	const page = rawPage ? Number(rawPage) : 1;
+	if (!key || !Number.isInteger(page) || page < 1) return null;
+	return {
+		key,
+		page
+	};
+}
+function escapeXml(value) {
+	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function renderSitemapIndex(sitemaps, origin) {
+	return `<?xml version="1.0" encoding="UTF-8"?>\n<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">\n${sitemaps.flatMap((sitemap) => Array.from({ length: sitemap.pages }, (_, index) => {
+		return `\t<sitemap>\n\t\t<loc>${escapeXml(`${origin}${sitemapEntryPath(sitemap.key, index + 1)}`)}</loc>\n\t\t<lastmod>${escapeXml(sitemap.lastmod)}</lastmod>\n\t</sitemap>`;
+	})).join("\n")}\n</sitemapindex>\n`;
+}
+function renderUrlSet(urls) {
+	return `<?xml version="1.0" encoding="UTF-8"?>\n<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:image="http://www.google.com/schemas/sitemap-image/1.1">\n${urls.map((url) => {
+		const images = url.images.map((image) => `\t\t<image:image>\n\t\t\t<image:loc>${escapeXml(image.loc)}</image:loc>\n\t\t</image:image>`).join("\n");
+		const imageBlock = images ? `\n${images}` : "";
+		return `\t<url>\n\t\t<loc>${escapeXml(url.loc)}</loc>\n\t\t<lastmod>${escapeXml(url.lastmod)}</lastmod>${imageBlock}\n\t</url>`;
+	}).join("\n")}\n</urlset>\n`;
+}
+function xmlResponse(body) {
+	return new Response(body, { headers: { "Content-Type": "application/xml; charset=utf-8" } });
+}
 
 //#endregion
-export { deserializeSeo };
+export { deserializeSeo, parseSitemapSlug, renderSitemapIndex, renderUrlSet, xmlResponse };

package/dist/settings/service.interface.d.ts

@@ -17,6 +17,7 @@ interface KizloSiteSettings {
   title_separator: string;
   fallback_image: KizloMedia | null;
   search_action_structure: string | null;
+  discourage_search_engines: boolean;
 }
 interface KizloPersonSettings {
   name: string;

package/dist/shared/crypto.d.ts

@@ -1,15 +1,18 @@
-import { BinaryLike } from "node:crypto";
-
 //#region src/shared/crypto.d.ts
-
+/** SHA family accepted by the Web Crypto API. */
+type ShaAlgorithm = "SHA-256" | "SHA-384" | "SHA-512";
 /**
  * Compares two strings in a timing-safe manner to prevent timing attacks.
  *
+ * Both inputs are hashed to fixed-length digests before comparison, so the
+ * check is constant-time regardless of input length and never throws on a
+ * length mismatch.
+ *
  * @param a - The first string to compare.
  * @param b - The second string to compare.
  * @returns `true` if the strings match, `false` otherwise.
  */
-declare function compare(a: string, b: string): boolean;
+declare function compare(a: string, b: string): Promise<boolean>;
 /**
  * Hashes a secret API key with SHA-256 for secure database storage.
  * Safe to use in place of bcrypt/argon2 because API keys are high-entropy
@@ -19,10 +22,10 @@ declare function compare(a: string, b: string): boolean;
  * @param key - The raw secret API key to hash.
  * @returns A SHA-256 hex string suitable for database storage.
  */
-declare function hash(key: string): string;
+declare function hash(key: string, algorithm?: ShaAlgorithm): Promise<string>;
 /**
- * Create hmac using node crypto lib.
+ * Create an HMAC hex digest using the Web Crypto API. Defaults to SHA-256.
  */
-declare function hmac(key: string, value: BinaryLike): string;
+declare function hmac(key: string, value: string, algorithm?: ShaAlgorithm): Promise<string>;
 //#endregion
-export { compare, hash, hmac };
+export { ShaAlgorithm, compare, hash, hmac };

package/dist/shared/crypto.js

@@ -1,15 +1,28 @@
-import { createHash, createHmac, timingSafeEqual } from "node:crypto";
-
 //#region src/shared/crypto.ts
+const encoder = new TextEncoder();
+function toHex(buffer) {
+	let hex = "";
+	for (const byte of new Uint8Array(buffer)) hex += byte.toString(16).padStart(2, "0");
+	return hex;
+}
 /**
 * Compares two strings in a timing-safe manner to prevent timing attacks.
 *
+* Both inputs are hashed to fixed-length digests before comparison, so the
+* check is constant-time regardless of input length and never throws on a
+* length mismatch.
+*
 * @param a - The first string to compare.
 * @param b - The second string to compare.
 * @returns `true` if the strings match, `false` otherwise.
 */
-function compare(a, b) {
-	return timingSafeEqual(Buffer.from(a), Buffer.from(b));
+async function compare(a, b) {
+	const [ha, hb] = await Promise.all([crypto.subtle.digest("SHA-256", encoder.encode(a)), crypto.subtle.digest("SHA-256", encoder.encode(b))]);
+	const va = new Uint8Array(ha);
+	const vb = new Uint8Array(hb);
+	let diff = 0;
+	for (let i = 0; i < va.length; i++) diff |= (va[i] ?? 0) ^ (vb[i] ?? 0);
+	return diff === 0;
 }
 /**
 * Hashes a secret API key with SHA-256 for secure database storage.
@@ -20,14 +33,18 @@ function compare(a, b) {
 * @param key - The raw secret API key to hash.
 * @returns A SHA-256 hex string suitable for database storage.
 */
-function hash(key) {
-	return createHash("sha256").update(key).digest("hex");
+async function hash(key, algorithm = "SHA-256") {
+	return toHex(await crypto.subtle.digest(algorithm, encoder.encode(key)));
 }
 /**
-* Create hmac using node crypto lib.
+* Create an HMAC hex digest using the Web Crypto API. Defaults to SHA-256.
 */
-function hmac(key, value) {
-	return createHmac("sha256", key).update(value).digest("hex");
+async function hmac(key, value, algorithm = "SHA-256") {
+	const cryptoKey = await crypto.subtle.importKey("raw", encoder.encode(key), {
+		name: "HMAC",
+		hash: algorithm
+	}, false, ["sign"]);
+	return toHex(await crypto.subtle.sign("HMAC", cryptoKey, encoder.encode(value)));
 }
 
 //#endregion

package/dist/shared/error.d.ts

@@ -1,4 +1,4 @@
-import { AnySchema, LiteralUnion, Metadata, SchemaInput, SchemaOutput } from "@kizlo/shared";
+import { LiteralUnion, Metadata, Schema, SchemaInput, SchemaOutput } from "@kizlo/shared";
 
 //#region src/shared/error.d.ts
 declare const COMMON_ERRORS: {
@@ -116,11 +116,11 @@ type ErrorDefinition = {
   /** Human-readable message. Overridable per throw via `errors.CODE({ message })`. */
   message?: string;
   /** Standard Schema for the error's `data` payload — validated and typed when you throw `errors.CODE({ data })`. */
-  data?: AnySchema;
+  data?: Schema;
 };
 declare function defineErrorMap<const T extends Partial<Record<CommonErrorLiteral, ErrorDefinition>>>(map: T): T;
 type DefinedErrorMapLike = Record<string, ErrorDefinition>;
-type ThrowableErrorFn<TCode extends string, T extends ErrorDefinition> = T["data"] extends AnySchema ? undefined extends SchemaInput<T["data"]> ? (options?: {
+type ThrowableErrorFn<TCode extends string, T extends ErrorDefinition> = T["data"] extends Schema ? undefined extends SchemaInput<T["data"]> ? (options?: {
   status?: number;
   message?: string;
   data?: SchemaInput<T["data"]>;

package/dist/shared/procedure.d.ts

@@ -2,7 +2,7 @@ import { DefinedErrorMapLike, ThrowableErrorMap, WithCommonErrorMap } from "./er
 import { ServerContext } from "../context.js";
 import { AnyMiddleware, InferUses, Middleware } from "./middleware.js";
 import * as _orpc_contract0 from "@orpc/contract";
-import { AnySchema, DeepMerge, Pathname, Prettify, Promisify, Schema, SchemaInput, SchemaOutput } from "@kizlo/shared";
+import { DeepMerge, Pathname, Prettify, Promisify, Schema, SchemaInput, SchemaOutput } from "@kizlo/shared";
 import * as _orpc_server0 from "@orpc/server";
 import { HTTPMethod } from "@orpc/server";
 import { JsonifiedValue } from "@orpc/openapi-client";
@@ -33,25 +33,25 @@ interface Procedure<TScope extends InvocationScope, TInput, TOutput, TError exte
     options: {
       scope: TScope;
       errors?: TError;
-      output: AnySchema;
+      output: Schema;
       inputValidation?: boolean;
       outputValidation?: boolean;
       middlewares?: AnyMiddleware[];
     } & ({
       scope: "internal";
-      input?: AnySchema;
+      input?: Schema;
     } | {
       scope: "remote";
-      input?: AnySchema;
+      input?: Schema;
       method?: HTTPMethod;
     } | {
       scope: "api";
       method?: HTTPMethod;
       path?: Pathname;
-      body?: AnySchema;
-      query?: AnySchema;
-      params?: AnySchema;
-      headers?: AnySchema;
+      body?: Schema;
+      query?: Schema;
+      params?: Schema;
+      headers?: Schema;
     });
   };
 }
@@ -112,9 +112,9 @@ type ProcedureOptions<TScope extends InvocationScope, TPathname extends Pathname
   input?: TInput;
 });
 declare function createProcedure<TScope extends InvocationScope, TPathname extends Pathname, TInput extends Schema | undefined = undefined, TBody extends Schema | undefined = undefined, TParams extends Schema | undefined = undefined, TQuery extends Schema | undefined = undefined, THeaders extends Schema | undefined = undefined, TOutput extends Schema = Schema, TError extends DefinedErrorMapLike = DefinedErrorMapLike, TMiddlewares extends Middleware<ResolvedSchemaOutput<TScope, TPathname, TInput, TBody, TParams, TQuery, THeaders>, SchemaOutput<TOutput>, TError>[] = Middleware<ResolvedSchemaOutput<TScope, TPathname, TInput, TBody, TParams, TQuery, THeaders>, SchemaOutput<TOutput>, TError>[], TContext extends ProcedureContext<TMiddlewares> = ProcedureContext<TMiddlewares>>(options: ProcedureOptions<TScope, TPathname, TInput, TBody, TParams, TQuery, THeaders, TOutput, TError, TMiddlewares>, handler: ProcedureHandler<ResolvedSchemaOutput<TScope, TPathname, TInput, TBody, TParams, TQuery, THeaders>, SchemaOutput<TOutput>, TError, TContext>): Procedure<TScope, ResolvedSchemaInput<TScope, TPathname, TInput, TBody, TParams, TQuery, THeaders>, TScope extends "api" ? JsonifiedValue<SchemaOutput<TOutput>> : SchemaOutput<TOutput>, TError>;
-declare function schemaType<TInput, TOutput = TInput>(schema?: AnySchema): Schema<TInput, TOutput>;
+declare function schemaType<TInput, TOutput = TInput>(schema?: Schema): Schema<TInput, TOutput>;
 declare function buildProcedure(procedure: AnyProcedure): _orpc_server0.DecoratedProcedure<_orpc_server0.Context & Record<never, never>, _orpc_server0.Context, _orpc_contract0.Schema<unknown, unknown>, _orpc_contract0.Schema<any, any>, Record<never, never>, Record<never, never>>;
 declare function handleUnexpectedError(error: unknown, errors?: DefinedErrorMapLike): never;
-declare function combineDetailed(parts: Record<string, AnySchema>): AnySchema;
+declare function combineDetailed(parts: Record<string, Schema>): Schema;
 //#endregion
 export { AnyProcedure, AnyProcedureRouter, BaseHandlerOptions, ExtractParams, ExtractProcedureByScope, InvocationScope, OpenapiPart, Procedure, ProcedureContext, ProcedureErrors, ProcedureHandler, ProcedureOptions, ResolveParamsPart, ResolvedSchemaInput, ResolvedSchemaOutput, RouterDepthTuple, SchemaIO, buildProcedure, combineDetailed, createProcedure, handleUnexpectedError, schemaType };

package/dist/webhook/schema.d.ts

@@ -12,6 +12,7 @@ declare const KizloEvent: z.ZodUnion<readonly [z.ZodObject<{
   data: z.ZodObject<{
     post_id: z.ZodNumber;
     post_type: z.ZodString;
+    url: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>;
 }, z.core.$strip>, z.ZodObject<{
   type: z.ZodEnum<{
@@ -24,15 +25,7 @@ declare const KizloEvent: z.ZodUnion<readonly [z.ZodObject<{
     taxonomy: z.ZodString;
     post_types: z.ZodArray<z.ZodString>;
     count: z.ZodNumber;
-  }, z.core.$strip>;
-}, z.core.$strip>, z.ZodObject<{
-  type: z.ZodEnum<{
-    "payment.status_requested": "payment.status_requested";
-  }>;
-  data: z.ZodObject<{
-    transaction_id: z.ZodNullable<z.ZodString>;
-    payment_method_id: z.ZodString;
-    payment_session_id: z.ZodString;
+    url: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>;
 }, z.core.$strip>, z.ZodObject<{
   type: z.ZodEnum<{

package/dist/webhook/schema.js

@@ -14,20 +14,18 @@ const POST_EVENT_TYPES = [
 	"post.deleted"
 ];
 const PostEventType = z.enum(POST_EVENT_TYPES);
-const PAYMENT_EVENT_TYPES = ["payment.status_requested"];
-const PaymentEventType = z.enum(PAYMENT_EVENT_TYPES);
 const SETTINGS_EVENT_TYPES = ["settings.saved"];
 const SettingsEventType = z.enum(SETTINGS_EVENT_TYPES);
 const EVENT_TYPES = [
 	...TERM_EVENT_TYPES,
 	...POST_EVENT_TYPES,
-	...PAYMENT_EVENT_TYPES,
 	...SETTINGS_EVENT_TYPES
 ];
 const EventType = z.enum(EVENT_TYPES);
 const PostEventData = z.object({
 	post_id: z.number(),
-	post_type: z.string()
+	post_type: z.string(),
+	url: z.string().optional()
 });
 const PostEvent = z.object({
 	type: PostEventType,
@@ -37,21 +35,13 @@ const TermEventData = z.object({
 	term_id: z.number(),
 	taxonomy: z.string(),
 	post_types: z.array(z.string()),
-	count: z.number().nonnegative()
+	count: z.number().nonnegative(),
+	url: z.string().optional()
 });
 const TermEvent = z.object({
 	type: TermEventType,
 	data: TermEventData
 });
-const PaymentEventData = z.object({
-	transaction_id: z.nullable(z.string()),
-	payment_method_id: z.string(),
-	payment_session_id: z.string()
-});
-const PaymentEvent = z.object({
-	type: PaymentEventType,
-	data: PaymentEventData
-});
 const SettingsEventData = z.null();
 const SettingsEvent = z.object({
 	type: SettingsEventType,
@@ -60,7 +50,6 @@ const SettingsEvent = z.object({
 const KizloEvent = z.union([
 	PostEvent,
 	TermEvent,
-	PaymentEvent,
 	SettingsEvent
 ]);
 const AnyEvent = z.object({
@@ -69,4 +58,4 @@ const AnyEvent = z.object({
 });
 
 //#endregion
-export { AnyEvent, KizloEvent };
+export { AnyEvent, KizloEvent, POST_EVENT_TYPES, TERM_EVENT_TYPES };

package/dist/wordpress/service.js

@@ -17,7 +17,10 @@ var WordPressService = class {
 	authHeader;
 	defaultTimeout;
 	constructor(context) {
-		this.authHeader = `${WP_AUTH_TYPE} ${Buffer.from(`${context.credentials.username}:${context.credentials.password}`, "utf8").toString("base64")}`;
+		const credentialBytes = new TextEncoder().encode(`${context.credentials.username}:${context.credentials.password}`);
+		let binary = "";
+		for (const byte of credentialBytes) binary += String.fromCharCode(byte);
+		this.authHeader = `${WP_AUTH_TYPE} ${btoa(binary)}`;
 		this.siteBase = context.credentials.url.endsWith("/") ? context.credentials.url : `${context.credentials.url}/`;
 		this.defaultTimeout = context.timeout ?? SAFE_REQUEST_TIMEOUT;
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kizlo",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "type": "module",
   "description": "A headless WordPress toolkit for TypeScript.",
   "keywords": [
@@ -76,7 +76,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.5.1",
-    "@kizlo/shared": "0.1.1",
+    "@kizlo/shared": "0.1.2",
     "@orpc/client": "^1.14.3",
     "@orpc/contract": "^1.14.3",
     "@orpc/openapi": "^1.14.3",