kizlo 0.2.2 → 0.3.0

package/dist/adapters/captcha.js

@@ -1,3 +1,5 @@
+import { hash, hmac } from "../shared/crypto.js";
+
 //#region src/adapters/captcha.ts
 /** Author a custom captcha adapter — types your verify function against the {@link CaptchaAdapter} contract. */
 function createCaptchaAdapter(adapter) {
@@ -72,14 +74,20 @@ function arkose(opts) {
 		})).json()).session_details?.solved === true;
 	};
 }
+const ALTCHA_ALGORITHMS = {
+	"SHA-256": "SHA-256",
+	"SHA-384": "SHA-384",
+	"SHA-512": "SHA-512"
+};
 function altcha(opts) {
 	return async ({ token }) => {
 		try {
-			const payload = JSON.parse(Buffer.from(token, "base64").toString("utf-8"));
-			const { createHmac, createHash } = await import("node:crypto");
-			const algo = payload.algorithm.toLowerCase().replace("-", "");
-			if (createHash(algo).update(`${payload.salt}${payload.number}`).digest("hex") !== payload.challenge) return false;
-			return createHmac(algo, opts.hmacKey).update(payload.challenge).digest("hex") === payload.signature;
+			const json = new TextDecoder().decode(Uint8Array.from(atob(token), (c) => c.charCodeAt(0)));
+			const payload = JSON.parse(json);
+			const algo = ALTCHA_ALGORITHMS[payload.algorithm.toUpperCase()];
+			if (!algo) return false;
+			if (await hash(`${payload.salt}${payload.number}`, algo) !== payload.challenge) return false;
+			return await hmac(opts.hmacKey, payload.challenge, algo) === payload.signature;
 		} catch {
 			return false;
 		}

package/dist/cli/commands/dev.js

@@ -7,10 +7,10 @@ import { bootstrapDev } from "../wp/dev.js";
 import { reapOrphans, registerSession, removeProjectContainers, spawnWatchdog, unregisterSession } from "../wp/session.js";
 import { syncSiteSettings } from "../wp/settings.js";
 import { devStack } from "../wp/stack.js";
-import { randomBytes } from "node:crypto";
 import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { defineCommand } from "citty";
+import { randomBytes } from "node:crypto";
 import { networkInterfaces } from "node:os";
 
 //#region src/cli/commands/dev.ts

package/dist/cli/commands/init.js

@@ -10,11 +10,11 @@ import { syncSiteSettings } from "../wp/settings.js";
 import { devStack } from "../wp/stack.js";
 import { PRESETS, detectPreset, getPreset } from "../presets/index.js";
 import z from "zod/v4";
-import { randomBytes } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
+import { randomBytes } from "node:crypto";
 
 //#region src/cli/commands/init.ts
 /** Production connection keys — what a real deploy needs, and what `.env.example` always lists. */
@@ -116,6 +116,35 @@ function orCancel(value) {
 	}
 	return value;
 }
+/**
+* The single overwrite policy for every scaffolded file: create it when absent, overwrite on
+* `--force`, and otherwise ask before clobbering an existing file (keeping it when the user
+* declines or when running non-interactively with `--yes`). Every scaffolded file routes through
+* here rather than deciding for itself, so new files inherit the same behavior for free.
+*/
+async function scaffoldFile(cwd, file, opts) {
+	const absPath = path.join(cwd, file.relPath);
+	const existed = fs.existsSync(absPath);
+	if (existed) {
+		let overwrite = opts.force;
+		if (!opts.force && !opts.yes) {
+			p.log.warn(`${file.label} already exists at ${file.relPath}`);
+			overwrite = orCancel(await p.confirm({
+				message: "Overwrite it?",
+				initialValue: true
+			}));
+		}
+		if (!overwrite) return "kept";
+	}
+	fs.mkdirSync(path.dirname(absPath), { recursive: true });
+	fs.writeFileSync(absPath, file.contents);
+	return existed ? "overwritten" : "created";
+}
+/** Report a {@link scaffoldFile} outcome in init's usual voice. */
+function reportScaffold(file, result, yes) {
+	if (result === "kept") p.log.info(`Kept existing ${file.label} (${file.relPath})${yes ? " — pass --force to overwrite" : ""}`);
+	else p.log.success(`${result === "overwritten" ? "Overwrote" : "Created"} ${file.label} (${file.relPath})`);
+}
 async function collectInteractively(ctx) {
 	let siteUrl;
 	let baseUrl;
@@ -193,7 +222,7 @@ async function collectInteractively(ctx) {
 		validate: validate(dirPath)
 	}));
 	let alias = "";
-	if (ctx.preset.routeHandler) {
+	if (ctx.preset.apiPath) {
 		const serverDir = path.join(dir.replace(/^\.\//, "").replace(/\/+$/, ""), "server");
 		const detected = detectImportAlias(ctx.cwd, serverDir)?.prefix;
 		alias = orCancel(await p.text({
@@ -230,7 +259,7 @@ function collectFromEnv(ctx) {
 		wpUsername: process.env.KIZLO_WORDPRESS_USERNAME?.trim() ?? "",
 		wpPassword: process.env.KIZLO_WORDPRESS_APPLICATION_PASSWORD?.trim() ?? "",
 		dir,
-		alias: ctx.preset.routeHandler ? aliasWithSlash(detectImportAlias(ctx.cwd, path.join(dir, "server"))?.prefix) : ""
+		alias: ctx.preset.apiPath ? aliasWithSlash(detectImportAlias(ctx.cwd, path.join(dir, "server"))?.prefix) : ""
 	};
 }
 function readPkg(pkgPath) {
@@ -434,52 +463,38 @@ const init = defineCommand({
 		const exampleBody = `${exampleEnv}\n# Point the app at a local dev stack (managed by \`kizlo dev\`) instead of the keys above:\n# KIZLO_TARGET=dev\n`;
 		const exampleCreated = writeFileIfAbsent(path.join(cwd, ".env.example"), exampleBody);
 		const dirRel = setup.dir.replace(/^\.\//, "").replace(/\/+$/, "");
-		const configCreated = writeFileIfAbsent(path.join(cwd, "kizlo.config.ts"), kizloConfigTemplate(dirRel, setup.alias, setup.devPath));
 		const serverDirRel = path.join(dirRel, "server");
-		const serverEntryRel = path.join(serverDirRel, "index.ts");
-		const serverPath = path.join(cwd, serverEntryRel);
-		const serverExisted = fs.existsSync(serverPath);
-		let wroteServer = !serverExisted || force;
-		if (serverExisted && !force && !yes) {
-			p.log.warn(`A Kizlo server instance already exists at ${serverEntryRel}`);
-			wroteServer = orCancel(await p.confirm({
-				message: "Overwrite it?",
-				initialValue: true
-			}));
-		}
-		if (wroteServer) {
-			fs.mkdirSync(path.dirname(serverPath), { recursive: true });
-			fs.writeFileSync(serverPath, preset.serverEntry());
-		}
-		const generatedDirRel = path.join(serverDirRel, "generated");
-		writeFileIfAbsent(path.join(cwd, generatedDirRel, "contract.json"), "{}\n");
-		writeFileIfAbsent(path.join(cwd, generatedDirRel, "index.ts"), CONTRACT_BARREL);
 		const clientUrl = setup.siteUrl && !sameOrigin(setup.siteUrl, setup.baseUrl) ? setup.baseUrl : void 0;
 		const scaffold = {
 			serverDirName: path.basename(serverDirRel),
+			serverEntryPath: path.join(serverDirRel, "index.ts"),
+			clientPath: path.join(dirRel, "client.ts"),
 			appDir: detectAppDir(cwd, hasSrcDir),
 			serverImport: (fromDir) => resolveModuleImport(cwd, serverDirRel, fromDir, setup.alias),
 			clientUrl
 		};
-		const clientRel = path.join(dirRel, "client.ts");
-		const clientCreated = writeFileIfAbsent(path.join(cwd, clientRel), preset.clientEntry(scaffold));
-		let routeRel;
-		let routeCreated = false;
-		if (preset.routeHandler) {
-			const route = preset.routeHandler(scaffold);
-			routeRel = route.path;
-			routeCreated = writeFileIfAbsent(path.join(cwd, route.path), route.contents);
-		}
+		const files = [{
+			label: "Kizlo config",
+			relPath: "kizlo.config.ts",
+			contents: kizloConfigTemplate(dirRel, setup.alias, setup.devPath)
+		}, ...preset.scaffolds(scaffold)];
+		const scaffolded = [];
+		for (const file of files) scaffolded.push({
+			file,
+			result: await scaffoldFile(cwd, file, {
+				force,
+				yes
+			})
+		});
+		const generatedDirRel = path.join(serverDirRel, "generated");
+		writeFileIfAbsent(path.join(cwd, generatedDirRel, "contract.json"), "{}\n");
+		writeFileIfAbsent(path.join(cwd, generatedDirRel, "index.ts"), CONTRACT_BARREL);
 		const gitignore = ensureGitignored(cwd, ".env");
 		if (!envExisted) p.log.success("Created .env");
 		else if (merge.updated.length || merge.added.length) p.log.success("Updated .env");
 		else p.log.info("Left .env unchanged");
 		p.log.success(exampleCreated ? "Created .env.example" : "Skipped .env.example (exists)");
-		p.log.success(configCreated ? "Created kizlo.config.ts" : "Skipped kizlo.config.ts (exists)");
-		if (wroteServer) p.log.success(`${serverExisted ? "Overwrote" : "Created"} Kizlo server instance (${serverEntryRel})`);
-		else p.log.info(`Kept existing Kizlo server instance (${serverEntryRel})${yes ? " — pass --force to overwrite" : ""}`);
-		p.log.success(clientCreated ? `Created browser client (${clientRel})` : "Skipped browser client (exists)");
-		if (routeRel) p.log.success(routeCreated ? `Created API route (${routeRel})` : "Skipped API route (exists)");
+		for (const { file, result } of scaffolded) reportScaffold(file, result, yes);
 		if (gitignore !== "present") p.log.success(`${gitignore === "created" ? "Created" : "Updated"} .gitignore (ignoring .env)`);
 		if (setup.mode === "local") {
 			p.log.success(`Local WordPress configured (${setup.devPath}) — .env points at ${setup.wpUrl}`);

package/dist/cli/presets/base.js

@@ -4,27 +4,35 @@ const base = {
 	label: "Generic (no framework detected)",
 	detect: () => 1,
 	baseUrlEnvKey: "KIZLO_BACKEND_URL",
-	serverEntry() {
-		return `import { createKizlo } from "kizlo"
+	scaffolds(ctx) {
+		return [{
+			label: "Kizlo server instance",
+			relPath: ctx.serverEntryPath,
+			contents: `import { createKizlo } from "kizlo"
 
 export const { router, client, context, handler } = createKizlo()
-`;
-	},
-	clientEntry(ctx) {
-		if (ctx.clientUrl) return `import { createKizloClient } from "kizlo"
+`
+		}, {
+			label: "Browser client",
+			relPath: ctx.clientPath,
+			contents: clientEntry(ctx)
+		}];
+	}
+};
+function clientEntry(ctx) {
+	if (ctx.clientUrl) return `import { createKizloClient } from "kizlo"
 import { contract } from "./${ctx.serverDirName}/generated"
 
 // Your Kizlo backend runs on a different origin than this app. Swap in your bundler's
 // public env var (e.g. import.meta.env.VITE_KIZLO_BACKEND_URL) to set it per environment.
 export const client = createKizloClient(contract, { url: "${ctx.clientUrl}" })
 `;
-		return `import { createKizloClient } from "kizlo"
+	return `import { createKizloClient } from "kizlo"
 import { contract } from "./${ctx.serverDirName}/generated"
 
 export const client = createKizloClient(contract)
 `;
-	}
-};
+}
 
 //#endregion
 export { base };

package/dist/cli/presets/nextjs.js

@@ -10,28 +10,75 @@ const nextjs = {
 	},
 	baseUrlEnvKey: "NEXT_PUBLIC_KIZLO_BACKEND_URL",
 	apiPath: "/api/kizlo",
-	serverEntry() {
-		return `import { createKizlo } from "kizlo/nextjs/server"
+	scaffolds(ctx) {
+		const apiDir = `${ctx.appDir}/api/kizlo/[[...rest]]`;
+		const robotsDir = `${ctx.appDir}/robots.txt`;
+		const sitemapDir = `${ctx.appDir}/sitemaps/[sitemap]`;
+		return [
+			{
+				label: "Kizlo server instance",
+				relPath: ctx.serverEntryPath,
+				contents: `import { createKizlo } from "kizlo/nextjs/server"
 
 export const { router, client, context, handler } = createKizlo()
-`;
-	},
-	clientEntry(ctx) {
-		return `import { createKizloClient } from "kizlo/nextjs"
+`
+			},
+			{
+				label: "Browser client",
+				relPath: ctx.clientPath,
+				contents: `import { createKizloClient } from "kizlo/nextjs"
 import { contract } from "./${ctx.serverDirName}/generated"
 
 export const client = createKizloClient(contract)
-`;
-	},
-	routeHandler(ctx) {
-		const dir = `${ctx.appDir}/api/kizlo/[[...rest]]`;
-		return {
-			path: `${dir}/route.ts`,
-			contents: `import { handler } from "${ctx.serverImport(dir)}"
+`
+			},
+			{
+				label: "API route",
+				relPath: `${apiDir}/route.ts`,
+				contents: `import { handler } from "${ctx.serverImport(apiDir)}"
 
 export { handler as GET, handler as POST, handler as PUT, handler as PATCH, handler as DELETE, handler as OPTIONS }
 `
-		};
+			},
+			{
+				label: "robots.txt route",
+				relPath: `${robotsDir}/route.ts`,
+				contents: `import { createRobotsRoute } from "kizlo/nextjs/server"
+import { client } from "${ctx.serverImport(robotsDir)}"
+
+// Run on the edge: cheaper and faster than Node for a response this small.
+export const runtime = "edge"
+
+// Vercel treats special metadata files like robots.txt and sitemap.xml as completely static
+// files at build time, bypassing normal Incremental Static Regeneration (ISR) and on-demand
+// revalidatePath rules.
+//
+// While your revalidation logic executes perfectly in a local Node.js server, Vercel uploads
+// these routes directly to its Edge CDN as immutable assets. Subsequent on-demand revalidation
+// triggers will successfully clear the Data Cache but fail to purge the CDN-level Edge cache
+// for that file.
+//
+// force-dynamic opts out of that static treatment so CMS edits show up; the WordPress call is
+// cached, so requests stay cheap.
+export const dynamic = "force-dynamic"
+
+export const GET = createRobotsRoute(client)
+`
+			},
+			{
+				label: "sitemap route",
+				relPath: `${sitemapDir}/route.ts`,
+				contents: `import { createSitemapRoute } from "kizlo/nextjs/server"
+import { client } from "${ctx.serverImport(sitemapDir)}"
+
+// Unlike robots.txt, Vercel revalidates this route on demand, so it can stay static. It's
+// served from the CDN at no per-request cost and still refreshes when content changes.
+export const dynamic = "force-static"
+
+export const GET = createSitemapRoute(client)
+`
+			}
+		];
 	}
 };
 

package/dist/cli/wp/dev.js

@@ -4,9 +4,9 @@ import { DEFAULT_PLUGINS, TEST_ADMIN } from "./constants.js";
 import { ensurePlugins } from "./utils.js";
 import { createAdminAppPassword, seedUsers } from "./bootstrap.js";
 import { prepareByo } from "./byo.js";
-import { randomBytes } from "node:crypto";
 import { existsSync, rmSync } from "node:fs";
 import { join } from "node:path";
+import { randomBytes } from "node:crypto";
 
 //#region src/cli/wp/dev.ts
 /** A strong random admin password (144 bits, URL/JSON/CLI-safe characters). */

package/dist/context.js

@@ -1,8 +1,8 @@
+import { compare, hmac } from "./shared/crypto.js";
 import { noopAdapter } from "./adapters/logger.js";
 import { PreviewTokenData } from "./shared/schema.js";
 import { CookiesStorage } from "./cookie.js";
 import { Service } from "./service.js";
-import { compare, hmac } from "./shared/crypto.js";
 import { base64Decode, tryCatchSync } from "@kizlo/shared";
 import { serialize } from "cookie";
 
@@ -106,7 +106,7 @@ var Context = class {
 			if (error) return null;
 			if (Date.now() > data.payload.expires * 1e3) return null;
 			const payloadStr = `${data.payload.id}.${data.payload.parent}.${data.payload.expires}`;
-			if (!compare(hmac(this.config.siteSecret ?? "", payloadStr), data.hash)) return null;
+			if (!await compare(await hmac(this.config.siteSecret ?? "", payloadStr), data.hash)) return null;
 			return data.payload;
 		};
 	}

package/dist/index.d.ts

@@ -17,8 +17,8 @@ import "./wordpress/index.js";
 import { DevPluginSource, Fixture, FixtureCleanupFn, FixtureSeedFn, JsonValue, LocalPlugin, PluginSource, SeedContext, TestAdminUser, TestCredentials, TestUser, defineFixture, isLocalPlugin } from "./cli/wp/types.js";
 import { AuthAdapter, AuthGetUser, AuthUser, authMock, createAuthAdapter } from "./adapters/auth.js";
 import { CaptchaAdapter, altcha, arkose, createCaptchaAdapter, friendlyCaptcha, hcaptcha, recaptcha, turnstile } from "./adapters/captcha.js";
-import { CONTENT_TYPES, ContentType, ListSitemapUrlInput, ListSitemapUrlInputBase, Robots, RobotsRule, Seo, SeoHead, SeoSchema, Sitemap, SitemapList, SitemapUrl, SitemapUrlImage, SitemapUrlList } from "./seo/schema.js";
-import { WPK_ListSitemapUrlInput, WPK_RobotRule, WPK_Robots, WPK_Seo, WPK_Sitemap, WPK_SitemapContentType, WPK_SitemapUrl, WPK_SitemapUrlImage } from "./seo/types.js";
+import { CONTENT_TYPES, ContentType, ListSitemapUrlInput, ListSitemapUrlInputBase, Robots, RobotsRule, Seo, SeoHead, SeoSchema, Sitemap, SitemapIndex, SitemapList, SitemapUrl, SitemapUrlImage, SitemapUrlList } from "./seo/schema.js";
+import { WPK_ListSitemapUrlInput, WPK_RobotRule, WPK_Robots, WPK_Seo, WPK_Sitemap, WPK_SitemapContentType, WPK_SitemapIndex, WPK_SitemapUrl, WPK_SitemapUrlImage } from "./seo/types.js";
 import { SitemapIndexEntry } from "./seo/utils.js";
 import { CurrencyFormat, IdentifierInput, LIST_ORDER, ListMetadata, ListOrder, Media, PreviewTokenData, PreviewTokenPayload } from "./shared/schema.js";
 import { AnyContext, AnyNestedClient, CookiesAdapter, CookiesDeleteAll, CookiesGetAll, CookiesSetAll, HTTPMethod, List, MaybeOptionalOptions, RedirectInput, RedirectStatus } from "./shared/types.js";
@@ -39,8 +39,8 @@ import { AnyProcedure, AnyProcedureRouter, BaseHandlerOptions, ExtractParams, Ex
 import { KizloClient, KizloClientConfig, createKizloClient } from "./client.js";
 import { CreateSitemapRouteOptions, SITEMAP_BASE, SITEMAP_INDEX_SLUG, SitemapRouteExtra, createSitemapRoute } from "./seo/sitemap.js";
 import { Contract, ContractProcedure, generateContract, isContractProcedure, restoreContract } from "./shared/contract.js";
-import { compare, hash, hmac } from "./shared/crypto.js";
+import { ShaAlgorithm, compare, hash, hmac } from "./shared/crypto.js";
 import { Identifier, parseIdentifier } from "./shared/identifier.js";
 import { createOrpcRouter } from "./shared/router.js";
 import { deserializeCurrencyFormat, deserializeListMetadata, emptyList, serializeCurrencyFormat } from "./shared/serialize.js";
-export { AnyContext, AnyEventSchema, AnyEvents, AnyExtension, AnyKizloConfig, AnyMiddleware, AnyNestedClient, AnyProcedure, AnyProcedureRouter, AuthAdapter, AuthGetUser, AuthUser, AuthUserFn, BaseHandlerOptions, CART_HASH_HEADER_KEY, COMMON_ERRORS, CONTENT_TYPES, CaptchaAdapter, CommentService, CommonErrorCode, CommonErrorLiteral, CommonErrorMap, ConnInfo, ConnInfoFn, ConsoleLogAdapterOptions, ContentType, Context, ContextConfig, Contract, ContractProcedure, CookiesAdapter, CookiesDeleteAll, CookiesGetAll, CookiesSetAll, CreateKizloOptions, CreateSitemapRouteOptions, CurrencyFormat, DefinedErrorMapLike, DevPluginSource, Environment, ErrorDefinition, EventHandler, EventHandlerFn, Extension, ExtensionInitFn, ExtensionInitOptions, ExtensionInitResult, ExtractExtensionRouter, ExtractMiddlewareContextOutput, ExtractParams, ExtractProcedureByScope, Fixture, FixtureCleanupFn, FixtureSeedFn, GeoAdapter, GeoGetConnInfo, HTTPMethod, Identifier, IdentifierInput, InferEventUnion, InferExtensionRouter, InferUses, InvocationScope, JsonValue, Kizlo, KizloAuthorsSettings, KizloAuthorsSettingsInput, KizloClient, KizloClientConfig, KizloConfig, KizloCrawlingSettings, KizloCrawlingSettingsInput, KizloError, KizloErrorOptions, KizloIdentitySettings, KizloIdentitySettingsInput, KizloMedia, KizloOrganizationFounder, KizloOrganizationSettings, KizloOrganizationSettingsInput, KizloPersonSettings, KizloPersonSettingsInput, KizloPostStatus, KizloPostTypeSettings, KizloPostTypeSettingsInput, KizloSettings, KizloSettingsService, KizloSiteSettings, KizloSiteSettingsInput, KizloSocialProfile, KizloTarget, KizloTaxonomySettings, KizloTaxonomySettingsInput, KizloWebhookSettings, KizloWebhookSettingsInput, LIST_ORDER, List, ListMetadata, ListOrder, ListSitemapUrlInput, ListSitemapUrlInputBase, LocalPlugin, LogLevel, LogPayload, Logger, LoggerAdapter, MaybeOptionalOptions, Media, MenuItemService, MenuService, Middleware, MiddlewareHandler, MiddlewareNextFn, MiddlewareOptions, MiddlewareResult, OpenapiPart, PluginSource, PostService, PreviewTokenData, PreviewTokenPayload, Procedure, ProcedureContext, ProcedureErrors, ProcedureHandler, ProcedureOptions, RedirectInput, RedirectStatus, ResolveParamsPart, ResolvedSchemaInput, ResolvedSchemaOutput, Robots, RobotsRule, RootRouter, RouterDepthTuple, S2SClient, SAFE_REQUEST_TIMEOUT, SITEMAP_BASE, SITEMAP_INDEX_SLUG, SchemaIO, SeedContext, Seo, SeoHead, SeoSchema, ServerContext, Service, ServiceAdapters, ServiceConfig, Sitemap, type SitemapIndexEntry, SitemapList, SitemapRouteExtra, SitemapUrl, SitemapUrlImage, SitemapUrlList, TestAdminUser, TestCredentials, TestUser, ThrowableErrorFn, ThrowableErrorMap, UNEXPECTED_BODY_SNIPPET_LENGTH, UserService, VerifyCaptchaFn, VerifyPreviewTokenFn, WC_CORE_BASE, WC_STORE_BASE, WPK_ListSitemapUrlInput, WPK_RobotRule, WPK_Robots, WPK_Seo, WPK_Sitemap, WPK_SitemapContentType, WPK_SitemapUrl, WPK_SitemapUrlImage, WP_AUTH_HEADER_KEY, WP_AUTH_TYPE, WP_CORE_BASE, WP_Comment, WP_CommentAvatarUrls, WP_CommentContent, WP_CommentContentInput, WP_CommentCreateErrorCode, WP_CommentCreateInput, WP_CommentDeleteErrorCode, WP_CommentDeleteInput, WP_CommentDeleteResponse, WP_CommentLinks, WP_CommentListErrorCode, WP_CommentListInput, WP_CommentOrderBy, WP_CommentRetrieveErrorCode, WP_CommentRetrieveInput, WP_CommentStatus, WP_CommentStatusFilter, WP_CommentStatusInput, WP_CommentType, WP_CommentUpdateErrorCode, WP_CommentUpdateInput, WP_CommonErrorCode, WP_Context, WP_CurrencyFormat, WP_Error, WP_ErrorData, WP_KIZLO_BASE, WP_Link, WP_List, WP_ListMetadata, WP_ListOrder, WP_Menu, WP_MenuCreateErrorCode, WP_MenuCreateInput, WP_MenuDeleteErrorCode, WP_MenuDeleteInput, WP_MenuDeleteResponse, WP_MenuItem, WP_MenuItemCreateErrorCode, WP_MenuItemCreateInput, WP_MenuItemDeleteErrorCode, WP_MenuItemDeleteInput, WP_MenuItemDeleteResponse, WP_MenuItemLinks, WP_MenuItemListErrorCode, WP_MenuItemListInput, WP_MenuItemOrderBy, WP_MenuItemRetrieveErrorCode, WP_MenuItemRetrieveInput, WP_MenuItemStatus, WP_MenuItemStatusFilter, WP_MenuItemTarget, WP_MenuItemTaxRelation, WP_MenuItemTitle, WP_MenuItemTitleInput, WP_MenuItemType, WP_MenuItemUpdateErrorCode, WP_MenuItemUpdateInput, WP_MenuLinks, WP_MenuListErrorCode, WP_MenuListInput, WP_MenuOrderBy, WP_MenuRetrieveErrorCode, WP_MenuRetrieveInput, WP_MenuUpdateErrorCode, WP_MenuUpdateInput, WP_Post, WP_PostCommentStatus, WP_PostContent, WP_PostContentInput, WP_PostCreateErrorCode, WP_PostCreateInput, WP_PostDeleteErrorCode, WP_PostDeleteInput, WP_PostDeleteResponse, WP_PostExcerpt, WP_PostExcerptInput, WP_PostFormat, WP_PostGuid, WP_PostLinks, WP_PostListErrorCode, WP_PostListInput, WP_PostOrderBy, WP_PostRetrieveErrorCode, WP_PostRetrieveInput, WP_PostStatus, WP_PostStatusFilter, WP_PostTaxRelation, WP_PostTitle, WP_PostTitleInput, WP_PostUpdateErrorCode, WP_PostUpdateInput, WP_RequestInput, WP_Result, WP_User, WP_UserAvatarUrls, WP_UserCapabilities, WP_UserCreateErrorCode, WP_UserCreateInput, WP_UserDeleteErrorCode, WP_UserDeleteInput, WP_UserDeleteMeErrorCode, WP_UserDeleteMeInput, WP_UserDeleteMeResponse, WP_UserDeleteResponse, WP_UserLinks, WP_UserListErrorCode, WP_UserListInput, WP_UserOrderBy, WP_UserRetrieveErrorCode, WP_UserRetrieveInput, WP_UserRetrieveMeErrorCode, WP_UserRetrieveMeInput, WP_UserUpdateErrorCode, WP_UserUpdateInput, WP_UserUpdateMeErrorCode, WP_UserUpdateMeInput, WP_UserWho, WebhookOptions, WithCommonErrorMap, WordPressCredentials, WordPressService, altcha, arkose, authMock, buildProcedure, combineDetailed, compare, consoleLog, createAuthAdapter, createCaptchaAdapter, createCookiesAdapter, createEventHandler, createExtension, createGeoAdapter, createKizlo, createKizloClient, createLoggerAdapter, createMiddleware, createOrpcRouter, createProcedure, createSitemapRoute, createThrowableErrorMap, createWebhookRouter, defineErrorMap, defineFixture, deserializeCurrencyFormat, deserializeListMetadata, emptyList, friendlyCaptcha, generateContract, geoMock, geoVercelNext, handleUnexpectedError, hash, hcaptcha, hmac, isContractProcedure, isKizloError, isLocalPlugin, isWordPressResourceError, noopAdapter, parseIdentifier, recaptcha, resolveKizloConfig, restoreContract, schemaType, serializeCurrencyFormat, toKizloError, turnstile };
+export { AnyContext, AnyEventSchema, AnyEvents, AnyExtension, AnyKizloConfig, AnyMiddleware, AnyNestedClient, AnyProcedure, AnyProcedureRouter, AuthAdapter, AuthGetUser, AuthUser, AuthUserFn, BaseHandlerOptions, CART_HASH_HEADER_KEY, COMMON_ERRORS, CONTENT_TYPES, CaptchaAdapter, CommentService, CommonErrorCode, CommonErrorLiteral, CommonErrorMap, ConnInfo, ConnInfoFn, ConsoleLogAdapterOptions, ContentType, Context, ContextConfig, Contract, ContractProcedure, CookiesAdapter, CookiesDeleteAll, CookiesGetAll, CookiesSetAll, CreateKizloOptions, CreateSitemapRouteOptions, CurrencyFormat, DefinedErrorMapLike, DevPluginSource, Environment, ErrorDefinition, EventHandler, EventHandlerFn, Extension, ExtensionInitFn, ExtensionInitOptions, ExtensionInitResult, ExtractExtensionRouter, ExtractMiddlewareContextOutput, ExtractParams, ExtractProcedureByScope, Fixture, FixtureCleanupFn, FixtureSeedFn, GeoAdapter, GeoGetConnInfo, HTTPMethod, Identifier, IdentifierInput, InferEventUnion, InferExtensionRouter, InferUses, InvocationScope, JsonValue, Kizlo, KizloAuthorsSettings, KizloAuthorsSettingsInput, KizloClient, KizloClientConfig, KizloConfig, KizloCrawlingSettings, KizloCrawlingSettingsInput, KizloError, KizloErrorOptions, KizloIdentitySettings, KizloIdentitySettingsInput, KizloMedia, KizloOrganizationFounder, KizloOrganizationSettings, KizloOrganizationSettingsInput, KizloPersonSettings, KizloPersonSettingsInput, KizloPostStatus, KizloPostTypeSettings, KizloPostTypeSettingsInput, KizloSettings, KizloSettingsService, KizloSiteSettings, KizloSiteSettingsInput, KizloSocialProfile, KizloTarget, KizloTaxonomySettings, KizloTaxonomySettingsInput, KizloWebhookSettings, KizloWebhookSettingsInput, LIST_ORDER, List, ListMetadata, ListOrder, ListSitemapUrlInput, ListSitemapUrlInputBase, LocalPlugin, LogLevel, LogPayload, Logger, LoggerAdapter, MaybeOptionalOptions, Media, MenuItemService, MenuService, Middleware, MiddlewareHandler, MiddlewareNextFn, MiddlewareOptions, MiddlewareResult, OpenapiPart, PluginSource, PostService, PreviewTokenData, PreviewTokenPayload, Procedure, ProcedureContext, ProcedureErrors, ProcedureHandler, ProcedureOptions, RedirectInput, RedirectStatus, ResolveParamsPart, ResolvedSchemaInput, ResolvedSchemaOutput, Robots, RobotsRule, RootRouter, RouterDepthTuple, S2SClient, SAFE_REQUEST_TIMEOUT, SITEMAP_BASE, SITEMAP_INDEX_SLUG, SchemaIO, SeedContext, Seo, SeoHead, SeoSchema, ServerContext, Service, ServiceAdapters, ServiceConfig, ShaAlgorithm, Sitemap, SitemapIndex, type SitemapIndexEntry, SitemapList, SitemapRouteExtra, SitemapUrl, SitemapUrlImage, SitemapUrlList, TestAdminUser, TestCredentials, TestUser, ThrowableErrorFn, ThrowableErrorMap, UNEXPECTED_BODY_SNIPPET_LENGTH, UserService, VerifyCaptchaFn, VerifyPreviewTokenFn, WC_CORE_BASE, WC_STORE_BASE, WPK_ListSitemapUrlInput, WPK_RobotRule, WPK_Robots, WPK_Seo, WPK_Sitemap, WPK_SitemapContentType, WPK_SitemapIndex, WPK_SitemapUrl, WPK_SitemapUrlImage, WP_AUTH_HEADER_KEY, WP_AUTH_TYPE, WP_CORE_BASE, WP_Comment, WP_CommentAvatarUrls, WP_CommentContent, WP_CommentContentInput, WP_CommentCreateErrorCode, WP_CommentCreateInput, WP_CommentDeleteErrorCode, WP_CommentDeleteInput, WP_CommentDeleteResponse, WP_CommentLinks, WP_CommentListErrorCode, WP_CommentListInput, WP_CommentOrderBy, WP_CommentRetrieveErrorCode, WP_CommentRetrieveInput, WP_CommentStatus, WP_CommentStatusFilter, WP_CommentStatusInput, WP_CommentType, WP_CommentUpdateErrorCode, WP_CommentUpdateInput, WP_CommonErrorCode, WP_Context, WP_CurrencyFormat, WP_Error, WP_ErrorData, WP_KIZLO_BASE, WP_Link, WP_List, WP_ListMetadata, WP_ListOrder, WP_Menu, WP_MenuCreateErrorCode, WP_MenuCreateInput, WP_MenuDeleteErrorCode, WP_MenuDeleteInput, WP_MenuDeleteResponse, WP_MenuItem, WP_MenuItemCreateErrorCode, WP_MenuItemCreateInput, WP_MenuItemDeleteErrorCode, WP_MenuItemDeleteInput, WP_MenuItemDeleteResponse, WP_MenuItemLinks, WP_MenuItemListErrorCode, WP_MenuItemListInput, WP_MenuItemOrderBy, WP_MenuItemRetrieveErrorCode, WP_MenuItemRetrieveInput, WP_MenuItemStatus, WP_MenuItemStatusFilter, WP_MenuItemTarget, WP_MenuItemTaxRelation, WP_MenuItemTitle, WP_MenuItemTitleInput, WP_MenuItemType, WP_MenuItemUpdateErrorCode, WP_MenuItemUpdateInput, WP_MenuLinks, WP_MenuListErrorCode, WP_MenuListInput, WP_MenuOrderBy, WP_MenuRetrieveErrorCode, WP_MenuRetrieveInput, WP_MenuUpdateErrorCode, WP_MenuUpdateInput, WP_Post, WP_PostCommentStatus, WP_PostContent, WP_PostContentInput, WP_PostCreateErrorCode, WP_PostCreateInput, WP_PostDeleteErrorCode, WP_PostDeleteInput, WP_PostDeleteResponse, WP_PostExcerpt, WP_PostExcerptInput, WP_PostFormat, WP_PostGuid, WP_PostLinks, WP_PostListErrorCode, WP_PostListInput, WP_PostOrderBy, WP_PostRetrieveErrorCode, WP_PostRetrieveInput, WP_PostStatus, WP_PostStatusFilter, WP_PostTaxRelation, WP_PostTitle, WP_PostTitleInput, WP_PostUpdateErrorCode, WP_PostUpdateInput, WP_RequestInput, WP_Result, WP_User, WP_UserAvatarUrls, WP_UserCapabilities, WP_UserCreateErrorCode, WP_UserCreateInput, WP_UserDeleteErrorCode, WP_UserDeleteInput, WP_UserDeleteMeErrorCode, WP_UserDeleteMeInput, WP_UserDeleteMeResponse, WP_UserDeleteResponse, WP_UserLinks, WP_UserListErrorCode, WP_UserListInput, WP_UserOrderBy, WP_UserRetrieveErrorCode, WP_UserRetrieveInput, WP_UserRetrieveMeErrorCode, WP_UserRetrieveMeInput, WP_UserUpdateErrorCode, WP_UserUpdateInput, WP_UserUpdateMeErrorCode, WP_UserUpdateMeInput, WP_UserWho, WebhookOptions, WithCommonErrorMap, WordPressCredentials, WordPressService, altcha, arkose, authMock, buildProcedure, combineDetailed, compare, consoleLog, createAuthAdapter, createCaptchaAdapter, createCookiesAdapter, createEventHandler, createExtension, createGeoAdapter, createKizlo, createKizloClient, createLoggerAdapter, createMiddleware, createOrpcRouter, createProcedure, createSitemapRoute, createThrowableErrorMap, createWebhookRouter, defineErrorMap, defineFixture, deserializeCurrencyFormat, deserializeListMetadata, emptyList, friendlyCaptcha, generateContract, geoMock, geoVercelNext, handleUnexpectedError, hash, hcaptcha, hmac, isContractProcedure, isKizloError, isLocalPlugin, isWordPressResourceError, noopAdapter, parseIdentifier, recaptcha, resolveKizloConfig, restoreContract, schemaType, serializeCurrencyFormat, toKizloError, turnstile };

package/dist/index.js

@@ -1,4 +1,5 @@
 import { authMock, createAuthAdapter } from "./adapters/auth.js";
+import { compare, hash, hmac } from "./shared/crypto.js";
 import { altcha, arkose, createCaptchaAdapter, friendlyCaptcha, hcaptcha, recaptcha, turnstile } from "./adapters/captcha.js";
 import { createCookiesAdapter } from "./adapters/cookies.js";
 import { createGeoAdapter, geoMock } from "./adapters/geo.js";
@@ -22,15 +23,14 @@ import { isWordPressResourceError } from "./wordpress/utils.js";
 import { WordPressService } from "./wordpress/service.js";
 import { KizloSettingsService } from "./settings/service.js";
 import { Service } from "./service.js";
-import { compare, hash, hmac } from "./shared/crypto.js";
 import { Context } from "./context.js";
 import { deserializeCurrencyFormat, deserializeListMetadata, emptyList, serializeCurrencyFormat } from "./shared/serialize.js";
 import { parseIdentifier } from "./shared/identifier.js";
-import { CONTENT_TYPES, ContentType, ListSitemapUrlInput, ListSitemapUrlInputBase, Robots, RobotsRule, Seo, SeoHead, SeoSchema, Sitemap, SitemapList, SitemapUrl, SitemapUrlImage, SitemapUrlList } from "./seo/schema.js";
+import { CONTENT_TYPES, ContentType, ListSitemapUrlInput, ListSitemapUrlInputBase, Robots, RobotsRule, Seo, SeoHead, SeoSchema, Sitemap, SitemapIndex, SitemapList, SitemapUrl, SitemapUrlImage, SitemapUrlList } from "./seo/schema.js";
 import { createEventHandler, createWebhookRouter } from "./webhook/index.js";
 import { Kizlo, createKizlo, resolveKizloConfig } from "./kizlo.js";
 import { SITEMAP_BASE, SITEMAP_INDEX_SLUG, createSitemapRoute } from "./seo/sitemap.js";
 import { createExtension } from "./shared/extension.js";
 import { createMiddleware } from "./shared/middleware.js";
 
-export { CART_HASH_HEADER_KEY, COMMON_ERRORS, CONTENT_TYPES, CommentService, ContentType, Context, CurrencyFormat, IdentifierInput, Kizlo, KizloClient, KizloError, KizloSettingsService, LIST_ORDER, ListMetadata, ListOrder, ListSitemapUrlInput, ListSitemapUrlInputBase, Media, MenuItemService, MenuService, PostService, PreviewTokenData, PreviewTokenPayload, Robots, RobotsRule, SAFE_REQUEST_TIMEOUT, SITEMAP_BASE, SITEMAP_INDEX_SLUG, Seo, SeoHead, SeoSchema, Service, Sitemap, SitemapList, SitemapUrl, SitemapUrlImage, SitemapUrlList, UNEXPECTED_BODY_SNIPPET_LENGTH, UserService, WC_CORE_BASE, WC_STORE_BASE, WP_AUTH_HEADER_KEY, WP_AUTH_TYPE, WP_CORE_BASE, WP_Error, WP_KIZLO_BASE, WordPressService, altcha, arkose, authMock, buildProcedure, combineDetailed, compare, consoleLog, createAuthAdapter, createCaptchaAdapter, createCookiesAdapter, createEventHandler, createExtension, createGeoAdapter, createKizlo, createKizloClient, createLoggerAdapter, createMiddleware, createOrpcRouter, createProcedure, createSitemapRoute, createThrowableErrorMap, createWebhookRouter, defineErrorMap, defineFixture, deserializeCurrencyFormat, deserializeListMetadata, emptyList, friendlyCaptcha, generateContract, geoMock, geoVercelNext, handleUnexpectedError, hash, hcaptcha, hmac, isContractProcedure, isKizloError, isLocalPlugin, isWordPressResourceError, noopAdapter, parseIdentifier, recaptcha, resolveKizloConfig, restoreContract, schemaType, serializeCurrencyFormat, toKizloError, turnstile };
+export { CART_HASH_HEADER_KEY, COMMON_ERRORS, CONTENT_TYPES, CommentService, ContentType, Context, CurrencyFormat, IdentifierInput, Kizlo, KizloClient, KizloError, KizloSettingsService, LIST_ORDER, ListMetadata, ListOrder, ListSitemapUrlInput, ListSitemapUrlInputBase, Media, MenuItemService, MenuService, PostService, PreviewTokenData, PreviewTokenPayload, Robots, RobotsRule, SAFE_REQUEST_TIMEOUT, SITEMAP_BASE, SITEMAP_INDEX_SLUG, Seo, SeoHead, SeoSchema, Service, Sitemap, SitemapIndex, SitemapList, SitemapUrl, SitemapUrlImage, SitemapUrlList, UNEXPECTED_BODY_SNIPPET_LENGTH, UserService, WC_CORE_BASE, WC_STORE_BASE, WP_AUTH_HEADER_KEY, WP_AUTH_TYPE, WP_CORE_BASE, WP_Error, WP_KIZLO_BASE, WordPressService, altcha, arkose, authMock, buildProcedure, combineDetailed, compare, consoleLog, createAuthAdapter, createCaptchaAdapter, createCookiesAdapter, createEventHandler, createExtension, createGeoAdapter, createKizlo, createKizloClient, createLoggerAdapter, createMiddleware, createOrpcRouter, createProcedure, createSitemapRoute, createThrowableErrorMap, createWebhookRouter, defineErrorMap, defineFixture, deserializeCurrencyFormat, deserializeListMetadata, emptyList, friendlyCaptcha, generateContract, geoMock, geoVercelNext, handleUnexpectedError, hash, hcaptcha, hmac, isContractProcedure, isKizloError, isLocalPlugin, isWordPressResourceError, noopAdapter, parseIdentifier, recaptcha, resolveKizloConfig, restoreContract, schemaType, serializeCurrencyFormat, toKizloError, turnstile };

package/dist/integrations/nextjs/revalidate.d.ts

@@ -4,20 +4,23 @@ import { Pathname } from "@kizlo/shared";
 
 //#region src/integrations/nextjs/revalidate.d.ts
 type RevalidatePathFn = (path: string, type?: "layout" | "page") => void;
-/** A path to revalidate, optionally with the Next `type` a dynamic route needs (e.g. `"page"`). */
+type RevalidateTagFn = (tag: string, profile: string | {
+  expire?: number;
+}) => void;
 type RevalidateTarget = Pathname | {
   path: Pathname;
   type?: "layout" | "page";
 };
 interface NextRevalidateOptions {
+  revalidateTag?: RevalidateTagFn;
   revalidatePath?: RevalidatePathFn;
   /** Return extra paths to revalidate for a given event, on top of the event's own URL. */
   paths?: (event: KizloEvent) => Pathname[] | Promise<Pathname[]>;
   /**
    * How to revalidate the sitemap. Defaults to the route `createSitemapRoute` serves
-   * (`/sitemaps/[sitemap]`, revalidated as a dynamic page). Override this only if you
-   * serve sitemaps from your own route(s) instead of `createSitemapRoute`; pass `false`
-   * to skip sitemap revalidation.
+   * (`/sitemaps/[sitemap]`, revalidated as a `layout` so the whole on-demand subtree
+   * refreshes at once). Override this only if you serve sitemaps from your own route(s)
+   * instead of `createSitemapRoute`; pass `false` to skip sitemap revalidation.
    */
   sitemap?: false | RevalidateTarget | RevalidateTarget[];
 }

package/dist/integrations/nextjs/revalidate.js

@@ -1,27 +1,30 @@
+import { POST_EVENT_TYPES, TERM_EVENT_TYPES } from "../../webhook/schema.js";
 import { createEventHandler } from "../../webhook/index.js";
 import { createExtension } from "../../shared/extension.js";
+import { ROBOTS_CACHE_TAG } from "./robots.js";
 import { SITEMAP_ROUTE } from "./sitemap.js";
 
 //#region src/integrations/nextjs/revalidate.ts
-const ROBOTS_PATH = "/robots.txt";
 const DEFAULT_SITEMAP_TARGET = {
 	path: SITEMAP_ROUTE,
-	type: "page"
+	type: "layout"
 };
+const CONTENT_EVENT_TYPES = new Set([...POST_EVENT_TYPES, ...TERM_EVENT_TYPES]);
 function nextRevalidation(options) {
 	return createExtension({
 		id: "nextjs-revalidation",
 		init: () => ({ events: [createEventHandler(async (event) => {
 			if (!event) return;
-			if (event.type.startsWith("settings")) return;
 			const revalidatePath = options?.revalidatePath ?? (await import("next/cache")).revalidatePath;
+			const revalidateTag = options?.revalidateTag ?? (await import("next/cache")).revalidateTag;
 			const paths = [
 				...await Promise.resolve(options?.paths?.(event) ?? []),
 				...event.data?.url ? [event.data.url] : [],
-				ROBOTS_PATH
+				"/post"
 			];
 			for (const path of normalizePaths(paths)) revalidatePath(path);
-			for (const target of resolveSitemapTargets(options?.sitemap)) revalidatePath(normalizePath(target.path), target.type);
+			if (event.type === "settings.saved") revalidateTag(ROBOTS_CACHE_TAG, { expire: 0 });
+			if (CONTENT_EVENT_TYPES.has(event.type)) for (const target of resolveSitemapTargets(options?.sitemap)) revalidatePath(normalizePath(target.path), target.type);
 		})] })
 	});
 }

package/dist/integrations/nextjs/robots.d.ts

@@ -0,0 +1,7 @@
+import { S2SClient } from "../../kizlo.js";
+
+//#region src/integrations/nextjs/robots.d.ts
+
+declare function createRobotsRoute(client: S2SClient<[]>): (request: Request) => Promise<Response>;
+//#endregion
+export { createRobotsRoute };

package/dist/integrations/nextjs/robots.js

@@ -0,0 +1,23 @@
+import { createRobotsRoute } from "../../seo/robots.js";
+
+//#region src/integrations/nextjs/robots.ts
+/**
+* Cache tag for the cached robots.txt body. The Next revalidation extension calls
+* `revalidateTag(ROBOTS_CACHE_TAG)` on every webhook event so the route refreshes
+* on-demand instead of on every request.
+*/
+const ROBOTS_CACHE_TAG = "kizlo:robots";
+function createRobotsRoute$1(client) {
+	const handler = createRobotsRoute(client);
+	let getBody;
+	return async function GET(request) {
+		if (!getBody) {
+			const { unstable_cache } = await import("next/cache");
+			getBody = unstable_cache(async () => (await handler(request)).text(), [ROBOTS_CACHE_TAG], { tags: [ROBOTS_CACHE_TAG] });
+		}
+		return new Response(await getBody(), { headers: { "Content-Type": "text/plain; charset=utf-8" } });
+	};
+}
+
+//#endregion
+export { ROBOTS_CACHE_TAG, createRobotsRoute$1 as createRobotsRoute };

package/dist/integrations/nextjs/sitemap.d.ts

@@ -6,8 +6,11 @@ import { CreateSitemapRouteOptions } from "../../seo/sitemap.js";
 /**
  * The Next route the sitemap handler is mounted at: a single dynamic segment named
  * `[sitemap]`. It is fixed (not configurable) so that one `revalidatePath(SITEMAP_ROUTE,
- * "page")` refreshes the index and every generated sitemap at once. `[sitemap]` is Next's
- * file-routing convention, which is why it lives in this integration and not in core.
+ * "layout")` refreshes the index and every generated sitemap at once. A `layout`
+ * revalidation (not `page`) is required because the route has no `generateStaticParams`,
+ * so its slugs are generated on-demand and only a subtree invalidation reaches them.
+ * `[sitemap]` is Next's file-routing convention, which is why it lives in this integration
+ * and not in core.
  */
 declare const SITEMAP_ROUTE: "/sitemaps/[sitemap]";
 /** Next's dynamic-route context. `params` is a promise in the App Router. */
@@ -22,7 +25,7 @@ interface NextRouteContext {
  * Next wrapper around the framework-agnostic {@link createCoreSitemapRoute}. It serves the
  * same sitemap index and collection pages, and additionally asserts the route is mounted at
  * {@link SITEMAP_ROUTE}: if the dynamic segment is not named `[sitemap]`, `params.sitemap`
- * is missing and a wrong mount would silently break `revalidatePath(SITEMAP_ROUTE, "page")`,
+ * is missing and a wrong mount would silently break `revalidatePath(SITEMAP_ROUTE, "layout")`,
  * so it throws loudly on the first request instead.
  */
 declare function createSitemapRoute(client: S2SClient<[]>, options?: CreateSitemapRouteOptions): (request: Request, ctx?: NextRouteContext) => Promise<Response>;

package/dist/integrations/nextjs/sitemap.js

@@ -4,15 +4,18 @@ import { SITEMAP_BASE, createSitemapRoute } from "../../seo/sitemap.js";
 /**
 * The Next route the sitemap handler is mounted at: a single dynamic segment named
 * `[sitemap]`. It is fixed (not configurable) so that one `revalidatePath(SITEMAP_ROUTE,
-* "page")` refreshes the index and every generated sitemap at once. `[sitemap]` is Next's
-* file-routing convention, which is why it lives in this integration and not in core.
+* "layout")` refreshes the index and every generated sitemap at once. A `layout`
+* revalidation (not `page`) is required because the route has no `generateStaticParams`,
+* so its slugs are generated on-demand and only a subtree invalidation reaches them.
+* `[sitemap]` is Next's file-routing convention, which is why it lives in this integration
+* and not in core.
 */
 const SITEMAP_ROUTE = `${SITEMAP_BASE}/[sitemap]`;
 /**
 * Next wrapper around the framework-agnostic {@link createCoreSitemapRoute}. It serves the
 * same sitemap index and collection pages, and additionally asserts the route is mounted at
 * {@link SITEMAP_ROUTE}: if the dynamic segment is not named `[sitemap]`, `params.sitemap`
-* is missing and a wrong mount would silently break `revalidatePath(SITEMAP_ROUTE, "page")`,
+* is missing and a wrong mount would silently break `revalidatePath(SITEMAP_ROUTE, "layout")`,
 * so it throws loudly on the first request instead.
 */
 function createSitemapRoute$1(client, options) {

package/dist/nextjs/server.d.ts

@@ -1,3 +1,4 @@
 import { KizloServerOptions, createKizlo } from "../integrations/nextjs/kizlo.server.js";
+import { createRobotsRoute } from "../integrations/nextjs/robots.js";
 import { SITEMAP_ROUTE, createSitemapRoute } from "../integrations/nextjs/sitemap.js";
-export { KizloServerOptions, SITEMAP_ROUTE, createKizlo, createSitemapRoute };
+export { KizloServerOptions, SITEMAP_ROUTE, createKizlo, createRobotsRoute, createSitemapRoute };

package/dist/nextjs/server.js

@@ -1,4 +1,5 @@
+import { createRobotsRoute } from "../integrations/nextjs/robots.js";
 import { SITEMAP_ROUTE, createSitemapRoute } from "../integrations/nextjs/sitemap.js";
 import { createKizlo } from "../integrations/nextjs/kizlo.server.js";
 
-export { SITEMAP_ROUTE, createKizlo, createSitemapRoute };
+export { SITEMAP_ROUTE, createKizlo, createRobotsRoute, createSitemapRoute };

package/dist/package.js

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.2.2";
+var version = "0.3.0";
 
 //#endregion
 export { version };

package/dist/post/index.js

@@ -1,5 +1,5 @@
-import { createProcedure } from "../shared/procedure.js";
 import { compare } from "../shared/crypto.js";
+import { createProcedure } from "../shared/procedure.js";
 import { deserializeListMetadata } from "../shared/serialize.js";
 import { getPostTypeService } from "../post-type/service.js";
 import { parseIdentifier } from "../shared/identifier.js";
@@ -59,7 +59,7 @@ const POST_ROUTER_MAP = {
 		}
 		const data = response.data;
 		if (input.query?.password && data.password) {
-			if (!compare(input.query.password, data.password)) throw errors.POST_PASSWORD_INVALID();
+			if (!await compare(input.query.password, data.password)) throw errors.POST_PASSWORD_INVALID();
 			return deserializePost({
 				...data,
 				password: ""

package/dist/router.d.ts

@@ -346,12 +346,23 @@ declare const ROUTER_MAP: {
         "@graph": Record<string, unknown>[];
       };
     }, DefinedErrorMapLike>;
-    sitemaps: Procedure<"internal", {}, {
-      key: string;
-      type: "author" | "post_type" | "taxonomy";
-      pages: number;
-      lastmod: string;
-    }[], DefinedErrorMapLike>;
+    sitemaps: {
+      list: Procedure<"internal", {}, {
+        key: string;
+        type: "author" | "post_type" | "taxonomy";
+        pages: number;
+        lastmod: string;
+      }[], DefinedErrorMapLike>;
+      index: Procedure<"internal", {}, {
+        origin: string;
+        sitemaps: {
+          key: string;
+          type: "author" | "post_type" | "taxonomy";
+          pages: number;
+          lastmod: string;
+        }[];
+      }, DefinedErrorMapLike>;
+    };
     robots: Procedure<"internal", {}, {
       sitemaps: string[];
       rules: {

package/dist/seo/index.js

@@ -1,6 +1,6 @@
 import { createProcedure } from "../shared/procedure.js";
 import { WP_KIZLO_BASE } from "../wordpress/constants.js";
-import { ListSitemapUrlInput, Robots, Seo, SitemapList, SitemapUrlList } from "./schema.js";
+import { ListSitemapUrlInput, Robots, Seo, SitemapIndex, SitemapList, SitemapUrlList } from "./schema.js";
 
 //#region src/seo/index.ts
 const SEO_ROUTER_MAP = {
@@ -53,17 +53,33 @@ const SEO_ROUTER_MAP = {
 			schema: response.data.schema
 		};
 	}),
-	sitemaps: createProcedure({
-		scope: "internal",
-		output: SitemapList
-	}, async ({ context, errors }) => {
-		const response = await context.service.wordpress.get("/seo/sitemaps", { base: WP_KIZLO_BASE });
-		if (response.error) {
-			context.logger.error("List sitemaps unhandled error", response.error);
-			throw errors.INTERNAL_SERVER_ERROR();
-		}
-		return response.data;
-	}),
+	sitemaps: {
+		list: createProcedure({
+			scope: "internal",
+			output: SitemapList
+		}, async ({ context, errors }) => {
+			const response = await context.service.wordpress.get("/seo/sitemaps", { base: WP_KIZLO_BASE });
+			if (response.error) {
+				context.logger.error("List sitemaps unhandled error", response.error);
+				throw errors.INTERNAL_SERVER_ERROR();
+			}
+			return response.data;
+		}),
+		index: createProcedure({
+			scope: "internal",
+			output: SitemapIndex
+		}, async ({ context, errors }) => {
+			const response = await context.service.wordpress.get("/seo/sitemaps/index", { base: WP_KIZLO_BASE });
+			if (response.error) {
+				context.logger.error("Get sitemap index unhandled error", response.error);
+				throw errors.INTERNAL_SERVER_ERROR();
+			}
+			return {
+				origin: response.data.origin,
+				sitemaps: response.data.sitemaps
+			};
+		})
+	},
 	robots: createProcedure({
 		scope: "internal",
 		output: Robots

package/dist/seo/robots.js

@@ -0,0 +1,18 @@
+//#region src/seo/robots.ts
+function createRobotsRoute(client) {
+	return async function GET(_request) {
+		const data = await client.seo.robots.call();
+		const groups = data.rules.map((rule) => {
+			const lines = [`User-agent: ${rule.userAgent}`];
+			for (const path of rule.allow) lines.push(`Allow: ${path}`);
+			for (const path of rule.disallow) lines.push(`Disallow: ${path}`);
+			return lines.join("\n");
+		});
+		const sitemaps = data.sitemaps.map((url) => `Sitemap: ${url}`).join("\n");
+		const blocks = [groups.join("\n\n"), sitemaps].filter(Boolean);
+		return new Response(`${blocks.join("\n\n")}\n`, { headers: { "Content-Type": "text/plain; charset=utf-8" } });
+	};
+}
+
+//#endregion
+export { createRobotsRoute };

package/dist/seo/schema.d.ts

@@ -131,6 +131,20 @@ declare const SitemapList: z.ZodArray<z.ZodObject<{
   lastmod: z.ZodString;
 }, z.core.$strip>>;
 type SitemapList = z.infer<typeof SitemapList>;
+declare const SitemapIndex: z.ZodObject<{
+  origin: z.ZodString;
+  sitemaps: z.ZodArray<z.ZodObject<{
+    key: z.ZodString;
+    type: z.ZodEnum<{
+      author: "author";
+      post_type: "post_type";
+      taxonomy: "taxonomy";
+    }>;
+    pages: z.ZodNumber;
+    lastmod: z.ZodString;
+  }, z.core.$strip>>;
+}, z.core.$strip>;
+type SitemapIndex = z.infer<typeof SitemapIndex>;
 declare const SitemapUrlImage: z.ZodObject<{
   loc: z.ZodString;
   title: z.ZodString;
@@ -193,4 +207,4 @@ declare const Robots: z.ZodObject<{
 }, z.core.$strip>;
 type Robots = z.infer<typeof Robots>;
 //#endregion
-export { CONTENT_TYPES, ContentType, ListSitemapUrlInput, ListSitemapUrlInputBase, Robots, RobotsRule, Seo, SeoHead, SeoSchema, Sitemap, SitemapList, SitemapUrl, SitemapUrlImage, SitemapUrlList };
+export { CONTENT_TYPES, ContentType, ListSitemapUrlInput, ListSitemapUrlInputBase, Robots, RobotsRule, Seo, SeoHead, SeoSchema, Sitemap, SitemapIndex, SitemapList, SitemapUrl, SitemapUrlImage, SitemapUrlList };

package/dist/seo/schema.js

@@ -64,6 +64,10 @@ const Sitemap = z.object({
 	lastmod: z.string()
 });
 const SitemapList = z.array(Sitemap);
+const SitemapIndex = z.object({
+	origin: z.string(),
+	sitemaps: SitemapList
+});
 const SitemapUrlImage = z.object({
 	loc: z.string(),
 	title: z.string()
@@ -93,4 +97,4 @@ const Robots = z.object({
 });
 
 //#endregion
-export { CONTENT_TYPES, ContentType, ListSitemapUrlInput, ListSitemapUrlInputBase, Robots, RobotsRule, Seo, SeoHead, SeoSchema, Sitemap, SitemapList, SitemapUrl, SitemapUrlImage, SitemapUrlList };
+export { CONTENT_TYPES, ContentType, ListSitemapUrlInput, ListSitemapUrlInputBase, Robots, RobotsRule, Seo, SeoHead, SeoSchema, Sitemap, SitemapIndex, SitemapList, SitemapUrl, SitemapUrlImage, SitemapUrlList };

package/dist/seo/sitemap.js

@@ -25,19 +25,19 @@ function createSitemapRoute(client, options) {
 		const url = new URL(request.url);
 		const slug = lastPathSegment(url);
 		if (!slug) return notFound();
-		const { origin } = url;
 		if (slug === SITEMAP_INDEX_SLUG) {
-			const { data: data$1 } = await client.seo.sitemaps();
-			return xmlResponse(renderSitemapIndex([...data$1 ?? [], ...extra.map((item) => item.entry)], origin));
+			const { data: data$1 } = await client.seo.sitemaps.index();
+			return xmlResponse(renderSitemapIndex([...data$1?.sitemaps ?? [], ...extra.map((item) => item.entry)], data$1?.origin ?? url.origin));
 		}
 		const parsed = parseSitemapSlug(slug);
 		if (!parsed) return notFound();
 		const custom = extra.find((item) => item.entry.key === parsed.key);
 		if (custom) {
 			if (parsed.page > custom.entry.pages) return notFound();
-			return xmlResponse(renderUrlSet(await custom.urls(origin, parsed.page)));
+			const { data: data$1 } = await client.seo.sitemaps.index();
+			return xmlResponse(renderUrlSet(await custom.urls(data$1?.origin ?? url.origin, parsed.page)));
 		}
-		const { data: sitemaps } = await client.seo.sitemaps();
+		const { data: sitemaps } = await client.seo.sitemaps.list();
 		if (!sitemaps) return notFound();
 		const entry = sitemaps.find((item) => item.key === parsed.key);
 		if (!entry || parsed.page > entry.pages) return notFound();

package/dist/seo/types.d.ts

@@ -62,6 +62,10 @@ interface WPK_Sitemap {
   pages: number;
   lastmod: string;
 }
+interface WPK_SitemapIndex {
+  origin: string;
+  sitemaps: WPK_Sitemap[];
+}
 interface WPK_SitemapUrlImage {
   loc: string;
   title: string;
@@ -77,4 +81,4 @@ interface WPK_ListSitemapUrlInput {
   page?: number;
 }
 //#endregion
-export { WPK_ListSitemapUrlInput, WPK_RobotRule, WPK_Robots, WPK_Seo, WPK_Sitemap, WPK_SitemapContentType, WPK_SitemapUrl, WPK_SitemapUrlImage };
+export { WPK_ListSitemapUrlInput, WPK_RobotRule, WPK_Robots, WPK_Seo, WPK_Sitemap, WPK_SitemapContentType, WPK_SitemapIndex, WPK_SitemapUrl, WPK_SitemapUrlImage };

package/dist/seo/utils.js

@@ -69,10 +69,7 @@ function renderUrlSet(urls) {
 	}).join("\n")}\n</urlset>\n`;
 }
 function xmlResponse(body) {
-	return new Response(body, { headers: {
-		"Content-Type": "application/xml; charset=utf-8",
-		"Cache-Control": "public, max-age=0, s-maxage=3600, stale-while-revalidate=86400"
-	} });
+	return new Response(body, { headers: { "Content-Type": "application/xml; charset=utf-8" } });
 }
 
 //#endregion

package/dist/shared/crypto.d.ts

@@ -1,15 +1,18 @@
-import { BinaryLike } from "node:crypto";
-
 //#region src/shared/crypto.d.ts
-
+/** SHA family accepted by the Web Crypto API. */
+type ShaAlgorithm = "SHA-256" | "SHA-384" | "SHA-512";
 /**
  * Compares two strings in a timing-safe manner to prevent timing attacks.
  *
+ * Both inputs are hashed to fixed-length digests before comparison, so the
+ * check is constant-time regardless of input length and never throws on a
+ * length mismatch.
+ *
  * @param a - The first string to compare.
  * @param b - The second string to compare.
  * @returns `true` if the strings match, `false` otherwise.
  */
-declare function compare(a: string, b: string): boolean;
+declare function compare(a: string, b: string): Promise<boolean>;
 /**
  * Hashes a secret API key with SHA-256 for secure database storage.
  * Safe to use in place of bcrypt/argon2 because API keys are high-entropy
@@ -19,10 +22,10 @@ declare function compare(a: string, b: string): boolean;
  * @param key - The raw secret API key to hash.
  * @returns A SHA-256 hex string suitable for database storage.
  */
-declare function hash(key: string): string;
+declare function hash(key: string, algorithm?: ShaAlgorithm): Promise<string>;
 /**
- * Create hmac using node crypto lib.
+ * Create an HMAC hex digest using the Web Crypto API. Defaults to SHA-256.
  */
-declare function hmac(key: string, value: BinaryLike): string;
+declare function hmac(key: string, value: string, algorithm?: ShaAlgorithm): Promise<string>;
 //#endregion
-export { compare, hash, hmac };
+export { ShaAlgorithm, compare, hash, hmac };

package/dist/shared/crypto.js

@@ -1,15 +1,28 @@
-import { createHash, createHmac, timingSafeEqual } from "node:crypto";
-
 //#region src/shared/crypto.ts
+const encoder = new TextEncoder();
+function toHex(buffer) {
+	let hex = "";
+	for (const byte of new Uint8Array(buffer)) hex += byte.toString(16).padStart(2, "0");
+	return hex;
+}
 /**
 * Compares two strings in a timing-safe manner to prevent timing attacks.
 *
+* Both inputs are hashed to fixed-length digests before comparison, so the
+* check is constant-time regardless of input length and never throws on a
+* length mismatch.
+*
 * @param a - The first string to compare.
 * @param b - The second string to compare.
 * @returns `true` if the strings match, `false` otherwise.
 */
-function compare(a, b) {
-	return timingSafeEqual(Buffer.from(a), Buffer.from(b));
+async function compare(a, b) {
+	const [ha, hb] = await Promise.all([crypto.subtle.digest("SHA-256", encoder.encode(a)), crypto.subtle.digest("SHA-256", encoder.encode(b))]);
+	const va = new Uint8Array(ha);
+	const vb = new Uint8Array(hb);
+	let diff = 0;
+	for (let i = 0; i < va.length; i++) diff |= (va[i] ?? 0) ^ (vb[i] ?? 0);
+	return diff === 0;
 }
 /**
 * Hashes a secret API key with SHA-256 for secure database storage.
@@ -20,14 +33,18 @@ function compare(a, b) {
 * @param key - The raw secret API key to hash.
 * @returns A SHA-256 hex string suitable for database storage.
 */
-function hash(key) {
-	return createHash("sha256").update(key).digest("hex");
+async function hash(key, algorithm = "SHA-256") {
+	return toHex(await crypto.subtle.digest(algorithm, encoder.encode(key)));
 }
 /**
-* Create hmac using node crypto lib.
+* Create an HMAC hex digest using the Web Crypto API. Defaults to SHA-256.
 */
-function hmac(key, value) {
-	return createHmac("sha256", key).update(value).digest("hex");
+async function hmac(key, value, algorithm = "SHA-256") {
+	const cryptoKey = await crypto.subtle.importKey("raw", encoder.encode(key), {
+		name: "HMAC",
+		hash: algorithm
+	}, false, ["sign"]);
+	return toHex(await crypto.subtle.sign("HMAC", cryptoKey, encoder.encode(value)));
 }
 
 //#endregion

package/dist/webhook/schema.js

@@ -14,14 +14,11 @@ const POST_EVENT_TYPES = [
 	"post.deleted"
 ];
 const PostEventType = z.enum(POST_EVENT_TYPES);
-const PAYMENT_EVENT_TYPES = ["payment.status_requested"];
-const PaymentEventType = z.enum(PAYMENT_EVENT_TYPES);
 const SETTINGS_EVENT_TYPES = ["settings.saved"];
 const SettingsEventType = z.enum(SETTINGS_EVENT_TYPES);
 const EVENT_TYPES = [
 	...TERM_EVENT_TYPES,
 	...POST_EVENT_TYPES,
-	...PAYMENT_EVENT_TYPES,
 	...SETTINGS_EVENT_TYPES
 ];
 const EventType = z.enum(EVENT_TYPES);
@@ -61,4 +58,4 @@ const AnyEvent = z.object({
 });
 
 //#endregion
-export { AnyEvent, KizloEvent };
+export { AnyEvent, KizloEvent, POST_EVENT_TYPES, TERM_EVENT_TYPES };

package/dist/wordpress/service.js

@@ -17,7 +17,10 @@ var WordPressService = class {
 	authHeader;
 	defaultTimeout;
 	constructor(context) {
-		this.authHeader = `${WP_AUTH_TYPE} ${Buffer.from(`${context.credentials.username}:${context.credentials.password}`, "utf8").toString("base64")}`;
+		const credentialBytes = new TextEncoder().encode(`${context.credentials.username}:${context.credentials.password}`);
+		let binary = "";
+		for (const byte of credentialBytes) binary += String.fromCharCode(byte);
+		this.authHeader = `${WP_AUTH_TYPE} ${btoa(binary)}`;
 		this.siteBase = context.credentials.url.endsWith("/") ? context.credentials.url : `${context.credentials.url}/`;
 		this.defaultTimeout = context.timeout ?? SAFE_REQUEST_TIMEOUT;
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kizlo",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "type": "module",
   "description": "A headless WordPress toolkit for TypeScript.",
   "keywords": [