@aeptus/aexeo-emdash 0.8.1 → 0.8.6

package/CHANGELOG.md

@@ -6,6 +6,247 @@ and the project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.8.6] - 2026-05-04
+
+Code-review follow-ups on the 0.8.5 agent-readiness rule bundles.
+All five issues are real correctness fixes; no behavior change
+for sites that already had clean output.
+
+### Fixed (engine via bridge)
+
+- **Public API exposure.** `SiteCapabilities`, `infer_site_capabilities`,
+  `well_known_path_exists`, `run_well_known_rules`, and
+  `run_header_rules` are now re-exported at the `aexeo-core` root
+  to match the existing pattern (`run_robots_rules`,
+  `run_surface_rules`, etc.). Previously consumers had to use the
+  long `aexeo_core::well_known_rules::run_well_known_rules` form.
+- **LNK020 group/check-key mismatch.** The rule was registered under
+  the `links` group but gated on the `headers` config key in
+  `static_check.rs`; toggling `links: false` would not silence it
+  and toggling `headers: false` would silence an unrelated group.
+  Fixed by moving LNK020 to a new `headers` rule group so the
+  registry name matches the toggle key.
+- **`route_looks_api` over-match.** Bare `v1/`, `v2/`, and
+  `graphql` prefixes incorrectly classified docs routes
+  (`/v1/getting-started`, `/v2/migration-guide`, `/graphql-101`)
+  as API surfaces, triggering SRF020 false-positives on
+  content-only docs sites. Tightened to require `api/` or
+  `graphql/` (with the slash) — the conditional-firing design's
+  whole point is to keep these silent on content sites.
+- **`render_robots_txt` round-trip.** Aexeo's own generator emitted
+  a robots.txt that tripped ROB010 + ROB011 (no AI-bot block, no
+  Content-Signal). Generator now emits explicit AI-bot blocks
+  (GPTBot, ClaudeBot, PerplexityBot, Google-Extended, CCBot) and
+  a permissive Content-Signal default so Aexeo's own output
+  passes Aexeo's own rules.
+- **SRF010/SRF015 unreachable from path-only signals.** The
+  capability gate required the canonical card/index file to
+  exist, but the rule fires when that exact file is missing —
+  structurally unreachable. Inference now also fires when the
+  `.well-known/mcp/` or `.well-known/agent-skills/` directory
+  exists without a canonical file inside (the partial-stub
+  pattern editors hit when starting an implementation).
+
+### Notes for hosts upgrading from 0.8.5
+
+- No code changes required.
+- `aexeo-cli generate robots-txt` (and the deploy generator) now
+  produces a robots.txt with explicit AI-bot blocks and a
+  Content-Signal directive. Editors who want a non-permissive
+  stance edit the line; the defaults match the wildcard `Allow: /`
+  posture so existing crawl behavior is unchanged.
+- Sites that have a `.well-known/mcp/` or
+  `.well-known/agent-skills/` directory stub without canonical
+  files inside will now see SRF010 / SRF015 fire (correctly —
+  the directory-stub state is exactly what the rule was meant
+  to catch).
+
+## [0.8.5] - 2026-05-04
+
+Brings in the agent-readiness audit rules from upstream
+aexeo-core 0.0.11 — three bundles extracted from the Cloudflare
+"Is Your Site Agent-Ready?" scan model.
+
+### Added (engine via bridge)
+
+- **Bundle A — robots.txt extensions** (always-on, retrievability):
+  - `ROB010` — robots.txt has no AI-bot User-agent directives
+    (GPTBot, ClaudeBot, ChatGPT-User, PerplexityBot, …)
+  - `ROB011` — robots.txt has no Content-Signal directives
+    (`ai-train`, `search`, `ai-input`)
+
+- **Bundle B — `.well-known/*` discovery surfaces** (conditional,
+  absorbability). All gated on a new `SiteCapabilities` inference
+  that reads route patterns, JSON-LD schema, llms.txt content,
+  and partial-file presence to decide whether the site claims
+  the underlying capability — so these rules don't fire on
+  content-only sites that have no business exposing the surface:
+  - `SRF010 / SRF011` — agent-skills index (Cloudflare RFC v0.2.0)
+  - `SRF015 / SRF016` — MCP server card (SEP-1649)
+  - `SRF020 / SRF021` — API catalog (RFC 9727 linkset+json)
+  - `SRF025` — OAuth/OIDC discovery (RFC 8414, OIDC Discovery 1.0)
+  - `SRF026` — OAuth protected-resource metadata (RFC 9728)
+
+- **Bundle C — runtime header audits** (runtime-only, mixed):
+  - `LNK020` — homepage response sends no Link headers (RFC 8288).
+    Silent on pure static audits — fires only when `Page.response_headers`
+    is populated.
+  - `SRF030` — homepage doesn't honor `Accept: text/markdown`
+    content negotiation (Cloudflare Markdown for Agents). Adds
+    one extra HTTP probe at the end of the runtime audit.
+
+### Notes for hosts upgrading from 0.8.4
+
+- No code changes required.
+- Static audits will gain ROB010/011 immediately on every site;
+  the SRF010+ rules are silent unless the site has the
+  capability signal (so most content sites see no new findings).
+- LNK020 + SRF030 only fire during runtime audits — static
+  audits don't reach that code path.
+- The new `SiteCapabilities` API is exported from aexeo-core
+  for hosts that want to reuse the inference in their own
+  tooling.
+
+## [0.8.4] - 2026-05-04
+
+Three follow-up quality fixes from Aeptus's post-0.8.3 rollout
+report. The 0.8.3 manifest-quality and GEO009 fixes landed
+correctly; this release closes the remaining edges that surfaced
+once those were out the door.
+
+### Fixed (engine via bridge)
+
+- **Multilingual 404 detection.** v0.0.9's blocklist was
+  English-only, so French, Spanish, Italian, German, Dutch, and
+  Portuguese 404 titles still leaked through as candidate
+  organization/product names. Aeptus reported a French
+  "Page introuvable" landing as `products[0].name`. The detector
+  now matches on cross-language morphological cues
+  (`introuvable`, `non trouv`, `no encontrad`, `não encontrad`,
+  `non trovat`, `nicht gefunden`, `niet gevonden`) plus the
+  literal numeric `404` anchor.
+
+### Fixed (presence diagnostic via bridge)
+
+- **RDAP normalizes to the apex domain.** The diagnostic was
+  asking rdap.org about `www.aeptus.com` (whatever subdomain the
+  manifest's website happened to record), which returns
+  not_found because the registrable domain is the apex
+  (`aeptus.com`). The RDAP fetcher now strips a leading `www.`
+  before the lookup; the result text shows the original host
+  alongside the apex so editors can see what was actually
+  checked. Deeper subdomains (`blog.foo.bar`) still need
+  manual manifest correction — full public-suffix-list-aware
+  resolution is a future hardening.
+- **Wikidata disambiguation.** wbsearchentities returns
+  label-matched candidates without distinguishing
+  Aeptus-the-company from Aeptus-the-genus-of-insects. The
+  fetcher now requests up to 10 candidates and prefers ones
+  whose description doesn't begin with natural-world or
+  geographic disambiguators (`genus of`, `species of`, `village
+  in`, `asteroid`, …). When every match is a generic-concept
+  description, the result still lands but `extra` flags
+  "likely disambiguation needed" so the editor sees the
+  problem instead of trusting the wrong record.
+
+### Notes for hosts upgrading from 0.8.3
+
+- No code changes required; pure engine-side improvements.
+- Worth re-running `intelligence facts generate` if your site
+  has any non-English 404 page that was leaking through.
+- Worth re-running `intelligence presence` if you saw
+  Wikidata false-positives or RDAP not-found on a www-prefixed
+  domain.
+
+## [0.8.3] - 2026-05-04
+
+Picks up the upstream aexeo-core 0.0.9 improvements that address
+the two open quality items Aeptus flagged after the 0.8.1 + CLI
+0.0.8 rollout.
+
+### Changed (engine via bridge)
+
+- **Truth-manifest generator no longer picks listing-page or
+  404 titles as the organization/product name.** Aeptus's
+  facts.json was being generated with `organization.name = "Blog"`
+  and `product.name = "Page not found"` because the listing page's
+  title outvoted the homepage and the 404 page's title leaked into
+  the candidate corpus. Three engine fixes ship in this release:
+  (a) the generic-label blocklist now covers blog, posts,
+  articles, authors, tags, categories, search, archive, page not
+  found, 404, error, oops, and pure-numeric labels;
+  (b) 404 / error pages are detected by title/h1 patterns and
+  excluded from the candidate corpus entirely;
+  (c) the homepage signal wins over any subpage signal regardless
+  of count when present.
+
+  This is a generation-quality improvement, not a wire-format
+  change — existing stored manifests are unaffected. Hosts who
+  re-run `intelligence facts generate` will get a cleaner draft.
+
+- **GEO009 ("page facts misalign across title/H1/OG/schema")
+  now uses the same identity-extraction logic as the
+  `intelligence identity` diagnostic.** Previously the rule read
+  every JSON-LD `name` field (including BreadcrumbList items and
+  ItemList children), so it fired on listing/author/localized
+  routes where breadcrumb crumbs leaked in. The diagnostic
+  already restricted to top-level identity-bearing schema; the
+  rule and the diagnostic now share that filter. Aeptus's
+  ~44 GEO009 warnings on listing/author/localized routes should
+  drop after re-running the audit.
+
+### Notes for hosts upgrading from 0.8.x
+
+- No code changes required — pure engine-side improvements.
+- Re-run `intelligence facts generate` if you generated your
+  manifest with v0.0.7 or earlier of the CLI; the new generator
+  output is materially better.
+- Re-run the audit; expect GEO009 counts to drop on listing
+  pages without any host-side change.
+
+## [0.8.2] - 2026-05-04
+
+Fix for the residual entity-presence trim() crash that 0.8.1
+didn't solve.
+
+### Fixed
+
+- **`/facts` and `/presence` routes were double-wrapping their
+  return values.** Both handlers returned `{ data: ... }` payloads,
+  but emdash's route registry already wraps a handler's return as
+  `{ data: <result> }` at the wire boundary. The result was
+  `{ data: { data: ... } }` on the wire. The React caller's
+  single-unwrap (`body.data`) surfaced `{ data: ... }` to the
+  consumer where the actual payload was expected — so
+  `(res as ManifestData).manifest` came back as `undefined`,
+  `JSON.stringify(undefined)` returned the literal `undefined`,
+  `setDraft(undefined)` set the textarea draft to undefined, and
+  the next render crashed on `draft.trim()`.
+
+  Fixed by changing both route handlers to return raw payloads
+  (matching the `/data` and `/refresh` route convention that has
+  always worked correctly). Errors are now signaled by throwing
+  `PluginRouteError` from the `emdash` package — the registry
+  treats thrown PluginRouteErrors as structured failures and
+  routes them through the host's standard error path. Returned
+  `{ error: ... }` objects (the previous pattern) flowed through
+  the success path and silently masqueraded as data.
+
+### Notes for hosts upgrading from 0.8.x
+
+- No code changes required.
+- The wire format of the `/facts` and `/presence` route responses
+  changes: where they previously returned
+  `{ data: { data: <payload> } }`, they now return
+  `{ data: <payload> }`. Anyone calling these routes directly
+  (outside the bundled React admin) needs to drop one unwrap.
+  The bundled admin is updated in lockstep so editors see no
+  behavioral difference beyond the bug being fixed.
+- Error responses for these routes now come back through the
+  standard `PluginRouteError` envelope (HTTP 4xx with
+  `{ error: { code, message } }`) instead of being silently
+  embedded in success responses.
+
 ## [0.8.1] - 2026-05-03
 
 Fix for the entity-presence diagnostic shipped in 0.8.0.
@@ -519,7 +760,12 @@ First public release.
   `astro.config.mjs` for the WASM import to resolve to a
   precompiled `WebAssembly.Module`. Not optional.
 
-[Unreleased]: https://github.com/schiste/Aexeo/compare/aexeo-emdash-v0.8.1...HEAD
+[Unreleased]: https://github.com/schiste/Aexeo/compare/aexeo-emdash-v0.8.6...HEAD
+[0.8.6]: https://github.com/schiste/Aexeo/compare/aexeo-emdash-v0.8.5...aexeo-emdash-v0.8.6
+[0.8.5]: https://github.com/schiste/Aexeo/compare/aexeo-emdash-v0.8.4...aexeo-emdash-v0.8.5
+[0.8.4]: https://github.com/schiste/Aexeo/compare/aexeo-emdash-v0.8.3...aexeo-emdash-v0.8.4
+[0.8.3]: https://github.com/schiste/Aexeo/compare/aexeo-emdash-v0.8.2...aexeo-emdash-v0.8.3
+[0.8.2]: https://github.com/schiste/Aexeo/compare/aexeo-emdash-v0.8.1...aexeo-emdash-v0.8.2
 [0.8.1]: https://github.com/schiste/Aexeo/compare/aexeo-emdash-v0.8.0...aexeo-emdash-v0.8.1
 [0.8.0]: https://github.com/schiste/Aexeo/compare/aexeo-emdash-v0.7.0...aexeo-emdash-v0.8.0
 [0.7.0]: https://github.com/schiste/Aexeo/compare/aexeo-emdash-v0.6.0...aexeo-emdash-v0.7.0

package/dist/configured.js

@@ -469,8 +469,8 @@ async function handleDataRoute(ctx, options) {
     });
     await persistManifestStateFindings(ctx);
   }
-  const payload = await buildFindingsPayload(ctx);
-  return { payload, summary };
+  const payload2 = await buildFindingsPayload(ctx);
+  return { payload: payload2, summary };
 }
 async function buildFindingsPayload(ctx) {
   const stored = await readAllStoredDocuments(ctx.kv);
@@ -649,6 +649,7 @@ function buildPublishedUrl(meta, route, siteUrl) {
 }
 
 // src/facts-route.ts
+import { PluginRouteError } from "emdash";
 async function handleFactsRoute(ctx) {
   const body = ctx.input ?? {};
   switch (body.kind) {
@@ -661,47 +662,34 @@ async function handleFactsRoute(ctx) {
     case "save":
       return await handleSave(ctx, body);
     default:
-      return {
-        error: {
-          code: "unknown_kind",
-          message: `unknown facts route kind: ${String(body.kind)}`
-        }
-      };
+      throw PluginRouteError.badRequest(
+        `unknown facts route kind: ${String(body.kind)}`
+      );
   }
 }
 async function handleData(ctx) {
   const manifest = await readStoredFacts(ctx.kv);
   return {
-    data: {
-      manifest,
-      // The presence flag lets the React component branch on
-      // "show authoring CTA" vs "show 'manifest stored' state" without
-      // having to introspect the manifest shape.
-      present: manifest !== null
-    }
+    manifest,
+    // The presence flag lets the React component branch on
+    // "show authoring CTA" vs "show 'manifest stored' state" without
+    // having to introspect the manifest shape.
+    present: manifest !== null
   };
 }
 async function handlePrompt(ctx) {
   const documents = await readAllDocuments(ctx.kv);
   if (documents.length === 0) {
-    return {
-      error: {
-        code: "no_documents",
-        message: "no documents indexed yet \u2014 click Refresh on the Findings page first, then come back to author the manifest"
-      }
-    };
+    throw PluginRouteError.badRequest(
+      "no documents indexed yet \u2014 click Refresh on the Findings page first, then come back to author the manifest"
+    );
   }
   const prompt = await generateFactsPrompt2(JSON.stringify(documents));
-  return { data: { prompt } };
+  return { prompt };
 }
 async function handleValidate(ctx, body) {
   if (typeof body.manifest_json !== "string" || body.manifest_json.length === 0) {
-    return {
-      error: {
-        code: "missing_manifest",
-        message: "manifest_json field is required"
-      }
-    };
+    throw PluginRouteError.badRequest("manifest_json field is required");
   }
   const documents = await readAllDocuments(ctx.kv);
   try {
@@ -709,24 +697,16 @@ async function handleValidate(ctx, body) {
       body.manifest_json,
       JSON.stringify(documents)
     );
-    return { data: JSON.parse(raw) };
+    return JSON.parse(raw);
   } catch (error) {
-    return {
-      error: {
-        code: "validate_failed",
-        message: error instanceof Error ? error.message : String(error)
-      }
-    };
+    throw PluginRouteError.badRequest(
+      error instanceof Error ? error.message : String(error)
+    );
   }
 }
 async function handleSave(ctx, body) {
   if (typeof body.manifest_json !== "string" || body.manifest_json.length === 0) {
-    return {
-      error: {
-        code: "missing_manifest",
-        message: "manifest_json field is required"
-      }
-    };
+    throw PluginRouteError.badRequest("manifest_json field is required");
   }
   const documents = await readAllDocuments(ctx.kv);
   let validation;
@@ -738,37 +718,31 @@ async function handleSave(ctx, body) {
     const parsed2 = JSON.parse(raw);
     validation = parsed2.validation;
   } catch (error) {
-    return {
-      error: {
-        code: "validate_failed",
-        message: error instanceof Error ? error.message : String(error)
-      }
-    };
+    throw PluginRouteError.badRequest(
+      error instanceof Error ? error.message : String(error)
+    );
   }
   if (!validation.valid || validation.errors.length > 0) {
-    return {
-      error: {
-        code: "validation_failed",
-        message: `manifest does not pass shape validation: ${validation.errors.slice(0, 3).join("; ")}`
-      }
-    };
+    throw PluginRouteError.badRequest(
+      `manifest does not pass shape validation: ${validation.errors.slice(0, 3).join("; ")}`
+    );
   }
   let parsed;
   try {
     parsed = JSON.parse(body.manifest_json);
   } catch (error) {
-    return {
-      error: {
-        code: "parse_failed",
-        message: error instanceof Error ? error.message : String(error)
-      }
-    };
+    throw PluginRouteError.badRequest(
+      error instanceof Error ? error.message : String(error)
+    );
   }
   await ctx.kv.set(FACTS_KEY, parsed);
   await persistManifestStateFindings(ctx);
-  return { data: { saved: true } };
+  return { saved: true };
 }
 
+// src/presence-route.ts
+import { PluginRouteError as PluginRouteError2 } from "emdash";
+
 // src/presence-check.ts
 var FETCH_TIMEOUT_MS = 5e3;
 var USER_AGENT = "aexeo-emdash-plugin/0.8 (+https://github.com/schiste/Aexeo; entity-presence diagnostic)";
@@ -1073,58 +1047,53 @@ async function handlePresenceRoute(ctx) {
     case "refresh":
       return await handleRefresh(ctx);
     default:
-      return {
-        error: {
-          code: "unknown_kind",
-          message: `unknown presence route kind: ${String(body.kind)}`
-        }
-      };
+      throw PluginRouteError2.badRequest(
+        `unknown presence route kind: ${String(body.kind)}`
+      );
   }
 }
 async function handleData2(ctx) {
   const manifest = await readStoredFacts(ctx.kv);
   if (manifest === null) {
-    return wireResponse("no_manifest", [], null, null);
+    return payload("no_manifest", [], null, null);
   }
   const entity = entityFromManifest(manifest);
   if (entity === null) {
-    return wireResponse("no_organization", [], null, null);
+    return payload("no_organization", [], null, null);
   }
   const cached = await ctx.kv.get(PRESENCE_KEY);
   if (!cached) {
-    return wireResponse("empty", [], null, entity.name);
+    return payload("empty", [], null, entity.name);
   }
   if (cached.entityName !== entity.name) {
-    return wireResponse("empty", [], null, entity.name);
+    return payload("empty", [], null, entity.name);
   }
   const ageMs = ageMillis(cached.generatedAt);
   const state = ageMs !== null && ageMs > CACHE_TTL_MS ? "stale" : "fresh";
-  return wireResponse(state, cached.results, cached.generatedAt, entity.name);
+  return payload(state, cached.results, cached.generatedAt, entity.name);
 }
 async function handleRefresh(ctx) {
   const manifest = await readStoredFacts(ctx.kv);
   if (manifest === null) {
-    return wireResponse("no_manifest", [], null, null);
+    return payload("no_manifest", [], null, null);
   }
   const entity = entityFromManifest(manifest);
   if (entity === null) {
-    return wireResponse("no_organization", [], null, null);
+    return payload("no_organization", [], null, null);
   }
   const results = await checkAllSources(entity);
   const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const payload = {
+  const cachePayload = {
     results,
     generatedAt,
     entityName: entity.name
   };
-  await ctx.kv.set(PRESENCE_KEY, payload);
-  return wireResponse("fresh", results, generatedAt, entity.name);
+  await ctx.kv.set(PRESENCE_KEY, cachePayload);
+  return payload("fresh", results, generatedAt, entity.name);
 }
-function wireResponse(state, results, generatedAt, entityName) {
+function payload(state, results, generatedAt, entityName) {
   const ageMinutes = generatedAt === null ? null : Math.max(0, Math.floor((ageMillis(generatedAt) ?? 0) / 6e4));
-  return {
-    data: { state, results, generatedAt, entityName, ageMinutes }
-  };
+  return { state, results, generatedAt, entityName, ageMinutes };
 }
 function ageMillis(iso) {
   const t = Date.parse(iso);
@@ -1191,7 +1160,7 @@ function globToMatcher(pattern) {
 }
 
 // src/version.ts
-var PACKAGE_VERSION = "0.8.1";
+var PACKAGE_VERSION = "0.8.6";
 
 // src/configured.ts
 import { definePlugin } from "emdash";

package/dist/facts-route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"facts-route.d.ts","sourceRoot":"","sources":["../src/facts-route.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAa9C,UAAU,YAAa,SAAQ,UAAU;IACvC,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAmB1E"}
+{"version":3,"file":"facts-route.d.ts","sourceRoot":"","sources":["../src/facts-route.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAa9C,UAAU,YAAa,SAAQ,UAAU;IACvC,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAcD,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAgB1E"}

package/dist/index.js

@@ -23,7 +23,7 @@ function buildAllowedHosts(evaluatorHost) {
 }
 
 // src/version.ts
-var PACKAGE_VERSION = "0.8.1";
+var PACKAGE_VERSION = "0.8.6";
 
 // src/sandbox.ts
 function aexeoPluginSandboxed(options = {}) {

package/dist/presence-route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"presence-route.d.ts","sourceRoot":"","sources":["../src/presence-route.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAuC9C,UAAU,YAAa,SAAQ,UAAU;IACvC,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAMD,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,YAAY,GAChB,OAAO,CAAC,OAAO,CAAC,CAelB"}
+{"version":3,"file":"presence-route.d.ts","sourceRoot":"","sources":["../src/presence-route.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA0C9C,UAAU,YAAa,SAAQ,UAAU;IACvC,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAMD,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,YAAY,GAChB,OAAO,CAAC,OAAO,CAAC,CAYlB"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const PACKAGE_VERSION = "0.8.1";
+export declare const PACKAGE_VERSION = "0.8.6";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aeptus/aexeo-emdash",
-  "version": "0.8.1",
+  "version": "0.8.6",
   "description": "Aexeo SEO/GEO content evaluator as an emdash plugin",
   "license": "MIT",
   "author": "Aeptus",