@aeptus/aexeo-emdash 0.8.12 → 0.8.14

package/CHANGELOG.md

@@ -6,6 +6,133 @@ and the project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.8.14] - 2026-05-06
+
+Two regressions Aeptus surfaced after running the v0.0.18 CLI
+release against their preview deployment, plus a new opt-in
+agent-discovery audit axis.
+
+### Added
+
+- **New `agent_discovery` rule group** with two opt-in checks
+  for the well-known machine-readable artifacts that signal a
+  site's agent-facing capabilities. Off by default since the
+  underlying specs (RFC 9727 api-catalog, SEP-1649 MCP server-
+  card) have nascent adoption and would otherwise generate
+  false positives across the long tail of sites that don't
+  publish them yet. Adopters opt in via:
+  ```toml
+  [agent_discovery]
+  enabled = true
+  ```
+  - `AGT001` (warning, policy/medium): missing
+    `/.well-known/api-catalog` (RFC 9727, finalized April
+    2025). The JSON Linkset format that lets agents enumerate
+    public APIs without crawling documentation.
+  - `AGT002` (warning, policy/medium): missing
+    `/.well-known/mcp/server-card.json` (SEP-1649, draft).
+    Lets MCP clients discover the site's MCP server endpoint
+    and capabilities without prior configuration.
+- **AGT layer mapping**: Retrievability primary (these files
+  exist so agents can *find* the site's surfaces), Absorbability
+  secondary (the surfaces they point at feed agent absorption
+  of the site's content).
+- **Post-crawl artifact probe extended** to HEAD-check the AGT
+  paths during live `aexeo-cli crawl` so AGT findings respect
+  the same presence signals as facts.json / llms-full.txt.
+  Probe runs unconditionally — the cost is two extra HEAD
+  requests, and sites that don't enable AGT just see the paths
+  recorded on `CrawlMeta` without any rule-side effect.
+
+### Fixed
+
+- **A11Y findings now use `severity: "warning"` (not `"warn"`).**
+  `Finding::is_error()` is implemented as `severity != "warning"`,
+  so the four-letter form was bucketed as an error in audit
+  summaries and made `success: false` even when the only
+  findings were warning-grade A11Y heuristics (heading-jump,
+  alt-equals-filename, missing-main-landmark). The three A11Y
+  rules emitted `"warn"` (A11Y004, A11Y005, A11Y006);
+  switched all three to `"warning"` to match the rest of the
+  rule corpus. No new `is_error` semantics — just severity-
+  string normalization.
+- **SRF030 now actually finds the homepage's markdown-mirror
+  alternates.** The 0.8.13 fix introduced
+  `homepage_advertises_markdown_mirror_discovery(site)` which
+  looked up `site.page("/")` — but the home page's route is
+  the empty string `""` in this codebase (per
+  `capture_route_for_relative_path`'s mapping for
+  `index.html`), not `"/"`. The lookup always returned None,
+  the helper always returned false, and SRF030 fired anyway
+  on Aeptus's preview despite the homepage carrying
+  `<link rel="alternate" type="text/markdown" href="/index.md.txt">`.
+  Switched to `site.route_pages().find(|p| p.route.is_empty())`
+  to match the rest of the crate's home-page convention.
+  Locked in by two new unit tests
+  (srf030_recognizes_markdown_mirror_discovery_on_home,
+  srf030_skips_unrelated_alternate_types).
+
+## [0.8.13] - 2026-05-06
+
+Closes four false-positive paths Aeptus surfaced while running
+the 0.8.12 plugin against their Cloudflare Pages preview
+deployment. 0.8.12 was already on npm before these landed; this
+release bundles the fixes into one consumer-visible bump.
+
+### Fixed
+
+- **Surface discovery for facts.json / llms-full.txt /
+  manifest-listed mirrors.** Aeptus reported false-negative
+  `facts_present: false` and `llms_full_present: false` on a
+  live Cloudflare Pages crawl where curl returned 200 for
+  both URLs. Root cause: the page-crawler skips non-HTML
+  responses, so JSON / plain-text artifacts not reachable
+  via the HTML link graph were never recorded as visited
+  and `local_artifact_exists` returned false even though the
+  files existed.
+  Fix: a new `artifact_probe` module HEAD-probes well-known
+  artifact paths after the main page-crawl, manifest-first.
+  If `manifest.json` is reachable, every `path` it lists
+  under `artifacts` is added to the candidate set. Each
+  candidate is independently HEAD-probed with the existing
+  crawl auth (basic auth + custom headers, including the
+  `--cf-access-*` Cloudflare Access headers). 2xx paths are
+  recorded on `CrawlMeta.probed_artifact_paths` and folded
+  into `Site::indexed_paths` so surface discovery and rules
+  see them as present.
+  Probes are time-boxed (3s per request) and bounded (max 64
+  paths per crawl) so a manifest with thousands of entries
+  can't blow up the audit budget. The probed list round-trips
+  through the audit artifact, so `intelligence surfaces
+  discover --from-crawl-artifact` sees the same presence
+  signal a fresh live crawl would.
+- **SEO009 no longer flags `<link rel="alternate"
+  type="text/markdown">` discovery links** as "hreflang
+  alternates pointing to missing internal paths." The rule
+  now consults the `type` attribute on the alternate and
+  skips the missing-target check for non-HTML media types
+  (text/markdown, text/plain, application/json,
+  application/ld+json, atom/rss/feed+json). Genuine hreflang
+  alternates that happen to declare `type="text/html"` still
+  fire SEO009.
+- **SRF030 now recognizes the `.md.txt` mirror discovery
+  pattern.** When the homepage advertises one or more
+  `<link rel="alternate" type="text/markdown">` discovery
+  links (the per-route mirror pattern Aeptus and similar
+  sites use), the probe stays silent. This is a valid
+  Markdown-for-Agents alternative to HTTP content
+  negotiation; the rule's role is to flag *absence* of any
+  markdown discovery contract, not the choice of which one.
+- **ROB008 skips deliberate sitewide-noindex deployments.**
+  Cloudflare Pages preview sets `X-Robots-Tag: noindex`
+  sitewide while the build still emits sitemap.xml for
+  parity with production; the prior rule fired on every
+  sitemap-listed route. The rule now detects when every
+  crawled page carries `X-Robots-Tag: noindex` and skips —
+  the inconsistency narrative no longer applies. A single
+  page lacking the header breaks uniformity (it would
+  actually be indexed), and ROB008 fires normally.
+
 ## [0.8.12] - 2026-05-06
 
 Adds **Accessibility (A11Y)** as a fifth audit pillar alongside

package/dist/configured.js

@@ -1215,7 +1215,7 @@ function globToMatcher(pattern) {
 }
 
 // src/version.ts
-var PACKAGE_VERSION = "0.8.12";
+var PACKAGE_VERSION = "0.8.14";
 
 // src/configured.ts
 import { definePlugin } from "emdash";

package/dist/index.js

@@ -23,7 +23,7 @@ function buildAllowedHosts(evaluatorHost) {
 }
 
 // src/version.ts
-var PACKAGE_VERSION = "0.8.12";
+var PACKAGE_VERSION = "0.8.14";
 
 // src/sandbox.ts
 function aexeoPluginSandboxed(options = {}) {

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const PACKAGE_VERSION = "0.8.12";
+export declare const PACKAGE_VERSION = "0.8.14";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aeptus/aexeo-emdash",
-  "version": "0.8.12",
+  "version": "0.8.14",
   "description": "Aexeo SEO/GEO content evaluator as an emdash plugin",
   "license": "MIT",
   "author": "Aeptus",