@aeptus/aexeo-emdash 0.8.9 → 0.8.11

package/CHANGELOG.md

@@ -6,6 +6,150 @@ and the project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.8.11] - 2026-05-05
+
+Picks up the post-0.8.10 product additions and the FACTS003
+quality fixes Aeptus reported after running 0.8.10 in
+preview. 0.8.10 was already on npm before these landed; this
+release bundles them into one consumer-visible bump.
+
+### Added (engine via bridge)
+
+- **`SOC006` enabled by default.** Missing `og:image` now
+  surfaces on every audit. The rule existed but was gated
+  behind `require_social_images = false`; flipped to true.
+- **`SOC009` (heuristic).** Recommends `summary_large_image`
+  when `twitter:card` is plain `summary`. Editors can keep
+  `summary` if they want; this is a nudge, not a blocker.
+- **`CNT006` (heuristic, low-confidence).** Generic-beneficiary
+  detector — flags abstract audience-needs copy
+  ("Needs speed and clarity to make decisions") that has no
+  concrete anchoring (numbers, named tools, quotes). Skips
+  when concrete-anchor tokens (`study`, `research`, etc.)
+  appear nearby. Editors can suppress via the new
+  `[route_kinds]` config block.
+- **`[route_kinds]` config block.** Named per-pattern rule
+  masking that compiles to virtual suppressions:
+  ```toml
+  [route_kinds.manifesto]
+  match = ["/foundations/"]
+  skip_rules = ["GEO007", "GEO008", "GEO010"]
+  noindex = false
+  ```
+  Bundles a path-pattern set with a stance (which rules
+  to skip, whether routes are intentionally noindex). Lighter
+  than scattering one suppression per rule × pattern.
+
+### Fixed
+
+- **FACTS003 schema half no longer fires on no-schema input.**
+  Configured-mode CMS document sets don't carry rendered JSON-LD,
+  so `pages_with_schema = 0`. The previous logic emitted
+  `organization_schema.name` (Error) and `organization_schema.url`
+  (Warning) with empty `observed` — `iter().any()` is trivially
+  false on an empty set, so the negation always fired. Aeptus
+  reported this as the first half of FACTS003 noise after
+  installing 0.8.10. Schema block is now gated on
+  `pages_with_schema > 0`; the `structured_truth_source` enum
+  (`Manifest` vs `SchemaAndManifest`) still records whether
+  schema participated, so downstream consumers can tell the
+  difference between "schema agreed" and "schema wasn't part
+  of the assessment".
+- **FACTS003 title check no longer fires on legal/utility
+  pages or on pages whose JSON-LD declares the brand.** Aeptus
+  reported title warnings on `/privacy`, `/terms`, `/principles`,
+  `/references`, `/signup` simply because their titles weren't
+  "Aeptus". The check now (a) skips pages classified as
+  `PageKind::{Search, Admin, Feed, Utility, NotFound, Legal}`,
+  and (b) treats per-page identity-bearing schema with a name
+  matching the brand as another `identity_present_elsewhere`
+  signal. Content pages that genuinely never mention the brand
+  in any identity-bearing surface still fire — the user can
+  silence those via the `[route_kinds]` block from this same
+  release.
+
+### Notes for hosts upgrading from 0.8.10
+
+- No code changes required.
+- After bumping, the admin's findings page will show:
+  - **New** SOC006 findings on every document missing og:image.
+  - **New** SOC009 nudges on documents declaring
+    `twitter:card = summary`.
+  - **New** CNT006 nudges on documents whose visible text has
+    generic-beneficiary copy without concrete anchors.
+  - **Fewer** FACTS003 findings: schema-half mismatches gone
+    when the CMS doc set lacks JSON-LD; title warnings gone
+    on legal/utility pages.
+- If the new SOC/CNT findings are too noisy on a specific
+  route family, declare a `[route_kinds.X]` block in
+  `aexeo.toml` with `match` patterns and a `skip_rules` list.
+- For the infrastructure-level audit (robots/sitemap/llms/
+  well-known/etc.), run `aexeo-cli check` against your static
+  dist; that's where those rules belong.
+
+### CLI side (aexeo-cli v0.0.16, same release window)
+
+- **`aexeo-cli crawl --cf-access-id … --cf-access-secret …`**
+  injects Cloudflare Access service-token headers
+  (`CF-Access-Client-Id` + `CF-Access-Client-Secret`) on every
+  fetch. Falls back to env vars `CF_ACCESS_CLIENT_ID` /
+  `CF_ACCESS_CLIENT_SECRET` when flags are absent. Closes the
+  loop for hosts whose preview deploys are behind Cloudflare
+  Access (Aeptus's CI was blocked on this).
+
+## [0.8.10] - 2026-05-04
+
+Two follow-up quality fixes from Aeptus's 0.8.9 retest. The
+local refresh path is now end-to-end correct.
+
+### Fixed
+
+- **Findings now attribute to document routes, not synthesized
+  HTML filenames.** v0.8.9's bridge set `page.path` to
+  `emdash/<route>.html`, which the plugin's
+  `evaluateAndPersistAll` then used as the bucket key when
+  distributing findings to document routes. The synthesized
+  filename never matched the documentRoutes set, so every
+  finding landed in a shadow bucket keyed by the filename and
+  the document's row in the admin showed zero findings. Bridge
+  now sets `page.path` to the document route directly
+  (`/about` rather than `emdash/about.html`); `Finding.path`
+  matches the bucket the plugin pre-populates.
+
+### Changed
+
+- **CMS evaluation suppresses site-wide infrastructure rule
+  groups.** The plugin's configured-mode evaluator now passes
+  a Config to `evaluateDocuments` that disables `robots`,
+  `sitemap`, `llm`, `surfaces`, `well_known`, `headers`, and
+  `deployment` rule groups. The CMS document set has no
+  robots.txt or sitemap.xml or llms.txt — those are the
+  host's deployed-site artifacts, audited by the CLI's
+  static-site mode against a real filesystem. Running them
+  against the bridge's synthetic CMS site produced
+  `missing robots.txt` / `missing sitemap.xml` / `missing
+  llms.txt` / `missing markdown mirrors` noise on every
+  refresh, none of which the editor could act on from inside
+  the CMS.
+
+  Per-page rule groups stay on: `html`, `social`, `schema`,
+  `content`, `structure`, `links`. Those audit per-document
+  content editors can actually fix.
+
+  CLI static-site audits are unaffected — they use
+  `Config::default()` with all groups on, against a
+  filesystem-rooted Site.
+
+### Notes for hosts upgrading from 0.8.9
+
+- No code changes required.
+- After bumping, the admin's findings page will show fewer
+  findings (infrastructure noise gone) and every finding
+  correctly attributed to its document route.
+- For the infrastructure-level audit (robots/sitemap/llms/
+  well-known/etc.), run `aexeo-cli check` against your static
+  dist; that's where those rules belong.
+
 ## [0.8.9] - 2026-05-04
 
 ### Fixed
@@ -908,7 +1052,9 @@ First public release.
   `astro.config.mjs` for the WASM import to resolve to a
   precompiled `WebAssembly.Module`. Not optional.
 
-[Unreleased]: https://github.com/schiste/Aexeo/compare/aexeo-emdash-v0.8.9...HEAD
+[Unreleased]: https://github.com/schiste/Aexeo/compare/aexeo-emdash-v0.8.11...HEAD
+[0.8.11]: https://github.com/schiste/Aexeo/compare/aexeo-emdash-v0.8.10...aexeo-emdash-v0.8.11
+[0.8.10]: https://github.com/schiste/Aexeo/compare/aexeo-emdash-v0.8.9...aexeo-emdash-v0.8.10
 [0.8.9]: https://github.com/schiste/Aexeo/compare/aexeo-emdash-v0.8.8...aexeo-emdash-v0.8.9
 [0.8.8]: https://github.com/schiste/Aexeo/compare/aexeo-emdash-v0.8.7...aexeo-emdash-v0.8.8
 [0.8.7]: https://github.com/schiste/Aexeo/compare/aexeo-emdash-v0.8.6...aexeo-emdash-v0.8.7

package/dist/configured.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"configured.d.ts","sourceRoot":"","sources":["../src/configured.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAmFrD,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEhC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEvC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEvC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;CACvC;AAED,wBAAgB,YAAY,CAAC,OAAO,GAAE,uBAA4B,GAAG,OAAO,CA2H3E;AAID,eAAe,YAAY,CAAC"}
+{"version":3,"file":"configured.d.ts","sourceRoot":"","sources":["../src/configured.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AA0HrD,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEhC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEvC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEvC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;CACvC;AAED,wBAAgB,YAAY,CAAC,OAAO,GAAE,uBAA4B,GAAG,OAAO,CA2H3E;AAID,eAAe,YAAY,CAAC"}

package/dist/configured.js

@@ -1215,7 +1215,7 @@ function globToMatcher(pattern) {
 }
 
 // src/version.ts
-var PACKAGE_VERSION = "0.8.9";
+var PACKAGE_VERSION = "0.8.11";
 
 // src/configured.ts
 import { definePlugin } from "emdash";
@@ -1238,9 +1238,28 @@ function resolveCollections(explicit, include, exclude) {
   }
   return result;
 }
+var CMS_DISABLED_GROUPS = [
+  "robots",
+  "sitemap",
+  "llm",
+  "surfaces",
+  "well_known",
+  "headers",
+  "deployment"
+];
+function buildCmsContextConfig() {
+  const checks = {};
+  for (const group of CMS_DISABLED_GROUPS) {
+    checks[group] = false;
+  }
+  return JSON.stringify({ checks });
+}
 var inProcessEvaluator = async (documents) => {
   try {
-    const raw = await evaluateDocuments2(JSON.stringify(documents));
+    const raw = await evaluateDocuments2(
+      JSON.stringify(documents),
+      buildCmsContextConfig()
+    );
     const findings = JSON.parse(raw);
     if (!Array.isArray(findings)) {
       return {

package/dist/index.js

@@ -23,7 +23,7 @@ function buildAllowedHosts(evaluatorHost) {
 }
 
 // src/version.ts
-var PACKAGE_VERSION = "0.8.9";
+var PACKAGE_VERSION = "0.8.11";
 
 // src/sandbox.ts
 function aexeoPluginSandboxed(options = {}) {

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const PACKAGE_VERSION = "0.8.9";
+export declare const PACKAGE_VERSION = "0.8.11";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,UAAU,CAAC"}
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,WAAW,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aeptus/aexeo-emdash",
-  "version": "0.8.9",
+  "version": "0.8.11",
   "description": "Aexeo SEO/GEO content evaluator as an emdash plugin",
   "license": "MIT",
   "author": "Aeptus",