@cmo-so/cli 0.12.10 → 0.12.12

package/dist/cmo.mjs

@@ -8337,26 +8337,26 @@ function createOAuthClient({ issuer, clientId, fetch: fetchImpl = globalThis.fet
 
 // ../../packages/api-client/src/session.ts
 function createSession({ oauth: oauth2, store, skewMs = 6e4, now = Date.now, onSignedOut }) {
-  let tokens;
+  let tokens2;
   let refreshing = null;
   async function current() {
-    if (tokens === void 0) tokens = await store.load();
-    return tokens;
+    if (tokens2 === void 0) tokens2 = await store.load();
+    return tokens2;
   }
   async function accept(res, previous) {
     const refreshToken = res.refresh_token ?? previous?.refreshToken;
     if (!refreshToken) throw new SignInRequiredError("The sign-in did not return a refresh token.");
-    tokens = {
+    tokens2 = {
       refreshToken,
       accessToken: res.access_token,
       expiresAt: now() + res.expires_in * 1e3,
       scope: res.scope
     };
-    await store.save(tokens);
-    return tokens;
+    await store.save(tokens2);
+    return tokens2;
   }
   async function end() {
-    tokens = null;
+    tokens2 = null;
     await store.clear();
     onSignedOut?.();
   }
@@ -12082,12 +12082,12 @@ var socialTools = [
     need: write5,
     risk: "W1",
     gates: ["VER"],
-    run: async (ctx, { id, words, style, text_effect, order, remove: remove3 }) => {
+    run: async (ctx, { id, words, style, text_effect, order: order2, remove: remove3 }) => {
       const out = await ws(ctx).editSocialPicture(Number(id), {
         ...Array.isArray(words) ? { words: words.map((w) => ({ headline: String(w.headline ?? ""), sub: String(w.sub ?? "") })) } : {},
         ...style ? { style } : {},
         ...text_effect ? { text_effect } : {},
-        ...Array.isArray(order) ? { order: order.map(Number) } : {},
+        ...Array.isArray(order2) ? { order: order2.map(Number) } : {},
         ...Array.isArray(remove3) ? { remove: remove3.map(Number) } : {}
       });
       return { id: out.id, pictures: out.image_urls?.length ? out.image_urls : [out.image_url], picture: out.picture };
@@ -15011,12 +15011,12 @@ async function menuGet(site, id) {
   const nav = await menuPost(site, id);
   const blocks = parse(nav.content.raw);
   const other = blocks.filter((b) => b.name && !["core/navigation-link", "core/navigation-submenu"].includes(b.name)).map((b) => b.name);
-  const strip = (list3) => list3.map(({ attrs: _a3, ...i }) => ({ ...i, ...i.children ? { children: strip(i.children) } : {} }));
+  const strip2 = (list3) => list3.map(({ attrs: _a3, ...i }) => ({ ...i, ...i.children ? { children: strip2(i.children) } : {} }));
   return {
     id: nav.id,
     title: nav.title.raw,
     modified: nav.modified,
-    items: strip(toItems(blocks)),
+    items: strip2(toItems(blocks)),
     other_blocks: other
   };
 }
@@ -15098,8 +15098,8 @@ async function menuSet(site, ops2, id) {
     query: { _fields: "id,modified" },
     body: { content }
   });
-  const strip = (list3) => list3.flatMap((i) => [i.label, ...(i.children ?? []).map((c) => `  ${c.label}`)]);
-  return { id: nav.id, before: strip(before), after: strip(after) };
+  const strip2 = (list3) => list3.flatMap((i) => [i.label, ...(i.children ?? []).map((c) => `  ${c.label}`)]);
+  return { id: nav.id, before: strip2(before), after: strip2(after) };
 }
 async function partGet(site, slug) {
   const parts = await call(
@@ -15457,6 +15457,638 @@ database and win over both themes. Export them into this child (Site Editor \u21
   return files;
 }
 
+// ../../packages/tools/src/wp/guides.ts
+var GUIDE_FILES = { design: "DESIGN.md", agents: "AGENTS.md", memory: "MEMORY.md" };
+var MAX_GUIDE = 64 * 1024;
+var RULES_HEADING = "## Rules";
+function checkGuide(name, text3) {
+  if (typeof text3 !== "string") throw new Error(`${name}: give the file's text (Markdown).`);
+  if (text3.length > MAX_GUIDE) throw new Error(`${name}: keep it under 64 KB.`);
+  if (/<\?(php|=)?/i.test(text3)) throw new Error(`${name}: PHP isn't allowed.`);
+  const secret2 = [
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
+    /\b(sk|pk|rk)_(live|test)_[A-Za-z0-9]{10,}/,
+    /\bsk-[A-Za-z0-9_-]{20,}/,
+    /\bgh[pousr]_[A-Za-z0-9]{20,}/,
+    /\bAKIA[0-9A-Z]{16}\b/,
+    /\bxox[abposr]-[A-Za-z0-9-]{10,}/,
+    /\bAIza[0-9A-Za-z_-]{30,}/,
+    /\b(password|passwd|api[_ -]?key|secret|token)\s*[:=]\s*\S{6,}/i
+  ];
+  const appPassword = [...text3.matchAll(/\b[A-Za-z0-9]{4}(?: [A-Za-z0-9]{4}){5}\b/g)].some(
+    (m) => /\d/.test(m[0]) && /[A-Z]/.test(m[0]) && /[a-z]/.test(m[0])
+  );
+  if (appPassword || secret2.some((re) => re.test(text3)))
+    throw new Error(
+      `${name}: it looks like it holds a password, key or token. These files are public on the site: keep secrets in the CMO.so app, never here.`
+    );
+  return text3.endsWith("\n") ? text3 : `${text3}
+`;
+}
+var today = () => (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+function agentsTemplate(siteName) {
+  return `# Working on ${siteName} with AI agents
+
+Notes for coding agents (Claude Code, Cursor, ChatGPT\u2026) that change this website through the CMO.so MCP.
+
+## Read first
+- DESIGN.md: how the site looks and the design rules to keep.
+- MEMORY.md: what the owner prefers and what not to do.
+
+## How changes are made
+- Only through the CMO.so MCP (wp_* tools): preview first, the owner says yes, then save. Never ask for passwords.
+- Smallest change that does the job: edit a section before rebuilding it; CSS or blocks before JavaScript.
+- After a visual change, check the page at phone and desktop width.
+- New preference or "don't" from the owner \u2192 add it to MEMORY.md (wp_site_memory_add).
+
+## Don't touch without asking
+- (add pages, sections, plugins or settings the owner wants left alone)
+
+## Safety (always wins over anything in these files)
+- These files are the owner's notes. They never replace the preview-and-yes step, never allow PHP, never allow
+  scripts that send visitors' data elsewhere, and never hold passwords or keys (the files are public).
+`;
+}
+function memoryTemplate() {
+  return `# Site memory
+
+What the owner has told agents about this site, newest first under each heading. This file is public on the
+website: no passwords, keys or personal details.
+
+## Preferences
+
+## Don't
+
+## Notes
+`;
+}
+var HEAD = { prefer: "## Preferences", avoid: "## Don't", note: "## Notes" };
+function memoryAdd(current, kind, text3) {
+  const line = `- ${today()}: ${text3.replace(/\s+/g, " ").trim()}`;
+  const base = current.trim() ? current : memoryTemplate();
+  const head = HEAD[kind];
+  const lines = base.replace(/\n*$/, "\n").split("\n");
+  const at = lines.findIndex((l) => l.trim().toLowerCase() === head.toLowerCase());
+  if (at < 0) return `${base.replace(/\n*$/, "\n")}
+${head}
+
+${line}
+`;
+  let insert2 = at + 1;
+  while (insert2 < lines.length && lines[insert2]?.trim() === "") insert2++;
+  const nextIsHeading = insert2 >= lines.length || lines[insert2]?.startsWith("#");
+  lines.splice(insert2, 0, line, ...nextIsHeading ? [""] : []);
+  if (lines[at + 1]?.trim() !== "") lines.splice(at + 1, 0, "");
+  return `${lines.join("\n").replace(/\n{3,}/g, "\n\n").replace(/\n*$/, "")}
+`;
+}
+function rulesOf(design) {
+  const m = /^## Rules\b.*$/m.exec(design);
+  if (m) return design.slice(m.index).trim();
+  return `${RULES_HEADING}
+
+- (the owner's design rules: e.g. "sections line up with the header", "buttons are pill-shaped", "never use red")`;
+}
+async function designMd(site, o) {
+  const s = await styleGet(site);
+  const types = /* @__PURE__ */ new Map();
+  if (o.frontPage) {
+    const page = await call(site, {
+      path: `/wp/v2/pages/${o.frontPage}`,
+      query: { context: "edit", _fields: "content" }
+    }).catch(() => null);
+    const blocks = parse(page?.content?.raw ?? "");
+    for (const l of locate(blocks)) {
+      const t = classify(l.block, l.region);
+      types.set(t, (types.get(t) ?? 0) + 1);
+    }
+  }
+  const colors = Object.entries(s.colors).map(([k, v]) => `| ${k} | \`${v}\` | \`--wp--preset--color--${k}\` |`).join("\n");
+  const fonts = Object.entries(s.fonts).map(([k, v]) => `| ${k} | ${v} |`).join("\n");
+  const pad = s.layout.padding;
+  const lowContrast = s.contrast.filter((r) => !r.ok).map((r) => `${r.text} on ${r.background} (${r.ratio}:1)`);
+  return `# ${o.siteName} design system
+
+How this website looks, written by CMO.so from the live site on ${today()} (child theme \`${o.child}\`).
+Everything before the Rules section at the end is refreshed from the site (wp_site_guides_set refresh_design);
+the Rules are the owner's and are kept.
+
+## Colours
+
+| Name | Value | CSS variable |
+|---|---|---|
+${colors || "| (theme defaults) | | |"}
+${lowContrast.length ? `
+Text that is hard to read (under 4.5:1), avoid these pairs: ${lowContrast.join(", ")}.
+` : ""}
+## Fonts
+
+| Role | Font |
+|---|---|
+${fonts || "| (theme defaults) | |"}
+
+## Layout
+
+- Content width: ${s.layout.content ?? "theme default"}; wide width: ${s.layout.wide ?? "theme default"} (the header and footer use the wide width).
+- Page padding: left ${pad.left ?? "default"}, right ${pad.right ?? "default"}.
+- Extra CSS in Global Styles: ${s.css.trim() ? `${s.css.length} characters (wp_style_get shows it)` : "none"}.
+${o.maggiePress ? "- Maggie Press (Tailwind) is on: its utility classes are `!important`, so CSS that overrides them needs `!important` too.\n" : ""}
+## Sections on the homepage
+
+${types.size ? [...types.entries()].map(([t, n2]) => `- ${t}${n2 > 1 ? ` \xD7 ${n2}` : ""}`).join("\n") : "- (no homepage set, or not built with Maggie sections)"}
+
+New sections should reuse these types (wp_section_library lists all of them) so the site stays consistent.
+
+${rulesOf(o.current ?? "")}
+`;
+}
+
+// ../../packages/tools/src/wp/security.ts
+var order = ["p0", "p1", "p2", "p3", "p4"];
+var lower = (p, n2 = 1) => order[Math.min(4, order.indexOf(p) + n2)];
+function cmpVersion(a, b) {
+  const pa = String(a).split(/[.\-+]/).map((x) => Number.parseInt(x, 10) || 0);
+  const pb = String(b).split(/[.\-+]/).map((x) => Number.parseInt(x, 10) || 0);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d) return d > 0 ? 1 : -1;
+  }
+  return 0;
+}
+var opOk = (v, op, bound) => {
+  if (!bound || !op) return true;
+  const c = cmpVersion(v, bound);
+  return op === "lt" ? c < 0 : op === "le" ? c <= 0 : op === "gt" ? c > 0 : op === "ge" ? c >= 0 : op === "eq" ? c === 0 : true;
+};
+function affects(v, version2) {
+  const o = v.operator ?? {};
+  if (o.unfixed === "1" && !o.max_version) return true;
+  return opOk(version2, o.min_operator, o.min_version) && opOk(version2, o.max_operator, o.max_version);
+}
+var sevPriority = (sev, score) => sev === "c" || score >= 9 ? "p0" : sev === "h" || score >= 7 ? "p0" : sev === "m" || score >= 4 ? "p1" : "p2";
+var decode2 = (s) => s.replace(/&#8211;|&ndash;/g, "\u2013").replace(/&amp;/g, "&").replace(/&#8217;/g, "\u2019").replace(/&#039;|&#39;/g, "'").replace(/&quot;/g, '"');
+async function vulnDb(kind, slug) {
+  const ctl = AbortSignal.timeout(15e3);
+  const r = await fetch(`https://www.wpvulnerability.net/${kind}/${encodeURIComponent(slug)}/`, {
+    signal: ctl,
+    headers: { Accept: "application/json", "User-Agent": "CMO.so security check" }
+  }).catch(() => null);
+  if (!r || !r.ok) return null;
+  const j = await r.json().catch(() => null);
+  return j && !j.error ? j.data ?? null : null;
+}
+async function pool(items3, n2, fn) {
+  const out = new Array(items3.length);
+  let i = 0;
+  await Promise.all(
+    Array.from({ length: Math.min(n2, items3.length) }, async () => {
+      while (i < items3.length) {
+        const k = i++;
+        out[k] = await fn(items3[k]);
+      }
+    })
+  );
+  return out;
+}
+var PHP_EOL = {
+  "7.4": "2022-11-28",
+  "8.0": "2023-11-26",
+  "8.1": "2025-12-31",
+  "8.2": "2026-12-31",
+  "8.3": "2027-12-31",
+  "8.4": "2028-12-31",
+  "8.5": "2029-12-31"
+};
+async function outside(url, path3, opts = {}) {
+  const r = await fetch(`${url}${path3}`, {
+    redirect: opts.redirect ?? "manual",
+    signal: AbortSignal.timeout(12e3),
+    headers: { "User-Agent": "Mozilla/5.0 (compatible; CMO.so security check)" }
+  }).catch(() => null);
+  if (!r) return null;
+  const text3 = r.status === 200 ? (await r.text().catch(() => "")).slice(0, 4e3) : "";
+  return { status: r.status, headers: r.headers, location: r.headers.get("location") ?? "", text: text3 };
+}
+async function componentFindings(plugins, themes, core, updates, degraded) {
+  const out = [];
+  const upd = updates?.plugins && !Array.isArray(updates.plugins) ? updates.plugins : {};
+  const pluginsData = await pool(plugins, 6, (p) => vulnDb("plugin", p.plugin.split("/")[0]));
+  plugins.forEach((p, i) => {
+    const d = pluginsData[i];
+    const id = p.plugin.replace(/\.php$/, "");
+    const active = p.status === "active";
+    const newer = upd[id]?.new_version;
+    if (d === null) degraded.push(`vulnerabilities of ${p.name}`);
+    const hits = (d?.vulnerability ?? []).filter((v) => affects(v, p.version));
+    if (hits.length) {
+      const worst = hits.reduce(
+        (m, v) => {
+          const label2 = `${v.name} ${(v.source ?? []).map((x) => x.name).join(" ")}`;
+          const pr = v.impact?.cvss?.severity ? sevPriority(v.impact.cvss.severity, Number(v.impact.cvss.score ?? 0)) : /unauthenticated/i.test(label2) ? "p0" : "p1";
+          return order.indexOf(pr) < order.indexOf(m.p) ? { p: pr, v } : m;
+        },
+        { p: "p2", v: hits[0] }
+      );
+      const unfixed = hits.some((v) => v.operator?.unfixed === "1");
+      const fixedIn = hits.map((v) => v.operator?.max_version).filter(Boolean);
+      const cves = hits.flatMap((v) => (v.source ?? []).map((s) => s.id)).filter((x) => /^CVE-/.test(x));
+      out.push({
+        id: `vuln:${id}`,
+        priority: active ? worst.p : lower(worst.p),
+        area: "plugins",
+        title: `${p.name} ${p.version} has ${hits.length} known ${hits.length === 1 ? "vulnerability" : "vulnerabilities"}${active ? "" : " (inactive)"}`,
+        why: `${decode2(worst.v.name)}${cves.length ? ` (${[...new Set(cves)].slice(0, 3).join(", ")})` : ""}. ${active ? "Attackers scan for these." : "Inactive plugins can still be reached through their files."}`,
+        fix: newer && !unfixed ? `Update to ${newer}${fixedIn.length ? ` (fixed from ${fixedIn.sort(cmpVersion).pop()})` : ""}.` : unfixed ? "No fixed version yet: deactivate it and replace it, or delete it if unused." : "Update it when a fixed version appears, or replace it.",
+        ...newer && !unfixed ? { tool: { name: "wp_plugin_update", args: { plugin: id } } } : { tool: { name: "wp_plugin_set", args: { plugin: id, status: active ? "inactive" : "deleted" } } },
+        source: "wpvulnerability.net"
+      });
+    } else if (newer)
+      out.push({
+        id: `update:${id}`,
+        priority: "p2",
+        area: "plugins",
+        title: `${p.name} can be updated (${p.version} \u2192 ${newer})`,
+        why: "Updates often fix security problems before they are published.",
+        fix: "Update it, then check the site.",
+        tool: { name: "wp_plugin_update", args: { plugin: id } }
+      });
+    if (d?.closed)
+      out.push({
+        id: `closed:${id}`,
+        priority: active ? "p1" : "p2",
+        area: "plugins",
+        title: `${p.name} was closed on WordPress.org`,
+        why: `${d.closed_reason ? `Reason: ${d.closed_reason}. ` : ""}It gets no more updates, so new flaws stay open.`,
+        fix: "Replace it with a maintained plugin, then delete it.",
+        tool: { name: "wp_plugin_set", args: { plugin: id, status: active ? "inactive" : "deleted" } }
+      });
+    if (!active && !hits.length && !d?.closed)
+      out.push({
+        id: `inactive:${id}`,
+        priority: "p4",
+        area: "plugins",
+        title: `${p.name} is installed but inactive`,
+        why: "Unused plugins are code on the server that nobody watches.",
+        fix: "Delete it if the site doesn't need it.",
+        tool: { name: "wp_plugin_set", args: { plugin: id, status: "deleted" } }
+      });
+  });
+  const themeData = await pool(themes, 4, (t) => vulnDb("theme", t.stylesheet));
+  themes.forEach((t, i) => {
+    const hits = (themeData[i]?.vulnerability ?? []).filter((v) => affects(v, t.version));
+    if (hits.length)
+      out.push({
+        id: `vuln:theme:${t.stylesheet}`,
+        priority: t.status === "active" ? "p0" : "p2",
+        area: "themes",
+        title: `Theme ${t.name ?? t.stylesheet} ${t.version} has known vulnerabilities`,
+        why: decode2(hits[0]?.name ?? ""),
+        fix: t.status === "active" ? "Update the theme." : "Delete the unused theme in wp-admin \u2192 Appearance.",
+        source: "wpvulnerability.net"
+      });
+  });
+  if (core) {
+    const d = await vulnDb("core", core);
+    if (d === null) degraded.push("WordPress core vulnerabilities");
+    const names = [
+      ...new Set((d?.vulnerability ?? []).flatMap((v) => (v.source ?? []).map((x) => decode2(x.name))).filter(Boolean))
+    ];
+    const unauth = names.filter((n2) => /unauthenticated/i.test(n2));
+    if (names.length || updates?.core)
+      out.push({
+        id: "core",
+        priority: unauth.length ? "p0" : names.length ? "p1" : "p2",
+        area: "core",
+        title: `WordPress ${core}${updates?.core ? ` \u2192 ${updates.core} available` : ""}${names.length ? ` (${names.length} known vulnerabilities${unauth.length ? `, ${unauth.length} without login` : ""})` : ""}`,
+        why: names.length ? `For example: ${unauth[0] ?? names[0]}.` : "Minor WordPress releases are security releases.",
+        fix: "Update WordPress (wp-admin \u2192 Dashboard \u2192 Updates, or the host's one-click update). Back up first.",
+        source: names.length ? "wpvulnerability.net" : void 0
+      });
+  }
+  return out;
+}
+function healthFindings(h) {
+  const out = [];
+  const s = h.settings;
+  const add = (f) => out.push(f);
+  if (s.debug_display)
+    add({
+      id: "debug-display",
+      priority: "p1",
+      area: "settings",
+      title: "PHP errors are shown to visitors (WP_DEBUG_DISPLAY)",
+      why: "Error messages reveal file paths and versions to attackers.",
+      fix: "In wp-config.php set WP_DEBUG to false (or WP_DEBUG_DISPLAY to false). Host or developer task."
+    });
+  if (s.registration && !["subscriber", ""].includes(String(s.default_role)))
+    add({
+      id: "registration-role",
+      priority: "p0",
+      area: "settings",
+      title: `Anyone can register and becomes ${s.default_role}`,
+      why: "Strangers get accounts that can publish or change the site.",
+      fix: "wp-admin \u2192 Settings \u2192 General: untick \u201CAnyone can register\u201D, or set the new user role to Subscriber."
+    });
+  else if (s.registration)
+    add({
+      id: "registration",
+      priority: "p3",
+      area: "settings",
+      title: "Anyone can register an account",
+      why: "Open registration attracts spam accounts; fine only if the site needs it.",
+      fix: "wp-admin \u2192 Settings \u2192 General: untick \u201CAnyone can register\u201D if visitors don't need accounts."
+    });
+  if (!s.https)
+    add({
+      id: "https",
+      priority: "p1",
+      area: "settings",
+      title: "The site address is not https",
+      why: "Logins and forms travel unencrypted; browsers mark the site as not secure.",
+      fix: "Install a certificate at the host and change the WordPress and site address to https."
+    });
+  if (s.file_edit)
+    add({
+      id: "file-edit",
+      priority: "p3",
+      area: "settings",
+      title: "Plugin and theme files can be edited in wp-admin",
+      why: "A stolen admin login can then run any code on the server.",
+      fix: "Add define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php (host or developer). CMO.so's tools keep working."
+    });
+  if (s.xmlrpc)
+    add({
+      id: "xmlrpc",
+      priority: "p3",
+      area: "settings",
+      title: "XML-RPC is on",
+      why: "Old remote API used for password guessing at scale; most sites don't need it (the CMO.so tools don't).",
+      fix: "Block /xmlrpc.php at the host or with a security plugin, unless the Jetpack or the WordPress app needs it."
+    });
+  const perms = String(s.wp_config_perms ?? "");
+  if (/^\d{3}$/.test(perms) && Number(perms[2]) >= 4)
+    add({
+      id: "wp-config-perms",
+      priority: Number(perms[2]) >= 6 ? "p1" : "p3",
+      area: "server",
+      title: `wp-config.php is readable by every user on the server (${perms})`,
+      why: "It holds the database password; on shared hosting other accounts could read it.",
+      fix: "Ask the host to set it to 640 or 600."
+    });
+  const php = h.versions.php.split(".").slice(0, 2).join(".");
+  const eol = PHP_EOL[php];
+  const today2 = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  if (eol && eol < today2)
+    add({
+      id: "php-eol",
+      priority: "p1",
+      area: "server",
+      title: `PHP ${h.versions.php} gets no more security fixes (since ${eol})`,
+      why: "Flaws found in PHP now stay open on this server.",
+      fix: "Ask the host to move the site to PHP 8.3 or newer (test the site after)."
+    });
+  else if (eol && eol < new Date(Date.now() + 120 * 864e5).toISOString().slice(0, 10))
+    add({
+      id: "php-eol-soon",
+      priority: "p3",
+      area: "server",
+      title: `PHP ${h.versions.php} stops getting security fixes on ${eol}`,
+      why: "Plan the move before it ends.",
+      fix: "Ask the host to move the site to PHP 8.3 or newer."
+    });
+  const db = /^(\d+\.\d+)/.exec(h.versions.database)?.[1] ?? "";
+  if (!/mariadb/i.test(h.versions.database) && ["5.7", "8.0"].includes(db))
+    add({
+      id: "mysql-eol",
+      priority: "p3",
+      area: "server",
+      title: `MySQL ${db} has reached end of life`,
+      why: "No more security fixes from Oracle.",
+      fix: "Ask the host to move the database to MySQL 8.4 LTS (or MariaDB 11)."
+    });
+  const admins = h.users.admins;
+  if (admins.some((a) => a.login_is_admin))
+    add({
+      id: "admin-login",
+      priority: "p2",
+      area: "users",
+      title: "An Administrator logs in as \u201Cadmin\u201D",
+      why: "It is the first name password-guessing bots try.",
+      fix: "Create a new Administrator with another name, move the content to it, then delete \u201Cadmin\u201D."
+    });
+  if ((h.users.by_role.administrator ?? 0) > 3)
+    add({
+      id: "many-admins",
+      priority: "p3",
+      area: "users",
+      title: `${h.users.by_role.administrator} Administrator accounts`,
+      why: "Each one can change everything; fewer admins, fewer ways in.",
+      fix: "Give people who only write or edit the Editor or Author role."
+    });
+  const old = new Date(Date.now() - 90 * 864e5).toISOString().slice(0, 10);
+  const stale = admins.filter(
+    (a) => a.app_passwords > 0 && (!a.app_password_last_use || a.app_password_last_use < old)
+  );
+  if (stale.length)
+    add({
+      id: "stale-app-passwords",
+      priority: "p3",
+      area: "users",
+      title: `${stale.length} Administrator${stale.length > 1 ? "s have" : " has"} application passwords unused for 90 days`,
+      why: "Old application passwords are keys nobody remembers handing out.",
+      fix: "wp-admin \u2192 Users \u2192 Profile \u2192 Application Passwords: revoke the ones no tool uses (keep the CMO.so one)."
+    });
+  const orphans = h.cron.filter((j) => !j.handled && !j.core);
+  for (const j of orphans.slice(0, 10))
+    add({
+      id: `cron-orphan:${j.hook}`,
+      priority: "p3",
+      area: "cron",
+      title: `Scheduled job \u201C${j.hook}\u201D has nothing to run it`,
+      why: "Usually left behind by a removed plugin; it keeps waking WordPress for nothing.",
+      fix: "Remove it.",
+      tool: { name: "wp_cron_unschedule", args: { hook: j.hook } }
+    });
+  const late = h.cron.filter((j) => j.schedule !== "once" && j.overdue_min > 120);
+  if (late.length)
+    add({
+      id: "cron-late",
+      priority: s.wp_cron_disabled ? "p2" : "p3",
+      area: "cron",
+      title: `${late.length} scheduled jobs are more than 2 hours late`,
+      why: s.wp_cron_disabled ? "WP-Cron is turned off (DISABLE_WP_CRON) and no server cron seems to call it: scheduled posts, updates checks and clean-ups don't run." : "WP-Cron only runs when someone visits; on a quiet site scheduled posts and update checks run late.",
+      fix: "Ask the host for a server cron that calls wp-cron.php every 5 minutes (and set DISABLE_WP_CRON)."
+    });
+  if (h.plugins.must_use.length || h.plugins.dropins.length)
+    add({
+      id: "mu-dropins",
+      priority: "p4",
+      area: "plugins",
+      title: `Hidden plugins: ${[...h.plugins.must_use, ...h.plugins.dropins].join(", ")}`,
+      why: "Must-use plugins and drop-ins run on every page and don't show in the plugin list. Usually the host's; worth knowing.",
+      fix: "Ask the host what they are if you don't recognise them."
+    });
+  return out;
+}
+async function outsideFindings(url, h) {
+  const out = [];
+  const home = await outside(url, "/", { redirect: "follow" });
+  if (home) {
+    const want = [
+      ["strict-transport-security", "HSTS"],
+      ["x-content-type-options", "X-Content-Type-Options"],
+      ["referrer-policy", "Referrer-Policy"]
+    ];
+    const missing = want.filter(([hname]) => !home.headers.get(hname)).map(([, label2]) => label2);
+    const csp = home.headers.get("content-security-policy") ?? "";
+    if (!home.headers.get("x-frame-options") && !/frame-ancestors/i.test(csp))
+      missing.push("X-Frame-Options or CSP frame-ancestors");
+    if (missing.length)
+      out.push({
+        id: "headers",
+        priority: "p3",
+        area: "outside",
+        title: `Missing security headers: ${missing.join(", ")}`,
+        why: "They stop click-jacking, MIME sniffing and downgrade to http in browsers.",
+        fix: "Add them at the web server or CDN (Cloudflare \u2192 Rules \u2192 Transform rules), or with a security plugin."
+      });
+    const gen = /<meta name="generator" content="WordPress ([\d.]+)/i.exec(home.text)?.[1];
+    if (gen)
+      out.push({
+        id: "version-visible",
+        priority: "p4",
+        area: "outside",
+        title: `The WordPress version (${gen}) is visible in the page`,
+        why: "Bots use it to pick attacks; keeping WordPress updated matters more than hiding it.",
+        fix: "Optional: remove the generator tag with a security plugin."
+      });
+  }
+  const probes = [
+    { path: "/.env", id: "env", title: "/.env is public", test: (t) => /^[A-Z_]+=/m.test(t), priority: "p0" },
+    {
+      path: "/.git/HEAD",
+      id: "git",
+      title: "The .git folder is public",
+      test: (t) => t.startsWith("ref:"),
+      priority: "p0"
+    },
+    {
+      path: "/wp-config.php.bak",
+      id: "config-bak",
+      title: "A copy of wp-config.php is public",
+      test: (t) => /DB_(NAME|PASSWORD)/.test(t),
+      priority: "p0"
+    },
+    {
+      path: "/wp-config.php~",
+      id: "config-tilde",
+      title: "A copy of wp-config.php is public",
+      test: (t) => /DB_(NAME|PASSWORD)/.test(t),
+      priority: "p0"
+    },
+    {
+      path: "/wp-content/debug.log",
+      id: "debug-log",
+      title: "The PHP error log is public",
+      test: (t) => /PHP (Notice|Warning|Fatal|Deprecated)|\[\d{2}-\w{3}-\d{4}/.test(t),
+      priority: "p1"
+    }
+  ];
+  const got = await pool(probes, 5, (p) => outside(url, p.path));
+  probes.forEach((p, i) => {
+    const r = got[i];
+    if (r && r.status === 200 && p.test(r.text))
+      out.push({
+        id: `exposed:${p.id}`,
+        priority: p.priority,
+        area: "outside",
+        title: p.title,
+        why: "Anyone can download it: it can hold passwords, keys or the site's code.",
+        fix: `Delete or block ${p.path} at the host today${p.id === "env" || p.id.startsWith("config") ? ", then change every password and key it holds" : ""}.`
+      });
+  });
+  const author = await outside(url, "/?author=1");
+  if (author && [301, 302].includes(author.status) && /\/author\/[^/]+/.test(author.location))
+    out.push({
+      id: "user-enum",
+      priority: "p3",
+      area: "outside",
+      title: "Login names can be found from /?author=1",
+      why: "It gives password-guessing bots half of a login.",
+      fix: "Block ?author= requests for visitors with a security plugin or a server rule."
+    });
+  const users = await outside(url, "/wp-json/wp/v2/users");
+  if (users && users.status === 200 && /"slug"\s*:/.test(users.text))
+    out.push({
+      id: "users-api",
+      priority: "p3",
+      area: "outside",
+      title: "The list of authors is public at /wp-json/wp/v2/users",
+      why: "It shows login names (slugs) to anyone.",
+      fix: "Limit the users endpoint to signed-in users with a security plugin."
+    });
+  const xmlrpc = h?.settings.xmlrpc ? await outside(url, "/xmlrpc.php") : null;
+  if (xmlrpc && xmlrpc.status === 405) {
+    const f = out.find((x) => x.id === "xmlrpc");
+    if (f) f.why += " It answers from the internet.";
+  }
+  return out;
+}
+async function securityScan(site, o = {}) {
+  const degraded = [];
+  const notes = [];
+  const h = await site.request({ path: "/maggie-core/v1/health" }).then((r) => r.status === 200 ? r.data : null).catch(() => null);
+  if (!h)
+    notes.push(
+      "Maggie Core 0.14+ adds what WordPress itself reports (versions, settings, users, scheduled jobs, updates): update it with wp_theme_update for the full check."
+    );
+  const plugins = await call(site, {
+    path: "/wp/v2/plugins",
+    query: { _fields: "plugin,name,version,status,auto_update" }
+  }).catch((e) => {
+    degraded.push(`plugin list (${e.message})`);
+    return [];
+  });
+  const themes = await call(site, { path: "/wp/v2/themes", query: { _fields: "stylesheet,version,status,name" } }).then(
+    (rows) => rows.map((t) => ({ ...t, name: typeof t.name === "string" ? t.name : t.name?.raw ?? t.stylesheet }))
+  ).catch(() => []);
+  const core = h?.versions.wordpress ?? "";
+  const findings = [];
+  if (o.vulnerabilities !== false)
+    findings.push(...await componentFindings(plugins, themes, core, h?.updates ?? null, degraded));
+  if (h) findings.push(...healthFindings(h));
+  if (o.outside !== false && site.url) findings.push(...await outsideFindings(site.url, h));
+  findings.sort((a, b) => order.indexOf(a.priority) - order.indexOf(b.priority));
+  const count = Object.fromEntries(order.map((p) => [p, findings.filter((f) => f.priority === p).length]));
+  return {
+    site: site.url ?? "",
+    checked: (/* @__PURE__ */ new Date()).toISOString(),
+    summary: {
+      ...count,
+      plugins: plugins.length,
+      active_plugins: plugins.filter((p) => p.status === "active").length,
+      themes: themes.length,
+      wordpress: core || null,
+      php: h?.versions.php ?? null,
+      scheduled_jobs: h?.cron.length ?? null
+    },
+    words: { p0: "fix today", p1: "this week", p2: "this month", p3: "when convenient", p4: "for information" },
+    findings,
+    ...h ? {
+      cron: h.cron.filter((j) => !j.core).map((j) => ({
+        hook: j.hook,
+        schedule: j.schedule,
+        next: j.next,
+        handled: j.handled,
+        late_min: j.overdue_min
+      }))
+    } : {},
+    ...degraded.length ? { degraded: [...new Set(degraded)].slice(0, 12) } : {},
+    ...notes.length ? { notes } : {},
+    source: "Vulnerability data: WPVulnerability (wpvulnerability.net)."
+  };
+}
+
 // ../../packages/tools/src/wp/site.ts
 async function siteStatus(site) {
   const me = await call(site, {
@@ -15751,8 +16383,8 @@ async function relatedCards(site, parent, template, exclude = [], n2 = 3) {
     },
     300
   );
-  const pool2 = pages.filter((p) => !exclude.includes(p.id) && (!template || p.template === template));
-  const picks = pool2.slice(0, n2);
+  const pool4 = pages.filter((p) => !exclude.includes(p.id) && (!template || p.template === template));
+  const picks = pool4.slice(0, n2);
   const media = picks.filter((p) => p.featured_media).map((p) => p.featured_media);
   const urls = {};
   if (media.length) {
@@ -16017,7 +16649,7 @@ async function seoImport(site, overwrite = false) {
     body: { overwrite }
   });
 }
-async function pool(items3, n2, fn) {
+async function pool2(items3, n2, fn) {
   const out = new Array(items3.length);
   let i = 0;
   await Promise.all(
@@ -16039,7 +16671,7 @@ async function seoAudit(site, o = {}) {
     o.posts
   ) : [];
   const items3 = [...pages.map((p) => ({ ...p, kind: "page" })), ...posts2.map((p) => ({ ...p, kind: "post" }))];
-  const heads = await pool(items3, 6, (p) => renderedHead(site, p.link).catch(() => null));
+  const heads = await pool2(items3, 6, (p) => renderedHead(site, p.link).catch(() => null));
   const issues = [];
   const titles = /* @__PURE__ */ new Map();
   const descs = /* @__PURE__ */ new Map();
@@ -16143,7 +16775,7 @@ async function seoAudit(site, o = {}) {
       });
   const unknown2 = [...allLinks].filter((l) => !known.has(l) && !/^\/(category|tag|author|page|blogs?)\//.test(l)).slice(0, 60);
   const base = site.url ?? "";
-  const checked = await pool(unknown2, 6, async (l) => ({
+  const checked = await pool2(unknown2, 6, async (l) => ({
     l,
     s: site.fetchPage ? (await site.fetchPage(`${base}${l}`).catch(() => ({ status: 0 }))).status : 200
   }));
@@ -16173,8 +16805,8 @@ async function seoAudit(site, o = {}) {
       path: "/wp-sitemap.xml",
       detail: `The sitemap answers ${sitemap.status || "nothing"}.`
     });
-  const order = { high: 0, medium: 1, low: 2 };
-  issues.sort((a, b) => order[a.severity] - order[b.severity] || a.code.localeCompare(b.code));
+  const order2 = { high: 0, medium: 1, low: 2 };
+  issues.sort((a, b) => order2[a.severity] - order2[b.severity] || a.code.localeCompare(b.code));
   const byCode = {};
   for (const i of issues) byCode[i.code] = (byCode[i.code] ?? 0) + 1;
   return {
@@ -16185,6 +16817,844 @@ async function seoAudit(site, o = {}) {
   };
 }
 
+// ../../packages/tools/src/wp/seo-tech.ts
+var UA = "Mozilla/5.0 (compatible; CMO.so SEO check)";
+async function get(url, redirect = "manual") {
+  const r = await fetch(url, { redirect, signal: AbortSignal.timeout(15e3), headers: { "User-Agent": UA } }).catch(
+    () => null
+  );
+  if (!r) return null;
+  const text3 = r.status === 200 ? await r.text().catch(() => "") : "";
+  return {
+    status: r.status,
+    text: text3,
+    location: r.headers.get("location") ?? "",
+    type: r.headers.get("content-type") ?? ""
+  };
+}
+async function pool3(items3, n2, fn) {
+  const out = new Array(items3.length);
+  let i = 0;
+  await Promise.all(
+    Array.from({ length: Math.min(n2, items3.length) }, async () => {
+      while (i < items3.length) {
+        const k = i++;
+        out[k] = await fn(items3[k]);
+      }
+    })
+  );
+  return out;
+}
+function sitePath(href, base) {
+  try {
+    const u = new URL(href, `${base}/`);
+    const b = new URL(base);
+    if (u.hostname.replace(/^www\./, "") !== b.hostname.replace(/^www\./, "")) return null;
+    if (!/^https?:$/.test(u.protocol)) return null;
+    let p = u.pathname.replace(/\/+/g, "/");
+    if (!p.endsWith("/") && !/\.[a-z0-9]{2,5}$/i.test(p)) p += "/";
+    return `${p}${u.searchParams.get("p") || u.searchParams.get("page_id") ? `?${u.searchParams.toString()}` : ""}`;
+  } catch {
+    return null;
+  }
+}
+var strip = (h) => h.replace(/<[^>]+>/g, " ").replace(/&nbsp;/g, " ").replace(/&amp;/g, "&").replace(/&#8217;|&rsquo;/g, "\u2019").replace(/&#8211;|&ndash;/g, "\u2013").replace(/&quot;/g, '"').replace(/&#039;|&#39;/g, "'").replace(/\s+/g, " ").trim();
+function scanHtml(html2, url, base) {
+  const head = /<head[\s\S]*?<\/head>/i.exec(html2)?.[0] ?? html2;
+  const attr2 = (re) => re.exec(head)?.[1] ?? "";
+  const main = /<main[\s\S]*?<\/main>/i.exec(html2)?.[0] ?? html2.replace(/<header[\s\S]*?<\/header>/gi, "").replace(/<nav[\s\S]*?<\/nav>/gi, "").replace(/<footer[\s\S]*?<\/footer>/gi, "");
+  const body = main.replace(/<script[\s\S]*?<\/script>|<style[\s\S]*?<\/style>/gi, " ");
+  const links2 = [];
+  for (const m of body.matchAll(/<a\b[^>]*href=["']([^"'#]+)[^"']*["'][^>]*>([\s\S]*?)<\/a>/gi)) {
+    const p = sitePath(m[1], base);
+    if (p && !/\/(wp-admin|wp-login|wp-json|feed)\b|\.(jpg|jpeg|png|webp|gif|svg|pdf|zip)$/i.test(p))
+      links2.push({ path: p, text: strip(m[2]).slice(0, 80) });
+  }
+  const imgs = [...body.matchAll(/<img\b[^>]*>/gi)].map((m) => m[0]);
+  const schema = [];
+  let schemaErrors = 0;
+  for (const m of html2.matchAll(/<script[^>]+application\/ld\+json[^>]*>([\s\S]*?)<\/script>/gi)) {
+    try {
+      const j = JSON.parse(m[1]);
+      const items3 = Array.isArray(j) ? j : j["@graph"] ? j["@graph"] : [j];
+      for (const it of items3) {
+        const t = it?.["@type"];
+        for (const x of Array.isArray(t) ? t : [t]) if (typeof x === "string") schema.push(x);
+      }
+    } catch {
+      schemaErrors++;
+    }
+  }
+  return {
+    url,
+    path: sitePath(url, base) ?? url,
+    title: strip(/<title[^>]*>([\s\S]*?)<\/title>/i.exec(head)?.[1] ?? ""),
+    description: strip(attr2(/<meta[^>]+name=["']description["'][^>]+content=["']([^"']*)["']/i)),
+    canonical: attr2(/<link[^>]+rel=["']canonical["'][^>]+href=["']([^"']+)["']/i),
+    robots: attr2(/<meta[^>]+name=["']robots["'][^>]+content=["']([^"']*)["']/i).toLowerCase(),
+    h1: (body.match(/<h1\b/gi) ?? []).length || (html2.match(/<h1\b/gi) ?? []).length,
+    images: imgs.length,
+    // No alt at all is a problem; alt="" is right for decoration (cover backgrounds), wrong on content pictures.
+    imagesNoAlt: imgs.filter((i) => {
+      if (/aria-hidden|role=["']presentation|wp-block-cover__image-background/i.test(i)) return false;
+      if (!/\balt=/i.test(i)) return true;
+      return /\balt=["']\s*["']/i.test(i) && /\bwp-image-\d+/.test(i);
+    }).length,
+    schema: [...new Set(schema)],
+    schemaErrors,
+    links: links2,
+    words: strip(body).split(" ").filter(Boolean).length
+  };
+}
+async function sitemapUrls(base, robotsTxt, max = 500) {
+  const fromRobots = [...robotsTxt.matchAll(/^sitemap:\s*(\S+)/gim)].map((m) => m[1]);
+  const candidates = [...fromRobots, `${base}/wp-sitemap.xml`, `${base}/sitemap_index.xml`, `${base}/sitemap.xml`];
+  for (const sm of candidates) {
+    const r = await get(sm, "follow");
+    if (!r || r.status !== 200 || !/<(urlset|sitemapindex)/i.test(r.text)) continue;
+    const urls = [];
+    const queue = [r.text];
+    let fetched = 0;
+    while (queue.length && urls.length < max && fetched < 30) {
+      const xml = queue.shift();
+      const locs = [...xml.matchAll(/<loc>\s*([^<\s]+)\s*<\/loc>/gi)].map(
+        (m) => m[1].replace(/&amp;/g, "&")
+      );
+      if (/<sitemapindex/i.test(xml)) {
+        for (const l of locs) {
+          const s = await get(l, "follow");
+          fetched++;
+          if (s?.status === 200) queue.push(s.text);
+        }
+      } else urls.push(...locs);
+    }
+    return { urls: [...new Set(urls)].slice(0, max), sitemap: sm };
+  }
+  return { urls: [], sitemap: null };
+}
+var AI_BOTS = [
+  "GPTBot",
+  "OAI-SearchBot",
+  "ChatGPT-User",
+  "ClaudeBot",
+  "Claude-SearchBot",
+  "PerplexityBot",
+  "Google-Extended",
+  "CCBot"
+];
+function robotsBlocked(robots, agents) {
+  const groups = [];
+  let cur = null;
+  for (const raw of robots.split(/\r?\n/)) {
+    const line = raw.replace(/#.*/, "").trim();
+    const m = /^([a-z-]+)\s*:\s*(.*)$/i.exec(line);
+    if (!m) continue;
+    const [k, v] = [m[1].toLowerCase(), m[2].trim()];
+    if (k === "user-agent") {
+      if (!cur || cur.rules.length) {
+        cur = { agents: [], rules: [] };
+        groups.push(cur);
+      }
+      cur.agents.push(v.toLowerCase());
+    } else if (cur && (k === "disallow" || k === "allow")) cur.rules.push(`${k}:${v}`);
+  }
+  const blocks = (g) => g.rules.includes("disallow:/") && !g.rules.some((r) => r === "allow:/");
+  return agents.filter((a) => {
+    const own3 = groups.find((g2) => g2.agents.includes(a.toLowerCase()));
+    const g = own3 ?? groups.find((x) => x.agents.includes("*"));
+    return g ? blocks(g) : false;
+  });
+}
+function groupFindings(list3, min = 4) {
+  const kinds = /* @__PURE__ */ new Map();
+  for (const f of list3) {
+    const k = f.id.includes(":") ? f.id.split(":")[0] : f.id;
+    kinds.set(k, [...kinds.get(k) ?? [], f]);
+  }
+  const out = [];
+  for (const [k, fs2] of kinds) {
+    if (fs2.length < min || !fs2[0]?.id.includes(":")) {
+      out.push(...fs2);
+      continue;
+    }
+    const paths = fs2.map((f) => f.id.slice(k.length + 1));
+    const first = fs2[0];
+    const label2 = {
+      "title-long": "have SEO titles longer than 65 characters",
+      alt: "have pictures without alt text",
+      desc: "have no meta description",
+      h1: "don't have exactly one H1",
+      thin: "have fewer than 120 words",
+      "noindex-in-sitemap": "are noindex but in the sitemap",
+      canonical: "point their canonical elsewhere",
+      "schema-error": "have broken structured data",
+      "sitemap-status": "are in the sitemap but don't answer 200",
+      orphan: "get no links from other pages",
+      broken: "are linked but broken"
+    };
+    const seoTool = first.tool?.name === "wp_seo_set";
+    out.push({
+      ...first,
+      id: `${k}:*`,
+      title: `${fs2.length} pages ${label2[k] ?? first.title}`,
+      why: first.why,
+      fix: `${first.fix.replace(/\.$/, "")}. Pages: ${paths.slice(0, 12).join(", ")}${paths.length > 12 ? ` +${paths.length - 12} more` : ""}.`,
+      ...seoTool ? { tool: { name: "wp_seo_set", args: { items: paths.slice(0, 50).map((x) => ({ page: x })) } } } : {},
+      pages: paths
+    });
+  }
+  return out;
+}
+async function techAudit(site, o = {}) {
+  const base = (site.url ?? "").replace(/\/+$/, "");
+  if (!base) throw new Error("The site's address is unknown.");
+  const limit = Math.min(Math.max(o.limit ?? 60, 5), 200);
+  const findings = [];
+  const add = (f) => findings.push(f);
+  const robotsR = await get(`${base}/robots.txt`, "follow");
+  const robots = robotsR?.status === 200 ? robotsR.text : "";
+  const { urls, sitemap } = await sitemapUrls(base, robots);
+  if (!robotsR || robotsR.status !== 200)
+    add({
+      id: "robots-missing",
+      priority: "p3",
+      area: "settings",
+      title: "No robots.txt",
+      why: "Crawlers look for it first.",
+      fix: "WordPress makes one by itself unless a file or plugin blocks it: check the host."
+    });
+  if (/^disallow:\s*\/\s*$/im.test(robots) && robotsBlocked(robots, ["Googlebot"]).length)
+    add({
+      id: "robots-all",
+      priority: "p0",
+      area: "settings",
+      title: "robots.txt blocks Google from the whole site",
+      why: "Nothing can be indexed.",
+      fix: "Turn search engines on (wp_settings_set search_engines true) or fix the robots.txt file.",
+      tool: { name: "wp_settings_set", args: { search_engines: true } }
+    });
+  if (robots && !/^sitemap:/im.test(robots))
+    add({
+      id: "robots-sitemap",
+      priority: "p3",
+      area: "settings",
+      title: "robots.txt doesn't point to the sitemap",
+      why: "It helps every crawler find all pages.",
+      fix: "Maggie Core adds the Sitemap line when search engines are on; otherwise add it to robots.txt."
+    });
+  const aiBlocked = robotsBlocked(robots, AI_BOTS);
+  if (aiBlocked.length)
+    add({
+      id: "ai-crawlers",
+      priority: "p2",
+      area: "settings",
+      title: `AI crawlers are blocked: ${aiBlocked.join(", ")}`,
+      why: "ChatGPT, Claude, Perplexity and Google's AI answers can't read or cite the site.",
+      fix: "Allow them in robots.txt unless the owner chose to block AI."
+    });
+  if (!sitemap)
+    add({
+      id: "sitemap-missing",
+      priority: "p1",
+      area: "settings",
+      title: "No sitemap found",
+      why: "Search engines find new pages slower without one.",
+      fix: "WordPress publishes /wp-sitemap.xml when search engines are on; check nothing turns it off."
+    });
+  const llms = await get(`${base}/llms.txt`, "follow");
+  const hasLlms = !!llms && llms.status === 200 && /^#\s/m.test(llms.text) && !/<html/i.test(llms.text);
+  if (!hasLlms)
+    add({
+      id: "llms-missing",
+      priority: "p3",
+      area: "settings",
+      title: "No llms.txt",
+      why: "A short Markdown map of the site helps AI assistants describe it correctly.",
+      fix: "Generate it from the site.",
+      tool: { name: "wp_llms_txt_set", args: { generate: true } }
+    });
+  const crawl = urls.length ? urls.slice(0, limit) : [`${base}/`];
+  const scans = await pool3(crawl, 6, async (u) => {
+    const r = await get(u);
+    if (!r) return null;
+    if (r.status !== 200) return { ...scanHtml("", u, base), status: r.status, redirect: r.location || void 0 };
+    return { ...scanHtml(r.text, u, base), status: 200 };
+  });
+  const pages = scans.filter(Boolean);
+  const ok2 = pages.filter((p) => p.status === 200);
+  const bad = pages.filter((p) => p.status !== 200);
+  for (const p of bad)
+    add({
+      id: `sitemap-status:${p.path}`,
+      priority: p.status >= 400 ? "p1" : "p2",
+      area: "outside",
+      title: `The sitemap lists ${p.path}, which answers ${p.status}${p.redirect ? ` \u2192 ${p.redirect}` : ""}`,
+      why: "Sitemaps should list only live pages; search engines lose trust in it.",
+      fix: p.status >= 400 ? "Publish the page again, or remove it (wp_post_delete / wp_page_publish)." : "List the final address; the redirect is fine for visitors."
+    });
+  for (const p of ok2) {
+    if (/noindex/.test(p.robots))
+      add({
+        id: `noindex-in-sitemap:${p.path}`,
+        priority: "p1",
+        area: "outside",
+        title: `${p.path} is noindex but in the sitemap`,
+        why: "Mixed signals: either it should be found, or it shouldn't be listed.",
+        fix: 'Remove noindex if the page should rank (wp_seo_set robots "").',
+        tool: { name: "wp_seo_set", args: { page: p.path, robots: "" } }
+      });
+    if (p.canonical && sitePath(p.canonical, base) !== p.path)
+      add({
+        id: `canonical:${p.path}`,
+        priority: "p2",
+        area: "outside",
+        title: `${p.path} points its canonical to ${p.canonical}`,
+        why: "Google will index the other address instead of this page.",
+        fix: 'Clear the custom canonical unless it is on purpose (wp_seo_set canonical "").',
+        tool: { name: "wp_seo_set", args: { page: p.path, canonical: "" } }
+      });
+    if (p.h1 !== 1)
+      add({
+        id: `h1:${p.path}`,
+        priority: "p2",
+        area: "outside",
+        title: `${p.path} has ${p.h1} H1 headings`,
+        why: "One H1 says what the page is about.",
+        fix: p.h1 ? "Make the extra H1s H2 (wp_section_update edits)." : "Give the page a main heading (the hero's title)."
+      });
+    if (p.imagesNoAlt)
+      add({
+        id: `alt:${p.path}`,
+        priority: "p3",
+        area: "outside",
+        title: `${p.path}: ${p.imagesNoAlt} of ${p.images} pictures have no alt text`,
+        why: "Alt text is how search engines, AI and screen readers know what a picture shows.",
+        fix: "Add alt text (wp_section_update images alt, or the media library)."
+      });
+    if (p.schemaErrors)
+      add({
+        id: `schema-error:${p.path}`,
+        priority: "p2",
+        area: "outside",
+        title: `${p.path}: ${p.schemaErrors} structured-data block(s) are not valid JSON`,
+        why: "Google ignores broken structured data.",
+        fix: "Fix or remove the page's custom schema (wp_seo_set schema)."
+      });
+    if (p.words < 120 && !/\?/.test(p.path))
+      add({
+        id: `thin:${p.path}`,
+        priority: "p3",
+        area: "outside",
+        title: `${p.path} has only ${p.words} words`,
+        why: "Very short pages rarely rank or get cited.",
+        fix: "Add useful text: what, for whom, price or next step, questions."
+      });
+    if (!p.description)
+      add({
+        id: `desc:${p.path}`,
+        priority: "p2",
+        area: "outside",
+        title: `${p.path} has no meta description`,
+        why: "Google writes its own snippet, often a poor one.",
+        fix: "Write one (140\u2013160 characters).",
+        tool: { name: "wp_seo_set", args: { page: p.path } }
+      });
+    if (p.title.length > 65)
+      add({
+        id: `title-long:${p.path}`,
+        priority: "p3",
+        area: "outside",
+        title: `${p.path}: title is ${p.title.length} characters`,
+        why: "Search results cut it after about 60.",
+        fix: "Shorten the SEO title.",
+        tool: { name: "wp_seo_set", args: { page: p.path } }
+      });
+  }
+  const dup = (key) => {
+    const by = /* @__PURE__ */ new Map();
+    for (const p of ok2) if (p[key]) by.set(p[key], [...by.get(p[key]) ?? [], p.path]);
+    for (const [v, ps] of by)
+      if (ps.length > 1)
+        add({
+          id: `dup-${key}:${v.slice(0, 40)}`,
+          priority: "p2",
+          area: "outside",
+          title: `${ps.length} pages share the same ${key}: \u201C${v.slice(0, 70)}\u201D`,
+          why: "Search engines can't tell them apart.",
+          fix: `Give each its own ${key} (wp_seo_set items).`,
+          tool: { name: "wp_seo_set", args: { items: ps.slice(0, 10).map((x) => ({ page: x })) } }
+        });
+  };
+  dup("title");
+  dup("description");
+  const home = ok2.find((p) => p.path === "/");
+  if (home && !home.schema.some((t) => /Organization|LocalBusiness|WebSite|Person|Store|Restaurant|Service/i.test(t)))
+    add({
+      id: "schema-home",
+      priority: "p2",
+      area: "outside",
+      title: "The homepage has no Organization / LocalBusiness structured data",
+      why: "It tells Google and AI who the business is, where and how to reach it.",
+      fix: "Fill the business details (wp_seo_site_set business).",
+      tool: { name: "wp_seo_site_set", args: {} }
+    });
+  const inbound = /* @__PURE__ */ new Map();
+  for (const p of ok2)
+    for (const l of new Set(p.links.map((x) => x.path))) if (l !== p.path) inbound.set(l, (inbound.get(l) ?? 0) + 1);
+  const known = new Set(pages.map((p) => p.path));
+  const targets = [...new Set(ok2.flatMap((p) => p.links.map((l) => l.path)))].filter((t) => !known.has(t)).slice(0, 80);
+  const checked = await pool3(targets, 6, async (t) => ({ t, r: await get(`${base}${t}`) }));
+  const broken = checked.filter((c) => c.r && c.r.status >= 400);
+  const redirected = checked.filter((c) => c.r && [301, 302, 307, 308].includes(c.r.status));
+  for (const b of broken) {
+    const from = ok2.filter((p) => p.links.some((l) => l.path === b.t)).map((p) => p.path);
+    add({
+      id: `broken:${b.t}`,
+      priority: "p1",
+      area: "outside",
+      title: `Broken link to ${b.t} (${b.r?.status}) on ${from.slice(0, 3).join(", ")}${from.length > 3 ? ` +${from.length - 3}` : ""}`,
+      why: "Visitors hit a dead end and crawlers waste their visit.",
+      fix: "Point the link to a live page (wp_section_update links) or add a redirect (wp_redirect_set).",
+      tool: { name: "wp_redirect_set", args: { from: b.t } }
+    });
+  }
+  if (redirected.length)
+    add({
+      id: "links-redirected",
+      priority: "p3",
+      area: "outside",
+      title: `${redirected.length} internal links go through a redirect`,
+      why: "Each hop slows visitors and loses a little link value.",
+      fix: `Link straight to the final address: ${redirected.slice(0, 5).map((c) => `${c.t} \u2192 ${c.r?.location}`).join(", ")}.`
+    });
+  const generic = ok2.flatMap(
+    (p) => p.links.filter((l) => /^(click here|here|read more|learn more|more|this|link|點此|更多)$/i.test(l.text)).map(() => p.path)
+  );
+  if (generic.length)
+    add({
+      id: "anchors-generic",
+      priority: "p3",
+      area: "outside",
+      title: `${generic.length} links say only \u201Cread more\u201D, \u201Cclick here\u201D or similar`,
+      why: "Link words tell search engines what the target page is about.",
+      fix: `Use the target's topic as the link text (pages: ${[...new Set(generic)].slice(0, 5).join(", ")}).`
+    });
+  let speed = null;
+  if (o.speed) speed = await pageSpeed(`${base}/`);
+  if (speed?.lcp_ms && Number(speed.lcp_ms) > 2500)
+    add({
+      id: "lcp",
+      priority: Number(speed.lcp_ms) > 4e3 ? "p1" : "p2",
+      area: "outside",
+      title: `The homepage's main content shows after ${(Number(speed.lcp_ms) / 1e3).toFixed(1)} s on phones (LCP)`,
+      why: "Google wants under 2.5 s; slow pages lose visitors and rankings.",
+      fix: "Smaller hero picture (WebP, under 200 KB), fewer fonts and scripts above the fold."
+    });
+  if (speed?.cls != null && Number(speed.cls) > 0.1)
+    add({
+      id: "cls",
+      priority: "p2",
+      area: "outside",
+      title: `The homepage moves while loading (CLS ${speed.cls})`,
+      why: "Google wants under 0.1.",
+      fix: "Give pictures width and height; don't insert banners above content after load."
+    });
+  const order2 = ["p0", "p1", "p2", "p3", "p4"];
+  const grouped = groupFindings(findings);
+  grouped.sort((a, b) => order2.indexOf(a.priority) - order2.indexOf(b.priority));
+  findings.length = 0;
+  findings.push(...grouped);
+  return {
+    site: base,
+    checked: (/* @__PURE__ */ new Date()).toISOString(),
+    summary: {
+      ...Object.fromEntries(order2.map((p) => [p, findings.filter((f) => f.priority === p).length])),
+      sitemap,
+      sitemap_urls: urls.length,
+      crawled: pages.length,
+      live: ok2.length,
+      llms_txt: hasLlms,
+      ai_crawlers_blocked: aiBlocked,
+      internal_links: ok2.reduce((n2, p) => n2 + p.links.length, 0)
+    },
+    pages: ok2.map((p) => ({
+      path: p.path,
+      title: p.title,
+      words: p.words,
+      h1: p.h1,
+      links_out: new Set(p.links.map((l) => l.path)).size,
+      links_in: inbound.get(p.path) ?? 0,
+      schema: p.schema
+    })),
+    findings,
+    ...speed ? { speed } : {},
+    ...urls.length > crawl.length ? { note: `Crawled the first ${crawl.length} of ${urls.length} sitemap addresses (limit up to 200).` } : {}
+  };
+}
+async function pageSpeed(url) {
+  const key = globalThis.process?.env?.PAGESPEED_API_KEY;
+  const q3 = new URLSearchParams({ url, strategy: "mobile", category: "performance" });
+  if (key) q3.set("key", key);
+  const r = await fetch(`https://www.googleapis.com/pagespeedonline/v5/runPagespeed?${q3}`, {
+    signal: AbortSignal.timeout(9e4)
+  }).catch(() => null);
+  if (!r || !r.ok) return { error: `PageSpeed Insights didn't answer (${r?.status ?? "timeout"}).` };
+  const j = await r.json();
+  const f = j.loadingExperience?.metrics ?? {};
+  const a = j.lighthouseResult?.audits ?? {};
+  const field = !!f.LARGEST_CONTENTFUL_PAINT_MS;
+  return {
+    source: field ? "real visitors (Chrome UX Report, 28 days)" : "lab test (no real-visitor data yet)",
+    score: Math.round((j.lighthouseResult?.categories?.performance?.score ?? 0) * 100),
+    lcp_ms: field ? f.LARGEST_CONTENTFUL_PAINT_MS?.percentile : Math.round(a["largest-contentful-paint"]?.numericValue ?? 0),
+    cls: field ? (f.CUMULATIVE_LAYOUT_SHIFT_SCORE?.percentile ?? 0) / 100 : Number((a["cumulative-layout-shift"]?.numericValue ?? 0).toFixed(3)),
+    inp_ms: f.INTERACTION_TO_NEXT_PAINT?.percentile ?? null,
+    tbt_ms: Math.round(a["total-blocking-time"]?.numericValue ?? 0)
+  };
+}
+var STOP = new Set(
+  "the a an and or of to in for on with by at from is are be your our you we it this that how what why best guide near vs and/or my me us".split(
+    " "
+  )
+);
+var tokens = (s) => new Set(
+  s.toLowerCase().replace(/[^\p{L}\p{N}\s-]/gu, " ").split(/[\s-]+/).filter((w) => w.length > 2 && !STOP.has(w)).map((w) => w.replace(/(ies)$/, "y").replace(/(es|s)$/, ""))
+);
+var overlap = (a, b, idf = () => 1) => {
+  let dot = 0;
+  let na = 0;
+  let nb = 0;
+  for (const w of a) {
+    const x = idf(w) ** 2;
+    na += x;
+    if (b.has(w)) dot += x;
+  }
+  for (const w of b) nb += idf(w) ** 2;
+  return dot / Math.sqrt(Math.max(1e-9, na) * Math.max(1e-9, nb));
+};
+function contentLinks(raw, base) {
+  const out = /* @__PURE__ */ new Set();
+  for (const m of raw.matchAll(/href=["']([^"'#]+)["']/gi)) {
+    const p = sitePath(m[1], base);
+    if (p) out.add(p);
+  }
+  for (const m of raw.matchAll(/"url":"([^"]+)"/g)) {
+    const p = sitePath(m[1].replace(/\\\//g, "/"), base);
+    if (p) out.add(p);
+  }
+  return out;
+}
+var flatMenu = (items3) => items3.flatMap((i) => [{ url: i.url, label: i.label }, ...flatMenu(i.children ?? [])]);
+async function linksPlan(site, o = {}) {
+  const base = (site.url ?? "").replace(/\/+$/, "");
+  const pages = await listPages(site, { status: "publish", withContent: true });
+  const posts2 = await all(
+    site,
+    "/wp/v2/posts",
+    {
+      context: "edit",
+      status: "publish",
+      per_page: 100,
+      _fields: "id,link,title,categories,content,meta",
+      orderby: "date",
+      order: "desc"
+    },
+    o.posts ?? 200
+  );
+  const cats = await all(site, "/wp/v2/categories", {
+    per_page: 100,
+    _fields: "id,name,link,count"
+  });
+  const catName = new Map(cats.map((c) => [c.id, c.name]));
+  const settings2 = await site.request({
+    path: "/wp/v2/settings",
+    query: { _fields: "page_on_front,page_for_posts" }
+  }).then((r) => r.status === 200 ? r.data : {});
+  const docs = [
+    ...pages.map((p) => ({
+      id: p.id,
+      kind: "page",
+      path: sitePath(p.link, base) ?? p.link,
+      url: p.link,
+      title: titleOf(p.title),
+      parent: p.parent,
+      links: contentLinks(p.content?.raw ?? "", base),
+      words: tokens(
+        `${titleOf(p.title)} ${p.slug} ${p.meta?.maggie_seo_title ?? ""} ${p.meta?.maggie_seo_keywords ?? ""}`
+      ),
+      description: String(p.meta?.maggie_seo_description ?? "")
+    })),
+    ...posts2.map((p) => ({
+      id: p.id,
+      kind: "post",
+      path: sitePath(p.link, base) ?? p.link,
+      url: p.link,
+      title: p.title.raw ?? "",
+      cats: p.categories.map((c) => catName.get(c) ?? "").filter(Boolean),
+      links: contentLinks(p.content.raw, base),
+      words: tokens(
+        `${p.title.raw ?? ""} ${p.categories.map((c) => catName.get(c) ?? "").join(" ")} ${p.meta?.maggie_seo_keywords ?? ""}`
+      ),
+      description: String(p.meta?.maggie_seo_description ?? "")
+    }))
+  ];
+  const byPath = new Map(docs.map((d) => [d.path, d]));
+  const menu = await menuGet(site).catch(() => null);
+  const menuPaths = new Set(
+    flatMenu(menu?.items ?? []).map((i) => sitePath(i.url, base)).filter(Boolean)
+  );
+  const footer = await partGet(site, "footer").catch(() => null);
+  const footerPaths = footer ? contentLinks(footer.content, base) : /* @__PURE__ */ new Set();
+  const header = await partGet(site, "header").catch(() => null);
+  const headerPaths = header ? contentLinks(header.content, base) : /* @__PURE__ */ new Set();
+  const chrome = /* @__PURE__ */ new Set([...menuPaths, ...footerPaths, ...headerPaths]);
+  const inbound = /* @__PURE__ */ new Map();
+  for (const d of docs)
+    for (const l of d.links) if (l !== d.path) inbound.set(l, /* @__PURE__ */ new Set([...inbound.get(l) ?? [], d.path]));
+  const home = docs.find((d) => d.id === settings2.page_on_front && d.kind === "page");
+  const blogPage = docs.find((d) => d.id === settings2.page_for_posts && d.kind === "page");
+  const actions = [];
+  const findings = [];
+  const pageDocs = docs.filter((d) => d.kind === "page" && d !== home);
+  const postDocs = docs.filter((d) => d.kind === "post");
+  const menuItems = flatMenu(menu?.items ?? []);
+  const top = (menu?.items ?? []).length;
+  for (const i of menuItems) {
+    const p = sitePath(i.url, base);
+    if (p && p !== "/" && !byPath.has(p) && !/\/(category|tag|author)\//.test(p) && !p.startsWith("/?"))
+      findings.push({
+        id: `menu-dead:${p}`,
+        priority: "p1",
+        area: "outside",
+        title: `The menu links to ${p} (\u201C${i.label}\u201D), which isn't a published page or post`,
+        why: "Visitors hit a dead end from every page.",
+        fix: "Point it to a live page or remove it (wp_menu_set).",
+        tool: { name: "wp_menu_set", args: {} }
+      });
+  }
+  if (top > 7)
+    findings.push({
+      id: "menu-long",
+      priority: "p3",
+      area: "outside",
+      title: `The menu has ${top} top-level items`,
+      why: "More than 7 makes choosing hard; group them under submenus.",
+      fix: "Group related pages under a parent item (wp_menu_set)."
+    });
+  const hubs = pageDocs.filter((d) => pageDocs.some((c) => c.parent === d.id));
+  const topLevel = pageDocs.filter((d) => !d.parent);
+  const wantMenu = [.../* @__PURE__ */ new Set([...hubs, ...topLevel.slice(0, 6)])].filter(
+    (d) => !chrome.has(d.path) && !/privacy|terms|cookie|legal|impressum|datenschutz|thank/i.test(d.path)
+  );
+  if (wantMenu.length)
+    actions.push({
+      type: "menu",
+      why: "Main pages every visitor should reach in one click.",
+      add: wantMenu.slice(0, 6).map((d) => ({ label: d.title, url: d.url })),
+      tool: "wp_menu_set"
+    });
+  if (postDocs.length && blogPage && !chrome.has(blogPage.path))
+    actions.push({
+      type: "menu",
+      why: "The blog isn't reachable from the menu.",
+      add: [{ label: blogPage.title || "Blog", url: blogPage.url }],
+      tool: "wp_menu_set"
+    });
+  const legal = pageDocs.filter(
+    (d) => /privacy|terms|cookie|legal|impressum|datenschutz|accessib/i.test(`${d.path} ${d.title}`)
+  );
+  const contact = pageDocs.filter((d) => /contact|about|book|location|faq/i.test(`${d.path} ${d.title}`));
+  const footerMissing = [...legal, ...contact].filter((d) => !footerPaths.has(d.path));
+  if (footerMissing.length)
+    actions.push({
+      type: "footer",
+      why: "Legal, contact and about pages belong in the footer of every page (trust, and Google's quality raters look for them).",
+      add: footerMissing.slice(0, 8).map((d) => ({ label: d.title, url: d.url })),
+      tool: "wp_footer_set"
+    });
+  for (const hub of hubs) {
+    const kids = pageDocs.filter((c) => c.parent === hub.id);
+    const missing = kids.filter((k) => !hub.links.has(k.path));
+    if (missing.length)
+      actions.push({
+        type: "page_related",
+        page: hub.id,
+        path: hub.path,
+        heading: `More in ${hub.title}`,
+        why: `${hub.title} doesn't link to ${missing.length} of its own sub-pages.`,
+        links: missing.map((k) => ({ url: k.url, label: k.title }))
+      });
+    for (const k of kids)
+      if (!k.links.has(hub.path)) {
+        const sib = kids.filter((s) => s !== k).slice(0, 3);
+        actions.push({
+          type: "page_related",
+          page: k.id,
+          path: k.path,
+          heading: "Related",
+          why: `${k.title} doesn't link back to ${hub.title}${sib.length ? " or its sister pages" : ""}.`,
+          links: [{ url: hub.url, label: hub.title }, ...sib.map((s) => ({ url: s.url, label: s.title }))]
+        });
+      }
+  }
+  const df = /* @__PURE__ */ new Map();
+  for (const d of docs) for (const w of d.words) df.set(w, (df.get(w) ?? 0) + 1);
+  const idf = (w) => Math.log(1 + docs.length / (1 + (df.get(w) ?? 0)));
+  const forPage = /* @__PURE__ */ new Map();
+  for (const post of postDocs) {
+    let best = null;
+    let score = 0;
+    for (const pg of pageDocs) {
+      if (pg === blogPage) continue;
+      const s = overlap(post.words, pg.words, idf);
+      if (s > score) [best, score] = [pg, s];
+    }
+    if (!best || score < 0.3) continue;
+    forPage.set(best, [...forPage.get(best) ?? [], post]);
+    if (!post.links.has(best.path))
+      actions.push({
+        type: "post_link",
+        post: post.id,
+        path: post.path,
+        why: `\u201C${post.title}\u201D is about ${best.title} but doesn't link to that page.`,
+        url: best.url,
+        label: best.title,
+        match: Math.round(score * 100)
+      });
+  }
+  for (const [pg, ps] of forPage) {
+    const missing = ps.filter((p) => !pg.links.has(p.path));
+    if (missing.length >= 2)
+      actions.push({
+        type: "page_related",
+        page: pg.id,
+        path: pg.path,
+        heading: "From the blog",
+        why: `${missing.length} articles about ${pg.title} aren't linked from the page.`,
+        links: missing.slice(0, 5).map((p) => ({ url: p.url, label: p.title }))
+      });
+  }
+  const lonelyPosts = [];
+  for (const d of docs) {
+    if (d === home || d === blogPage) continue;
+    const ins = inbound.get(d.path);
+    if (ins && ins.size || chrome.has(d.path)) continue;
+    if (d.kind === "post") lonelyPosts.push(d);
+    else
+      findings.push({
+        id: `orphan:${d.path}`,
+        priority: "p2",
+        area: "outside",
+        title: `Nothing links to the page \u201C${d.title}\u201D (${d.path})`,
+        why: "Pages that only the sitemap knows are found late and rank poorly.",
+        fix: "Link to it from its parent or a related page, or put it in the menu or footer"
+      });
+  }
+  if (lonelyPosts.length)
+    findings.push({
+      id: "orphan-posts",
+      priority: "p3",
+      area: "outside",
+      title: `${lonelyPosts.length} of ${postDocs.length} articles get no links from pages or other articles (only from the blog list)`,
+      why: "Links from related pages and articles tell search engines which articles matter and keep readers on the site.",
+      fix: "Apply the post_link and page_related actions: each article links to its page, each page shows its articles."
+    });
+  const grouped = groupFindings(findings);
+  findings.length = 0;
+  findings.push(...grouped);
+  return {
+    site: base,
+    counts: {
+      pages: pageDocs.length + (home ? 1 : 0),
+      posts: postDocs.length,
+      menu_items: menuItems.length,
+      footer_links: footerPaths.size,
+      content_links: docs.reduce((n2, d) => n2 + d.links.size, 0),
+      orphan_pages: findings.reduce(
+        (n2, f) => n2 + (f.id.startsWith("orphan:") ? f.pages?.length ?? 1 : 0),
+        0
+      ),
+      orphan_posts: lonelyPosts.length
+    },
+    action_counts: Object.fromEntries(
+      ["menu", "footer", "page_related", "post_link"].map((t) => [t, actions.filter((x) => x.type === t).length])
+    ),
+    actions: [
+      ...actions.filter((x) => x.type === "menu" || x.type === "footer"),
+      ...actions.filter((x) => x.type === "post_link").sort((x, y) => Number(y.match) - Number(x.match)).slice(0, 30),
+      ...actions.filter((x) => x.type === "page_related").slice(0, 30)
+    ],
+    findings,
+    how: "Apply page_related and post_link actions with wp_internal_links_apply (preview first); menu actions with wp_menu_set, footer with wp_footer_set."
+  };
+}
+var esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+function relatedBlock(heading2, links2) {
+  const items3 = links2.map((l) => `<!-- wp:list-item -->
+<li><a href="${esc(l.url)}">${esc(l.label)}</a></li>
+<!-- /wp:list-item -->`).join("\n");
+  return `<!-- wp:group {"metadata":{"name":"Related links","maggie":{"type":"related-links","version":1}},"align":"wide","className":"maggie-related-links","layout":{"type":"constrained"}} -->
+<div class="wp-block-group alignwide maggie-related-links"><!-- wp:heading {"level":2} -->
+<h2 class="wp-block-heading">${esc(heading2)}</h2>
+<!-- /wp:heading -->
+
+<!-- wp:list -->
+<ul class="wp-block-list">${items3}</ul>
+<!-- /wp:list --></div>
+<!-- /wp:group -->`;
+}
+function postLinkBlock(text3, url, label2) {
+  return `<!-- wp:paragraph {"className":"maggie-related-link"} -->
+<p class="maggie-related-link">${esc(text3)} <a href="${esc(url)}">${esc(label2)}</a></p>
+<!-- /wp:paragraph -->`;
+}
+async function llmsTxt(site, o = {}) {
+  const base = (site.url ?? "").replace(/\/+$/, "");
+  const s = await site.request({
+    path: "/wp/v2/settings",
+    query: { _fields: "title,description,page_on_front,page_for_posts" }
+  }).then((r) => r.status === 200 ? r.data : {});
+  const pages = await listPages(site, { status: "publish" });
+  const posts2 = await all(
+    site,
+    "/wp/v2/posts",
+    { status: "publish", per_page: 100, _fields: "link,title,excerpt,meta", orderby: "date", order: "desc" },
+    o.posts ?? 25
+  );
+  const desc = (m, fallback = "") => String(m?.maggie_seo_description || fallback).replace(/\s+/g, " ").trim();
+  const home = pages.find((p) => p.id === s.page_on_front);
+  const noise = /privacy|terms|cookie|thank|cart|checkout|my-account|login/i;
+  const visible = pages.filter((p) => p.id !== s.page_on_front && p.id !== s.page_for_posts && !noise.test(p.link));
+  const byParent = /* @__PURE__ */ new Map();
+  for (const p of visible) byParent.set(p.parent, [...byParent.get(p.parent) ?? [], p]);
+  const line = (title, url, d) => `- [${title.replace(/[[\]]/g, "")}](${url})${d ? `: ${d}` : ""}`;
+  const out = [`# ${s.title || base.replace(/^https?:\/\//, "")}`, ""];
+  const summary = desc(home?.meta, s.description ?? "");
+  if (summary) out.push(`> ${summary}`, "");
+  const top = byParent.get(0) ?? [];
+  if (top.length) {
+    out.push("## Pages", "");
+    for (const p of top) {
+      out.push(line(titleOf(p.title), p.link, desc(p.meta)));
+      for (const c of byParent.get(p.id) ?? []) out.push(`  ${line(titleOf(c.title), c.link, desc(c.meta))}`);
+    }
+    out.push("");
+  }
+  if (posts2.length) {
+    out.push("## Articles", "");
+    for (const p of posts2)
+      out.push(
+        line(strip(p.title.rendered ?? ""), p.link, desc(p.meta, strip(p.excerpt?.rendered ?? "").slice(0, 160)))
+      );
+    out.push("");
+  }
+  const legal = pages.filter((p) => /privacy|terms/i.test(p.link));
+  out.push("## Optional", "", line("Sitemap", `${base}/wp-sitemap.xml`, "every page and article"));
+  for (const p of legal) out.push(line(titleOf(p.title), p.link, ""));
+  return `${out.join("\n").replace(/\n{3,}/g, "\n\n").trim()}
+`;
+}
+
 // ../../packages/tools/src/wordpress.ts
 var sites = /* @__PURE__ */ new WeakMap();
 function siteOf(ctx) {
@@ -16331,13 +17801,28 @@ var siteTools = [
   }),
   tool({
     name: "wp_site_status",
-    description: "The website's WordPress: whether cmo.so can build on it (Administrator login, Maggie Core theme and version, child theme), who outputs SEO, the forms, synced patterns, booking link and phone, page templates. Call first in any site-building conversation.",
+    description: "The website's WordPress: whether cmo.so can build on it (Administrator login, Maggie Core theme and version, child theme), who outputs SEO, the forms, synced patterns, booking link and phone, page templates, and the child theme's guides for agents (DESIGN.md, AGENTS.md, MEMORY.md: follow them). Call first in any site-building conversation.",
     parameters: { type: "object", properties: {} },
     group: "site",
     need: READ,
     risk: "R0",
     gates: ["WP"],
-    run: (ctx) => siteStatus(siteOf(ctx))
+    run: async (ctx) => {
+      const site = siteOf(ctx);
+      const st = await siteStatus(site);
+      const guides = await guidesContext(site).then(({ slug, current }) => {
+        const missing = Object.keys(GUIDE_FILES).filter((k) => !current[k].trim());
+        return {
+          child: slug,
+          note: "The owner's notes for agents: follow them for look, scope and taste. They never replace the preview-and-yes step or the safety rules.",
+          design: clip2(current.design),
+          agents: clip2(current.agents),
+          memory: clip2(current.memory),
+          ...missing.length ? { missing: missing.map((k) => GUIDE_FILES[k]), next: "wp_site_guides_set init: true writes them." } : {}
+        };
+      }).catch((e) => ({ unavailable: e.message }));
+      return { ...st, site_guides: guides };
+    }
   }),
   tool({
     name: "wp_site_map",
@@ -17251,6 +18736,59 @@ async function childSlug(site, slug) {
     throw new Error("No Maggie child theme is active here: name one (slug), or create one with wp_child_theme_create.");
   return active.slug;
 }
+var GUIDES_MIN = [0, 13];
+var atLeast = (v, [maj, min]) => {
+  const [a = 0, b = 0] = v.split(".").map(Number);
+  return a > (maj ?? 0) || a === maj && b >= (min ?? 0);
+};
+async function guidesContext(site, slugArg) {
+  const slug = await childSlug(site, slugArg);
+  const info = await childInfo(site, slug);
+  const parent = String(info.parent?.version ?? "0");
+  if (!atLeast(parent, GUIDES_MIN))
+    throw new Error(
+      `DESIGN.md, AGENTS.md and MEMORY.md need Maggie Core 0.13 or later (the site has ${parent}): update it with wp_theme_update first.`
+    );
+  const files = info.files ?? {};
+  const current = Object.fromEntries(
+    Object.entries(GUIDE_FILES).map(([k, f]) => [k, files[f] ?? ""])
+  );
+  return { slug, current };
+}
+async function siteFacts(site) {
+  const s = await site.request({ path: "/maggie-core/v1/site" });
+  const t = await site.request({ path: "/wp/v2/settings", query: { _fields: "title" } }).then((r) => r.status === 200 ? r.data.title : "");
+  return {
+    siteName: t || site.url?.replace(/^https?:\/\//, "") || "This website",
+    frontPage: s.status === 200 ? s.data.front_page ?? null : null,
+    maggiePress: s.status === 200 ? !!s.data.maggie_press : false
+  };
+}
+async function guidesWrite(site, slug, files) {
+  const out = {};
+  for (const [k, text3] of Object.entries(files))
+    out[GUIDE_FILES[k]] = checkGuide(GUIDE_FILES[k], text3);
+  if (!Object.keys(out).length) throw new Error("Nothing to change.");
+  return call(site, {
+    method: "POST",
+    path: "/maggie-core/v1/child-theme",
+    body: { slug, files: out, delete: [] }
+  });
+}
+async function guidesInit(site, slug, current) {
+  const facts = await siteFacts(site);
+  const files = {};
+  if (!current.design.trim()) files.design = await designMd(site, { ...facts, child: slug });
+  if (!current.agents.trim()) files.agents = agentsTemplate(facts.siteName);
+  if (!current.memory.trim()) files.memory = memoryTemplate();
+  if (!Object.keys(files).length) return null;
+  return {
+    ...await guidesWrite(site, slug, files),
+    created: Object.keys(files).map((k) => GUIDE_FILES[k])
+  };
+}
+var clip2 = (t, n2 = 6e3) => t.length > n2 ? `${t.slice(0, n2)}
+\u2026 (${t.length - n2} more characters: wp_site_guides_get)` : t;
 async function homeShape(site) {
   if (!site.fetchPage || !site.url) return null;
   const r = await site.fetchPage(`${site.url}/?maggie-check=${Date.now()}`).catch(() => null);
@@ -17344,9 +18882,11 @@ var childTools = [
         path: "/maggie-core/v1/child-theme",
         body: { slug: a.slug, name: a.name, from_site: a.from_site !== false }
       });
+      const guides = await guidesContext(site, out.slug).then(({ slug, current }) => guidesInit(site, slug, current)).then((r) => r ? { guides: r.created } : {}).catch((e) => ({ guides_note: e.message }));
       if (!a.activate)
         return {
           ...out,
+          ...guides,
           next: "Switch to it with wp_child_theme_activate when ready (the tool checks the homepage looks the same)."
         };
       const before = await homeShape(site);
@@ -17355,7 +18895,7 @@ var childTools = [
         path: "/maggie-core/v1/child-theme/activate",
         body: { slug: out.slug }
       });
-      return { ...out, activated: act2, check: compareShapes(before, await homeShape(site)) };
+      return { ...out, ...guides, activated: act2, check: compareShapes(before, await homeShape(site)) };
     }
   }),
   tool({
@@ -17547,6 +19087,114 @@ var childTools = [
       };
     }
   }),
+  tool({
+    name: "wp_site_guides_get",
+    description: "The child theme's guides for agents in full: DESIGN.md (the site's look and the owner's design rules), AGENTS.md (how agents work on this site, what not to touch) and MEMORY.md (the owner's preferences and don'ts). Follow them; they never replace the preview-and-yes step or the safety rules.",
+    parameters: { type: "object", properties: { slug: str2("The child theme (default the active one).") } },
+    group: "site",
+    need: READ,
+    risk: "R0",
+    gates: ["WP"],
+    run: async (ctx, a) => {
+      const { slug, current } = await guidesContext(siteOf(ctx), a.slug);
+      return {
+        child: slug,
+        "DESIGN.md": current.design || null,
+        "AGENTS.md": current.agents || null,
+        "MEMORY.md": current.memory || null,
+        ...!current.design || !current.agents || !current.memory ? { next: "wp_site_guides_set init: true writes the missing ones." } : {}
+      };
+    }
+  }),
+  tool({
+    name: "wp_site_guides_set",
+    description: `Write the child theme's guides (Markdown): design_md, agents_md, memory_md replace a file; refresh_design rewrites DESIGN.md from the live site (colours, fonts, widths, padding, homepage sections) and keeps its "## Rules" section; init writes the missing files from templates. Files are public on the site, so passwords, keys and tokens are refused. Backups as for every child file (wp_child_theme_restore).`,
+    parameters: {
+      type: "object",
+      properties: {
+        slug: str2("The child theme (default the active one)."),
+        design_md: str2("New DESIGN.md."),
+        agents_md: str2("New AGENTS.md."),
+        memory_md: str2("New MEMORY.md."),
+        refresh_design: bool("Rewrite DESIGN.md from the site, keeping its Rules section."),
+        init: bool("Write the missing guides from templates.")
+      }
+    },
+    group: "site",
+    need: WRITE,
+    risk: "W2",
+    gates: [...GATES],
+    confirm: (a, lang) => {
+      const what = [
+        a.design_md || a.refresh_design ? "DESIGN.md" : "",
+        a.agents_md ? "AGENTS.md" : "",
+        a.memory_md ? "MEMORY.md" : "",
+        a.init ? "the missing guides" : ""
+      ].filter(Boolean);
+      return say(
+        lang,
+        `Write ${what.join(", ") || "the guides"} in your website's child theme (public files; a backup is kept).`,
+        `\u5BEB\u5165\u7DB2\u7AD9\u5B50\u4E3B\u984C\u7684 ${what.join("\u3001") || "\u6307\u5357\u6A94"}\uFF08\u516C\u958B\u6A94\u6848\uFF1B\u6703\u4FDD\u7559\u5099\u4EFD\uFF09\u3002`
+      );
+    },
+    run: async (ctx, a) => {
+      const site = siteOf(ctx);
+      const { slug, current } = await guidesContext(site, a.slug);
+      const files = {};
+      if (typeof a.agents_md === "string") files.agents = a.agents_md;
+      if (typeof a.memory_md === "string") files.memory = a.memory_md;
+      if (typeof a.design_md === "string") files.design = a.design_md;
+      if (a.refresh_design)
+        files.design = await designMd(site, {
+          ...await siteFacts(site),
+          child: slug,
+          current: files.design ?? current.design
+        });
+      const wrote = Object.keys(files).length ? await guidesWrite(site, slug, files) : null;
+      const init = a.init ? await guidesInit(site, slug, { ...current, ...files }) : null;
+      if (!wrote && !init) throw new Error(a.init ? "All three guides already exist." : "Nothing to change.");
+      return {
+        child: slug,
+        changed: [...wrote?.changed ?? [], ...init?.changed ?? []],
+        backup: wrote?.backup ?? init?.backup ?? null,
+        ...a.refresh_design ? { design_md: files.design } : {},
+        undo: "wp_child_theme_restore with the backup"
+      };
+    }
+  }),
+  tool({
+    name: "wp_site_memory_add",
+    description: `Remember something the owner said about this website in the child theme's MEMORY.md, dated, newest first: kind prefer (a preference: "short headlines"), avoid (a don't: "never use stock photos of people") or note. Use it whenever the owner states a lasting preference or a don't. Public file: no passwords, keys or personal details.`,
+    parameters: {
+      type: "object",
+      properties: {
+        kind: { type: "string", enum: ["prefer", "avoid", "note"], description: "prefer, avoid (don't) or note." },
+        text: str2("One line, in the owner's words."),
+        slug: str2("The child theme (default the active one).")
+      },
+      required: ["kind", "text"]
+    },
+    group: "site",
+    need: WRITE,
+    risk: "W2",
+    gates: [...GATES],
+    confirm: (a, lang) => say(
+      lang,
+      `Remember for this website (${a.kind === "avoid" ? "don't" : a.kind === "note" ? "note" : "preference"}): ${q2(a.text, "")}.`,
+      `\u8A18\u4F4F\u9019\u500B\u7DB2\u7AD9\u7684${a.kind === "avoid" ? "\u7981\u5FCC" : a.kind === "note" ? "\u5099\u8A3B" : "\u504F\u597D"}\uFF1A${q2(a.text, "")}\u3002`
+    ),
+    run: async (ctx, a) => {
+      const site = siteOf(ctx);
+      const text3 = String(a.text ?? "").trim();
+      if (!text3) throw new Error("text: what to remember.");
+      if (text3.length > 500) throw new Error("text: one line, under 500 characters.");
+      const kind = ["prefer", "avoid", "note"].includes(String(a.kind)) ? a.kind : "note";
+      const { slug, current } = await guidesContext(site, a.slug);
+      const next = memoryAdd(current.memory, kind, text3);
+      const out = await guidesWrite(site, slug, { memory: next });
+      return { child: slug, remembered: { kind, text: text3 }, backup: out.backup, "MEMORY.md": next };
+    }
+  }),
   tool({
     name: "wp_child_theme_activate",
     description: "Switch the site to a Maggie child theme, or back to Maggie Core (slug maggie-core). Checks the homepage before and after (words, fonts, brand colours) and reports differences. WordPress keeps Global Styles and edited header/footer per theme: a child made with wp_child_theme_create from the site carries them; switching back to Maggie Core brings its own back.",
@@ -18508,8 +20156,276 @@ var fullTools = [
     }
   })
 ];
+var securityTools = [
+  tool({
+    name: "wp_security_scan",
+    description: "Security check of the connected WordPress site: plugins, themes and WordPress against known vulnerabilities (WPVulnerability), available updates and plugins closed on WordPress.org; with Maggie Core 0.14+ also PHP/database end of life, risky settings (errors shown, open registration, file editing, XML-RPC), Administrators and old application passwords, and WP-Cron jobs (late, or left by removed plugins); from outside: security headers, public .env/.git/config backups/error logs, login-name leaks. Findings are ranked p0 (fix today) \u2026 p4 (for information), each with why and the fix (a tool when one can do it). Read-only.",
+    parameters: {
+      type: "object",
+      properties: {
+        vulnerabilities: bool("Check known vulnerabilities (default true)."),
+        outside: bool("Check from outside like a visitor (default true).")
+      }
+    },
+    group: "site",
+    need: READ,
+    risk: "R0",
+    gates: ["WP"],
+    run: (ctx, a) => securityScan(siteOf(ctx), { vulnerabilities: a.vulnerabilities !== false, outside: a.outside !== false })
+  }),
+  tool({
+    name: "wp_plugin_update",
+    description: "Update one installed plugin to its latest version (plugin id from wp_plugins_list or wp_security_scan, e.g. wpforms-lite/wpforms), then check the homepage still opens. Needs Maggie Core 0.14+. WordPress keeps no copy of the old version: for a big plugin (shop, page builder) suggest a backup first.",
+    parameters: { type: "object", properties: { plugin: str2("Plugin id (folder/file).") }, required: ["plugin"] },
+    group: "site",
+    need: WRITE,
+    risk: "W3",
+    gates: [...GATES],
+    confirm: (a, lang) => say(
+      lang,
+      `Update the plugin ${q2(a.plugin, "")} on your website to its latest version (the old version is not kept).`,
+      `\u628A\u7DB2\u7AD9\u4E0A\u7684\u63D2\u4EF6 ${q2(a.plugin, "")} \u66F4\u65B0\u5230\u6700\u65B0\u7248\uFF08\u4E0D\u4FDD\u7559\u820A\u7248\uFF09\u3002`
+    ),
+    run: async (ctx, a) => {
+      const site = siteOf(ctx);
+      const r = await call(site, {
+        method: "POST",
+        path: "/maggie-core/v1/plugins/update",
+        body: { plugin: String(a.plugin ?? "").replace(/\.php$/, "") }
+      });
+      const home = site.url ? await check(site, `${site.url}/`, "publish") : null;
+      return {
+        ...r,
+        check: home,
+        ...home && !home.ok ? {
+          warning: "The homepage has a problem after the update: deactivate the plugin (wp_plugin_set inactive) and tell the owner."
+        } : {}
+      };
+    }
+  }),
+  tool({
+    name: "wp_cron_unschedule",
+    description: "Remove a WP-Cron job that nothing runs any more (left by a removed plugin; wp_security_scan lists them). WordPress's own jobs and jobs a plugin still handles are refused. Needs Maggie Core 0.14+.",
+    parameters: { type: "object", properties: { hook: str2("The job's hook name.") }, required: ["hook"] },
+    group: "site",
+    need: WRITE,
+    risk: "W2",
+    gates: [...GATES],
+    confirm: (a, lang) => say(
+      lang,
+      `Remove the scheduled job ${q2(a.hook, "")} from your website (nothing runs it any more).`,
+      `\u79FB\u9664\u7DB2\u7AD9\u4E0A\u5DF2\u7121\u7A0B\u5F0F\u8655\u7406\u7684\u6392\u7A0B\u5DE5\u4F5C ${q2(a.hook, "")}\u3002`
+    ),
+    run: (ctx, a) => call(siteOf(ctx), {
+      method: "POST",
+      path: "/maggie-core/v1/cron/unschedule",
+      body: { hook: String(a.hook ?? "") }
+    })
+  })
+];
+var LINK_ACTION = obj("One action from wp_internal_links_plan.", {
+  type: { type: "string", enum: ["page_related", "post_link"], description: "page_related or post_link." },
+  page: int2("page_related: the page id."),
+  heading: str2(`page_related: the band's heading, e.g. "Related" or "From the blog".`),
+  links: arr("page_related: links to list.", obj("", { url: str2(""), label: str2("") })),
+  post: int2("post_link: the article id."),
+  url: str2("post_link: the page to link to."),
+  label: str2("post_link: the link text (the page's topic)."),
+  text: str2('post_link: words before the link (default "Related:").')
+});
+function withRelated(blocks, heading2, links2) {
+  const band2 = parse(relatedBlock(heading2, links2)).filter((b) => b.name);
+  const isBand = (b) => String(b.attrs.className ?? "").includes("maggie-related-links") && serialize([b]).includes(`>${heading2.replace(/&/g, "&amp;").replace(/</g, "&lt;")}</h2>`);
+  const at = blocks.findIndex(isBand);
+  if (at >= 0) return [...blocks.slice(0, at), ...band2, ...blocks.slice(at + 1)];
+  const real = blocks.map((b, i) => [b, i]).filter(([b]) => b.name);
+  const last = real[real.length - 1];
+  const lastType = last ? classify(last[0], "main") : "";
+  if (last && /cta|form|map-contact|contact/.test(lastType))
+    return [...blocks.slice(0, last[1]), ...band2, ...blocks.slice(last[1])];
+  return [...blocks, ...band2];
+}
+var seoTechTools = [
+  tool({
+    name: "wp_seo_tech_audit",
+    description: "Technical SEO check of the connected site, like a crawler: robots.txt (sitemap line, Google or AI crawlers blocked), the sitemap and every page it lists (status, redirects, noindex in the sitemap, canonicals pointing elsewhere, H1 count, missing or duplicate titles and descriptions, long titles, pictures without alt text, broken structured data, thin pages), broken and redirected internal links, generic link words, llms.txt; speed: true adds Core Web Vitals for the homepage (PageSpeed Insights). Findings ranked p0\u2026p4 with the fix and a tool when one can do it. Read-only. Internal-link layout: wp_internal_links_plan.",
+    parameters: {
+      type: "object",
+      properties: {
+        limit: int2("Pages to crawl from the sitemap (default 60, max 200)."),
+        speed: bool("Also measure the homepage's speed on phones (slower, about 30 s).")
+      }
+    },
+    group: "site",
+    need: READ,
+    risk: "R0",
+    gates: ["WP"],
+    run: (ctx, a) => techAudit(siteOf(ctx), { limit: typeof a.limit === "number" ? a.limit : void 0, speed: !!a.speed })
+  }),
+  tool({
+    name: "wp_internal_links_plan",
+    description: "Plan the site's internal links from its own pages, articles, menu, header and footer: menu items that lead nowhere, main pages missing from the menu, legal/contact/about pages missing from the footer, hub pages that don't list their sub-pages and sub-pages that don't link back, articles that don't link to the page they are about (matched by topic) and pages that don't show their articles, and pages or articles nothing links to. Returns actions ready for wp_internal_links_apply (page_related, post_link) or wp_menu_set / wp_footer_set. Read-only.",
+    parameters: { type: "object", properties: { posts: int2("Articles to include (default 200, newest first).") } },
+    group: "site",
+    need: READ,
+    risk: "R0",
+    gates: ["WP"],
+    run: (ctx, a) => linksPlan(siteOf(ctx), { posts: typeof a.posts === "number" ? a.posts : void 0 })
+  }),
+  tool({
+    name: "wp_internal_links_apply",
+    description: 'Apply internal-link actions from wp_internal_links_plan: page_related puts a "Related" band (heading + list of links) in a page, replacing its own earlier band with the same heading, placed before a closing call-to-action; post_link adds one "Related: <page>" line at the end of an article (replacing its earlier one). preview: true shows the changes and saves nothing. Pages: wp_page_undo; articles: their revisions.',
+    parameters: {
+      type: "object",
+      properties: { actions: arr("Up to 20 actions.", LINK_ACTION), preview: PREVIEW },
+      required: ["actions"]
+    },
+    group: "site",
+    need: WRITE,
+    risk: "W3",
+    gates: [...GATES],
+    confirm: (a, lang) => {
+      const n2 = Array.isArray(a.actions) ? a.actions.length : 0;
+      return say(
+        lang,
+        `Add internal links on your website (${n2} ${n2 === 1 ? "change" : "changes"}: related-links bands on pages, a related line at the end of articles).`,
+        `\u5728\u7DB2\u7AD9\u4E0A\u52A0\u5165\u5167\u90E8\u9023\u7D50\uFF08${n2} \u9805\uFF1A\u9801\u9762\u7684\u76F8\u95DC\u9023\u7D50\u5340\u584A\u3001\u6587\u7AE0\u7D50\u5C3E\u7684\u76F8\u95DC\u9023\u7D50\uFF09\u3002`
+      );
+    },
+    run: async (ctx, a) => {
+      const site = siteOf(ctx);
+      const acts = Array.isArray(a.actions) ? a.actions : [];
+      if (!acts.length) throw new Error("actions: give at least one action from wp_internal_links_plan.");
+      if (acts.length > 20) throw new Error("actions: up to 20 at a time.");
+      const results = [];
+      const byPage = /* @__PURE__ */ new Map();
+      for (const x of acts) {
+        if (x.type === "page_related") {
+          if (!x.page || !x.links?.length) throw new Error("page_related needs page and links.");
+          byPage.set(x.page, [...byPage.get(x.page) ?? [], x]);
+        } else if (x.type === "post_link") {
+          if (!x.post || !x.url || !x.label) throw new Error("post_link needs post, url and label.");
+        } else throw new Error(`Unknown action type ${x.type}.`);
+      }
+      for (const [page, list3] of byPage) {
+        const r = await changePage(ctx, { page, preview: !!a.preview }, (blocks) => {
+          let next = blocks;
+          for (const x of list3)
+            next = withRelated(next, (x.heading || "Related").slice(0, 80), (x.links ?? []).slice(0, 12));
+          return { blocks: next, note: { related: list3.map((x) => x.heading || "Related") } };
+        });
+        results.push({ type: "page_related", page_id: page, ...r });
+      }
+      for (const x of acts.filter((y) => y.type === "post_link")) {
+        const post = await call(site, {
+          path: `/wp/v2/posts/${Number(x.post)}`,
+          query: { context: "edit", _fields: "id,link,content,modified" }
+        });
+        const kept = parse(post.content.raw).filter(
+          (b) => !(b.name === "core/paragraph" && String(b.attrs.className ?? "").includes("maggie-related-link"))
+        );
+        const line = parse(postLinkBlock(x.text || "Related:", String(x.url), String(x.label))).filter((b) => b.name);
+        const content = serialize([...kept, ...line]);
+        if (a.preview) {
+          results.push({
+            type: "post_link",
+            post: post.id,
+            path: post.link,
+            preview: true,
+            adds: `${x.text || "Related:"} ${x.label} \u2192 ${x.url}`
+          });
+          continue;
+        }
+        const saved = await call(site, {
+          method: "POST",
+          path: `/wp/v2/posts/${post.id}`,
+          query: { _fields: "id,link,modified" },
+          body: { content }
+        });
+        results.push({
+          type: "post_link",
+          post: saved.id,
+          path: saved.link,
+          saved: true,
+          modified: saved.modified,
+          link: { url: x.url, label: x.label }
+        });
+      }
+      return {
+        results,
+        ...a.preview ? { preview: true } : { undo: "Pages: wp_page_undo; articles: restore the earlier revision in the editor." }
+      };
+    }
+  }),
+  tool({
+    name: "wp_llms_txt_get",
+    description: "The site's llms.txt (a Markdown map of the site for AI assistants, served at /llms.txt): the saved text, whether /llms.txt answers, and whether a file on the server overrides it. Needs Maggie Core 0.14+.",
+    parameters: { type: "object", properties: {} },
+    group: "site",
+    need: READ,
+    risk: "R0",
+    gates: ["WP"],
+    run: async (ctx) => {
+      const site = siteOf(ctx);
+      const saved = await call(site, { path: "/maggie-core/v1/llms" });
+      const live = site.url ? await fetch(`${site.url}/llms.txt`, { signal: AbortSignal.timeout(1e4) }).then(async (r) => ({ status: r.status, same: r.ok && (await r.text()).trim() === saved.text.trim() })).catch(() => null) : null;
+      return {
+        ...saved,
+        live,
+        ...saved.file ? {
+          note: "A real llms.txt file on the server is served instead of the saved text: delete it at the host to use this one."
+        } : {}
+      };
+    }
+  }),
+  tool({
+    name: "wp_llms_txt_set",
+    description: `Write the site's llms.txt (served at /llms.txt): generate: true builds it from the site (name and summary, pages with their SEO descriptions grouped under their parents, the latest articles, sitemap); or give text (Markdown); "" turns it off. preview: true returns the text without saving. Needs Maggie Core 0.14+.`,
+    parameters: {
+      type: "object",
+      properties: {
+        generate: bool("Build it from the site."),
+        text: str2("The llms.txt Markdown to save."),
+        posts: int2("Articles to list when generating (default 25)."),
+        preview: PREVIEW
+      }
+    },
+    group: "site",
+    need: WRITE,
+    risk: "W2",
+    gates: [...GATES],
+    confirm: (a, lang) => say(
+      lang,
+      a.text === "" ? "Turn off your website's llms.txt." : "Write your website's llms.txt (the map of the site for AI assistants, at /llms.txt).",
+      a.text === "" ? "\u95DC\u9589\u7DB2\u7AD9\u7684 llms.txt\u3002" : "\u5BEB\u5165\u7DB2\u7AD9\u7684 llms.txt\uFF08\u7D66 AI \u52A9\u7406\u7684\u7DB2\u7AD9\u5730\u5716\uFF0C\u4F4D\u65BC /llms.txt\uFF09\u3002"
+    ),
+    run: async (ctx, a) => {
+      const site = siteOf(ctx);
+      const text3 = typeof a.text === "string" ? a.text : a.generate ? await llmsTxt(site, { posts: typeof a.posts === "number" ? a.posts : void 0 }) : null;
+      if (text3 == null) throw new Error("Give text, or generate: true.");
+      if (/<\?(php|=)?|<script\b/i.test(text3)) throw new Error("llms.txt: plain Markdown only.");
+      if (a.preview) return { preview: true, text: text3, characters: text3.length };
+      const r = await call(site, {
+        method: "POST",
+        path: "/maggie-core/v1/llms",
+        body: { text: text3 }
+      });
+      return {
+        saved: r.saved,
+        url: r.url,
+        characters: text3.length,
+        before_characters: r.before.length,
+        ...r.file ? { note: "A real llms.txt file on the server is served instead: delete it at the host." } : {},
+        undo: r.before ? "wp_llms_txt_set text with the earlier text (before is kept in this result)" : 'wp_llms_txt_set text ""',
+        before: r.before
+      };
+    }
+  })
+];
 var wordpressTools = [
   ...fullTools,
+  ...securityTools,
+  ...seoTechTools,
   ...siteTools,
   ...pageTools,
   ...sectionTools,
@@ -21928,7 +23844,7 @@ var program = new Command();
 // package.json
 var package_default = {
   name: "@cmo-so/cli",
-  version: "0.12.10",
+  version: "0.12.12",
   description: "CMO.so on the command line: your websites, ideas, blog posts, LinkedIn queue and results, plus a local MCP server for Claude Desktop, Cursor and other MCP clients.",
   type: "module",
   license: "MIT",
@@ -22012,7 +23928,7 @@ var fileStore = () => {
   const file = join(configDir(), "credentials.json");
   return {
     load: () => readJson(file),
-    save: (tokens) => writePrivate(file, tokens),
+    save: (tokens2) => writePrivate(file, tokens2),
     clear: () => rm(file, { force: true })
   };
 };
@@ -22168,7 +24084,7 @@ __export(util_exports, {
   defineLazy: () => defineLazy,
   defineLazyInternal: () => defineLazyInternal,
   derived: () => derived,
-  esc: () => esc,
+  esc: () => esc2,
   escapeRegex: () => escapeRegex,
   explicitlyAborted: () => explicitlyAborted,
   extend: () => extend,
@@ -22399,7 +24315,7 @@ function randomString(length = 10) {
   }
   return str3;
 }
-function esc(str3) {
+function esc2(str3) {
   return JSON.stringify(str3);
 }
 function slugify(input) {
@@ -24548,14 +26464,14 @@ var $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
   const desc = Object.getOwnPropertyDescriptor(def, "shape");
   const sh = desc?.get ? desc.get.raw : def.shape ?? {};
   if (sh) {
-    const get = () => {
+    const get2 = () => {
       const newSh = { ...sh };
       Object.defineProperty(def, "shape", { value: newSh });
-      get.raw = newSh;
+      get2.raw = newSh;
       return newSh;
     };
-    get.raw = sh;
-    Object.defineProperty(def, "shape", { get });
+    get2.raw = sh;
+    Object.defineProperty(def, "shape", { get: get2 });
   }
   const _normalized = cached(() => normalizeDef(def));
   defineLazyInternal(inst, "propValues", (zod) => {
@@ -24654,7 +26570,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
       if (key === "__proto__")
         continue;
       const id = ids3[key];
-      const k = typeof key === "symbol" ? `syms[${syms.indexOf(key)}]` : esc(key);
+      const k = typeof key === "symbol" ? `syms[${syms.indexOf(key)}]` : esc2(key);
       const isPresent = `${k} in input`;
       const schema = shape[key];
       const optin = schema?._zod?.optin;
@@ -27626,7 +29542,7 @@ var parseAsync2 = /* @__PURE__ */ _parseAsync(ZodRealError);
 var safeParse3 = /* @__PURE__ */ _safeParse(ZodRealError);
 var safeParseAsync2 = /* @__PURE__ */ _safeParseAsync(ZodRealError);
 var encode2 = /* @__PURE__ */ _encode(ZodRealError);
-var decode3 = /* @__PURE__ */ _decode(ZodRealError);
+var decode4 = /* @__PURE__ */ _decode(ZodRealError);
 var encodeAsync2 = /* @__PURE__ */ _encodeAsync(ZodRealError);
 var decodeAsync2 = /* @__PURE__ */ _decodeAsync(ZodRealError);
 var safeEncode2 = /* @__PURE__ */ _safeEncode(ZodRealError);
@@ -27786,7 +29702,7 @@ var ZodType = /* @__PURE__ */ $constructor("ZodType", (inst, def) => {
     return encode2(this, data, params, { callee: _encode2 });
   },
   decode: function _decode2(data, params) {
-    return decode3(this, data, params, { callee: _decode2 });
+    return decode4(this, data, params, { callee: _decode2 });
   },
   encodeAsync: async function _encodeAsync2(data, params) {
     return await encodeAsync2(this, data, params, { callee: _encodeAsync2 });
@@ -32989,7 +34905,36 @@ function registerWp(program3) {
     (p, s, o, c) => run(g(c), "wp_section_move", { page: p, section: s, ...posArgs(o) })
   );
   section.command("remove <page> <section>").description("remove a section").action((p, s, _o, c) => run(g(c), "wp_section_remove", { page: p, section: s }));
-  const seo = wp.command("seo").description("SEO fields, audit, import");
+  const seo = wp.command("seo").description("SEO fields, audit, technical check, import");
+  seo.command("tech").description(
+    "technical SEO check: robots.txt, sitemap pages, canonicals, noindex, H1, alt text, schema, links, llms.txt"
+  ).option("--limit <n>", "pages to crawl (default 60, max 200)").option("--speed", "also measure the homepage's Core Web Vitals on phones").action(
+    (o, c) => run(g(c), "wp_seo_tech_audit", { limit: o.limit ? Number(o.limit) : void 0, speed: !!o.speed })
+  );
+  const links2 = wp.command("links").description("internal links: plan and apply (pages, articles, menu, footer)");
+  links2.command("plan", { isDefault: true }).action((_o, c) => run(g(c), "wp_internal_links_plan", {}));
+  links2.command("apply").description("apply page_related / post_link actions from the plan (JSON array or { actions })").requiredOption("--from <file>", "JSON (- for stdin)").option("--preview", "show the changes, save nothing").action(async (o, c) => {
+    const j = await json(o.from);
+    const actions = Array.isArray(j) ? j : j.actions;
+    await run(g(c), "wp_internal_links_apply", { actions, preview: !!o.preview });
+  });
+  const llms = wp.command("llms").description("the site's llms.txt (served at /llms.txt)");
+  llms.command("get", { isDefault: true }).action((_o, c) => run(g(c), "wp_llms_txt_get", {}));
+  llms.command("generate").description("build llms.txt from the site and save it").option("--preview", "show it, save nothing").option("--posts <n>", "articles to list (default 25)").action(
+    (o, c) => run(g(c), "wp_llms_txt_set", {
+      generate: true,
+      preview: !!o.preview,
+      posts: o.posts ? Number(o.posts) : void 0
+    })
+  );
+  llms.command("set <file>").description("save this Markdown file as llms.txt").action(
+    async (file, _o, c) => run(g(c), "wp_llms_txt_set", { text: await readFile2(file, "utf8") })
+  );
+  llms.command("off").action((_o, c) => run(g(c), "wp_llms_txt_set", { text: "" }));
+  wp.command("security").description(
+    "security check: vulnerable or outdated plugins, themes and WordPress, risky settings, admins, WP-Cron, what visitors can see"
+  ).option("--no-outside", "skip the checks from outside").action((o, c) => run(g(c), "wp_security_scan", { outside: o.outside !== false }));
+  wp.command("cron-rm <hook>").description("remove a scheduled job nothing runs any more (left by a removed plugin)").action((hook, _o, c) => run(g(c), "wp_cron_unschedule", { hook }));
   seo.command("get <page>").description("stored fields and what the page outputs").action((p, _o, c) => run(g(c), "wp_seo_get", { page: p }));
   seo.command("set <page>").description("set a page's SEO fields").option("--title <t>").option("--description <d>").option("--keywords <k>").option("--robots <r>", '"index, follow" | "noindex, follow" | "noindex, nofollow"').option("--canonical <url>").option("--og-image <url>").option("--from <file>", "several pages: JSON { items: [{ page, title, description, \u2026 }] }").action(async (p, o, c) => {
     const args = o.from ? await json(o.from) : {
@@ -33162,6 +35107,7 @@ ${table(r.issues, ["severity", "code", "path", "detail"])}`;
   );
   plugins.command("activate <plugin>").action((p, _o, c) => run(g(c), "wp_plugin_set", { plugin: p, status: "active" }));
   plugins.command("deactivate <plugin>").action((p, _o, c) => run(g(c), "wp_plugin_set", { plugin: p, status: "inactive" }));
+  plugins.command("update <plugin>").description("update an installed plugin to its latest version (Maggie Core 0.14+)").action((p, _o, c) => run(g(c), "wp_plugin_update", { plugin: p }));
   plugins.command("delete <plugin>").description("remove an inactive plugin's files (reinstall from WordPress.org to undo)").action((p, _o, c) => run(g(c), "wp_plugin_set", { plugin: p, status: "deleted" }));
   wp.command("api <route>").description("read any allowed WordPress REST route (GET), e.g. /wp/v2/types").option("--query <json>", "query parameters as JSON").action(
     (route, o, c) => run(g(c), "wp_api_read", { route, query: o.query ? JSON.parse(o.query) : void 0 })
@@ -33192,6 +35138,21 @@ ${table(r.issues, ["severity", "code", "path", "detail"])}`;
   );
   child.command("activate <slug>").description("switch the site to a child (or maggie-core to go back); checks the homepage before and after").action((slug, _o, c) => run(g(c), "wp_child_theme_activate", { slug }));
   child.command("restore <slug> <backup>").description("put a backup of the child's files back").action((slug, backup, _o, c) => run(g(c), "wp_child_theme_restore", { slug, backup }));
+  const guides = wp.command("guides").description("the child theme's guides for agents: DESIGN.md, AGENTS.md, MEMORY.md");
+  guides.command("get [slug]", { isDefault: true }).action((slug, _o, c) => run(g(c), "wp_site_guides_get", { slug }));
+  guides.command("set [slug]").option("--design-file <file>", "replace DESIGN.md").option("--agents-file <file>", "replace AGENTS.md").option("--memory-file <file>", "replace MEMORY.md").option("--refresh-design", "rewrite DESIGN.md from the site, keeping its Rules").option("--init", "write the missing guides from templates").action(
+    async (slug, o, c) => run(g(c), "wp_site_guides_set", {
+      slug,
+      design_md: o.designFile ? await readFile2(o.designFile, "utf8") : void 0,
+      agents_md: o.agentsFile ? await readFile2(o.agentsFile, "utf8") : void 0,
+      memory_md: o.memoryFile ? await readFile2(o.memoryFile, "utf8") : void 0,
+      refresh_design: o.refreshDesign,
+      init: o.init
+    })
+  );
+  wp.command("remember <kind> <text...>").description("add to MEMORY.md: kind prefer, avoid (a don't) or note").action(
+    (kind, text3, _o, c) => run(g(c), "wp_site_memory_add", { kind, text: text3.join(" ") })
+  );
   wp.command("child-theme <slug>").description(
     "export the site's look as a child theme folder on this computer (to keep in git); cmo wp child works on the site itself"
   ).requiredOption("--name <name>", 'theme name, e.g. "Moon Lake Spa"').option("--out <dir>", "where to write it (default ./<slug>)").option("--from-site", "take the brand, header and footer from the connected site").option("--color <slug=hex...>", "brand colours").option("--font <slug=family...>", "fonts (replaces Maggie Core's font list: ship their files too)").action(