@cmo-so/cli 0.12.11 → 0.12.13

package/dist/cmo.mjs

@@ -8337,26 +8337,26 @@ function createOAuthClient({ issuer, clientId, fetch: fetchImpl = globalThis.fet
 
 // ../../packages/api-client/src/session.ts
 function createSession({ oauth: oauth2, store, skewMs = 6e4, now = Date.now, onSignedOut }) {
-  let tokens;
+  let tokens2;
   let refreshing = null;
   async function current() {
-    if (tokens === void 0) tokens = await store.load();
-    return tokens;
+    if (tokens2 === void 0) tokens2 = await store.load();
+    return tokens2;
   }
   async function accept(res, previous) {
     const refreshToken = res.refresh_token ?? previous?.refreshToken;
     if (!refreshToken) throw new SignInRequiredError("The sign-in did not return a refresh token.");
-    tokens = {
+    tokens2 = {
       refreshToken,
       accessToken: res.access_token,
       expiresAt: now() + res.expires_in * 1e3,
       scope: res.scope
     };
-    await store.save(tokens);
-    return tokens;
+    await store.save(tokens2);
+    return tokens2;
   }
   async function end() {
-    tokens = null;
+    tokens2 = null;
     await store.clear();
     onSignedOut?.();
   }
@@ -12082,12 +12082,12 @@ var socialTools = [
     need: write5,
     risk: "W1",
     gates: ["VER"],
-    run: async (ctx, { id, words, style, text_effect, order, remove: remove3 }) => {
+    run: async (ctx, { id, words, style, text_effect, order: order2, remove: remove3 }) => {
       const out = await ws(ctx).editSocialPicture(Number(id), {
         ...Array.isArray(words) ? { words: words.map((w) => ({ headline: String(w.headline ?? ""), sub: String(w.sub ?? "") })) } : {},
         ...style ? { style } : {},
         ...text_effect ? { text_effect } : {},
-        ...Array.isArray(order) ? { order: order.map(Number) } : {},
+        ...Array.isArray(order2) ? { order: order2.map(Number) } : {},
         ...Array.isArray(remove3) ? { remove: remove3.map(Number) } : {}
       });
       return { id: out.id, pictures: out.image_urls?.length ? out.image_urls : [out.image_url], picture: out.picture };
@@ -15011,12 +15011,12 @@ async function menuGet(site, id) {
   const nav = await menuPost(site, id);
   const blocks = parse(nav.content.raw);
   const other = blocks.filter((b) => b.name && !["core/navigation-link", "core/navigation-submenu"].includes(b.name)).map((b) => b.name);
-  const strip = (list3) => list3.map(({ attrs: _a3, ...i }) => ({ ...i, ...i.children ? { children: strip(i.children) } : {} }));
+  const strip2 = (list3) => list3.map(({ attrs: _a3, ...i }) => ({ ...i, ...i.children ? { children: strip2(i.children) } : {} }));
   return {
     id: nav.id,
     title: nav.title.raw,
     modified: nav.modified,
-    items: strip(toItems(blocks)),
+    items: strip2(toItems(blocks)),
     other_blocks: other
   };
 }
@@ -15098,8 +15098,8 @@ async function menuSet(site, ops2, id) {
     query: { _fields: "id,modified" },
     body: { content }
   });
-  const strip = (list3) => list3.flatMap((i) => [i.label, ...(i.children ?? []).map((c) => `  ${c.label}`)]);
-  return { id: nav.id, before: strip(before), after: strip(after) };
+  const strip2 = (list3) => list3.flatMap((i) => [i.label, ...(i.children ?? []).map((c) => `  ${c.label}`)]);
+  return { id: nav.id, before: strip2(before), after: strip2(after) };
 }
 async function partGet(site, slug) {
   const parts = await call(
@@ -15603,6 +15603,492 @@ ${rulesOf(o.current ?? "")}
 `;
 }
 
+// ../../packages/tools/src/wp/security.ts
+var order = ["p0", "p1", "p2", "p3", "p4"];
+var lower = (p, n2 = 1) => order[Math.min(4, order.indexOf(p) + n2)];
+function cmpVersion(a, b) {
+  const pa = String(a).split(/[.\-+]/).map((x) => Number.parseInt(x, 10) || 0);
+  const pb = String(b).split(/[.\-+]/).map((x) => Number.parseInt(x, 10) || 0);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d) return d > 0 ? 1 : -1;
+  }
+  return 0;
+}
+var opOk = (v, op, bound) => {
+  if (!bound || !op) return true;
+  const c = cmpVersion(v, bound);
+  return op === "lt" ? c < 0 : op === "le" ? c <= 0 : op === "gt" ? c > 0 : op === "ge" ? c >= 0 : op === "eq" ? c === 0 : true;
+};
+function affects(v, version2) {
+  const o = v.operator ?? {};
+  if (o.unfixed === "1" && !o.max_version) return true;
+  return opOk(version2, o.min_operator, o.min_version) && opOk(version2, o.max_operator, o.max_version);
+}
+var sevPriority = (sev, score) => sev === "c" || score >= 9 ? "p0" : sev === "h" || score >= 7 ? "p0" : sev === "m" || score >= 4 ? "p1" : "p2";
+var decode2 = (s) => s.replace(/&#8211;|&ndash;/g, "\u2013").replace(/&amp;/g, "&").replace(/&#8217;/g, "\u2019").replace(/&#039;|&#39;/g, "'").replace(/&quot;/g, '"');
+async function vulnDb(kind, slug) {
+  const ctl = AbortSignal.timeout(15e3);
+  const r = await fetch(`https://www.wpvulnerability.net/${kind}/${encodeURIComponent(slug)}/`, {
+    signal: ctl,
+    headers: { Accept: "application/json", "User-Agent": "CMO.so security check" }
+  }).catch(() => null);
+  if (!r || !r.ok) return null;
+  const j = await r.json().catch(() => null);
+  return j && !j.error ? j.data ?? null : null;
+}
+async function pool(items3, n2, fn) {
+  const out = new Array(items3.length);
+  let i = 0;
+  await Promise.all(
+    Array.from({ length: Math.min(n2, items3.length) }, async () => {
+      while (i < items3.length) {
+        const k = i++;
+        out[k] = await fn(items3[k]);
+      }
+    })
+  );
+  return out;
+}
+var PHP_EOL = {
+  "7.4": "2022-11-28",
+  "8.0": "2023-11-26",
+  "8.1": "2025-12-31",
+  "8.2": "2026-12-31",
+  "8.3": "2027-12-31",
+  "8.4": "2028-12-31",
+  "8.5": "2029-12-31"
+};
+async function outside(url, path3, opts = {}) {
+  const r = await fetch(`${url}${path3}`, {
+    redirect: opts.redirect ?? "manual",
+    signal: AbortSignal.timeout(12e3),
+    headers: { "User-Agent": "Mozilla/5.0 (compatible; CMO.so security check)" }
+  }).catch(() => null);
+  if (!r) return null;
+  const text3 = r.status === 200 ? (await r.text().catch(() => "")).slice(0, 4e3) : "";
+  return { status: r.status, headers: r.headers, location: r.headers.get("location") ?? "", text: text3 };
+}
+async function componentFindings(plugins, themes, core, updates, degraded) {
+  const out = [];
+  const upd = updates?.plugins && !Array.isArray(updates.plugins) ? updates.plugins : {};
+  const pluginsData = await pool(plugins, 6, (p) => vulnDb("plugin", p.plugin.split("/")[0]));
+  plugins.forEach((p, i) => {
+    const d = pluginsData[i];
+    const id = p.plugin.replace(/\.php$/, "");
+    const active = p.status === "active";
+    const newer = upd[id]?.new_version;
+    if (d === null) degraded.push(`vulnerabilities of ${p.name}`);
+    const hits = (d?.vulnerability ?? []).filter((v) => affects(v, p.version));
+    if (hits.length) {
+      const worst = hits.reduce(
+        (m, v) => {
+          const label2 = `${v.name} ${(v.source ?? []).map((x) => x.name).join(" ")}`;
+          const pr = v.impact?.cvss?.severity ? sevPriority(v.impact.cvss.severity, Number(v.impact.cvss.score ?? 0)) : /unauthenticated/i.test(label2) ? "p0" : "p1";
+          return order.indexOf(pr) < order.indexOf(m.p) ? { p: pr, v } : m;
+        },
+        { p: "p2", v: hits[0] }
+      );
+      const unfixed = hits.some((v) => v.operator?.unfixed === "1");
+      const fixedIn = hits.map((v) => v.operator?.max_version).filter(Boolean);
+      const cves = hits.flatMap((v) => (v.source ?? []).map((s) => s.id)).filter((x) => /^CVE-/.test(x));
+      out.push({
+        id: `vuln:${id}`,
+        priority: active ? worst.p : lower(worst.p),
+        area: "plugins",
+        title: `${p.name} ${p.version} has ${hits.length} known ${hits.length === 1 ? "vulnerability" : "vulnerabilities"}${active ? "" : " (inactive)"}`,
+        why: `${decode2(worst.v.name)}${cves.length ? ` (${[...new Set(cves)].slice(0, 3).join(", ")})` : ""}. ${active ? "Attackers scan for these." : "Inactive plugins can still be reached through their files."}`,
+        fix: newer && !unfixed ? `Update to ${newer}${fixedIn.length ? ` (fixed from ${fixedIn.sort(cmpVersion).pop()})` : ""}.` : unfixed ? "No fixed version yet: deactivate it and replace it, or delete it if unused." : "Update it when a fixed version appears, or replace it.",
+        ...newer && !unfixed ? { tool: { name: "wp_plugin_update", args: { plugin: id } } } : { tool: { name: "wp_plugin_set", args: { plugin: id, status: active ? "inactive" : "deleted" } } },
+        source: "wpvulnerability.net"
+      });
+    } else if (newer)
+      out.push({
+        id: `update:${id}`,
+        priority: "p2",
+        area: "plugins",
+        title: `${p.name} can be updated (${p.version} \u2192 ${newer})`,
+        why: "Updates often fix security problems before they are published.",
+        fix: "Update it, then check the site.",
+        tool: { name: "wp_plugin_update", args: { plugin: id } }
+      });
+    if (d?.closed)
+      out.push({
+        id: `closed:${id}`,
+        priority: active ? "p1" : "p2",
+        area: "plugins",
+        title: `${p.name} was closed on WordPress.org`,
+        why: `${d.closed_reason ? `Reason: ${d.closed_reason}. ` : ""}It gets no more updates, so new flaws stay open.`,
+        fix: "Replace it with a maintained plugin, then delete it.",
+        tool: { name: "wp_plugin_set", args: { plugin: id, status: active ? "inactive" : "deleted" } }
+      });
+    if (!active && !hits.length && !d?.closed)
+      out.push({
+        id: `inactive:${id}`,
+        priority: "p4",
+        area: "plugins",
+        title: `${p.name} is installed but inactive`,
+        why: "Unused plugins are code on the server that nobody watches.",
+        fix: "Delete it if the site doesn't need it.",
+        tool: { name: "wp_plugin_set", args: { plugin: id, status: "deleted" } }
+      });
+  });
+  const themeData = await pool(themes, 4, (t) => vulnDb("theme", t.stylesheet));
+  themes.forEach((t, i) => {
+    const hits = (themeData[i]?.vulnerability ?? []).filter((v) => affects(v, t.version));
+    if (hits.length)
+      out.push({
+        id: `vuln:theme:${t.stylesheet}`,
+        priority: t.status === "active" ? "p0" : "p2",
+        area: "themes",
+        title: `Theme ${t.name ?? t.stylesheet} ${t.version} has known vulnerabilities`,
+        why: decode2(hits[0]?.name ?? ""),
+        fix: t.status === "active" ? "Update the theme." : "Delete the unused theme in wp-admin \u2192 Appearance.",
+        source: "wpvulnerability.net"
+      });
+  });
+  if (core) {
+    const d = await vulnDb("core", core);
+    if (d === null) degraded.push("WordPress core vulnerabilities");
+    const names = [
+      ...new Set((d?.vulnerability ?? []).flatMap((v) => (v.source ?? []).map((x) => decode2(x.name))).filter(Boolean))
+    ];
+    const unauth = names.filter((n2) => /unauthenticated/i.test(n2));
+    if (names.length || updates?.core)
+      out.push({
+        id: "core",
+        priority: unauth.length ? "p0" : names.length ? "p1" : "p2",
+        area: "core",
+        title: `WordPress ${core}${updates?.core ? ` \u2192 ${updates.core} available` : ""}${names.length ? ` (${names.length} known vulnerabilities${unauth.length ? `, ${unauth.length} without login` : ""})` : ""}`,
+        why: names.length ? `For example: ${unauth[0] ?? names[0]}.` : "Minor WordPress releases are security releases.",
+        fix: "Update WordPress (wp-admin \u2192 Dashboard \u2192 Updates, or the host's one-click update). Back up first.",
+        source: names.length ? "wpvulnerability.net" : void 0
+      });
+  }
+  return out;
+}
+function healthFindings(h) {
+  const out = [];
+  const s = h.settings;
+  const add = (f) => out.push(f);
+  if (s.debug_display)
+    add({
+      id: "debug-display",
+      priority: "p1",
+      area: "settings",
+      title: "PHP errors are shown to visitors (WP_DEBUG_DISPLAY)",
+      why: "Error messages reveal file paths and versions to attackers.",
+      fix: "In wp-config.php set WP_DEBUG to false (or WP_DEBUG_DISPLAY to false). Host or developer task."
+    });
+  if (s.registration && !["subscriber", ""].includes(String(s.default_role)))
+    add({
+      id: "registration-role",
+      priority: "p0",
+      area: "settings",
+      title: `Anyone can register and becomes ${s.default_role}`,
+      why: "Strangers get accounts that can publish or change the site.",
+      fix: "wp-admin \u2192 Settings \u2192 General: untick \u201CAnyone can register\u201D, or set the new user role to Subscriber."
+    });
+  else if (s.registration)
+    add({
+      id: "registration",
+      priority: "p3",
+      area: "settings",
+      title: "Anyone can register an account",
+      why: "Open registration attracts spam accounts; fine only if the site needs it.",
+      fix: "wp-admin \u2192 Settings \u2192 General: untick \u201CAnyone can register\u201D if visitors don't need accounts."
+    });
+  if (!s.https)
+    add({
+      id: "https",
+      priority: "p1",
+      area: "settings",
+      title: "The site address is not https",
+      why: "Logins and forms travel unencrypted; browsers mark the site as not secure.",
+      fix: "Install a certificate at the host and change the WordPress and site address to https."
+    });
+  if (s.file_edit)
+    add({
+      id: "file-edit",
+      priority: "p3",
+      area: "settings",
+      title: "Plugin and theme files can be edited in wp-admin",
+      why: "A stolen admin login can then run any code on the server.",
+      fix: "Add define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php (host or developer). CMO.so's tools keep working."
+    });
+  if (s.xmlrpc)
+    add({
+      id: "xmlrpc",
+      priority: "p3",
+      area: "settings",
+      title: "XML-RPC is on",
+      why: "Old remote API used for password guessing at scale; most sites don't need it (the CMO.so tools don't).",
+      fix: "Block /xmlrpc.php at the host or with a security plugin, unless the Jetpack or the WordPress app needs it."
+    });
+  const perms = String(s.wp_config_perms ?? "");
+  if (/^\d{3}$/.test(perms) && Number(perms[2]) >= 4)
+    add({
+      id: "wp-config-perms",
+      priority: Number(perms[2]) >= 6 ? "p1" : "p3",
+      area: "server",
+      title: `wp-config.php is readable by every user on the server (${perms})`,
+      why: "It holds the database password; on shared hosting other accounts could read it.",
+      fix: "Ask the host to set it to 640 or 600."
+    });
+  const php = h.versions.php.split(".").slice(0, 2).join(".");
+  const eol = PHP_EOL[php];
+  const today2 = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  if (eol && eol < today2)
+    add({
+      id: "php-eol",
+      priority: "p1",
+      area: "server",
+      title: `PHP ${h.versions.php} gets no more security fixes (since ${eol})`,
+      why: "Flaws found in PHP now stay open on this server.",
+      fix: "Ask the host to move the site to PHP 8.3 or newer (test the site after)."
+    });
+  else if (eol && eol < new Date(Date.now() + 120 * 864e5).toISOString().slice(0, 10))
+    add({
+      id: "php-eol-soon",
+      priority: "p3",
+      area: "server",
+      title: `PHP ${h.versions.php} stops getting security fixes on ${eol}`,
+      why: "Plan the move before it ends.",
+      fix: "Ask the host to move the site to PHP 8.3 or newer."
+    });
+  const db = /^(\d+\.\d+)/.exec(h.versions.database)?.[1] ?? "";
+  if (!/mariadb/i.test(h.versions.database) && ["5.7", "8.0"].includes(db))
+    add({
+      id: "mysql-eol",
+      priority: "p3",
+      area: "server",
+      title: `MySQL ${db} has reached end of life`,
+      why: "No more security fixes from Oracle.",
+      fix: "Ask the host to move the database to MySQL 8.4 LTS (or MariaDB 11)."
+    });
+  const admins = h.users.admins;
+  if (admins.some((a) => a.login_is_admin))
+    add({
+      id: "admin-login",
+      priority: "p2",
+      area: "users",
+      title: "An Administrator logs in as \u201Cadmin\u201D",
+      why: "It is the first name password-guessing bots try.",
+      fix: "Create a new Administrator with another name, move the content to it, then delete \u201Cadmin\u201D."
+    });
+  if ((h.users.by_role.administrator ?? 0) > 3)
+    add({
+      id: "many-admins",
+      priority: "p3",
+      area: "users",
+      title: `${h.users.by_role.administrator} Administrator accounts`,
+      why: "Each one can change everything; fewer admins, fewer ways in.",
+      fix: "Give people who only write or edit the Editor or Author role."
+    });
+  const old = new Date(Date.now() - 90 * 864e5).toISOString().slice(0, 10);
+  const stale = admins.filter(
+    (a) => a.app_passwords > 0 && (!a.app_password_last_use || a.app_password_last_use < old)
+  );
+  if (stale.length)
+    add({
+      id: "stale-app-passwords",
+      priority: "p3",
+      area: "users",
+      title: `${stale.length} Administrator${stale.length > 1 ? "s have" : " has"} application passwords unused for 90 days`,
+      why: "Old application passwords are keys nobody remembers handing out.",
+      fix: "wp-admin \u2192 Users \u2192 Profile \u2192 Application Passwords: revoke the ones no tool uses (keep the CMO.so one)."
+    });
+  const orphans = h.cron.filter((j) => !j.handled && !j.core);
+  for (const j of orphans.slice(0, 10))
+    add({
+      id: `cron-orphan:${j.hook}`,
+      priority: "p3",
+      area: "cron",
+      title: `Scheduled job \u201C${j.hook}\u201D has nothing to run it`,
+      why: "Usually left behind by a removed plugin; it keeps waking WordPress for nothing.",
+      fix: "Remove it.",
+      tool: { name: "wp_cron_unschedule", args: { hook: j.hook } }
+    });
+  const late = h.cron.filter((j) => j.schedule !== "once" && j.overdue_min > 120);
+  if (late.length)
+    add({
+      id: "cron-late",
+      priority: s.wp_cron_disabled ? "p2" : "p3",
+      area: "cron",
+      title: `${late.length} scheduled jobs are more than 2 hours late`,
+      why: s.wp_cron_disabled ? "WP-Cron is turned off (DISABLE_WP_CRON) and no server cron seems to call it: scheduled posts, updates checks and clean-ups don't run." : "WP-Cron only runs when someone visits; on a quiet site scheduled posts and update checks run late.",
+      fix: "Ask the host for a server cron that calls wp-cron.php every 5 minutes (and set DISABLE_WP_CRON)."
+    });
+  if (h.plugins.must_use.length || h.plugins.dropins.length)
+    add({
+      id: "mu-dropins",
+      priority: "p4",
+      area: "plugins",
+      title: `Hidden plugins: ${[...h.plugins.must_use, ...h.plugins.dropins].join(", ")}`,
+      why: "Must-use plugins and drop-ins run on every page and don't show in the plugin list. Usually the host's; worth knowing.",
+      fix: "Ask the host what they are if you don't recognise them."
+    });
+  return out;
+}
+async function outsideFindings(url, h) {
+  const out = [];
+  const home = await outside(url, "/", { redirect: "follow" });
+  if (home) {
+    const want = [
+      ["strict-transport-security", "HSTS"],
+      ["x-content-type-options", "X-Content-Type-Options"],
+      ["referrer-policy", "Referrer-Policy"]
+    ];
+    const missing = want.filter(([hname]) => !home.headers.get(hname)).map(([, label2]) => label2);
+    const csp = home.headers.get("content-security-policy") ?? "";
+    if (!home.headers.get("x-frame-options") && !/frame-ancestors/i.test(csp))
+      missing.push("X-Frame-Options or CSP frame-ancestors");
+    if (missing.length)
+      out.push({
+        id: "headers",
+        priority: "p3",
+        area: "outside",
+        title: `Missing security headers: ${missing.join(", ")}`,
+        why: "They stop click-jacking, MIME sniffing and downgrade to http in browsers.",
+        fix: "Add them at the web server or CDN (Cloudflare \u2192 Rules \u2192 Transform rules), or with a security plugin."
+      });
+    const gen = /<meta name="generator" content="WordPress ([\d.]+)/i.exec(home.text)?.[1];
+    if (gen)
+      out.push({
+        id: "version-visible",
+        priority: "p4",
+        area: "outside",
+        title: `The WordPress version (${gen}) is visible in the page`,
+        why: "Bots use it to pick attacks; keeping WordPress updated matters more than hiding it.",
+        fix: "Optional: remove the generator tag with a security plugin."
+      });
+  }
+  const probes = [
+    { path: "/.env", id: "env", title: "/.env is public", test: (t) => /^[A-Z_]+=/m.test(t), priority: "p0" },
+    {
+      path: "/.git/HEAD",
+      id: "git",
+      title: "The .git folder is public",
+      test: (t) => t.startsWith("ref:"),
+      priority: "p0"
+    },
+    {
+      path: "/wp-config.php.bak",
+      id: "config-bak",
+      title: "A copy of wp-config.php is public",
+      test: (t) => /DB_(NAME|PASSWORD)/.test(t),
+      priority: "p0"
+    },
+    {
+      path: "/wp-config.php~",
+      id: "config-tilde",
+      title: "A copy of wp-config.php is public",
+      test: (t) => /DB_(NAME|PASSWORD)/.test(t),
+      priority: "p0"
+    },
+    {
+      path: "/wp-content/debug.log",
+      id: "debug-log",
+      title: "The PHP error log is public",
+      test: (t) => /PHP (Notice|Warning|Fatal|Deprecated)|\[\d{2}-\w{3}-\d{4}/.test(t),
+      priority: "p1"
+    }
+  ];
+  const got = await pool(probes, 5, (p) => outside(url, p.path));
+  probes.forEach((p, i) => {
+    const r = got[i];
+    if (r && r.status === 200 && p.test(r.text))
+      out.push({
+        id: `exposed:${p.id}`,
+        priority: p.priority,
+        area: "outside",
+        title: p.title,
+        why: "Anyone can download it: it can hold passwords, keys or the site's code.",
+        fix: `Delete or block ${p.path} at the host today${p.id === "env" || p.id.startsWith("config") ? ", then change every password and key it holds" : ""}.`
+      });
+  });
+  const author = await outside(url, "/?author=1");
+  if (author && [301, 302].includes(author.status) && /\/author\/[^/]+/.test(author.location))
+    out.push({
+      id: "user-enum",
+      priority: "p3",
+      area: "outside",
+      title: "Login names can be found from /?author=1",
+      why: "It gives password-guessing bots half of a login.",
+      fix: "Block ?author= requests for visitors with a security plugin or a server rule."
+    });
+  const users = await outside(url, "/wp-json/wp/v2/users");
+  if (users && users.status === 200 && /"slug"\s*:/.test(users.text))
+    out.push({
+      id: "users-api",
+      priority: "p3",
+      area: "outside",
+      title: "The list of authors is public at /wp-json/wp/v2/users",
+      why: "It shows login names (slugs) to anyone.",
+      fix: "Limit the users endpoint to signed-in users with a security plugin."
+    });
+  const xmlrpc = h?.settings.xmlrpc ? await outside(url, "/xmlrpc.php") : null;
+  if (xmlrpc && xmlrpc.status === 405) {
+    const f = out.find((x) => x.id === "xmlrpc");
+    if (f) f.why += " It answers from the internet.";
+  }
+  return out;
+}
+async function securityScan(site, o = {}) {
+  const degraded = [];
+  const notes = [];
+  const h = await site.request({ path: "/maggie-core/v1/health" }).then((r) => r.status === 200 ? r.data : null).catch(() => null);
+  if (!h)
+    notes.push(
+      "Maggie Core 0.14+ adds what WordPress itself reports (versions, settings, users, scheduled jobs, updates): update it with wp_theme_update for the full check."
+    );
+  const plugins = await call(site, {
+    path: "/wp/v2/plugins",
+    query: { _fields: "plugin,name,version,status,auto_update" }
+  }).catch((e) => {
+    degraded.push(`plugin list (${e.message})`);
+    return [];
+  });
+  const themes = await call(site, { path: "/wp/v2/themes", query: { _fields: "stylesheet,version,status,name" } }).then(
+    (rows) => rows.map((t) => ({ ...t, name: typeof t.name === "string" ? t.name : t.name?.raw ?? t.stylesheet }))
+  ).catch(() => []);
+  const core = h?.versions.wordpress ?? "";
+  const findings = [];
+  if (o.vulnerabilities !== false)
+    findings.push(...await componentFindings(plugins, themes, core, h?.updates ?? null, degraded));
+  if (h) findings.push(...healthFindings(h));
+  if (o.outside !== false && site.url) findings.push(...await outsideFindings(site.url, h));
+  findings.sort((a, b) => order.indexOf(a.priority) - order.indexOf(b.priority));
+  const count = Object.fromEntries(order.map((p) => [p, findings.filter((f) => f.priority === p).length]));
+  return {
+    site: site.url ?? "",
+    checked: (/* @__PURE__ */ new Date()).toISOString(),
+    summary: {
+      ...count,
+      plugins: plugins.length,
+      active_plugins: plugins.filter((p) => p.status === "active").length,
+      themes: themes.length,
+      wordpress: core || null,
+      php: h?.versions.php ?? null,
+      scheduled_jobs: h?.cron.length ?? null
+    },
+    words: { p0: "fix today", p1: "this week", p2: "this month", p3: "when convenient", p4: "for information" },
+    findings,
+    ...h ? {
+      cron: h.cron.filter((j) => !j.core).map((j) => ({
+        hook: j.hook,
+        schedule: j.schedule,
+        next: j.next,
+        handled: j.handled,
+        late_min: j.overdue_min
+      }))
+    } : {},
+    ...degraded.length ? { degraded: [...new Set(degraded)].slice(0, 12) } : {},
+    ...notes.length ? { notes } : {},
+    source: "Vulnerability data: WPVulnerability (wpvulnerability.net)."
+  };
+}
+
 // ../../packages/tools/src/wp/site.ts
 async function siteStatus(site) {
   const me = await call(site, {
@@ -15897,8 +16383,8 @@ async function relatedCards(site, parent, template, exclude = [], n2 = 3) {
     },
     300
   );
-  const pool2 = pages.filter((p) => !exclude.includes(p.id) && (!template || p.template === template));
-  const picks = pool2.slice(0, n2);
+  const pool4 = pages.filter((p) => !exclude.includes(p.id) && (!template || p.template === template));
+  const picks = pool4.slice(0, n2);
   const media = picks.filter((p) => p.featured_media).map((p) => p.featured_media);
   const urls = {};
   if (media.length) {
@@ -16163,7 +16649,7 @@ async function seoImport(site, overwrite = false) {
     body: { overwrite }
   });
 }
-async function pool(items3, n2, fn) {
+async function pool2(items3, n2, fn) {
   const out = new Array(items3.length);
   let i = 0;
   await Promise.all(
@@ -16185,7 +16671,7 @@ async function seoAudit(site, o = {}) {
     o.posts
   ) : [];
   const items3 = [...pages.map((p) => ({ ...p, kind: "page" })), ...posts2.map((p) => ({ ...p, kind: "post" }))];
-  const heads = await pool(items3, 6, (p) => renderedHead(site, p.link).catch(() => null));
+  const heads = await pool2(items3, 6, (p) => renderedHead(site, p.link).catch(() => null));
   const issues = [];
   const titles = /* @__PURE__ */ new Map();
   const descs = /* @__PURE__ */ new Map();
@@ -16289,7 +16775,7 @@ async function seoAudit(site, o = {}) {
       });
   const unknown2 = [...allLinks].filter((l) => !known.has(l) && !/^\/(category|tag|author|page|blogs?)\//.test(l)).slice(0, 60);
   const base = site.url ?? "";
-  const checked = await pool(unknown2, 6, async (l) => ({
+  const checked = await pool2(unknown2, 6, async (l) => ({
     l,
     s: site.fetchPage ? (await site.fetchPage(`${base}${l}`).catch(() => ({ status: 0 }))).status : 200
   }));
@@ -16319,8 +16805,8 @@ async function seoAudit(site, o = {}) {
       path: "/wp-sitemap.xml",
       detail: `The sitemap answers ${sitemap.status || "nothing"}.`
     });
-  const order = { high: 0, medium: 1, low: 2 };
-  issues.sort((a, b) => order[a.severity] - order[b.severity] || a.code.localeCompare(b.code));
+  const order2 = { high: 0, medium: 1, low: 2 };
+  issues.sort((a, b) => order2[a.severity] - order2[b.severity] || a.code.localeCompare(b.code));
   const byCode = {};
   for (const i of issues) byCode[i.code] = (byCode[i.code] ?? 0) + 1;
   return {
@@ -16331,6 +16817,888 @@ async function seoAudit(site, o = {}) {
   };
 }
 
+// ../../packages/tools/src/wp/seo-tech.ts
+var UA = "Mozilla/5.0 (compatible; CMO.so SEO check)";
+async function get(url, redirect = "manual") {
+  const r = await fetch(url, { redirect, signal: AbortSignal.timeout(15e3), headers: { "User-Agent": UA } }).catch(
+    () => null
+  );
+  if (!r) return null;
+  const text3 = r.status === 200 ? await r.text().catch(() => "") : "";
+  return {
+    status: r.status,
+    text: text3,
+    location: r.headers.get("location") ?? "",
+    type: r.headers.get("content-type") ?? ""
+  };
+}
+async function pool3(items3, n2, fn) {
+  const out = new Array(items3.length);
+  let i = 0;
+  await Promise.all(
+    Array.from({ length: Math.min(n2, items3.length) }, async () => {
+      while (i < items3.length) {
+        const k = i++;
+        out[k] = await fn(items3[k]);
+      }
+    })
+  );
+  return out;
+}
+function sitePath(href, base) {
+  try {
+    const u = new URL(href, `${base}/`);
+    const b = new URL(base);
+    if (u.hostname.replace(/^www\./, "") !== b.hostname.replace(/^www\./, "")) return null;
+    if (!/^https?:$/.test(u.protocol)) return null;
+    let p = u.pathname.replace(/\/+/g, "/");
+    if (!p.endsWith("/") && !/\.[a-z0-9]{2,5}$/i.test(p)) p += "/";
+    return `${p}${u.searchParams.get("p") || u.searchParams.get("page_id") ? `?${u.searchParams.toString()}` : ""}`;
+  } catch {
+    return null;
+  }
+}
+var strip = (h) => h.replace(/<[^>]+>/g, " ").replace(/&nbsp;/g, " ").replace(/&amp;/g, "&").replace(/&#8217;|&rsquo;/g, "\u2019").replace(/&#8211;|&ndash;/g, "\u2013").replace(/&quot;/g, '"').replace(/&#039;|&#39;/g, "'").replace(/\s+/g, " ").trim();
+function scanHtml(html2, url, base) {
+  const head = /<head[\s\S]*?<\/head>/i.exec(html2)?.[0] ?? html2;
+  const attr2 = (re) => re.exec(head)?.[1] ?? "";
+  const main = /<main[\s\S]*?<\/main>/i.exec(html2)?.[0] ?? html2.replace(/<header[\s\S]*?<\/header>/gi, "").replace(/<nav[\s\S]*?<\/nav>/gi, "").replace(/<footer[\s\S]*?<\/footer>/gi, "");
+  const body = main.replace(/<script[\s\S]*?<\/script>|<style[\s\S]*?<\/style>/gi, " ");
+  const links2 = [];
+  for (const m of body.matchAll(/<a\b[^>]*href=["']([^"'#]+)[^"']*["'][^>]*>([\s\S]*?)<\/a>/gi)) {
+    const p = sitePath(m[1], base);
+    if (p && !/\/(wp-admin|wp-login|wp-json|feed)\b|\.(jpg|jpeg|png|webp|gif|svg|pdf|zip)$/i.test(p))
+      links2.push({ path: p, text: strip(m[2]).slice(0, 80) });
+  }
+  const imgs = [...body.matchAll(/<img\b[^>]*>/gi)].map((m) => m[0]);
+  const schema = [];
+  let schemaErrors = 0;
+  for (const m of html2.matchAll(/<script[^>]+application\/ld\+json[^>]*>([\s\S]*?)<\/script>/gi)) {
+    try {
+      const j = JSON.parse(m[1]);
+      const items3 = Array.isArray(j) ? j : j["@graph"] ? j["@graph"] : [j];
+      for (const it of items3) {
+        const t = it?.["@type"];
+        for (const x of Array.isArray(t) ? t : [t]) if (typeof x === "string") schema.push(x);
+      }
+    } catch {
+      schemaErrors++;
+    }
+  }
+  return {
+    url,
+    path: sitePath(url, base) ?? url,
+    title: strip(/<title[^>]*>([\s\S]*?)<\/title>/i.exec(head)?.[1] ?? ""),
+    description: strip(attr2(/<meta[^>]+name=["']description["'][^>]+content=["']([^"']*)["']/i)),
+    canonical: attr2(/<link[^>]+rel=["']canonical["'][^>]+href=["']([^"']+)["']/i),
+    robots: attr2(/<meta[^>]+name=["']robots["'][^>]+content=["']([^"']*)["']/i).toLowerCase(),
+    h1: (body.match(/<h1\b/gi) ?? []).length || (html2.match(/<h1\b/gi) ?? []).length,
+    images: imgs.length,
+    // No alt at all is a problem; alt="" is right for decoration (cover backgrounds), wrong on content pictures.
+    imagesNoAlt: imgs.filter((i) => {
+      if (/aria-hidden|role=["']presentation|wp-block-cover__image-background/i.test(i)) return false;
+      if (!/\balt=/i.test(i)) return true;
+      return /\balt=["']\s*["']/i.test(i) && /\bwp-image-\d+/.test(i);
+    }).length,
+    schema: [...new Set(schema)],
+    schemaErrors,
+    links: links2,
+    words: strip(body).split(" ").filter(Boolean).length
+  };
+}
+async function sitemapUrls(base, robotsTxt, max = 500) {
+  const fromRobots = [...robotsTxt.matchAll(/^sitemap:\s*(\S+)/gim)].map((m) => m[1]);
+  const candidates = [...fromRobots, `${base}/wp-sitemap.xml`, `${base}/sitemap_index.xml`, `${base}/sitemap.xml`];
+  for (const sm of candidates) {
+    const r = await get(sm, "follow");
+    if (!r || r.status !== 200 || !/<(urlset|sitemapindex)/i.test(r.text)) continue;
+    const urls = [];
+    const queue = [r.text];
+    let fetched = 0;
+    while (queue.length && urls.length < max && fetched < 30) {
+      const xml = queue.shift();
+      const locs = [...xml.matchAll(/<loc>\s*([^<\s]+)\s*<\/loc>/gi)].map(
+        (m) => m[1].replace(/&amp;/g, "&")
+      );
+      if (/<sitemapindex/i.test(xml)) {
+        for (const l of locs) {
+          const s = await get(l, "follow");
+          fetched++;
+          if (s?.status === 200) queue.push(s.text);
+        }
+      } else urls.push(...locs);
+    }
+    return { urls: [...new Set(urls)].slice(0, max), sitemap: sm };
+  }
+  return { urls: [], sitemap: null };
+}
+var AI_BOTS = [
+  "GPTBot",
+  "OAI-SearchBot",
+  "ChatGPT-User",
+  "ClaudeBot",
+  "Claude-SearchBot",
+  "PerplexityBot",
+  "Google-Extended",
+  "CCBot"
+];
+function robotsBlocked(robots, agents) {
+  const groups = [];
+  let cur = null;
+  for (const raw of robots.split(/\r?\n/)) {
+    const line = raw.replace(/#.*/, "").trim();
+    const m = /^([a-z-]+)\s*:\s*(.*)$/i.exec(line);
+    if (!m) continue;
+    const [k, v] = [m[1].toLowerCase(), m[2].trim()];
+    if (k === "user-agent") {
+      if (!cur || cur.rules.length) {
+        cur = { agents: [], rules: [] };
+        groups.push(cur);
+      }
+      cur.agents.push(v.toLowerCase());
+    } else if (cur && (k === "disallow" || k === "allow")) cur.rules.push(`${k}:${v}`);
+  }
+  const blocks = (g) => g.rules.includes("disallow:/") && !g.rules.some((r) => r === "allow:/");
+  return agents.filter((a) => {
+    const own3 = groups.find((g2) => g2.agents.includes(a.toLowerCase()));
+    const g = own3 ?? groups.find((x) => x.agents.includes("*"));
+    return g ? blocks(g) : false;
+  });
+}
+function groupFindings(list3, min = 4) {
+  const kinds = /* @__PURE__ */ new Map();
+  for (const f of list3) {
+    const k = f.id.includes(":") ? f.id.split(":")[0] : f.id;
+    kinds.set(k, [...kinds.get(k) ?? [], f]);
+  }
+  const out = [];
+  for (const [k, fs2] of kinds) {
+    if (fs2.length < min || !fs2[0]?.id.includes(":")) {
+      out.push(...fs2);
+      continue;
+    }
+    const paths = fs2.map((f) => f.id.slice(k.length + 1));
+    const first = fs2[0];
+    const label2 = {
+      "title-long": "have SEO titles longer than 65 characters",
+      alt: "have pictures without alt text",
+      desc: "have no meta description",
+      h1: "don't have exactly one H1",
+      thin: "have fewer than 120 words",
+      "noindex-in-sitemap": "are noindex but in the sitemap",
+      canonical: "point their canonical elsewhere",
+      "schema-error": "have broken structured data",
+      "sitemap-status": "are in the sitemap but don't answer 200",
+      orphan: "get no links from other pages",
+      broken: "are linked but broken"
+    };
+    const seoTool = first.tool?.name === "wp_seo_set";
+    out.push({
+      ...first,
+      id: `${k}:*`,
+      title: `${fs2.length} pages ${label2[k] ?? first.title}`,
+      why: first.why,
+      fix: `${first.fix.replace(/\.$/, "")}. Pages: ${paths.slice(0, 12).join(", ")}${paths.length > 12 ? ` +${paths.length - 12} more` : ""}.`,
+      ...seoTool ? { tool: { name: "wp_seo_set", args: { items: paths.slice(0, 50).map((x) => ({ page: x })) } } } : {},
+      pages: paths
+    });
+  }
+  return out;
+}
+async function techAudit(site, o = {}) {
+  const base = (site.url ?? "").replace(/\/+$/, "");
+  if (!base) throw new Error("The site's address is unknown.");
+  const limit = Math.min(Math.max(o.limit ?? 60, 5), 200);
+  const findings = [];
+  const add = (f) => findings.push(f);
+  const robotsR = await get(`${base}/robots.txt`, "follow");
+  const robots = robotsR?.status === 200 ? robotsR.text : "";
+  const visible = await site.request({ path: "/wp/v2/settings", query: { _fields: "blog_public" } }).then((r) => r.status === 200 && r.data.blog_public != null ? !!Number(r.data.blog_public) : null).catch(() => null);
+  const engagedOff = visible === false;
+  let { urls, sitemap } = await sitemapUrls(base, robots);
+  let discovered = "sitemap";
+  if (!urls.length) {
+    const rows = await Promise.all(
+      ["/wp/v2/pages", "/wp/v2/posts"].map(
+        (path3) => all(site, path3, { status: "publish", _fields: "link", per_page: 100 }, limit).catch(() => [])
+      )
+    );
+    urls = [...new Set(rows.flat().map((r) => r.link))];
+    discovered = "wordpress";
+  }
+  if (engagedOff)
+    add({
+      id: "search-engines-off",
+      priority: "p1",
+      area: "settings",
+      title: "Search engines are switched off for this site",
+      why: "WordPress tells every search engine not to index it (noindex on every page, no sitemap). Right for a test or unfinished site; check MEMORY.md before changing it.",
+      fix: "When the site is ready: wp_settings_set search_engines true.",
+      tool: { name: "wp_settings_set", args: { search_engines: true } }
+    });
+  if (!robotsR || robotsR.status !== 200)
+    add({
+      id: "robots-missing",
+      priority: "p3",
+      area: "settings",
+      title: "No robots.txt",
+      why: "Crawlers look for it first.",
+      fix: "WordPress makes one by itself unless a file or plugin blocks it: check the host."
+    });
+  if (/^disallow:\s*\/\s*$/im.test(robots) && robotsBlocked(robots, ["Googlebot"]).length)
+    add({
+      id: "robots-all",
+      priority: "p0",
+      area: "settings",
+      title: "robots.txt blocks Google from the whole site",
+      why: "Nothing can be indexed.",
+      fix: "Turn search engines on (wp_settings_set search_engines true) or fix the robots.txt file.",
+      tool: { name: "wp_settings_set", args: { search_engines: true } }
+    });
+  if (robots && !engagedOff && !/^sitemap:/im.test(robots))
+    add({
+      id: "robots-sitemap",
+      priority: "p3",
+      area: "settings",
+      title: "robots.txt doesn't point to the sitemap",
+      why: "It helps every crawler find all pages.",
+      fix: "Maggie Core adds the Sitemap line when search engines are on; otherwise add it to robots.txt."
+    });
+  const aiBlocked = robotsBlocked(robots, AI_BOTS);
+  if (aiBlocked.length)
+    add({
+      id: "ai-crawlers",
+      priority: "p2",
+      area: "settings",
+      title: `AI crawlers are blocked: ${aiBlocked.join(", ")}`,
+      why: "ChatGPT, Claude, Perplexity and Google's AI answers can't read or cite the site.",
+      fix: "Allow them in robots.txt unless the owner chose to block AI."
+    });
+  if (!sitemap && !engagedOff)
+    add({
+      id: "sitemap-missing",
+      priority: "p1",
+      area: "settings",
+      title: "No sitemap found",
+      why: "Search engines find new pages slower without one.",
+      fix: "WordPress publishes /wp-sitemap.xml when search engines are on; check nothing turns it off."
+    });
+  const llms = await get(`${base}/llms.txt`, "follow");
+  const hasLlms = !!llms && llms.status === 200 && /^#\s/m.test(llms.text) && !/<html/i.test(llms.text);
+  if (!hasLlms)
+    add({
+      id: "llms-missing",
+      priority: "p3",
+      area: "settings",
+      title: "No llms.txt",
+      why: "A short Markdown map of the site helps AI assistants describe it correctly.",
+      fix: "Generate it from the site.",
+      tool: { name: "wp_llms_txt_set", args: { generate: true } }
+    });
+  const crawl = urls.length ? urls.slice(0, limit) : [`${base}/`];
+  if (!crawl.some((u) => sitePath(u, base) === "/")) crawl.unshift(`${base}/`);
+  const scans = await pool3(crawl, 6, async (u) => {
+    const r = await get(u);
+    if (!r) return null;
+    if (r.status !== 200) return { ...scanHtml("", u, base), status: r.status, redirect: r.location || void 0 };
+    return { ...scanHtml(r.text, u, base), status: 200 };
+  });
+  const pages = scans.filter(Boolean);
+  const ok2 = pages.filter((p) => p.status === 200);
+  const bad = pages.filter((p) => p.status !== 200);
+  for (const p of bad)
+    add({
+      id: `sitemap-status:${p.path}`,
+      priority: p.status >= 400 ? "p1" : "p2",
+      area: "outside",
+      title: `The sitemap lists ${p.path}, which answers ${p.status}${p.redirect ? ` \u2192 ${p.redirect}` : ""}`,
+      why: "Sitemaps should list only live pages; search engines lose trust in it.",
+      fix: p.status >= 400 ? "Publish the page again, or remove it (wp_post_delete / wp_page_publish)." : "List the final address; the redirect is fine for visitors."
+    });
+  for (const p of ok2) {
+    if (/noindex/.test(p.robots) && !engagedOff && discovered === "sitemap")
+      add({
+        id: `noindex-in-sitemap:${p.path}`,
+        priority: "p1",
+        area: "outside",
+        title: `${p.path} is noindex but in the sitemap`,
+        why: "Mixed signals: either it should be found, or it shouldn't be listed.",
+        fix: 'Remove noindex if the page should rank (wp_seo_set robots "").',
+        tool: { name: "wp_seo_set", args: { page: p.path, robots: "" } }
+      });
+    if (p.canonical && sitePath(p.canonical, base) !== p.path)
+      add({
+        id: `canonical:${p.path}`,
+        priority: "p2",
+        area: "outside",
+        title: `${p.path} points its canonical to ${p.canonical}`,
+        why: "Google will index the other address instead of this page.",
+        fix: 'Clear the custom canonical unless it is on purpose (wp_seo_set canonical "").',
+        tool: { name: "wp_seo_set", args: { page: p.path, canonical: "" } }
+      });
+    if (p.h1 !== 1)
+      add({
+        id: `h1:${p.path}`,
+        priority: "p2",
+        area: "outside",
+        title: `${p.path} has ${p.h1} H1 headings`,
+        why: "One H1 says what the page is about.",
+        fix: p.h1 ? "Make the extra H1s H2 (wp_section_update edits)." : "Give the page a main heading (the hero's title)."
+      });
+    if (p.imagesNoAlt)
+      add({
+        id: `alt:${p.path}`,
+        priority: "p3",
+        area: "outside",
+        title: `${p.path}: ${p.imagesNoAlt} of ${p.images} pictures have no alt text`,
+        why: "Alt text is how search engines, AI and screen readers know what a picture shows.",
+        fix: "Add alt text (wp_section_update images alt, or the media library)."
+      });
+    if (p.schemaErrors)
+      add({
+        id: `schema-error:${p.path}`,
+        priority: "p2",
+        area: "outside",
+        title: `${p.path}: ${p.schemaErrors} structured-data block(s) are not valid JSON`,
+        why: "Google ignores broken structured data.",
+        fix: "Fix or remove the page's custom schema (wp_seo_set schema)."
+      });
+    if (p.words < 120 && !/\?/.test(p.path))
+      add({
+        id: `thin:${p.path}`,
+        priority: "p3",
+        area: "outside",
+        title: `${p.path} has only ${p.words} words`,
+        why: "Very short pages rarely rank or get cited.",
+        fix: "Add useful text: what, for whom, price or next step, questions."
+      });
+    if (!p.description)
+      add({
+        id: `desc:${p.path}`,
+        priority: "p2",
+        area: "outside",
+        title: `${p.path} has no meta description`,
+        why: "Google writes its own snippet, often a poor one.",
+        fix: "Write one (140\u2013160 characters).",
+        tool: { name: "wp_seo_set", args: { page: p.path } }
+      });
+    if (p.title.length > 65)
+      add({
+        id: `title-long:${p.path}`,
+        priority: "p3",
+        area: "outside",
+        title: `${p.path}: title is ${p.title.length} characters`,
+        why: "Search results cut it after about 60.",
+        fix: "Shorten the SEO title.",
+        tool: { name: "wp_seo_set", args: { page: p.path } }
+      });
+  }
+  const dup = (key) => {
+    const by = /* @__PURE__ */ new Map();
+    for (const p of ok2) if (p[key]) by.set(p[key], [...by.get(p[key]) ?? [], p.path]);
+    for (const [v, ps] of by)
+      if (ps.length > 1)
+        add({
+          id: `dup-${key}:${v.slice(0, 40)}`,
+          priority: "p2",
+          area: "outside",
+          title: `${ps.length} pages share the same ${key}: \u201C${v.slice(0, 70)}\u201D`,
+          why: "Search engines can't tell them apart.",
+          fix: `Give each its own ${key} (wp_seo_set items).`,
+          tool: { name: "wp_seo_set", args: { items: ps.slice(0, 10).map((x) => ({ page: x })) } }
+        });
+  };
+  dup("title");
+  dup("description");
+  const home = ok2.find((p) => p.path === "/");
+  if (home && !home.schema.some((t) => /Organization|LocalBusiness|WebSite|Person|Store|Restaurant|Service/i.test(t)))
+    add({
+      id: "schema-home",
+      priority: "p2",
+      area: "outside",
+      title: "The homepage has no Organization / LocalBusiness structured data",
+      why: "It tells Google and AI who the business is, where and how to reach it.",
+      fix: "Fill the business details (wp_seo_site_set business).",
+      tool: { name: "wp_seo_site_set", args: {} }
+    });
+  const inbound = /* @__PURE__ */ new Map();
+  for (const p of ok2)
+    for (const l of new Set(p.links.map((x) => x.path))) if (l !== p.path) inbound.set(l, (inbound.get(l) ?? 0) + 1);
+  const known = new Set(pages.map((p) => p.path));
+  const targets = [...new Set(ok2.flatMap((p) => p.links.map((l) => l.path)))].filter((t) => !known.has(t)).slice(0, 80);
+  const checked = await pool3(targets, 6, async (t) => ({ t, r: await get(`${base}${t}`) }));
+  const broken = checked.filter((c) => c.r && c.r.status >= 400);
+  const redirected = checked.filter((c) => c.r && [301, 302, 307, 308].includes(c.r.status));
+  for (const b of broken) {
+    const from = ok2.filter((p) => p.links.some((l) => l.path === b.t)).map((p) => p.path);
+    add({
+      id: `broken:${b.t}`,
+      priority: "p1",
+      area: "outside",
+      title: `Broken link to ${b.t} (${b.r?.status}) on ${from.slice(0, 3).join(", ")}${from.length > 3 ? ` +${from.length - 3}` : ""}`,
+      why: "Visitors hit a dead end and crawlers waste their visit.",
+      fix: "Point the link to a live page (wp_section_update links) or add a redirect (wp_redirect_set).",
+      tool: { name: "wp_redirect_set", args: { from: b.t } }
+    });
+  }
+  if (redirected.length)
+    add({
+      id: "links-redirected",
+      priority: "p3",
+      area: "outside",
+      title: `${redirected.length} internal links go through a redirect`,
+      why: "Each hop slows visitors and loses a little link value.",
+      fix: `Link straight to the final address: ${redirected.slice(0, 5).map((c) => `${c.t} \u2192 ${c.r?.location}`).join(", ")}.`
+    });
+  const generic = ok2.flatMap(
+    (p) => p.links.filter((l) => /^(click here|here|read more|learn more|more|this|link|點此|更多)$/i.test(l.text)).map(() => p.path)
+  );
+  if (generic.length)
+    add({
+      id: "anchors-generic",
+      priority: "p3",
+      area: "outside",
+      title: `${generic.length} links say only \u201Cread more\u201D, \u201Cclick here\u201D or similar`,
+      why: "Link words tell search engines what the target page is about.",
+      fix: `Use the target's topic as the link text (pages: ${[...new Set(generic)].slice(0, 5).join(", ")}).`
+    });
+  let speed = null;
+  if (o.speed) speed = await pageSpeed(`${base}/`);
+  if (speed?.lcp_ms && Number(speed.lcp_ms) > 2500)
+    add({
+      id: "lcp",
+      priority: Number(speed.lcp_ms) > 4e3 ? "p1" : "p2",
+      area: "outside",
+      title: `The homepage's main content shows after ${(Number(speed.lcp_ms) / 1e3).toFixed(1)} s on phones (LCP)`,
+      why: "Google wants under 2.5 s; slow pages lose visitors and rankings.",
+      fix: "Smaller hero picture (WebP, under 200 KB), fewer fonts and scripts above the fold."
+    });
+  if (speed?.cls != null && Number(speed.cls) > 0.1)
+    add({
+      id: "cls",
+      priority: "p2",
+      area: "outside",
+      title: `The homepage moves while loading (CLS ${speed.cls})`,
+      why: "Google wants under 0.1.",
+      fix: "Give pictures width and height; don't insert banners above content after load."
+    });
+  const order2 = ["p0", "p1", "p2", "p3", "p4"];
+  const grouped = groupFindings(findings);
+  grouped.sort((a, b) => order2.indexOf(a.priority) - order2.indexOf(b.priority));
+  findings.length = 0;
+  findings.push(...grouped);
+  return {
+    site: base,
+    checked: (/* @__PURE__ */ new Date()).toISOString(),
+    summary: {
+      ...Object.fromEntries(order2.map((p) => [p, findings.filter((f) => f.priority === p).length])),
+      sitemap,
+      pages_from: discovered,
+      search_engines: visible,
+      sitemap_urls: discovered === "sitemap" ? urls.length : 0,
+      crawled: pages.length,
+      live: ok2.length,
+      llms_txt: hasLlms,
+      ai_crawlers_blocked: aiBlocked,
+      internal_links: ok2.reduce((n2, p) => n2 + p.links.length, 0)
+    },
+    pages: ok2.map((p) => ({
+      path: p.path,
+      title: p.title,
+      words: p.words,
+      h1: p.h1,
+      links_out: new Set(p.links.map((l) => l.path)).size,
+      links_in: inbound.get(p.path) ?? 0,
+      schema: p.schema
+    })),
+    findings,
+    ...speed ? { speed } : {},
+    ...urls.length > crawl.length ? { note: `Crawled the first ${crawl.length} of ${urls.length} sitemap addresses (limit up to 200).` } : {}
+  };
+}
+async function pageSpeed(url) {
+  const key = globalThis.process?.env?.PAGESPEED_API_KEY;
+  const q3 = new URLSearchParams({ url, strategy: "mobile", category: "performance" });
+  if (key) q3.set("key", key);
+  const r = await fetch(`https://www.googleapis.com/pagespeedonline/v5/runPagespeed?${q3}`, {
+    signal: AbortSignal.timeout(9e4)
+  }).catch(() => null);
+  if (!r || !r.ok)
+    return {
+      error: `PageSpeed Insights didn't answer (${r?.status ?? "timeout"})${r?.status === 429 && !key ? ": the server needs a PAGESPEED_API_KEY (Google Cloud, free)" : ""}.`
+    };
+  const j = await r.json();
+  const f = j.loadingExperience?.metrics ?? {};
+  const a = j.lighthouseResult?.audits ?? {};
+  const field = !!f.LARGEST_CONTENTFUL_PAINT_MS;
+  return {
+    source: field ? "real visitors (Chrome UX Report, 28 days)" : "lab test (no real-visitor data yet)",
+    score: Math.round((j.lighthouseResult?.categories?.performance?.score ?? 0) * 100),
+    lcp_ms: field ? f.LARGEST_CONTENTFUL_PAINT_MS?.percentile : Math.round(a["largest-contentful-paint"]?.numericValue ?? 0),
+    cls: field ? (f.CUMULATIVE_LAYOUT_SHIFT_SCORE?.percentile ?? 0) / 100 : Number((a["cumulative-layout-shift"]?.numericValue ?? 0).toFixed(3)),
+    inp_ms: f.INTERACTION_TO_NEXT_PAINT?.percentile ?? null,
+    tbt_ms: Math.round(a["total-blocking-time"]?.numericValue ?? 0)
+  };
+}
+var STOP = new Set(
+  "the a an and or of to in for on with by at from is are be your our you we it this that how what why best guide near vs and/or my me us".split(
+    " "
+  )
+);
+var tokens = (s) => new Set(
+  s.toLowerCase().replace(/[^\p{L}\p{N}\s-]/gu, " ").split(/[\s-]+/).filter((w) => w.length > 2 && !STOP.has(w)).map((w) => w.replace(/(ies)$/, "y").replace(/(es|s)$/, ""))
+);
+var overlap = (a, b, idf = () => 1) => {
+  let dot = 0;
+  let na = 0;
+  let nb = 0;
+  for (const w of a) {
+    const x = idf(w) ** 2;
+    na += x;
+    if (b.has(w)) dot += x;
+  }
+  for (const w of b) nb += idf(w) ** 2;
+  return dot / Math.sqrt(Math.max(1e-9, na) * Math.max(1e-9, nb));
+};
+function contentLinks(raw, base) {
+  const out = /* @__PURE__ */ new Set();
+  for (const m of raw.matchAll(/href=["']([^"'#]+)["']/gi)) {
+    const p = sitePath(m[1], base);
+    if (p) out.add(p);
+  }
+  for (const m of raw.matchAll(/"url":"([^"]+)"/g)) {
+    const p = sitePath(m[1].replace(/\\\//g, "/"), base);
+    if (p) out.add(p);
+  }
+  return out;
+}
+var flatMenu = (items3) => items3.flatMap((i) => [{ url: i.url, label: i.label }, ...flatMenu(i.children ?? [])]);
+async function linksPlan(site, o = {}) {
+  const base = (site.url ?? "").replace(/\/+$/, "");
+  const pages = await listPages(site, { status: "publish", withContent: true });
+  const posts2 = await all(
+    site,
+    "/wp/v2/posts",
+    {
+      context: "edit",
+      status: "publish",
+      per_page: 100,
+      _fields: "id,link,title,categories,content,meta",
+      orderby: "date",
+      order: "desc"
+    },
+    o.posts ?? 200
+  );
+  const cats = await all(site, "/wp/v2/categories", {
+    per_page: 100,
+    _fields: "id,name,link,count"
+  });
+  const catName = new Map(cats.map((c) => [c.id, c.name]));
+  const settings2 = await site.request({
+    path: "/wp/v2/settings",
+    query: { _fields: "page_on_front,page_for_posts" }
+  }).then((r) => r.status === 200 ? r.data : {});
+  const docs = [
+    ...pages.map((p) => ({
+      id: p.id,
+      kind: "page",
+      path: sitePath(p.link, base) ?? p.link,
+      url: p.link,
+      title: titleOf(p.title),
+      parent: p.parent,
+      links: contentLinks(p.content?.raw ?? "", base),
+      words: tokens(
+        `${titleOf(p.title)} ${p.slug} ${p.meta?.maggie_seo_title ?? ""} ${p.meta?.maggie_seo_keywords ?? ""}`
+      ),
+      description: String(p.meta?.maggie_seo_description ?? "")
+    })),
+    ...posts2.map((p) => ({
+      id: p.id,
+      kind: "post",
+      path: sitePath(p.link, base) ?? p.link,
+      url: p.link,
+      title: p.title.raw ?? "",
+      cats: p.categories.map((c) => catName.get(c) ?? "").filter(Boolean),
+      links: contentLinks(p.content.raw, base),
+      words: tokens(
+        `${p.title.raw ?? ""} ${p.categories.map((c) => catName.get(c) ?? "").join(" ")} ${p.meta?.maggie_seo_keywords ?? ""}`
+      ),
+      description: String(p.meta?.maggie_seo_description ?? "")
+    }))
+  ];
+  const byPath = new Map(docs.map((d) => [d.path, d]));
+  const menu = await menuGet(site).catch(() => null);
+  const menuPaths = new Set(
+    flatMenu(menu?.items ?? []).map((i) => sitePath(i.url, base)).filter(Boolean)
+  );
+  const footer = await partGet(site, "footer").catch(() => null);
+  const footerPaths = footer ? contentLinks(footer.content, base) : /* @__PURE__ */ new Set();
+  const header = await partGet(site, "header").catch(() => null);
+  const headerPaths = header ? contentLinks(header.content, base) : /* @__PURE__ */ new Set();
+  const chrome = /* @__PURE__ */ new Set([...menuPaths, ...footerPaths, ...headerPaths]);
+  const inbound = /* @__PURE__ */ new Map();
+  for (const d of docs)
+    for (const l of d.links) if (l !== d.path) inbound.set(l, /* @__PURE__ */ new Set([...inbound.get(l) ?? [], d.path]));
+  const home = docs.find((d) => d.id === settings2.page_on_front && d.kind === "page");
+  const blogPage = docs.find((d) => d.id === settings2.page_for_posts && d.kind === "page");
+  const actions = [];
+  const findings = [];
+  const sample = docs.filter(
+    (d) => d.kind === "page" && (/\/sample-page\/$/.test(d.path) || d.title === "Sample Page") || d.kind === "post" && (/\/hello-world\/$/.test(d.path) || d.title === "Hello world!")
+  );
+  for (const d of sample)
+    findings.push({
+      id: `sample:${d.path}`,
+      priority: "p2",
+      area: "outside",
+      title: `WordPress's sample ${d.kind === "page" ? "page" : "article"} \u201C${d.title}\u201D is still published`,
+      why: "It tells visitors and search engines the site isn't finished, and dilutes the real pages.",
+      fix: "Move it to the trash.",
+      tool: {
+        name: d.kind === "page" ? "wp_page_delete" : "wp_post_delete",
+        args: d.kind === "page" ? { page: d.id } : { post: d.id }
+      }
+    });
+  const pageDocs = docs.filter((d) => d.kind === "page" && d !== home && !sample.includes(d));
+  const postDocs = docs.filter((d) => d.kind === "post" && !sample.includes(d));
+  const menuItems = flatMenu(menu?.items ?? []);
+  const top = (menu?.items ?? []).length;
+  for (const i of menuItems) {
+    const p = sitePath(i.url, base);
+    if (p && p !== "/" && !byPath.has(p) && !/\/(category|tag|author)\//.test(p) && !p.startsWith("/?"))
+      findings.push({
+        id: `menu-dead:${p}`,
+        priority: "p1",
+        area: "outside",
+        title: `The menu links to ${p} (\u201C${i.label}\u201D), which isn't a published page or post`,
+        why: "Visitors hit a dead end from every page.",
+        fix: "Point it to a live page or remove it (wp_menu_set).",
+        tool: { name: "wp_menu_set", args: {} }
+      });
+  }
+  if (top > 7)
+    findings.push({
+      id: "menu-long",
+      priority: "p3",
+      area: "outside",
+      title: `The menu has ${top} top-level items`,
+      why: "More than 7 makes choosing hard; group them under submenus.",
+      fix: "Group related pages under a parent item (wp_menu_set)."
+    });
+  const hubs = pageDocs.filter((d) => pageDocs.some((c) => c.parent === d.id));
+  const topLevel = pageDocs.filter((d) => !d.parent);
+  const wantMenu = [.../* @__PURE__ */ new Set([...hubs, ...topLevel.slice(0, 6)])].filter(
+    (d) => !chrome.has(d.path) && !/privacy|terms|cookie|legal|impressum|datenschutz|thank/i.test(d.path)
+  );
+  if (wantMenu.length)
+    actions.push({
+      type: "menu",
+      why: "Main pages every visitor should reach in one click.",
+      add: wantMenu.slice(0, 6).map((d) => ({ label: d.title, url: d.url })),
+      tool: "wp_menu_set"
+    });
+  if (postDocs.length && blogPage && !chrome.has(blogPage.path))
+    actions.push({
+      type: "menu",
+      why: "The blog isn't reachable from the menu.",
+      add: [{ label: blogPage.title || "Blog", url: blogPage.url }],
+      tool: "wp_menu_set"
+    });
+  const legal = pageDocs.filter(
+    (d) => /privacy|terms|cookie|legal|impressum|datenschutz|accessib/i.test(`${d.path} ${d.title}`)
+  );
+  const contact = pageDocs.filter((d) => /contact|about|book|location|faq/i.test(`${d.path} ${d.title}`));
+  const footerMissing = [...legal, ...contact].filter((d) => !footerPaths.has(d.path));
+  if (footerMissing.length)
+    actions.push({
+      type: "footer",
+      why: "Legal, contact and about pages belong in the footer of every page (trust, and Google's quality raters look for them).",
+      add: footerMissing.slice(0, 8).map((d) => ({ label: d.title, url: d.url })),
+      tool: "wp_footer_set"
+    });
+  for (const hub of hubs) {
+    const kids = pageDocs.filter((c) => c.parent === hub.id);
+    const missing = kids.filter((k) => !hub.links.has(k.path));
+    if (missing.length)
+      actions.push({
+        type: "page_related",
+        page: hub.id,
+        path: hub.path,
+        heading: `More in ${hub.title}`,
+        why: `${hub.title} doesn't link to ${missing.length} of its own sub-pages.`,
+        links: missing.map((k) => ({ url: k.url, label: k.title }))
+      });
+    for (const k of kids)
+      if (!k.links.has(hub.path)) {
+        const sib = kids.filter((s) => s !== k).slice(0, 3);
+        actions.push({
+          type: "page_related",
+          page: k.id,
+          path: k.path,
+          heading: "Related",
+          why: `${k.title} doesn't link back to ${hub.title}${sib.length ? " or its sister pages" : ""}.`,
+          links: [{ url: hub.url, label: hub.title }, ...sib.map((s) => ({ url: s.url, label: s.title }))]
+        });
+      }
+  }
+  const df = /* @__PURE__ */ new Map();
+  for (const d of docs) for (const w of d.words) df.set(w, (df.get(w) ?? 0) + 1);
+  const idf = (w) => Math.log(1 + docs.length / (1 + (df.get(w) ?? 0)));
+  const forPage = /* @__PURE__ */ new Map();
+  for (const post of postDocs) {
+    let best = null;
+    let score = 0;
+    for (const pg of home ? [...pageDocs, home] : pageDocs) {
+      if (pg === blogPage) continue;
+      const s = overlap(post.words, pg.words, idf);
+      if (s > score) [best, score] = [pg, s];
+    }
+    if (!best || score < 0.3) continue;
+    forPage.set(best, [...forPage.get(best) ?? [], post]);
+    if (!post.links.has(best.path))
+      actions.push({
+        type: "post_link",
+        post: post.id,
+        path: post.path,
+        why: `\u201C${post.title}\u201D is about ${best.title} but doesn't link to that page.`,
+        url: best.url,
+        label: best.title,
+        match: Math.round(score * 100)
+      });
+  }
+  for (const [pg, ps] of forPage) {
+    const missing = ps.filter((p) => !pg.links.has(p.path));
+    if (missing.length >= 2)
+      actions.push({
+        type: "page_related",
+        page: pg.id,
+        path: pg.path,
+        heading: "From the blog",
+        why: `${missing.length} articles about ${pg.title} aren't linked from the page.`,
+        links: missing.slice(0, 5).map((p) => ({ url: p.url, label: p.title }))
+      });
+  }
+  const lonelyPosts = [];
+  for (const d of docs) {
+    if (d === home || d === blogPage || sample.includes(d)) continue;
+    const ins = inbound.get(d.path);
+    if (ins && ins.size || chrome.has(d.path)) continue;
+    if (d.kind === "post") lonelyPosts.push(d);
+    else
+      findings.push({
+        id: `orphan:${d.path}`,
+        priority: "p2",
+        area: "outside",
+        title: `Nothing links to the page \u201C${d.title}\u201D (${d.path})`,
+        why: "Pages that only the sitemap knows are found late and rank poorly.",
+        fix: "Link to it from its parent or a related page, or put it in the menu or footer"
+      });
+  }
+  if (lonelyPosts.length)
+    findings.push({
+      id: "orphan-posts",
+      priority: "p3",
+      area: "outside",
+      title: `${lonelyPosts.length} of ${postDocs.length} articles get no links from pages or other articles (only from the blog list)`,
+      why: "Links from related pages and articles tell search engines which articles matter and keep readers on the site.",
+      fix: "Apply the post_link and page_related actions: each article links to its page, each page shows its articles."
+    });
+  const grouped = groupFindings(findings);
+  findings.length = 0;
+  findings.push(...grouped);
+  return {
+    site: base,
+    counts: {
+      pages: pageDocs.length + (home ? 1 : 0),
+      posts: postDocs.length,
+      menu_items: menuItems.length,
+      footer_links: footerPaths.size,
+      content_links: docs.reduce((n2, d) => n2 + d.links.size, 0),
+      orphan_pages: findings.reduce(
+        (n2, f) => n2 + (f.id.startsWith("orphan:") ? f.pages?.length ?? 1 : 0),
+        0
+      ),
+      orphan_posts: lonelyPosts.length
+    },
+    action_counts: Object.fromEntries(
+      ["menu", "footer", "page_related", "post_link"].map((t) => [t, actions.filter((x) => x.type === t).length])
+    ),
+    actions: [
+      ...actions.filter((x) => x.type === "menu" || x.type === "footer"),
+      ...actions.filter((x) => x.type === "post_link").sort((x, y) => Number(y.match) - Number(x.match)).slice(0, 30),
+      ...actions.filter((x) => x.type === "page_related").slice(0, 30)
+    ],
+    findings,
+    how: "Apply page_related and post_link actions with wp_internal_links_apply (preview first); menu actions with wp_menu_set, footer with wp_footer_set."
+  };
+}
+var esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+function relatedBlock(heading2, links2) {
+  const items3 = links2.map((l) => `<!-- wp:list-item -->
+<li><a href="${esc(l.url)}">${esc(l.label)}</a></li>
+<!-- /wp:list-item -->`).join("\n");
+  return `<!-- wp:group {"metadata":{"name":"Related links","maggie":{"type":"related-links","version":1}},"align":"wide","className":"maggie-related-links","layout":{"type":"constrained"}} -->
+<div class="wp-block-group alignwide maggie-related-links"><!-- wp:heading {"level":2} -->
+<h2 class="wp-block-heading">${esc(heading2)}</h2>
+<!-- /wp:heading -->
+
+<!-- wp:list -->
+<ul class="wp-block-list">${items3}</ul>
+<!-- /wp:list --></div>
+<!-- /wp:group -->`;
+}
+function postLinkBlock(text3, url, label2) {
+  return `<!-- wp:paragraph {"className":"maggie-related-link"} -->
+<p class="maggie-related-link">${esc(text3)} <a href="${esc(url)}">${esc(label2)}</a></p>
+<!-- /wp:paragraph -->`;
+}
+async function llmsTxt(site, o = {}) {
+  const base = (site.url ?? "").replace(/\/+$/, "");
+  const s = await site.request({
+    path: "/wp/v2/settings",
+    query: { _fields: "title,description,page_on_front,page_for_posts" }
+  }).then((r) => r.status === 200 ? r.data : {});
+  const pages = await listPages(site, { status: "publish" });
+  const posts2 = await all(
+    site,
+    "/wp/v2/posts",
+    { status: "publish", per_page: 100, _fields: "link,title,excerpt,meta", orderby: "date", order: "desc" },
+    o.posts ?? 25
+  );
+  const desc = (m, fallback = "") => String(m?.maggie_seo_description || fallback).replace(/\s+/g, " ").trim();
+  const home = pages.find((p) => p.id === s.page_on_front);
+  const noise = /privacy|terms|cookie|thank|cart|checkout|my-account|login/i;
+  const visible = pages.filter((p) => p.id !== s.page_on_front && p.id !== s.page_for_posts && !noise.test(p.link));
+  const byParent = /* @__PURE__ */ new Map();
+  for (const p of visible) byParent.set(p.parent, [...byParent.get(p.parent) ?? [], p]);
+  const line = (title, url, d) => `- [${title.replace(/[[\]]/g, "")}](${url})${d ? `: ${d}` : ""}`;
+  const out = [`# ${s.title || base.replace(/^https?:\/\//, "")}`, ""];
+  const summary = desc(home?.meta, s.description ?? "");
+  if (summary) out.push(`> ${summary}`, "");
+  const top = byParent.get(0) ?? [];
+  if (top.length) {
+    out.push("## Pages", "");
+    for (const p of top) {
+      out.push(line(titleOf(p.title), p.link, desc(p.meta)));
+      for (const c of byParent.get(p.id) ?? []) out.push(`  ${line(titleOf(c.title), c.link, desc(c.meta))}`);
+    }
+    out.push("");
+  }
+  if (posts2.length) {
+    out.push("## Articles", "");
+    for (const p of posts2)
+      out.push(
+        line(strip(p.title.rendered ?? ""), p.link, desc(p.meta, strip(p.excerpt?.rendered ?? "").slice(0, 160)))
+      );
+    out.push("");
+  }
+  const legal = pages.filter((p) => /privacy|terms/i.test(p.link));
+  out.push("## Optional", "", line("Sitemap", `${base}/wp-sitemap.xml`, "every page and article"));
+  for (const p of legal) out.push(line(titleOf(p.title), p.link, ""));
+  return `${out.join("\n").replace(/\n{3,}/g, "\n\n").trim()}
+`;
+}
+
 // ../../packages/tools/src/wordpress.ts
 var sites = /* @__PURE__ */ new WeakMap();
 function siteOf(ctx) {
@@ -18832,8 +20200,276 @@ var fullTools = [
     }
   })
 ];
+var securityTools = [
+  tool({
+    name: "wp_security_scan",
+    description: "Security check of the connected WordPress site: plugins, themes and WordPress against known vulnerabilities (WPVulnerability), available updates and plugins closed on WordPress.org; with Maggie Core 0.14+ also PHP/database end of life, risky settings (errors shown, open registration, file editing, XML-RPC), Administrators and old application passwords, and WP-Cron jobs (late, or left by removed plugins); from outside: security headers, public .env/.git/config backups/error logs, login-name leaks. Findings are ranked p0 (fix today) \u2026 p4 (for information), each with why and the fix (a tool when one can do it). Read-only.",
+    parameters: {
+      type: "object",
+      properties: {
+        vulnerabilities: bool("Check known vulnerabilities (default true)."),
+        outside: bool("Check from outside like a visitor (default true).")
+      }
+    },
+    group: "site",
+    need: READ,
+    risk: "R0",
+    gates: ["WP"],
+    run: (ctx, a) => securityScan(siteOf(ctx), { vulnerabilities: a.vulnerabilities !== false, outside: a.outside !== false })
+  }),
+  tool({
+    name: "wp_plugin_update",
+    description: "Update one installed plugin to its latest version (plugin id from wp_plugins_list or wp_security_scan, e.g. wpforms-lite/wpforms), then check the homepage still opens. Needs Maggie Core 0.14+. WordPress keeps no copy of the old version: for a big plugin (shop, page builder) suggest a backup first.",
+    parameters: { type: "object", properties: { plugin: str2("Plugin id (folder/file).") }, required: ["plugin"] },
+    group: "site",
+    need: WRITE,
+    risk: "W3",
+    gates: [...GATES],
+    confirm: (a, lang) => say(
+      lang,
+      `Update the plugin ${q2(a.plugin, "")} on your website to its latest version (the old version is not kept).`,
+      `\u628A\u7DB2\u7AD9\u4E0A\u7684\u63D2\u4EF6 ${q2(a.plugin, "")} \u66F4\u65B0\u5230\u6700\u65B0\u7248\uFF08\u4E0D\u4FDD\u7559\u820A\u7248\uFF09\u3002`
+    ),
+    run: async (ctx, a) => {
+      const site = siteOf(ctx);
+      const r = await call(site, {
+        method: "POST",
+        path: "/maggie-core/v1/plugins/update",
+        body: { plugin: String(a.plugin ?? "").replace(/\.php$/, "") }
+      });
+      const home = site.url ? await check(site, `${site.url}/`, "publish") : null;
+      return {
+        ...r,
+        check: home,
+        ...home && !home.ok ? {
+          warning: "The homepage has a problem after the update: deactivate the plugin (wp_plugin_set inactive) and tell the owner."
+        } : {}
+      };
+    }
+  }),
+  tool({
+    name: "wp_cron_unschedule",
+    description: "Remove a WP-Cron job that nothing runs any more (left by a removed plugin; wp_security_scan lists them). WordPress's own jobs and jobs a plugin still handles are refused. Needs Maggie Core 0.14+.",
+    parameters: { type: "object", properties: { hook: str2("The job's hook name.") }, required: ["hook"] },
+    group: "site",
+    need: WRITE,
+    risk: "W2",
+    gates: [...GATES],
+    confirm: (a, lang) => say(
+      lang,
+      `Remove the scheduled job ${q2(a.hook, "")} from your website (nothing runs it any more).`,
+      `\u79FB\u9664\u7DB2\u7AD9\u4E0A\u5DF2\u7121\u7A0B\u5F0F\u8655\u7406\u7684\u6392\u7A0B\u5DE5\u4F5C ${q2(a.hook, "")}\u3002`
+    ),
+    run: (ctx, a) => call(siteOf(ctx), {
+      method: "POST",
+      path: "/maggie-core/v1/cron/unschedule",
+      body: { hook: String(a.hook ?? "") }
+    })
+  })
+];
+var LINK_ACTION = obj("One action from wp_internal_links_plan.", {
+  type: { type: "string", enum: ["page_related", "post_link"], description: "page_related or post_link." },
+  page: int2("page_related: the page id."),
+  heading: str2(`page_related: the band's heading, e.g. "Related" or "From the blog".`),
+  links: arr("page_related: links to list.", obj("", { url: str2(""), label: str2("") })),
+  post: int2("post_link: the article id."),
+  url: str2("post_link: the page to link to."),
+  label: str2("post_link: the link text (the page's topic)."),
+  text: str2('post_link: words before the link (default "Related:").')
+});
+function withRelated(blocks, heading2, links2) {
+  const band2 = parse(relatedBlock(heading2, links2)).filter((b) => b.name);
+  const isBand = (b) => String(b.attrs.className ?? "").includes("maggie-related-links") && serialize([b]).includes(`>${heading2.replace(/&/g, "&amp;").replace(/</g, "&lt;")}</h2>`);
+  const at = blocks.findIndex(isBand);
+  if (at >= 0) return [...blocks.slice(0, at), ...band2, ...blocks.slice(at + 1)];
+  const real = blocks.map((b, i) => [b, i]).filter(([b]) => b.name);
+  const last = real[real.length - 1];
+  const lastType = last ? classify(last[0], "main") : "";
+  if (last && /cta|form|map-contact|contact/.test(lastType))
+    return [...blocks.slice(0, last[1]), ...band2, ...blocks.slice(last[1])];
+  return [...blocks, ...band2];
+}
+var seoTechTools = [
+  tool({
+    name: "wp_seo_tech_audit",
+    description: "Technical SEO check of the connected site, like a crawler: robots.txt (sitemap line, Google or AI crawlers blocked), the sitemap and every page it lists (status, redirects, noindex in the sitemap, canonicals pointing elsewhere, H1 count, missing or duplicate titles and descriptions, long titles, pictures without alt text, broken structured data, thin pages), broken and redirected internal links, generic link words, llms.txt; speed: true adds Core Web Vitals for the homepage (PageSpeed Insights). Findings ranked p0\u2026p4 with the fix and a tool when one can do it. Read-only. Internal-link layout: wp_internal_links_plan.",
+    parameters: {
+      type: "object",
+      properties: {
+        limit: int2("Pages to crawl from the sitemap (default 60, max 200)."),
+        speed: bool("Also measure the homepage's speed on phones (slower, about 30 s).")
+      }
+    },
+    group: "site",
+    need: READ,
+    risk: "R0",
+    gates: ["WP"],
+    run: (ctx, a) => techAudit(siteOf(ctx), { limit: typeof a.limit === "number" ? a.limit : void 0, speed: !!a.speed })
+  }),
+  tool({
+    name: "wp_internal_links_plan",
+    description: "Plan the site's internal links from its own pages, articles, menu, header and footer: menu items that lead nowhere, main pages missing from the menu, legal/contact/about pages missing from the footer, hub pages that don't list their sub-pages and sub-pages that don't link back, articles that don't link to the page they are about (matched by topic) and pages that don't show their articles, and pages or articles nothing links to. Returns actions ready for wp_internal_links_apply (page_related, post_link) or wp_menu_set / wp_footer_set. Read-only.",
+    parameters: { type: "object", properties: { posts: int2("Articles to include (default 200, newest first).") } },
+    group: "site",
+    need: READ,
+    risk: "R0",
+    gates: ["WP"],
+    run: (ctx, a) => linksPlan(siteOf(ctx), { posts: typeof a.posts === "number" ? a.posts : void 0 })
+  }),
+  tool({
+    name: "wp_internal_links_apply",
+    description: 'Apply internal-link actions from wp_internal_links_plan: page_related puts a "Related" band (heading + list of links) in a page, replacing its own earlier band with the same heading, placed before a closing call-to-action; post_link adds one "Related: <page>" line at the end of an article (replacing its earlier one). preview: true shows the changes and saves nothing. Pages: wp_page_undo; articles: their revisions.',
+    parameters: {
+      type: "object",
+      properties: { actions: arr("Up to 20 actions.", LINK_ACTION), preview: PREVIEW },
+      required: ["actions"]
+    },
+    group: "site",
+    need: WRITE,
+    risk: "W3",
+    gates: [...GATES],
+    confirm: (a, lang) => {
+      const n2 = Array.isArray(a.actions) ? a.actions.length : 0;
+      return say(
+        lang,
+        `Add internal links on your website (${n2} ${n2 === 1 ? "change" : "changes"}: related-links bands on pages, a related line at the end of articles).`,
+        `\u5728\u7DB2\u7AD9\u4E0A\u52A0\u5165\u5167\u90E8\u9023\u7D50\uFF08${n2} \u9805\uFF1A\u9801\u9762\u7684\u76F8\u95DC\u9023\u7D50\u5340\u584A\u3001\u6587\u7AE0\u7D50\u5C3E\u7684\u76F8\u95DC\u9023\u7D50\uFF09\u3002`
+      );
+    },
+    run: async (ctx, a) => {
+      const site = siteOf(ctx);
+      const acts = Array.isArray(a.actions) ? a.actions : [];
+      if (!acts.length) throw new Error("actions: give at least one action from wp_internal_links_plan.");
+      if (acts.length > 20) throw new Error("actions: up to 20 at a time.");
+      const results = [];
+      const byPage = /* @__PURE__ */ new Map();
+      for (const x of acts) {
+        if (x.type === "page_related") {
+          if (!x.page || !x.links?.length) throw new Error("page_related needs page and links.");
+          byPage.set(x.page, [...byPage.get(x.page) ?? [], x]);
+        } else if (x.type === "post_link") {
+          if (!x.post || !x.url || !x.label) throw new Error("post_link needs post, url and label.");
+        } else throw new Error(`Unknown action type ${x.type}.`);
+      }
+      for (const [page, list3] of byPage) {
+        const r = await changePage(ctx, { page, preview: !!a.preview }, (blocks) => {
+          let next = blocks;
+          for (const x of list3)
+            next = withRelated(next, (x.heading || "Related").slice(0, 80), (x.links ?? []).slice(0, 12));
+          return { blocks: next, note: { related: list3.map((x) => x.heading || "Related") } };
+        });
+        results.push({ type: "page_related", page_id: page, ...r });
+      }
+      for (const x of acts.filter((y) => y.type === "post_link")) {
+        const post = await call(site, {
+          path: `/wp/v2/posts/${Number(x.post)}`,
+          query: { context: "edit", _fields: "id,link,content,modified" }
+        });
+        const kept = parse(post.content.raw).filter(
+          (b) => !(b.name === "core/paragraph" && String(b.attrs.className ?? "").includes("maggie-related-link"))
+        );
+        const line = parse(postLinkBlock(x.text || "Related:", String(x.url), String(x.label))).filter((b) => b.name);
+        const content = serialize([...kept, ...line]);
+        if (a.preview) {
+          results.push({
+            type: "post_link",
+            post: post.id,
+            path: post.link,
+            preview: true,
+            adds: `${x.text || "Related:"} ${x.label} \u2192 ${x.url}`
+          });
+          continue;
+        }
+        const saved = await call(site, {
+          method: "POST",
+          path: `/wp/v2/posts/${post.id}`,
+          query: { _fields: "id,link,modified" },
+          body: { content }
+        });
+        results.push({
+          type: "post_link",
+          post: saved.id,
+          path: saved.link,
+          saved: true,
+          modified: saved.modified,
+          link: { url: x.url, label: x.label }
+        });
+      }
+      return {
+        results,
+        ...a.preview ? { preview: true } : { undo: "Pages: wp_page_undo; articles: restore the earlier revision in the editor." }
+      };
+    }
+  }),
+  tool({
+    name: "wp_llms_txt_get",
+    description: "The site's llms.txt (a Markdown map of the site for AI assistants, served at /llms.txt): the saved text, whether /llms.txt answers, and whether a file on the server overrides it. Needs Maggie Core 0.14+.",
+    parameters: { type: "object", properties: {} },
+    group: "site",
+    need: READ,
+    risk: "R0",
+    gates: ["WP"],
+    run: async (ctx) => {
+      const site = siteOf(ctx);
+      const saved = await call(site, { path: "/maggie-core/v1/llms" });
+      const live = site.url ? await fetch(`${site.url}/llms.txt`, { signal: AbortSignal.timeout(1e4) }).then(async (r) => ({ status: r.status, same: r.ok && (await r.text()).trim() === saved.text.trim() })).catch(() => null) : null;
+      return {
+        ...saved,
+        live,
+        ...saved.file ? {
+          note: "A real llms.txt file on the server is served instead of the saved text: delete it at the host to use this one."
+        } : {}
+      };
+    }
+  }),
+  tool({
+    name: "wp_llms_txt_set",
+    description: `Write the site's llms.txt (served at /llms.txt): generate: true builds it from the site (name and summary, pages with their SEO descriptions grouped under their parents, the latest articles, sitemap); or give text (Markdown); "" turns it off. preview: true returns the text without saving. Needs Maggie Core 0.14+.`,
+    parameters: {
+      type: "object",
+      properties: {
+        generate: bool("Build it from the site."),
+        text: str2("The llms.txt Markdown to save."),
+        posts: int2("Articles to list when generating (default 25)."),
+        preview: PREVIEW
+      }
+    },
+    group: "site",
+    need: WRITE,
+    risk: "W2",
+    gates: [...GATES],
+    confirm: (a, lang) => say(
+      lang,
+      a.text === "" ? "Turn off your website's llms.txt." : "Write your website's llms.txt (the map of the site for AI assistants, at /llms.txt).",
+      a.text === "" ? "\u95DC\u9589\u7DB2\u7AD9\u7684 llms.txt\u3002" : "\u5BEB\u5165\u7DB2\u7AD9\u7684 llms.txt\uFF08\u7D66 AI \u52A9\u7406\u7684\u7DB2\u7AD9\u5730\u5716\uFF0C\u4F4D\u65BC /llms.txt\uFF09\u3002"
+    ),
+    run: async (ctx, a) => {
+      const site = siteOf(ctx);
+      const text3 = typeof a.text === "string" ? a.text : a.generate ? await llmsTxt(site, { posts: typeof a.posts === "number" ? a.posts : void 0 }) : null;
+      if (text3 == null) throw new Error("Give text, or generate: true.");
+      if (/<\?(php|=)?|<script\b/i.test(text3)) throw new Error("llms.txt: plain Markdown only.");
+      if (a.preview) return { preview: true, text: text3, characters: text3.length };
+      const r = await call(site, {
+        method: "POST",
+        path: "/maggie-core/v1/llms",
+        body: { text: text3 }
+      });
+      return {
+        saved: r.saved,
+        url: r.url,
+        characters: text3.length,
+        before_characters: r.before.length,
+        ...r.file ? { note: "A real llms.txt file on the server is served instead: delete it at the host." } : {},
+        undo: r.before ? "wp_llms_txt_set text with the earlier text (before is kept in this result)" : 'wp_llms_txt_set text ""',
+        before: r.before
+      };
+    }
+  })
+];
 var wordpressTools = [
   ...fullTools,
+  ...securityTools,
+  ...seoTechTools,
   ...siteTools,
   ...pageTools,
   ...sectionTools,
@@ -22252,7 +23888,7 @@ var program = new Command();
 // package.json
 var package_default = {
   name: "@cmo-so/cli",
-  version: "0.12.11",
+  version: "0.12.13",
   description: "CMO.so on the command line: your websites, ideas, blog posts, LinkedIn queue and results, plus a local MCP server for Claude Desktop, Cursor and other MCP clients.",
   type: "module",
   license: "MIT",
@@ -22336,7 +23972,7 @@ var fileStore = () => {
   const file = join(configDir(), "credentials.json");
   return {
     load: () => readJson(file),
-    save: (tokens) => writePrivate(file, tokens),
+    save: (tokens2) => writePrivate(file, tokens2),
     clear: () => rm(file, { force: true })
   };
 };
@@ -22492,7 +24128,7 @@ __export(util_exports, {
   defineLazy: () => defineLazy,
   defineLazyInternal: () => defineLazyInternal,
   derived: () => derived,
-  esc: () => esc,
+  esc: () => esc2,
   escapeRegex: () => escapeRegex,
   explicitlyAborted: () => explicitlyAborted,
   extend: () => extend,
@@ -22723,7 +24359,7 @@ function randomString(length = 10) {
   }
   return str3;
 }
-function esc(str3) {
+function esc2(str3) {
   return JSON.stringify(str3);
 }
 function slugify(input) {
@@ -24872,14 +26508,14 @@ var $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
   const desc = Object.getOwnPropertyDescriptor(def, "shape");
   const sh = desc?.get ? desc.get.raw : def.shape ?? {};
   if (sh) {
-    const get = () => {
+    const get2 = () => {
       const newSh = { ...sh };
       Object.defineProperty(def, "shape", { value: newSh });
-      get.raw = newSh;
+      get2.raw = newSh;
       return newSh;
     };
-    get.raw = sh;
-    Object.defineProperty(def, "shape", { get });
+    get2.raw = sh;
+    Object.defineProperty(def, "shape", { get: get2 });
   }
   const _normalized = cached(() => normalizeDef(def));
   defineLazyInternal(inst, "propValues", (zod) => {
@@ -24978,7 +26614,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
       if (key === "__proto__")
         continue;
       const id = ids3[key];
-      const k = typeof key === "symbol" ? `syms[${syms.indexOf(key)}]` : esc(key);
+      const k = typeof key === "symbol" ? `syms[${syms.indexOf(key)}]` : esc2(key);
       const isPresent = `${k} in input`;
       const schema = shape[key];
       const optin = schema?._zod?.optin;
@@ -27950,7 +29586,7 @@ var parseAsync2 = /* @__PURE__ */ _parseAsync(ZodRealError);
 var safeParse3 = /* @__PURE__ */ _safeParse(ZodRealError);
 var safeParseAsync2 = /* @__PURE__ */ _safeParseAsync(ZodRealError);
 var encode2 = /* @__PURE__ */ _encode(ZodRealError);
-var decode3 = /* @__PURE__ */ _decode(ZodRealError);
+var decode4 = /* @__PURE__ */ _decode(ZodRealError);
 var encodeAsync2 = /* @__PURE__ */ _encodeAsync(ZodRealError);
 var decodeAsync2 = /* @__PURE__ */ _decodeAsync(ZodRealError);
 var safeEncode2 = /* @__PURE__ */ _safeEncode(ZodRealError);
@@ -28110,7 +29746,7 @@ var ZodType = /* @__PURE__ */ $constructor("ZodType", (inst, def) => {
     return encode2(this, data, params, { callee: _encode2 });
   },
   decode: function _decode2(data, params) {
-    return decode3(this, data, params, { callee: _decode2 });
+    return decode4(this, data, params, { callee: _decode2 });
   },
   encodeAsync: async function _encodeAsync2(data, params) {
     return await encodeAsync2(this, data, params, { callee: _encodeAsync2 });
@@ -33313,7 +34949,36 @@ function registerWp(program3) {
     (p, s, o, c) => run(g(c), "wp_section_move", { page: p, section: s, ...posArgs(o) })
   );
   section.command("remove <page> <section>").description("remove a section").action((p, s, _o, c) => run(g(c), "wp_section_remove", { page: p, section: s }));
-  const seo = wp.command("seo").description("SEO fields, audit, import");
+  const seo = wp.command("seo").description("SEO fields, audit, technical check, import");
+  seo.command("tech").description(
+    "technical SEO check: robots.txt, sitemap pages, canonicals, noindex, H1, alt text, schema, links, llms.txt"
+  ).option("--limit <n>", "pages to crawl (default 60, max 200)").option("--speed", "also measure the homepage's Core Web Vitals on phones").action(
+    (o, c) => run(g(c), "wp_seo_tech_audit", { limit: o.limit ? Number(o.limit) : void 0, speed: !!o.speed })
+  );
+  const links2 = wp.command("links").description("internal links: plan and apply (pages, articles, menu, footer)");
+  links2.command("plan", { isDefault: true }).action((_o, c) => run(g(c), "wp_internal_links_plan", {}));
+  links2.command("apply").description("apply page_related / post_link actions from the plan (JSON array or { actions })").requiredOption("--from <file>", "JSON (- for stdin)").option("--preview", "show the changes, save nothing").action(async (o, c) => {
+    const j = await json(o.from);
+    const actions = Array.isArray(j) ? j : j.actions;
+    await run(g(c), "wp_internal_links_apply", { actions, preview: !!o.preview });
+  });
+  const llms = wp.command("llms").description("the site's llms.txt (served at /llms.txt)");
+  llms.command("get", { isDefault: true }).action((_o, c) => run(g(c), "wp_llms_txt_get", {}));
+  llms.command("generate").description("build llms.txt from the site and save it").option("--preview", "show it, save nothing").option("--posts <n>", "articles to list (default 25)").action(
+    (o, c) => run(g(c), "wp_llms_txt_set", {
+      generate: true,
+      preview: !!o.preview,
+      posts: o.posts ? Number(o.posts) : void 0
+    })
+  );
+  llms.command("set <file>").description("save this Markdown file as llms.txt").action(
+    async (file, _o, c) => run(g(c), "wp_llms_txt_set", { text: await readFile2(file, "utf8") })
+  );
+  llms.command("off").action((_o, c) => run(g(c), "wp_llms_txt_set", { text: "" }));
+  wp.command("security").description(
+    "security check: vulnerable or outdated plugins, themes and WordPress, risky settings, admins, WP-Cron, what visitors can see"
+  ).option("--no-outside", "skip the checks from outside").action((o, c) => run(g(c), "wp_security_scan", { outside: o.outside !== false }));
+  wp.command("cron-rm <hook>").description("remove a scheduled job nothing runs any more (left by a removed plugin)").action((hook, _o, c) => run(g(c), "wp_cron_unschedule", { hook }));
   seo.command("get <page>").description("stored fields and what the page outputs").action((p, _o, c) => run(g(c), "wp_seo_get", { page: p }));
   seo.command("set <page>").description("set a page's SEO fields").option("--title <t>").option("--description <d>").option("--keywords <k>").option("--robots <r>", '"index, follow" | "noindex, follow" | "noindex, nofollow"').option("--canonical <url>").option("--og-image <url>").option("--from <file>", "several pages: JSON { items: [{ page, title, description, \u2026 }] }").action(async (p, o, c) => {
     const args = o.from ? await json(o.from) : {
@@ -33486,6 +35151,7 @@ ${table(r.issues, ["severity", "code", "path", "detail"])}`;
   );
   plugins.command("activate <plugin>").action((p, _o, c) => run(g(c), "wp_plugin_set", { plugin: p, status: "active" }));
   plugins.command("deactivate <plugin>").action((p, _o, c) => run(g(c), "wp_plugin_set", { plugin: p, status: "inactive" }));
+  plugins.command("update <plugin>").description("update an installed plugin to its latest version (Maggie Core 0.14+)").action((p, _o, c) => run(g(c), "wp_plugin_update", { plugin: p }));
   plugins.command("delete <plugin>").description("remove an inactive plugin's files (reinstall from WordPress.org to undo)").action((p, _o, c) => run(g(c), "wp_plugin_set", { plugin: p, status: "deleted" }));
   wp.command("api <route>").description("read any allowed WordPress REST route (GET), e.g. /wp/v2/types").option("--query <json>", "query parameters as JSON").action(
     (route, o, c) => run(g(c), "wp_api_read", { route, query: o.query ? JSON.parse(o.query) : void 0 })