@ibalzam/codejitsu-core 0.1.0 → 0.2.1

package/CLAUDE.md

@@ -1,67 +1,83 @@
 # Master instructions — @ibalzam/codejitsu-core
 
-This is the shared core for all Codejitsu sites. When a Codejitsu site depends on this package and the user invokes a module by name (e.g. **"implement codejitsu/core/blog"**, **"add codejitsu/core/seo"**), this file is your starting point.
+Shared core for every Codejitsu site. When the user invokes a module by name (e.g. **"implement codejitsu/core/blog"**), this file is your starting point.
 
 ## How to act on a module request
 
-1. Open `node_modules/@ibalzam/codejitsu-core/modules/<name>/CLAUDE.md` — it tells you what to do for that module specifically.
-2. Import code from the matching subpath (e.g. `@ibalzam/codejitsu-core/blog`). Do **not** copy-paste the source into the site.
-3. If the module has a `templates/` directory, copy those files into the site at the locations the module's CLAUDE.md specifies. Templates are starting points — adapt them for the site's content.
-4. After the change, run the module's `checklist.md` mentally, plus `checklist/core.md` (sitewide).
+1. **Always start with the unified config.** Open `codejitsu.config.ts` at the site root. If it doesn't exist yet, create one — see `modules/config/CLAUDE.md`.
+2. Open `node_modules/@ibalzam/codejitsu-core/modules/<name>/CLAUDE.md` for that module's specific wiring instructions.
+3. Import code from the matching subpath (e.g. `@ibalzam/codejitsu-core/blog`). Do **not** copy-paste source into the site.
+4. If the module has a `templates/` directory, copy those files into the site at the locations the module's CLAUDE.md specifies. Adapt templates for the site's brand and content.
+5. After the change, walk through the module's `checklist.md` plus `checklist/core.md` (sitewide). Run `npx codejitsu-check` from the site root.
+
+## Module subpaths
+
+| Subpath | Provides |
+|---|---|
+| `@ibalzam/codejitsu-core/config` | `defineConfig()`, `loadConfig()`, all types |
+| `@ibalzam/codejitsu-core/blog` | `createBlog()` (fs+gray-matter), `createBlogFromCollection()` (Astro CC) |
+| `@ibalzam/codejitsu-core/seo` | Schema builders, sitemap helpers, `jsonLd()` |
+| `@ibalzam/codejitsu-core/seo/schema` | Schema builders only |
+| `@ibalzam/codejitsu-core/seo/sitemap` | Sitemap helpers only |
+| `@ibalzam/codejitsu-core/images` | `optimizeImages()`, `autoBlogImages()` (mostly used via CLI) |
+| `@ibalzam/codejitsu-core/llms` | `generateLlms()` (mostly used via CLI) |
+
+CLIs (auto-discover `codejitsu.config.ts`):
+- `codejitsu-optimize-images`
+- `codejitsu-llms`
+- `codejitsu-check`
 
 ## Principles that apply to every Codejitsu site
 
-These are non-negotiable unless the user explicitly opts out:
+Non-negotiable unless the user explicitly opts out.
 
 ### Stack
-- **Astro** (latest stable). Pure static output (`output: 'static'`).
-- **Tailwind v4** via `@tailwindcss/vite`. Theme via CSS variables on `:root`, not hardcoded color palettes.
-- **TypeScript** everywhere except config files where Astro/Vite expects `.mjs`.
-- **React** integration only if the site needs interactive client islands (Framer, charts). Otherwise pure Astro.
+- **Astro** (latest stable). Pure static (`output: 'static'`).
+- **Tailwind v4** via `@tailwindcss/vite`. Theme via CSS variables, not hardcoded palettes.
+- **TypeScript** everywhere except where Astro/Vite expects `.mjs`.
+- **React** integration only if the site needs client islands (Framer, charts). Otherwise pure Astro.
+- **Astro Content Collections** for blog (use `createBlogFromCollection`). The fs loader is for non-Astro projects.
 
 ### Deploy
 - **Cloudflare Pages**, static deploy. `wrangler.toml` at site root.
-- `npm run build && npx wrangler pages deploy dist` is the deploy command (or git-integration on Pages).
-- Daily GH Action (`.github/workflows/daily-deploy.yml`) pings a Cloudflare deploy hook to publish scheduled content. See `modules/deploy/`.
+- Daily GH Action pings the Cloudflare deploy hook to publish scheduled content.
 
 ### URLs + routing
-- `trailingSlash: 'always'` in Astro config. Every internal link ends with `/`.
-- Canonical URLs are absolute and trailing-slashed.
+- `trailingSlash: 'always'`. Internal links end with `/`.
+- Canonical URLs absolute, trailing-slashed.
 
 ### Images
-- Source images in `public/images/` (or `src/assets/` for Astro-processed). Originals can be PNG/JPG.
-- Every shipped image must be available as WebP. The Astro sharp service handles `<Image>` references automatically (`image.defaults: { quality: 82, format: 'webp' }`). For images referenced by URL in HTML/CSS, run the pre-pass: `npx codejitsu-optimize-images`.
-- No raw PNGs referenced from production HTML when a WebP equivalent exists.
-
-### SEO (must be on every page)
-- `<title>` and `<meta name="description">` set per page.
-- Canonical URL `<link rel="canonical">`.
-- OG meta (`og:title`, `og:description`, `og:image`, `og:url`, `og:type`).
-- Twitter card meta.
-- JSON-LD schema.org appropriate to the page type (Organization on home, LocalBusiness if applicable, BlogPosting on blog posts, FAQPage if FAQs present). Use builders from `@ibalzam/codejitsu-core/seo/schema`.
-- `sitemap.xml` generated via `@astrojs/sitemap` with helpers from `@ibalzam/codejitsu-core/seo/sitemap`.
+- Source images for general assets in `public/...`; auto-converted to WebP via `codejitsu-optimize-images` in `prebuild`.
+- Blog source images live OUTSIDE `public/` (e.g. `private/blog-source-images/`), named `<slug>.{png,jpg,jpeg,webp}`. The CLI optimizes them to `public/assets/images/blog/<slug>.webp` via `autoBlogImages`.
+- Astro `<Image>` auto-converts components-loaded images. Use it for hero / inline imagery imported from `src/assets/`.
+- No raw PNG/JPG references in production HTML where a `.webp` sibling exists.
+
+### SEO (every page)
+- `<title>`, meta description, canonical, OG, Twitter, JSON-LD via `<SiteHead />` (site wrapper around `@ibalzam/codejitsu-core/seo/Head.astro`).
+- Schemas from `@ibalzam/codejitsu-core/seo` builders. Inject with `jsonLd()` (never raw `JSON.stringify`).
+- `sitemap.xml` generated via `@astrojs/sitemap` + `defaultPriorityRules()` + `excludeFuturePosts()`.
 - `robots.txt` at site root.
-- `/llms.txt` + `/llms-full.txt` generated via `npx codejitsu-llms` in prebuild.
+- `/llms.txt` + `/llms-full.txt` generated via `codejitsu-llms` in prebuild.
 
 ### Content
-- Blog posts as Markdown in `content/blog/` with frontmatter (see `modules/blog/CLAUDE.md`).
-- Future-dated posts are hidden from public pages and sitemap but kept addressable for OG meta scrapers.
-- All copy in English unless the site uses the i18n module (workzen-only currently).
+- Blog posts as `.md` in `src/content/blog/` with frontmatter validated by an Astro CC schema.
+- Future-dated posts hidden from public pages and sitemap; pages built for OG scrapers.
+- `draft: true` posts excluded everywhere.
 
 ### What NOT to do
-- Don't reinvent modules that exist here. If you're tempted to write a blog loader, image optimizer, sitemap config, schema builder, or daily-deploy workflow, **import or copy from this package instead**.
-- Don't hardcode brand colors in component files — always via Tailwind theme tokens / CSS variables.
-- Don't add a runtime database, server-rendered routes, or anything that breaks static export. These sites deploy as plain HTML.
-- Don't add page-level redirects in code; use Cloudflare Pages `_redirects` or `_headers`.
-- Don't introduce a new heavy dependency without checking if existing modules already cover it.
+- Don't reinvent modules. Always import or copy from this package.
+- Don't hardcode brand colors in component files — use Tailwind theme tokens / CSS variables.
+- Don't add server-rendered routes or anything that breaks static export.
+- Don't write to `dist/` directly. All artifacts flow from `prebuild` + `astro build`.
+- Don't keep old per-module config files (`codejitsu-images.config.mjs`, `codejitsu-llms.config.mjs`). Only `codejitsu.config.ts` is read in v0.2.0+.
 
 ## After any non-trivial change
 
-Run through `checklist/core.md` before reporting work as done. For UI changes, build the site and view the pages in a browser — type-checking is not visual verification.
+`npx codejitsu-check` and walk `checklist/core.md`. For UI: build, open in browser, verify visually.
 
-## Updating to a new version of `@ibalzam/codejitsu-core`
+## Upgrading `@ibalzam/codejitsu-core`
 
 1. `npm update @ibalzam/codejitsu-core`
-2. Read `node_modules/@ibalzam/codejitsu-core/MIGRATIONS/` for any version notes newer than the previous installed version.
-3. Apply migration steps in order. They're prose, not codemods — judgment is fine; ask the user when ambiguous.
-4. Run `checklist/core.md` to verify nothing regressed.
+2. Read every `MIGRATIONS/<version>.md` between the old installed version and the new one.
+3. Apply migration steps in order. They're prose — judgment is fine; ask the user when ambiguous.
+4. Run `codejitsu-check` to verify.

package/MIGRATIONS/0.2.0.md

@@ -0,0 +1,166 @@
+# 0.2.0 — Unified config, CC blog support, richer Head
+
+## Summary
+
+v0.2.0 introduces a **single config file** (`codejitsu.config.ts`) that drives every module. The blog module gains Astro Content Collections support. The Head template gains noindex, hero preload, and article metadata. This is a **hard break** from v0.1.0 — old per-module config files are no longer read.
+
+## Required actions
+
+### 1. Create `codejitsu.config.ts` at the site root
+
+```ts
+import { defineConfig } from '@ibalzam/codejitsu-core/config';
+
+export default defineConfig({
+  site: {
+    url: 'https://example.com',
+    name: 'Example',
+    titleSuffix: ' | Example',
+    defaultAuthor: 'editor',
+    defaultOgImage: '/og-image.webp',
+    locale: 'en_US',
+    business: {
+      telephone: '...',
+      email: '...',
+      address: { addressLocality: 'City', addressCountry: 'US' },
+      // optionally: license, areaServed, sameAs, etc.
+    },
+  },
+
+  blog: {
+    mode: 'collection',         // or 'fs' for non-Astro projects
+    collectionName: 'blog',
+    dateField: 'pubDate',        // adjust to match your CC schema
+    draftField: 'draft',
+  },
+
+  seo: {
+    sitemap: {
+      excludePatterns: [/\/lp\//],
+    },
+  },
+
+  images: {
+    sourceDir: 'public/assets/images',
+    defaultQuality: 82,
+    defaultMaxSize: 1376,
+    specialRules: { /* ... */ },
+    autoBlogImages: {
+      contentDir: 'src/content/blog',
+      sourceImageDir: 'private/blog-source-images',
+      outputDir: 'public/assets/images/blog',
+      width: 1376,
+    },
+  },
+
+  llms: {
+    mode: 'content-scan',
+    tagline: '...',
+    about: '...',
+    aboutFull: '...',
+    aiGuidance: '...',
+    blogDir: 'src/content/blog',
+    contentScan: {
+      servicesDir: 'src/content/services',
+      locationsDir: 'src/content/locations',
+      pagesDir: 'src/pages',
+      dynamicRoutes: [
+        { template: '/services/{services}/' },
+        { template: '/services/{services}/{locations}/' },
+        { template: '/service-areas/{locations}/' },
+      ],
+    },
+  },
+
+  deploy: { cloudflarePagesName: 'example' },
+});
+```
+
+### 2. Install jiti as a dev dep (for `.ts` config)
+
+```bash
+npm install -D jiti
+```
+
+`.mjs` and `.json` configs work without it. Skip if you used those formats.
+
+### 3. Delete deprecated config files
+
+```bash
+rm -f codejitsu-images.config.mjs codejitsu-llms.config.mjs
+```
+
+`codejitsu-check` flags these as failures in v0.2.0.
+
+### 4. Update blog wiring (if you used the v0.1.0 fs loader)
+
+**Before (v0.1.0):**
+```ts
+// src/lib/blog.ts
+import { createBlog } from '@ibalzam/codejitsu-core/blog';
+export const blog = createBlog({ contentDir: 'content/blog', defaultAuthor: 'editor' });
+```
+
+**After (v0.2.0, Astro CC):**
+```ts
+// src/lib/blog.ts
+import { createBlogFromCollection } from '@ibalzam/codejitsu-core/blog';
+export const blog = createBlogFromCollection({
+  collectionName: 'blog',
+  dateField: 'pubDate',    // match your CC schema
+  draftField: 'draft',
+  defaultAuthor: 'editor',
+});
+```
+
+If you stayed on fs mode: `createBlog` still works, but it now reads `dateField`/`draftField` config. Pass them if your frontmatter uses non-default field names.
+
+### 5. Update Head wiring
+
+The package's `Head.astro` template grew new props (`siteUrl`, `siteName`, `locale`, `titleSuffix`, `heroImage`, `author`, `publishedTime`, `modifiedTime`). Sites should wrap it in `SiteHead.astro` that passes config defaults. See `modules/seo/CLAUDE.md`.
+
+### 6. Replace `JSON.stringify(schema)` with `jsonLd(schema)`
+
+If any layout/component injects schema via `set:html={JSON.stringify(s)}`, replace with `jsonLd()` to escape `</` (prevents XSS via crafted schema content):
+
+```diff
++ import { jsonLd } from '@ibalzam/codejitsu-core/seo';
+  ...
+- <script type="application/ld+json" set:html={JSON.stringify(s)} />
++ <script type="application/ld+json" set:html={jsonLd(s)} />
+```
+
+`codejitsu-check` now flags pages where rendered JSON-LD contains unescaped `</`.
+
+### 7. Update `package.json` scripts (no change to commands)
+
+Scripts stay the same — `codejitsu-optimize-images` and `codejitsu-llms` now auto-discover `codejitsu.config.ts` so the CLIs work as before.
+
+## Verify
+
+After applying:
+
+```bash
+rm -rf node_modules package-lock.json
+npm install
+npm run build
+npx codejitsu-check
+```
+
+All checks should pass. New v0.2.0 checks:
+- `codejitsu config loaded` — config file exists and parses
+- `No deprecated codejitsu-images.config.mjs` — old per-module config removed
+- `No deprecated codejitsu-llms.config.mjs` — old per-module config removed
+- `JSON-LD uses safe injection (escapes </)` — verifies `jsonLd()` is used
+
+## Rollback
+
+If something goes badly:
+
+```bash
+npm install @ibalzam/codejitsu-core@0.1.0
+git checkout HEAD~1 -- codejitsu.config.ts  # if it was committed
+# Restore old codejitsu-images.config.mjs / codejitsu-llms.config.mjs from git
+```
+
+But the v0.1.0 → v0.2.0 changes are mostly additive (new config file, new schemas) — applying them carefully should not break a working v0.1.0 setup. Roll forward, not back.

package/README.md

@@ -11,13 +11,33 @@ Sites stay thin: configuration + content + brand. Everything else lives here.
 
 | Module | Subpath | What it provides |
 |---|---|---|
-| `blog` | `@ibalzam/codejitsu-core/blog` | Markdown-based blog system with scheduled publishing, FAQs, tags, categories |
-| `seo` | `@ibalzam/codejitsu-core/seo` | Sitemap helpers, schema.org JSON-LD builders, meta tag patterns |
-| `images` | `@ibalzam/codejitsu-core/images` + `codejitsu-optimize-images` CLI | PNG/JPG→WebP pre-pass + Astro sharp defaults |
+| `config` | `@ibalzam/codejitsu-core/config` | `defineConfig()` + types for the unified `codejitsu.config.ts` |
+| `blog` | `@ibalzam/codejitsu-core/blog` | `createBlog()` (fs+gray-matter) and `createBlogFromCollection()` (Astro CC) with scheduled publishing, drafts, dual-slug, FAQs, tags, categories |
+| `seo` | `@ibalzam/codejitsu-core/seo` | Sitemap helpers, schema.org JSON-LD builders, safe `jsonLd()` injection, `Head.astro` template |
+| `images` | `codejitsu-optimize-images` CLI | PNG/JPG→WebP optimizer + `autoBlogImages` (one image per post slug) |
 | `deploy` | (templates only) | GH Action daily-deploy + Cloudflare wrangler templates |
-| `llms` | `codejitsu-llms` CLI | Generates `/llms.txt` + `/llms-full.txt` from site content |
+| `llms` | `codejitsu-llms` CLI | Generates `/llms.txt` + `/llms-full.txt`. Config-driven or content-scan modes |
 
-Plus `checklist/` — sitewide invariants Claude verifies after any non-trivial change.
+Plus `checklist/` — sitewide invariants Claude verifies after any non-trivial change (`codejitsu-check` CLI).
+
+## Unified config
+
+Every module reads from one file at the site root: `codejitsu.config.ts` (or `.mjs`, `.json`, or `codejitsu` key in `package.json`).
+
+```ts
+import { defineConfig } from '@ibalzam/codejitsu-core/config';
+
+export default defineConfig({
+  site: { url: 'https://...', name: '...', business: { /* ... */ } },
+  blog: { mode: 'collection', dateField: 'pubDate', draftField: 'draft' },
+  seo: { sitemap: { excludePatterns: [/\/lp\//] } },
+  images: { /* ... */ },
+  llms: { mode: 'content-scan', /* ... */ },
+  deploy: { /* ... */ },
+});
+```
+
+See `modules/config/CLAUDE.md` for the full shape.
 
 ## How Claude uses this package
 

package/checklist/bin/run.mjs

@@ -1,35 +1,31 @@
 #!/usr/bin/env node
 /**
- * Smoke checker for Codejitsu sites. Run from a site repo root after
- * `npm run build`. Verifies sitewide invariants from `checklist/core.md`
- * that can be checked programmatically.
+ * Sitewide checker for Codejitsu sites. Run from the site repo root.
  *
- * Exit code 0 = all checks pass.
- * Exit code 1 = at least one check failed (warnings still exit 0).
+ * Reads `codejitsu.config.ts` (etc.) to know which modules are enabled,
+ * then runs programmatic checks against the source tree and `dist/`.
+ *
+ * Exit code 0 = no failures. Exit code 1 = at least one failure.
  *
  * Not exhaustive — visual/UX/content checks need human + Claude review.
  */
 import fs from 'fs';
 import path from 'path';
+import { loadConfig, isModuleEnabled } from '../../modules/config/src/load.mjs';
 
 const cwd = process.cwd();
 const distDir = path.join(cwd, 'dist');
 
 const checks = [];
 
-function pass(name) {
-  checks.push({ status: 'pass', name });
-}
-function warn(name, detail) {
-  checks.push({ status: 'warn', name, detail });
-}
-function fail(name, detail) {
-  checks.push({ status: 'fail', name, detail });
-}
+function pass(name) { checks.push({ status: 'pass', name }); }
+function warn(name, detail) { checks.push({ status: 'warn', name, detail }); }
+function fail(name, detail) { checks.push({ status: 'fail', name, detail }); }
+function info(name) { checks.push({ status: 'info', name }); }
 
-function exists(p) {
-  return fs.existsSync(path.join(cwd, p));
-}
+function exists(p) { return fs.existsSync(path.join(cwd, p)); }
+
+function readFile(p) { return fs.readFileSync(p, 'utf8'); }
 
 function distHtmlFiles() {
   if (!fs.existsSync(distDir)) return [];
@@ -44,25 +40,57 @@ function distHtmlFiles() {
   return out;
 }
 
-function readFile(p) {
-  return fs.readFileSync(p, 'utf8');
+// ─── Config presence ─────────────────────────────────────────────────────
+
+let config = null;
+try {
+  config = await loadConfig(cwd);
+  pass('codejitsu config loaded');
+} catch (err) {
+  fail('codejitsu config loaded', err.message);
+  printAndExit();
 }
 
-// ─── Pre-build files ─────────────────────────────────────────────────────
+const enabled = {
+  blog: isModuleEnabled(config, 'blog'),
+  seo: isModuleEnabled(config, 'seo'),
+  images: isModuleEnabled(config, 'images'),
+  llms: isModuleEnabled(config, 'llms'),
+  deploy: isModuleEnabled(config, 'deploy'),
+};
+
+info(`Modules: ${Object.entries(enabled).filter(([, v]) => v).map(([k]) => k).join(', ') || 'none'}`);
+
+// ─── Deprecated v0.1.0 config files ─────────────────────────────────────
+
+if (exists('codejitsu-images.config.mjs')) {
+  fail('No deprecated codejitsu-images.config.mjs', 'Remove this file. v0.2.0 reads only codejitsu.config.ts.');
+} else pass('No deprecated codejitsu-images.config.mjs');
 
-if (!exists('wrangler.toml')) fail('wrangler.toml present');
-else pass('wrangler.toml present');
+if (exists('codejitsu-llms.config.mjs')) {
+  fail('No deprecated codejitsu-llms.config.mjs', 'Remove this file. v0.2.0 reads only codejitsu.config.ts.');
+} else pass('No deprecated codejitsu-llms.config.mjs');
 
-if (!exists('.github/workflows/daily-deploy.yml'))
-  warn('.github/workflows/daily-deploy.yml present', 'Skip only if site has no scheduled content.');
-else pass('.github/workflows/daily-deploy.yml present');
+// ─── Pre-build invariants ────────────────────────────────────────────────
 
-if (!exists('astro.config.mjs') && !exists('astro.config.ts'))
-  fail('astro.config.{mjs,ts} present');
-else {
-  const cfg = readFile(
-    path.join(cwd, exists('astro.config.ts') ? 'astro.config.ts' : 'astro.config.mjs')
-  );
+if (enabled.deploy) {
+  if (!exists('wrangler.toml')) fail('wrangler.toml present');
+  else pass('wrangler.toml present');
+
+  if (!exists('.github/workflows/daily-deploy.yml'))
+    warn('.github/workflows/daily-deploy.yml present', 'Skip only if site has no scheduled content.');
+  else pass('.github/workflows/daily-deploy.yml present');
+}
+
+const astroCfgPath = exists('astro.config.ts')
+  ? path.join(cwd, 'astro.config.ts')
+  : exists('astro.config.mjs')
+    ? path.join(cwd, 'astro.config.mjs')
+    : null;
+if (!astroCfgPath) {
+  fail('astro.config.{ts,mjs} present');
+} else {
+  const cfg = readFile(astroCfgPath);
   if (!/trailingSlash:\s*['"]always['"]/.test(cfg))
     fail("trailingSlash: 'always' in astro.config", 'Required for canonical URL policy.');
   else pass("trailingSlash: 'always' in astro.config");
@@ -71,15 +99,21 @@ else {
     fail("output: 'static' in astro.config");
   else pass("output: 'static' in astro.config");
 
-  if (!/format:\s*['"]webp['"]/.test(cfg))
+  if (enabled.images && !/format:\s*['"]webp['"]/.test(cfg))
     warn("image.defaults.format: 'webp' in astro.config");
-  else pass("image.defaults.format: 'webp' in astro.config");
+  else if (enabled.images) pass("image.defaults.format: 'webp' in astro.config");
+}
+
+if (enabled.seo) {
+  if (!exists('src/components/SiteHead.astro') && !exists('src/components/Head.astro'))
+    warn('Head component present', 'Recommended: src/components/SiteHead.astro wrapping @ibalzam/codejitsu-core/seo/Head.astro.');
+  else pass('Head component present');
 }
 
 // ─── Build artifacts ─────────────────────────────────────────────────────
 
 if (!fs.existsSync(distDir)) {
-  fail('dist/ exists', 'Run `npm run build` first.');
+  warn('dist/ exists', 'Run `npm run build` first to enable per-page HTML checks.');
   printAndExit();
 }
 pass('dist/ exists');
@@ -90,17 +124,21 @@ else pass(`dist/ contains ${htmlFiles.length} HTML files`);
 
 const hasSitemap = fs.existsSync(path.join(distDir, 'sitemap-index.xml')) ||
   fs.existsSync(path.join(distDir, 'sitemap-0.xml'));
-if (!hasSitemap) fail('sitemap-(index|0).xml in dist/');
-else pass('sitemap in dist/');
+if (enabled.seo) {
+  if (!hasSitemap) fail('sitemap-(index|0).xml in dist/');
+  else pass('sitemap in dist/');
 
-if (!fs.existsSync(path.join(distDir, 'robots.txt'))) fail('dist/robots.txt');
-else pass('dist/robots.txt');
+  if (!fs.existsSync(path.join(distDir, 'robots.txt'))) fail('dist/robots.txt');
+  else pass('dist/robots.txt');
+}
 
-if (!fs.existsSync(path.join(distDir, 'llms.txt'))) warn('dist/llms.txt');
-else pass('dist/llms.txt');
+if (enabled.llms) {
+  if (!fs.existsSync(path.join(distDir, 'llms.txt'))) warn('dist/llms.txt');
+  else pass('dist/llms.txt');
 
-if (!fs.existsSync(path.join(distDir, 'llms-full.txt'))) warn('dist/llms-full.txt');
-else pass('dist/llms-full.txt');
+  if (!fs.existsSync(path.join(distDir, 'llms-full.txt'))) warn('dist/llms-full.txt');
+  else pass('dist/llms-full.txt');
+}
 
 // ─── Per-page checks ─────────────────────────────────────────────────────
 
@@ -111,6 +149,7 @@ const missingOgImage = [];
 const missingJsonLd = [];
 const pngWhereWebp = [];
 const placeholderText = [];
+const unsafeJsonLd = [];
 
 const webpSet = new Set();
 (function walkAssets(dir) {
@@ -124,23 +163,20 @@ const webpSet = new Set();
   }
 })(distDir);
 
-const PLACEHOLDER_RE = /\b(lorem ipsum|TODO|FIXME|XXX:|placeholder)\b/i;
+// Matches actual placeholder *content*, not CSS ::placeholder or HTML
+// placeholder="..." attributes (both legitimate).
+const PLACEHOLDER_RE = /\b(lorem ipsum|TODO:|FIXME:|XXX:)\b/i;
 
 for (const file of htmlFiles) {
   const rel = path.relative(distDir, file);
   const html = readFile(file);
 
   if (!/<title>[^<]+<\/title>/.test(html)) missingTitle.push(rel);
-  if (!/<meta\s+name=["']description["']\s+content=["'][^"']+["']/i.test(html))
-    missingDescription.push(rel);
-  if (!/<link\s+rel=["']canonical["']\s+href=["'][^"']+["']/i.test(html))
-    missingCanonical.push(rel);
-  if (!/<meta\s+property=["']og:image["']\s+content=["'][^"']+["']/i.test(html))
-    missingOgImage.push(rel);
-  if (!/<script\s+type=["']application\/ld\+json["']/i.test(html))
-    missingJsonLd.push(rel);
-
-  // Find <img src="*.png|*.jpg"> and check if a .webp equivalent exists.
+  if (!/<meta\s+name=["']description["']\s+content=["'][^"']+["']/i.test(html)) missingDescription.push(rel);
+  if (!/<link\s+rel=["']canonical["']\s+href=["'][^"']+["']/i.test(html)) missingCanonical.push(rel);
+  if (!/<meta\s+property=["']og:image["']\s+content=["'][^"']+["']/i.test(html)) missingOgImage.push(rel);
+  if (!/<script\s+type=["']application\/ld\+json["']/i.test(html)) missingJsonLd.push(rel);
+
   for (const m of html.matchAll(/<img[^>]+src=["']([^"']+\.(?:png|jpe?g))["']/gi)) {
     const src = m[1].replace(/^\//, '');
     const noExt = src.replace(/\.(?:png|jpe?g)$/i, '');
@@ -148,6 +184,11 @@ for (const file of htmlFiles) {
   }
 
   if (PLACEHOLDER_RE.test(html)) placeholderText.push(rel);
+
+  // JSON-LD that contains an unescaped </ closing tag indicator (potential XSS).
+  for (const m of html.matchAll(/<script[^>]*application\/ld\+json[^>]*>([\s\S]*?)<\/script>/gi)) {
+    if (/<\/[a-z]/i.test(m[1])) unsafeJsonLd.push(rel);
+  }
 }
 
 function reportList(name, list, severity = 'fail') {
@@ -166,9 +207,10 @@ reportList('Every page has <title>', missingTitle);
 reportList('Every page has <meta description>', missingDescription);
 reportList('Every page has canonical link', missingCanonical);
 reportList('Every page has og:image', missingOgImage, 'warn');
-reportList('Every page has JSON-LD schema', missingJsonLd);
+if (enabled.seo) reportList('Every page has JSON-LD schema', missingJsonLd);
 reportList('No <img> references raw PNG/JPG where WebP exists', pngWhereWebp);
 reportList('No placeholder text in production HTML', placeholderText);
+reportList('JSON-LD uses safe injection (escapes </)', unsafeJsonLd);
 
 // ─── Output ──────────────────────────────────────────────────────────────
 
@@ -180,7 +222,7 @@ function printAndExit() {
   const fails = checks.filter((c) => c.status === 'fail').length;
 
   for (const c of checks) {
-    const icon = c.status === 'pass' ? '✓' : c.status === 'warn' ? '!' : '✗';
+    const icon = c.status === 'pass' ? '✓' : c.status === 'warn' ? '!' : c.status === 'info' ? 'i' : '✗';
     const line = `${icon} ${c.name}`;
     console.log(c.detail ? `${line}\n  ${c.detail}` : line);
   }