npm - @maccesar/aiskills - Versions diffs - 1.17.1 → 1.18.1 - Mend

@maccesar/aiskills 1.17.1 → 1.18.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (35) hide show

package/README.md CHANGED Viewed

@@ -2,7 +2,7 @@
 <div align="center">
-![npm](https://img.shields.io/npm/dm/aiskills) ![npm](https://img.shields.io/npm/v/aiskills) ![NPM](https://img.shields.io/npm/l/aiskills)
+![npm](https://img.shields.io/npm/dm/@maccesar/aiskills) ![npm](https://img.shields.io/npm/v/@maccesar/aiskills) ![NPM](https://img.shields.io/npm/l/@maccesar/aiskills)
 </div>
@@ -73,6 +73,7 @@ All three platforms use the same Agent Skills format: a `SKILL.md` file with YAM
 | vscode-extension-dev | VS Code      | VS Code Extension API docs           | 14 files        |
 | stitch-showcase      | Design Tools | Google Stitch export workflow        | 16 files        |
 | session-log          | Project      | Convention + 3 A/B rounds            | 2 files         |
+| seo-launch           | Web / SEO    | Head tags, share cards, server files | 5 files         |
 Use `aiskills list` to see available skills from the command line. Pull requests are welcome.
@@ -452,6 +453,46 @@ Anti-patterns `refactoring-ui` guards against:
 ---
+### seo-launch
+Takes a site from "it's online" to "search engines can find it and the link looks right when someone shares it". It covers the part that is configuration rather than content: the `<head>` tags, the images the platforms actually fetch, the server files, the JSON-LD, and the handover to Search Console.
+It runs in two stages, separated by your approval — the same shape as `audit-codebase`, and for the same reason: a tool that edits while it looks hands you a list of things it already changed instead of a diagnosis.
+**Stage 1** runs `scripts/auditar_seo.py` against the live URL and reports what is missing, with a severity per finding and the consequence spelled out. The script is standard-library Python, so there is nothing to install. It checks the `<head>` tags and their lengths, the seven Open Graph tags, the Twitter card, the icons, the JSON-LD, `robots.txt`, `sitemap.xml`, the `http→https` and `www→apex` redirects, the response headers, and whether the `og:image` exists — reading its **real dimensions from the file header**, which is how it catches an image declared as 1200×630 that is not.
+```bash
+python3 <SKILL_DIR>/scripts/auditar_seo.py https://example.com
+python3 <SKILL_DIR>/scripts/auditar_seo.py https://mysite.test --local   # self-signed Herd certificate
+```
+`<SKILL_DIR>` is wherever the skill got installed — `~/.agents/skills/seo-launch` for an npm install, a versioned path under `~/.claude/plugins/cache/` for a marketplace one. The skill reads it from the system message rather than assuming, because the working directory during an audit is your project, not the skill.
+Certificate verification is on by default; `--local` is the explicit opt-out for local `.test` domains, because an unverified response is not evidence of anything.
+**Stage 2**, once you approve, installs the tags from a parameterized template, generates the images with ImageMagick, writes `robots.txt` / `sitemap.xml` / `.htaccess`, and re-runs the audit against the live site to verify.
+| Reference file | Covers |
+| --- | --- |
+| `head-tags.md` | title, description, canonical, robots, the Open Graph block, Twitter card, and why the URLs must be absolute |
+| `images.md` | og:image 1200×630, SVG favicon, apple-touch-icon, and the ImageMagick commands with the decision behind each flag |
+| `server-files.md` | robots.txt, sitemap.xml, .htaccess: canonical domain, compression, split caching, security headers |
+| `structured-data.md` | JSON-LD for LocalBusiness, Organization, Article and BreadcrumbList |
+| `search-engines.md` | Search Console (Domain vs URL prefix), Bing, submitting the sitemap, validators, busting Facebook's cache |
+Templates in `assets/`: a parameterized `head.php` for static sites, a `social-meta.blade.php` component for Laravel, a commented `.htaccess`, and a `robots.txt`.
+How to invoke it — in whatever words you'd use anyway:
+```
+"el enlace sale como cuadro gris cuando lo mando por WhatsApp"
+"why doesn't Google find this site?"
+"vamos a poner el dominio en producción, ¿qué falta?"
+"review the meta tags on this site"
+```
+---
 ## CLI reference
 ### aiskills list

package/lib/commands/list.js CHANGED Viewed

@@ -16,10 +16,104 @@ import {
 const CHECK = chalk.green('✓');
 const CROSS = chalk.red('✗');
+// Two lines of description per skill: enough to tell what a skill is for,
+// short enough that the list stays a list. Everything past that is the
+// skill's trigger text, which is written for the agent, not for this screen.
+const MAX_DESCRIPTION_LINES = 2;
+// Descriptions still need room to say something when the window is narrow.
+const MIN_DESCRIPTION_WIDTH = 24;
+/**
+ * Unquote a YAML scalar. The frontmatter of every skill here is single-quoted
+ * because the descriptions contain colons and apostrophes; without this, the
+ * quote is printed as part of the text.
+ * @param {string} value - Raw scalar as it appears after `description:`
+ * @returns {string} The value with its wrapping quotes and escapes resolved
+ */
+function unquote(value) {
+  const text = value.trim();
+  const quote = text[0];
+  if ((quote !== "'" && quote !== '"') || !text.endsWith(quote) || text.length < 2) {
+    return text;
+  }
+  const inner = text.slice(1, -1);
+  // In single-quoted YAML an apostrophe is escaped by doubling it.
+  return quote === "'" ? inner.replace(/''/g, "'") : inner.replace(/\\"/g, '"');
+}
 /**
- * Extract the skill's human-readable name and short description from SKILL.md.
- * Returns { description, installed } where description is the first sentence of
- * the frontmatter description, trimmed for terminal display.
+ * Wrap text into aligned lines, capped at maxLines with an ellipsis when it
+ * does not fit.
+ * @param {string} text - Text to wrap
+ * @param {number} width - Columns available for the text itself
+ * @param {number} maxLines - Hard cap on the number of lines
+ * @returns {string[]} Lines, none longer than width
+ */
+export function wrapDescription(text, width, maxLines = MAX_DESCRIPTION_LINES) {
+  const columns = Math.max(width, MIN_DESCRIPTION_WIDTH);
+  const lines = [];
+  let current = '';
+  for (let word of text.split(/\s+/).filter(Boolean)) {
+    // A single word wider than the column (a long URL) is broken by hand;
+    // otherwise the loop below could never place it and would spin.
+    while (word.length > columns) {
+      if (current) {
+        lines.push(current);
+        current = '';
+      }
+      lines.push(word.slice(0, columns));
+      word = word.slice(columns);
+    }
+    if (!current) {
+      current = word;
+    } else if (current.length + 1 + word.length <= columns) {
+      current += ` ${word}`;
+    } else {
+      lines.push(current);
+      current = word;
+    }
+  }
+  if (current) lines.push(current);
+  if (lines.length <= maxLines) return lines;
+  const kept = lines.slice(0, maxLines);
+  let last = kept[maxLines - 1];
+  if (last.length + 1 > columns) {
+    last = last.slice(0, columns - 1).replace(/\s+\S*$/, '');
+  }
+  kept[maxLines - 1] = `${last.replace(/[,;:]$/, '')}…`;
+  return kept;
+}
+/**
+ * Extract the skill's short description from SKILL.md — the first sentence of
+ * the frontmatter description, unquoted and collapsed to a single line.
+ * @param {string} frontmatter - The YAML block between the --- fences
+ * @returns {string|null} The description, or null when there is none
+ */
+export function parseDescription(frontmatter) {
+  // The lookahead ends the value at the next top-level key, or at the end of
+  // the block. `(?![\s\S])` rather than `$`, which under the /m flag would
+  // match the first newline and cut a description written across two lines.
+  const descMatch = frontmatter.match(/^description:\s*([\s\S]+?)(?=\n[A-Za-z][\w-]*:|(?![\s\S]))/m);
+  if (!descMatch) return null;
+  const full = unquote(descMatch[1]).replace(/\s+/g, ' ').trim();
+  if (!full) return null;
+  const firstSentence = full.match(/^([^]*?\.)\s/);
+  if (firstSentence) return firstSentence[1].trim();
+  return full;
+}
+/**
+ * Read a skill's description from disk.
+ * @param {string} skillDir - Directory holding the skill's SKILL.md
+ * @returns {{description: string|null, installed: boolean}}
  */
 function readSkillMetadata(skillDir) {
   const skillMd = join(skillDir, 'SKILL.md');
@@ -32,21 +126,7 @@ function readSkillMetadata(skillDir) {
     const frontmatter = content.match(/^---\n([\s\S]*?)\n---/);
     if (!frontmatter) return { description: null, installed: true };
-    const descMatch = frontmatter[1].match(/description:\s*"([^"]+)"|description:\s*(.+)/);
-    if (!descMatch) return { description: null, installed: true };
-    const full = descMatch[1] || descMatch[2] || '';
-    let short;
-    const firstSentence = full.match(/^([^]*?\.)\s/);
-    if (firstSentence) {
-      short = firstSentence[1];
-    } else if (full.length > 80) {
-      const cut = full.slice(0, 80);
-      short = cut.slice(0, cut.lastIndexOf(' ')) + '…';
-    } else {
-      short = full;
-    }
-    return { description: short.trim(), installed: true };
+    return { description: parseDescription(frontmatter[1]), installed: true };
   } catch {
     return { description: null, installed: true };
   }
@@ -81,14 +161,21 @@ export async function listCommand() {
     rows.push({ name, description, installed });
   }
+  // Where the description column starts: '  ' + mark + ' ' + padded name + ' '.
+  // Measured on the plain text, since chalk's colour codes take no columns.
+  const descriptionColumn = 2 + 1 + 1 + (maxNameLen + 2) + 1;
+  const available = (process.stdout.columns || 80) - descriptionColumn;
   for (const row of rows) {
     const mark = row.installed ? CHECK : CROSS;
     const paddedName = row.name.padEnd(maxNameLen + 2);
-    const desc = row.description
-      ? chalk.gray(row.description)
-      : chalk.gray(row.installed ? '(no description)' : 'not installed');
+    const text = row.description || (row.installed ? '(no description)' : 'not installed');
+    const [first, ...rest] = wrapDescription(text, available);
-    console.log(`  ${mark} ${chalk.cyan(paddedName)} ${desc}`);
+    console.log(`  ${mark} ${chalk.cyan(paddedName)} ${chalk.gray(first)}`);
+    for (const line of rest) {
+      console.log(`${' '.repeat(descriptionColumn)}${chalk.gray(line)}`);
+    }
   }
   console.log('');

package/lib/commands/skills.js CHANGED Viewed

@@ -8,9 +8,7 @@ import ora from 'ora';
 import {
   SKILLS,
   getPlatforms,
-  getAgentsSkillsDir,
 } from '../config.js';
-import select from '../prompts/selectCancel.js';
 import checkbox, { Separator } from '../prompts/checkboxCancel.js';
 import {
   detectPlatforms,
@@ -256,7 +254,7 @@ export async function skillsCommand(options) {
     if (!removeOnly) {
       // Install skills
       spinner.start('Installing skills...');
-      const skillsResult = await installSkills(repoDir, baseDir, skillsToInstall);
+      await installSkills(repoDir, baseDir, skillsToInstall);
       spinner.succeed(`${skillsToInstall.length} skill${skillsToInstall.length !== 1 ? 's' : ''} installed`);
       // If the user deselected some skills, sweep any previously-installed

package/lib/config.js CHANGED Viewed

@@ -30,6 +30,7 @@ export const SKILLS = [
   'audit-codebase',
   'humaniza',
   'refactoring-ui',
+  'seo-launch',
   'session-log',
   'stitch-showcase',
   'vscode-extension-dev',

package/lib/prompts/checkboxCancel.js CHANGED Viewed

@@ -49,12 +49,6 @@ function toggle(item) {
   return isSelectable(item) ? { ...item, checked: !item.checked } : item;
 }
-function check(checked) {
-  return function (item) {
-    return isSelectable(item) ? { ...item, checked } : item;
-  };
-}
 function normalizeChoices(choices) {
   return choices.map((choice) => {
     if (Separator.isSeparator(choice)) return choice;

package/lib/symlink.js CHANGED Viewed

@@ -4,7 +4,7 @@
  */
 import { mkdirSync, existsSync } from 'fs';
-import { symlink, readlink, unlink, lstat } from 'fs/promises';
+import { symlink, readlink } from 'fs/promises';
 import { join, dirname, relative } from 'path';
 import { copy, remove } from 'fs-extra';
 import { isWindows } from './platform.js';

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@maccesar/aiskills",
-  "version": "1.17.1",
+  "version": "1.18.1",
   "description": "AI coding assistant skills for Claude Code, Gemini CLI, and Codex CLI",
   "type": "module",
   "bin": {
@@ -8,7 +8,7 @@
   },
   "scripts": {
     "test": "node --test test/*.test.js",
-    "lint": "eslint lib/**/*.js",
+    "lint": "eslint bin lib test",
     "format": "prettier --write lib/**/*.js"
   },
   "keywords": [
@@ -47,7 +47,9 @@
     "tar": "^7.5.7"
   },
   "devDependencies": {
+    "@eslint/js": "^9.39.5",
     "eslint": "^9.39.2",
+    "globals": "^16.5.0",
     "prettier": "^3.8.1"
   },
   "files": [

package/skills/seo-launch/SKILL.md ADDED Viewed

@@ -0,0 +1,91 @@
+---
+name: seo-launch
+description: 'Audit and then install everything a site needs to be indexed and to render a proper card when its link is shared: head tags, Open Graph and Twitter card, the 1200x630 og:image, favicon and apple-touch-icon, robots.txt, sitemap.xml, an .htaccess with one canonical domain, JSON-LD, and the Search Console handover. Works on static sites and on Laravel or plain PHP projects. Use when the user says the link shows a grey box with no preview in WhatsApp, asks why Google cannot find the site, is putting a new domain live, or asks for an SEO review, meta tags, og:image, sitemap or robots.txt — even when they never say "SEO". Not for: keyword research, writing the content itself, backlinks, paid ads, or analytics dashboards.'
+allowed-tools: Read, Grep, Glob, Bash, Edit, Write, AskUserQuestion
+---
+# SEO Launch
+Get a site indexable and shareable: the `<head>` tags, the images the platforms actually fetch, the server files, the structured data, and the handover to Search Console.
+The work has two stages separated by an explicit authorization. The separation exists because the report is the deliverable: an audit that edits while it looks produces a list of things you already changed, which is not a diagnosis and takes the decision away from the owner. Stage 1 writes nothing.
+Respond in the user's language. This skill is written in English for portability; the report should match whatever language the user is writing in.
+## Read the terrain first
+Three questions, answered before anything else, because each one changes what you apply and where:
+1. **What kind of project is this?** `artisan` in the root means Laravel — the tags belong in a Blade component or the layout's `<head>`, not in each view. A tree of `.html` files means a static site; look for a `partials/` directory or an SSI/PHP include before writing the same block into every page. Anything else (Astro, Next, Hugo, WordPress), find the one template that owns the `<head>` and edit that.
+2. **Is the site live?** A reachable URL means the audit can be measured instead of guessed — run the script. A domain that does not resolve yet means the audit is a read of local files only, and the verification step moves to after the deploy.
+3. **Where is the document root?** The `.htaccess`, `robots.txt` and `sitemap.xml` go where Apache serves from, which in a Laravel project is `public/` and in a static project is often `public/` too. Writing them one level up is the most common way this work silently does nothing.
+Ask only what you cannot read from the repo. The domain, the business name and the phone number are the user's to give; the framework is yours to detect.
+## Stage 1 — Audit, no modifications
+Do not create or edit files in this stage, including images.
+1. **Measure the live site**, if there is one:
+   ```bash
+   python3 <SKILL_DIR>/scripts/auditar_seo.py https://example.com
+   python3 <SKILL_DIR>/scripts/auditar_seo.py https://mysite.test --local   # self-signed Herd cert
+   ```
+   Replace `<SKILL_DIR>` with the absolute "Base directory for this skill" from the system message that loaded this skill — the working directory here is the user's project, not this one, so a relative `scripts/…` resolves to nothing. The path also differs by install type (`~/.claude/plugins/cache/<plugin>/<version>/skills/seo-launch` for a plugin install, `~/.claude/skills/seo-launch` standalone), so read it rather than assuming it.
+   It reads the page once and checks the `<head>` tags, `robots.txt`, `sitemap.xml`, the `http→https` and `www→apex` redirects, the response headers, and whether the `og:image` exists — including its **real dimensions**, read from the file header, which is how you catch an image declared as 1200×630 that is not.
+   `--no-network` limits it to the markup. `--local` relaxes certificate verification and exists only for local `.test` domains; never point it at a site on the public internet, since an unverified response is not evidence of anything.
+2. **Read the local files** that own what the script found missing: the template holding the `<head>`, the document root, `.htaccess`, `robots.txt`, `sitemap.xml`.
+3. **Report findings as a table** — item, severity, what breaks because of it:
+   | Finding | Severity | Consequence |
+   | --- | --- | --- |
+   | No `og:image` | High | Every shared link renders as a grey rectangle |
+   | `<title>` is 74 characters | Medium | Google truncates it at ~60 and the tail is lost |
+   Severity is what breaks, not how hard it is to fix. Anything that makes the site invisible (no `sitemap.xml`, `noindex` in production, two domains serving 200) or unshareable (no `og:image`, relative image URLs) is High. Nice-to-haves (`twitter:site`, `theme-color`) are Low, and say so rather than padding the list.
+4. **Stop.** Present the table and what you would do about it. Do not start fixing.
+If the user asked up front to "audit and fix", still show the table first — approving it takes seconds, and the content decisions inside it (the description text, which pages go in the sitemap, whether keywords are wanted) are not yours to invent.
+## Stage 2 — Authorized implementation
+Start only once the user approves. Work in this order, because each step depends on the previous one being real:
+1. **Tags.** Install the `<head>` block from the right template in `assets/`, parameterized — one place holds the domain, one place holds the fallback image. Never paste the same literal block into five pages.
+2. **Images.** Generate the `og:image`, the favicon and the `apple-touch-icon` per `references/images.md`. Verify each file exists and measures what the tags declare.
+3. **Server files.** `robots.txt` with the `Sitemap:` line, `sitemap.xml` with the real pages, `.htaccess` with the canonical domain, caching and security headers.
+4. **Structured data.** The JSON-LD block, with confirmed data only.
+5. **Verify against the live site**, not against the repo. Re-run the script and expect the findings you fixed to be gone. If the site deploys by SFTP-on-save, the files may already be up; if it deploys by git, they are not until it ships — check, do not infer.
+6. **Search engines.** The Search Console steps in `references/search-engines.md` need a browser and the domain's DNS. Hand the user the exact sequence; you cannot do this part for them.
+## Where to look
+| What the work touches | Read |
+| --- | --- |
+| `<title>`, description, canonical, Open Graph, Twitter card | `references/head-tags.md` |
+| `og:image`, favicon, `apple-touch-icon`, ImageMagick commands | `references/images.md` |
+| `robots.txt`, `sitemap.xml`, `.htaccess`, caching, headers | `references/server-files.md` |
+| JSON-LD: `LocalBusiness`, `Organization`, `Article`, breadcrumbs | `references/structured-data.md` |
+| Search Console, Bing, submitting the sitemap, validators | `references/search-engines.md` |
+Templates in `assets/`: `head.php` (static site, parameterized include), `social-meta.blade.php` (Laravel component), `htaccess-static`, `robots.txt`.
+## Hard rules
+These are the ones that break on their own, each with the reason it matters:
+- **`og:image` and `canonical` carry absolute URLs.** Facebook, WhatsApp and X discard an image with a relative path — the tag is present, valid, and produces no thumbnail at all.
+- **The `og:image` is a JPEG, not WebP.** Several preview clients still cannot decode WebP and fall back to no image; the 30 KB you save are not worth an invisible link.
+- **The `apple-touch-icon` is a flat PNG with a white background and no alpha.** iOS does not honour the alpha channel here, it fills transparency with black, and a dark logo disappears into it.
+- **The `<title>` stays under ~60 characters.** Past that Google truncates it in the results, and what gets cut is the tail — which is where the brand usually sits.
+- **`og:image:width` and `og:image:height` must match the file.** They exist so the client can lay out the card before downloading; wrong values render a cropped or stretched card and nothing reports an error.
+- **The canonical redirects go in the server config, not only in the tag.** `rel=canonical` is a hint Google may ignore; the 301 is the one that settles it.
+- **JSON-LD carries confirmed data only.** Google cross-checks it against other sources — an invented address or opening hours costs you trust in the whole block, and there is no warning when that happens.
+- **Changing the `og:image` requires busting Facebook's cache.** It caches the card for days; without the debugger refresh, the "fixed" preview keeps showing the old image and it looks like the fix failed.

package/skills/seo-launch/assets/head.php ADDED Viewed

@@ -0,0 +1,85 @@
+<?php
+/**
+ * The full <head>, shared by every page of a static site.
+ *
+ * Include it once per page:  <?php $titulo = '…'; $descripcion = '…'; $ruta = ''; include '../partials/head.php'; ?>
+ *
+ * Variables it expects before the include:
+ *   $titulo       (required) the <title>
+ *   $descripcion  (required) the meta description
+ *   $ruta         (required) path from the root, '' for the home page
+ *   $og_titulo    (optional) defaults to $titulo — the card usually drops the brand,
+ *                 because og:site_name already prints it right below
+ *   $og_desc      (optional) defaults to $descripcion
+ *   $og_img       (optional) absolute URL, overrides the site-wide card image
+ *   $og_img_alt   (optional) alt text for the card image
+ *   $twitter_desc (optional) X truncates earlier than Facebook; sometimes a
+ *                 shorter version is worth writing
+ *   $keywords     (optional) Google has ignored these since 2009
+ *   $jsonld       (optional) an already-formatted structured data block
+ *
+ * The URLs are absolute on purpose: Facebook, WhatsApp and X discard images
+ * with a relative path. The base lives here, in one place.
+ */
+const BASE = 'https://example.com/';
+const OG_IMAGEN = BASE . 'images/og-image.jpg';
+const OG_IMAGEN_ALT = 'Describe the card image in one sentence.';
+const SITIO = 'Site Name';
+$url = BASE . ($ruta ?? '');
+$ogTitulo = $og_titulo ?? $titulo;
+$ogDesc = $og_desc ?? $descripcion;
+$ogImagen = $og_img ?? OG_IMAGEN;
+$ogImgAlt = $og_img_alt ?? OG_IMAGEN_ALT;
+$twitterDesc = $twitter_desc ?? $ogDesc;
+function attr(string $valor): string
+{
+    return htmlspecialchars($valor, ENT_QUOTES, 'UTF-8');
+}
+?>
+<meta charset="utf-8"/>
+<meta content="width=device-width, initial-scale=1.0" name="viewport"/>
+<title><?= attr($titulo) ?></title>
+<meta content="<?= attr($descripcion) ?>" name="description"/>
+<link href="<?= attr($url) ?>" rel="canonical"/>
+<meta content="index, follow" name="robots"/>
+<meta content="#0f2d52" name="theme-color"/>
+<?php if (! empty($keywords)): ?>
+<meta content="<?= attr($keywords) ?>" name="keywords"/>
+<?php endif; ?>
+<!-- An SVG favicon has no intrinsic size, so it draws sharp in the tab, in the
+     bookmarks bar and at any density. iOS ignores it for the home screen — that
+     is what the PNG below is for. -->
+<link href="<?= BASE ?>images/logo-symbol.svg" rel="icon" type="image/svg+xml"/>
+<link href="<?= BASE ?>images/apple-touch-icon.png" rel="apple-touch-icon" sizes="180x180"/>
+<!-- Without this, iOS puts the whole <title> under the icon and cuts it. -->
+<meta content="<?= SITIO ?>" name="apple-mobile-web-app-title"/>
+<!-- Open Graph: Facebook, WhatsApp, LinkedIn -->
+<meta content="website" property="og:type"/>
+<meta content="es_MX" property="og:locale"/>
+<meta content="<?= SITIO ?>" property="og:site_name"/>
+<meta content="<?= attr($url) ?>" property="og:url"/>
+<meta content="<?= attr($ogTitulo) ?>" property="og:title"/>
+<meta content="<?= attr($ogDesc) ?>" property="og:description"/>
+<meta content="<?= attr($ogImagen) ?>" property="og:image"/>
+<meta content="<?= attr($ogImagen) ?>" property="og:image:secure_url"/>
+<meta content="image/jpeg" property="og:image:type"/>
+<!-- These must match the real file. A wrong value renders a cropped card and
+     nothing reports an error. -->
+<meta content="1200" property="og:image:width"/>
+<meta content="630" property="og:image:height"/>
+<meta content="<?= attr($ogImgAlt) ?>" property="og:image:alt"/>
+<!-- X. summary_large_image is the one that shows the photo full width. -->
+<meta content="summary_large_image" name="twitter:card"/>
+<meta content="<?= attr($ogTitulo) ?>" name="twitter:title"/>
+<meta content="<?= attr($twitterDesc) ?>" name="twitter:description"/>
+<meta content="<?= attr($ogImagen) ?>" name="twitter:image"/>
+<meta content="<?= attr($ogImgAlt) ?>" name="twitter:image:alt"/>
+<?php if (! empty($jsonld)): ?>
+<script type="application/ld+json">
+<?= $jsonld ?>
+</script>
+<?php endif; ?>
+<link href="<?= BASE ?>css/app.css" rel="stylesheet"/>

package/skills/seo-launch/assets/htaccess-static ADDED Viewed

@@ -0,0 +1,86 @@
+# .htaccess for a static site served directly by Apache.
+#
+# Goes in the document root. A Laravel project already ships an .htaccess with
+# the front-controller rewrite: add these blocks to that file, do not replace it.
+#
+# Replace example.com with the real domain in the two RewriteRules below.
+# ---------------------------------------------------------------- hidden files
+# Any path starting with a dot returns 404. Defence in depth for the day a
+# deploy tool uploads .vscode/ or .git/ into the document root.
+#
+# The (?!well-known/) exception is NOT optional: AutoSSL renews the certificate
+# by placing a file in /.well-known/acme-challenge/. Without it, validation
+# fails silently and you find out when the certificate expires.
+RedirectMatch 404 /\.(?!well-known/)
+# Formats that only exist to work on the site, never to be served.
+<FilesMatch "\.(md|json|lock|yml|yaml|sh|sql|bak|log)$">
+  Require all denied
+</FilesMatch>
+# ------------------------------------------------------------ canonical domain
+# Without this, http://, https://www. and https:// all serve the same content
+# with a 200 — duplicate content, with the authority split three ways.
+<IfModule mod_rewrite.c>
+  RewriteEngine On
+  # The double condition is not redundant: behind a proxy or CDN, %{HTTPS} can
+  # arrive off even though the request was secure. Testing only that variable
+  # produces an infinite redirect loop.
+  RewriteCond %{HTTPS} !=on
+  RewriteCond %{HTTP:X-Forwarded-Proto} !=https
+  RewriteRule ^ https://example.com%{REQUEST_URI} [R=301,L]
+  # Pick apex or www and stay consistent with the canonical tag and the sitemap.
+  RewriteCond %{HTTP_HOST} ^www\.example\.com$ [NC]
+  RewriteRule ^ https://example.com%{REQUEST_URI} [R=301,L]
+</IfModule>
+# ------------------------------------------------------------------ compression
+# image/svg+xml is the one usually missing from a default config. An SVG is
+# text and compresses enormously.
+<IfModule mod_deflate.c>
+  AddOutputFilterByType DEFLATE text/html text/css text/plain text/xml \
+    application/javascript application/json image/svg+xml
+</IfModule>
+# ----------------------------------------------------------------------- cache
+<IfModule mod_headers.c>
+  # Images and fonts: a year, immutable — the browser will not even ask whether
+  # they changed. What makes this safe is renaming a file when its content does.
+  <FilesMatch "\.(webp|jpe?g|png|gif|svg|ico|woff2)$">
+    Header set Cache-Control "public, max-age=31536000, immutable"
+  </FilesMatch>
+  # HTML, CSS and JS: revalidate every time. A stylesheet always named app.css
+  # cannot be cached long — recompile it and returning visitors keep the old one
+  # until it expires, with new classes silently missing and no console error.
+  # This flips only when the build fingerprints filenames (app.4f3a1c.css).
+  <FilesMatch "\.(html|css|js)$">
+    Header set Cache-Control "public, max-age=0, must-revalidate"
+  </FilesMatch>
+  # ------------------------------------------------------------------ security
+  Header always set X-Content-Type-Options "nosniff"
+  Header always set Referrer-Policy "strict-origin-when-cross-origin"
+  Header always set X-Frame-Options "SAMEORIGIN"
+  Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
+  # Content-Security-Policy is deliberately absent. A miscalibrated CSP strips
+  # the site of its styles, and any page with an inline <script> or a
+  # third-party font needs it tuned by hand. Add it once those are self-hosted
+  # and you can test it.
+</IfModule>
+# ------------------------------------------------------------------ MIME types
+# An SVG served as text/plain renders blank — including the favicon.
+<IfModule mod_mime.c>
+  AddType image/svg+xml .svg
+  AddType image/webp    .webp
+  AddType application/xml .xml
+</IfModule>
+# --------------------------------------------------------------- default files
+DirectoryIndex index.html index.php
+Options -Indexes

package/skills/seo-launch/assets/robots.txt ADDED Viewed

@@ -0,0 +1,17 @@
+# robots.txt — goes in the document root, reachable at https://example.com/robots.txt
+#
+# The point of this file here is the Sitemap: line: it is the only standard
+# place to point at the sitemap without submitting it by hand to each engine.
+#
+# It is public. Do not list paths you would rather nobody found — a Disallow
+# reads as a directory of interesting URLs. It keeps polite crawlers out; it is
+# not access control.
+User-agent: *
+Allow: /
+# Endpoints that are not pages: form handlers, internal APIs, debug routes.
+# Disallow: /send.php
+# The URL must be absolute, and must match the canonical domain.
+Sitemap: https://example.com/sitemap.xml