@nurkamol/seo-audit 1.39.0 → 1.40.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nurkamol/seo-audit",
-  "version": "1.39.0",
+  "version": "1.40.0",
   "description": "Crawl a site's sitemap and check every page for SEO, metadata and structured-data problems that single-page graders miss. Zero dependencies.",
   "type": "module",
   "bin": {

package/src/http.mjs

@@ -81,7 +81,7 @@ export class Fetcher {
    * @returns {Promise<{url: string, status: number, ok: boolean, headers: Headers,
    *                    body: string, location: string|null, ms: number, error?: string}>}
    */
-  async get(url, { method = 'GET', retries = 2 } = {}) {
+  async get(url, { method = 'GET', retries = 2, keepBody = true } = {}) {
     const key = `${method} ${url}`;
     if (this.cache.has(key)) return this.cache.get(key);
 
@@ -171,7 +171,24 @@ export class Fetcher {
       return last;
     });
 
-    this.cache.set(key, promise);
+    // The caller is handed the whole response; the cache may keep less.
+    //
+    // The cache is here so a URL is never fetched twice across checks, and for
+    // most of what a run fetches that means remembering a status and a
+    // content-type — the link sweep, the image sweep and the social-image
+    // sweeps all judge on those alone. Keeping every body as well made the
+    // cache the largest live object in the process: 403 requests on one 25-page
+    // site held 65MB, of which 18MB was still reachable once the run let go.
+    // That is under Node's default heap and over Raycast's, whose commands get
+    // 100MB and were dying on sites this tool audits comfortably from a
+    // terminal.
+    //
+    // So a sweep asks for `keepBody: false` and the body is dropped on the way
+    // into the cache, never on the way out — whoever fetched it reads it in
+    // full, and only a *second* reader of the same URL sees an empty body. The
+    // page crawl, robots.txt, the home page and the host checks all keep
+    // theirs, because something does read those twice.
+    this.cache.set(key, keepBody ? promise : promise.then((res) => ({ ...res, body: '' })));
     return promise;
   }
 
@@ -200,16 +217,16 @@ export class Fetcher {
   }
 
   /** Follow a chain by hand so the number of hops can be reported. */
-  async chain(url, max = 5) {
+  async chain(url, max = 5, { keepBody = true } = {}) {
     const hops = [];
     let current = url;
     for (let i = 0; i < max; i++) {
-      const res = await this.get(current);
+      const res = await this.get(current, { keepBody });
       hops.push({ url: current, status: res.status });
       if (res.status < 300 || res.status >= 400 || !res.location) return { hops, final: res };
       current = new URL(res.location, current).toString();
     }
-    return { hops, final: await this.get(current) };
+    return { hops, final: await this.get(current, { keepBody }) };
   }
 }
 

package/src/score.mjs

@@ -349,6 +349,8 @@ export function scoreRun(findings, { pages = 0, applicable = {} } = {}) {
       area: categoryOf(r.id),
       pass: r.check.pass,
       why: WHY_SKIPPED[r.check.needs] ?? 'Not applicable to this run.',
+      // Absent when nothing can be pressed, which is most of them.
+      ...(ENABLED_BY[r.check.needs] ? { enabledBy: ENABLED_BY[r.check.needs] } : {}),
     }));
 
   return {
@@ -394,6 +396,30 @@ const WHY_SKIPPED = {
   hosts: 'The rest of the domain was not enumerated — run with --hosts.',
 };
 
+/** The option that would have let a skipped check run, where one exists.
+ *
+ *  A skip has two very different causes and only one of them is anybody's to
+ *  fix. "No page declares hreflang" is a fact about the site — there is nothing
+ *  to press. "Outbound links were not checked" is a run that was not asked to,
+ *  and asking is one flag away.
+ *
+ *  Saying which is which here rather than in each front end, because the engine
+ *  is what decided the check was skipped and a client re-deriving that from the
+ *  prose in WHY_SKIPPED would be parsing an English sentence for a flag name.
+ *  A front end that can offer the re-run offers it; one that cannot ignores
+ *  this, and nothing about the report changes.
+ *
+ *  Only the reasons a *run* controls appear. `redirects` and `compareAs` are
+ *  deliberately absent even though both are flags: one needs a file that only
+ *  the person who did the migration has, and the other needs a second identity
+ *  to fetch as. Offering a button that cannot be pressed without an argument
+ *  is worse than offering nothing. */
+export const ENABLED_BY = {
+  external: '--check-external',
+  hosts: '--hosts',
+  psi: '--psi',
+};
+
 /** The same sum, once per area, so "where is this site weak" is answerable
  *  without reading the list. Areas with nothing applicable are absent rather
  *  than shown at 100, which would read as a clean bill of health. */

package/src/site.mjs

@@ -379,7 +379,7 @@ export async function siteChecks(origin, fetcher, pages, opts = {}) {
   const targets = all.slice(0, limit);
   opts.onProgress?.({ phase: 'links', detail: `${targets.length} distinct targets to check` });
   const results = await mapLimit(targets, 6, async (target) => {
-    const res = await fetcher.get(target);
+    const res = await fetcher.get(target, { keepBody: false });
     opts.onProgress?.({ phase: 'links', status: res.status, ms: res.ms, url: target });
     const type = res.headers.get('content-type') ?? '';
     // A third question the same response answers — and the only place it can be
@@ -499,9 +499,9 @@ export async function siteChecks(origin, fetcher, pages, opts = {}) {
   const imageTargets = [...imageSources.values()].slice(0, imageLimit).map((entry) => entry.src);
   opts.onProgress?.({ phase: 'images', detail: `${imageTargets.length} distinct images to check` });
   const imageResults = await mapLimit(imageTargets, 6, async (src) => {
-    let res = await fetcher.get(src, { method: 'HEAD' });
+    let res = await fetcher.get(src, { method: 'HEAD', keepBody: false });
     // Some hosts answer HEAD with 405 or 501 and serve the file perfectly well.
-    if (res.status === 405 || res.status === 501) res = await fetcher.get(src);
+    if (res.status === 405 || res.status === 501) res = await fetcher.get(src, { keepBody: false });
     opts.onProgress?.({ phase: 'images', status: res.status, ms: res.ms, url: src });
     return { src, status: res.status, error: res.error };
   });
@@ -590,8 +590,8 @@ export async function siteChecks(origin, fetcher, pages, opts = {}) {
   }
   const schemaTargets = [...schemaImages.keys()].slice(0, opts.maxImageChecks ?? 200);
   const schemaResults = await mapLimit(schemaTargets, 4, async (href) => {
-    let res = await fetcher.get(href, { method: 'HEAD' });
-    if (res.status === 405 || res.status === 501) res = await fetcher.get(href);
+    let res = await fetcher.get(href, { method: 'HEAD', keepBody: false });
+    if (res.status === 405 || res.status === 501) res = await fetcher.get(href, { keepBody: false });
     return { href, status: res.status, error: res.error };
   });
   const deadSchemaImages = schemaResults.filter(
@@ -733,7 +733,7 @@ export async function siteChecks(origin, fetcher, pages, opts = {}) {
   // Conservative about what counts as broken, for the same reason as the image
   // sweep: 403 is hotlink protection working, not a missing file.
   const ogResults = await mapLimit([...ogImages.keys()], 4, async (src) => {
-    const { final } = await fetcher.chain(src);
+    const { final } = await fetcher.chain(src, 5, { keepBody: false });
     return { src, final };
   });
   for (const { src, final } of ogResults) {
@@ -768,7 +768,7 @@ export async function siteChecks(origin, fetcher, pages, opts = {}) {
     twitterImages.set(src, page.url);
   }
   const twitterResults = await mapLimit([...twitterImages.keys()], 4, async (src) => {
-    const { final } = await fetcher.chain(src);
+    const { final } = await fetcher.chain(src, 5, { keepBody: false });
     return { src, final };
   });
   for (const { src, final } of twitterResults) {