@reddoorla/maintenance 0.86.0 → 0.88.2

package/dist/{chunk-X3B723J4.js → chunk-7TMWBXX7.js}

@@ -1,6 +1,6 @@
 import {
   isPrivateOrLoopbackHost
-} from "./chunk-EVBCK2KC.js";
+} from "./chunk-RARREDQE.js";
 
 // src/prospect/crawl.ts
 import { parse as parse2, NodeType as NodeType2 } from "node-html-parser";
@@ -264,6 +264,17 @@ function decodeXmlText(s) {
 function parseSitemapLocs(xml) {
   return [...xml.matchAll(/<(?:[\w-]+:)?loc\b[^>]*>([\s\S]*?)<\/(?:[\w-]+:)?loc>/gi)].map((m) => decodeXmlText(m[1] ?? "").trim()).filter(Boolean);
 }
+function isSafeNestedSitemap(child, origin) {
+  let url;
+  try {
+    url = new URL(child, origin);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") return false;
+  if (url.origin !== origin) return false;
+  return !isPrivateOrLoopbackHost(url.hostname);
+}
 function isSitemapIndex(xml) {
   return /<(?:[\w-]+:)?sitemapindex[\s>]/i.test(xml);
 }
@@ -347,7 +358,8 @@ async function fetchSidecars(origin, deps) {
   if (sitemap.res && /<(urlset|sitemapindex)[\s>]/i.test(sitemap.res.body)) {
     sitemapPresent = true;
     if (isSitemapIndex(sitemap.res.body)) {
-      for (const child of parseSitemapLocs(sitemap.res.body).slice(0, 3)) {
+      const children = parseSitemapLocs(sitemap.res.body).filter((child) => isSafeNestedSitemap(child, origin)).slice(0, 3);
+      for (const child of children) {
         const nested = await optional(deps, child);
         if (nested.res) sitemapUrls.push(...parseSitemapLocs(nested.res.body));
       }
@@ -369,6 +381,14 @@ async function crawlSite(rawUrl, deps) {
   start.hash = "";
   start.username = "";
   start.password = "";
+  if (isPrivateOrLoopbackHost(start.hostname)) {
+    throw Object.assign(
+      new Error(
+        `${start.toString()} is a private address (${start.hostname}) \u2014 refusing to crawl it.`
+      ),
+      { exitCode: 1 }
+    );
+  }
   let home;
   try {
     home = await deps.fetchUrl(start.toString());
@@ -720,9 +740,8 @@ var AnalyzeSchema = z.object({
   businessName: z.string(),
   business: z.string(),
   entityClarity: z.object({ score: z.number().min(0).max(100), missing: z.array(z.string()) }),
-  // 6-10, not just "an array": this also seeds the live-search probes in the next
-  // stage, so a thin or empty response must fail loudly here rather than quietly
-  // starving that stage of questions to ask.
+  // 6-10, not just "an array": a thin or empty response must fail loudly here
+  // rather than quietly starving the report's Answers section.
   buyerQuestions: z.array(
     z.object({
       question: z.string(),
@@ -732,6 +751,14 @@ var AnalyzeSchema = z.object({
       evidence: z.string().nullable()
     })
   ).min(6).max(10),
+  // Seeds the live-search probes in the next stage. Deliberately NOT the same
+  // strings as buyerQuestions: those are written about THIS site and read
+  // correctly only beside it ("What services does this agency offer?"), so as
+  // standalone searches they are unanswerable — proved in production, where an
+  // engine handed one replied "I don't have any context about who 'they'
+  // refers to" and the category score collapsed to a measurement of our own
+  // malformed prompt. A probe query must stand alone with no antecedent.
+  categoryQueries: z.array(z.string()).min(3).max(5),
   // No documented floor (a clean site may legitimately need none), but an
   // unbounded array had no cost/context ceiling either — a report's fix list
   // is a prioritized top set, not an exhaustive audit, so it's bounded the
@@ -780,6 +807,20 @@ Return:
   the site answers it (yes/partial/no), whether there is a passage an AI could quote verbatim, the page
   it lives on, and the evidence quote. evidence must be an EXACT substring of that page's quoted text \u2014
   copied verbatim, never paraphrased or invented \u2014 or null when no exact quote supports the answer.
+- categoryQueries: 5 searches a buyer types BEFORE they have heard of this company, chosen so that this
+  company could PLAUSIBLY RANK for them today \u2014 not ones it arguably deserves. A broad head term
+  ("branding agency Los Angeles") returns directories and listicles, which is where small firms are
+  aggregated rather than surfaced, so a query like that measures nothing about this company. Give a
+  spread: at most ONE head term, and at least THREE that are long-tail \u2014 a specific service, a
+  narrower niche or industry, a smaller locality, or a question phrased the way a buyer types it.
+  Prefer the specific over the impressive. Each one is sent verbatim to a live answer engine on its
+  own, with no other context, so it must stand alone: name the service and the place or the qualifier
+  a buyer would use ("trade show booth design for medical device companies", "how much does a rebrand
+  cost for a B2B company", "packaging design studio San Antonio").
+  Never refer to the company \u2014 not by name, and not as "this agency", "they", "them" or "you". A query
+  that names the company measures nothing (the engine just echoes the name back); a query that points
+  at it with a pronoun has no antecedent and the engine will answer that it does not know who is meant.
+  These are searches, not conversational questions, and they are not the buyerQuestions above.
 - fixes: prioritized, concrete, specific to this site. No generic SEO advice.
 - narrative: two or three plain sentences per report section, addressed to the business owner. No
   jargon, no hedging.`;
@@ -887,16 +928,19 @@ function verifyEvidence(result, crawl) {
     if (view) textByUrl.set(p.url, view.text);
   }
   const buyerQuestions = result.buyerQuestions.map((q) => {
-    if (q.page === null) {
-      return q.evidence === null ? q : { ...q, evidence: null };
-    }
-    if (!crawledUrls.has(q.page)) {
-      return { ...q, page: null, evidence: null };
-    }
-    if (q.evidence === null) return q;
-    const pageText = textByUrl.get(q.page) ?? "";
-    const verified = normalizeWhitespace(pageText).includes(normalizeWhitespace(q.evidence));
-    return verified ? q : { ...q, evidence: null };
+    const verified = (() => {
+      if (q.page === null) {
+        return q.evidence === null ? q : { ...q, evidence: null };
+      }
+      if (!crawledUrls.has(q.page)) {
+        return { ...q, page: null, evidence: null };
+      }
+      if (q.evidence === null) return q;
+      const pageText = textByUrl.get(q.page) ?? "";
+      const quoted = normalizeWhitespace(pageText).includes(normalizeWhitespace(q.evidence));
+      return quoted ? q : { ...q, evidence: null };
+    })();
+    return verified.evidence === null && verified.answered !== "no" ? { ...verified, answered: "no" } : verified;
   });
   return { ...result, buyerQuestions };
 }
@@ -907,8 +951,9 @@ async function analyzeSite(url, crawl, checks, deps = defaultAnalyzeDeps()) {
 }
 
 // src/prospect/probes.ts
-var MAX_QUERIES = 8;
+var MAX_QUERIES = 9;
 var SNIPPET_CHARS = 300;
+var PROBE_MODEL = "claude-sonnet-5";
 function domainOf(raw) {
   const withScheme = /^https?:\/\//i.test(raw) ? raw : `https://${raw}`;
   try {
@@ -921,11 +966,13 @@ function isSameSite(cited, prospect) {
   return cited === prospect || cited.endsWith(`.${prospect}`) || prospect.endsWith(`.${cited}`);
 }
 var MAX_NAME_CHARS = 60;
+var NAME_ABBREVIATIONS = /\b(st|mt|ft|dr|mr|mrs|ms|jr|sr|co|inc|ltd|llc|corp|assoc|bros|dept|ave|blvd|rd)\.\s/gi;
+var INITIALS = /\b[a-z]\.\s/gi;
 function resolveBusinessName(business, url) {
   const trimmed = business.trim();
-  if (!trimmed || trimmed.length > MAX_NAME_CHARS || /\.\s/.test(trimmed)) {
-    return domainOf(url);
-  }
+  if (!trimmed || trimmed.length > MAX_NAME_CHARS) return domainOf(url);
+  const withoutAbbreviations = trimmed.replace(NAME_ABBREVIATIONS, "").replace(INITIALS, "");
+  if (/\.\s/.test(withoutAbbreviations)) return domainOf(url);
   return trimmed;
 }
 function buildQueries(input) {
@@ -933,7 +980,11 @@ function buildQueries(input) {
   const candidates = [
     { query: `who is ${name}`, kind: "branded" },
     { query: `${name} reviews`, kind: "branded" },
-    ...input.buyerQuestions.slice(0, 3).map((query) => ({ query, kind: "category" })),
+    // All five, not three. The schema asks the model for up to five and we were
+    // paying to generate them, then discarding two — which also pinned the
+    // denominator at 3, making visibilityScore a four-valued {0,33,67,100}
+    // rendered on a 0-100 card. Five halves the step to 20 points.
+    ...input.categoryQueries.slice(0, 5).map((query) => ({ query, kind: "category" })),
     ...input.competitors.slice(0, 2).map((c) => ({ query: `${name} vs ${c}`, kind: "competitor" }))
   ];
   const seen = /* @__PURE__ */ new Set();
@@ -945,6 +996,110 @@ function buildQueries(input) {
   }
   return deduped.slice(0, MAX_QUERIES);
 }
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var LEGAL_SUFFIX = /\b(llc|inc|incorporated|ltd|limited|corp|corporation|plc|llp|lp|pllc|pc)\b/g;
+function normalizeForMatch(s) {
+  return s.toLowerCase().replace(/&/g, " and ").replace(/[‐-―]/g, " ").replace(/[^a-z0-9]+/g, " ").replace(LEGAL_SUFFIX, " ").replace(/\s+/g, " ").trim();
+}
+function mentionsBrand(answer, brand) {
+  const needle = normalizeForMatch(brand);
+  if (!needle) return false;
+  return new RegExp(`(^| )${escapeRegExp(needle)}( |$)`).test(normalizeForMatch(answer));
+}
+var CATEGORY_WORDS = /* @__PURE__ */ new Set([
+  // articles and joiners
+  "the",
+  "a",
+  "an",
+  "and",
+  "of",
+  "for",
+  "at",
+  "by",
+  // company words
+  "co",
+  "company",
+  "group",
+  "collective",
+  "partners",
+  "associates",
+  "works",
+  "lab",
+  "labs",
+  "studio",
+  "studios",
+  "agency",
+  "agencies",
+  "firm",
+  "practice",
+  "shop",
+  "house",
+  "office",
+  // sector words
+  "design",
+  "designs",
+  "creative",
+  "creatives",
+  "brand",
+  "branding",
+  "marketing",
+  "media",
+  "digital",
+  "solutions",
+  "services",
+  "consulting",
+  "consultants",
+  "advisors",
+  "strategy",
+  "dental",
+  "dentistry",
+  "orthodontics",
+  "law",
+  "legal",
+  "clinic",
+  "care",
+  "health",
+  "medical",
+  "roofing",
+  "construction",
+  "builders",
+  "contracting",
+  "plumbing",
+  "electric",
+  "landscaping",
+  "interiors",
+  "architects",
+  "photography",
+  "films",
+  "productions",
+  "printing",
+  "packaging",
+  // adjectives that market rather than identify
+  "modern",
+  "premier",
+  "elite",
+  "first",
+  "best",
+  "local",
+  "family",
+  "advanced",
+  "complete",
+  "quality",
+  "professional",
+  "trusted",
+  "expert",
+  "affordable",
+  "custom",
+  "creative"
+]);
+function isDistinctiveName(brand) {
+  if (brand.includes(".")) return true;
+  const tokens = normalizeForMatch(brand).split(" ").filter(Boolean);
+  if (tokens.length < 2) return false;
+  return tokens.some((t) => !CATEGORY_WORDS.has(t));
+}
 function isRateLimited(err) {
   const message = err instanceof Error ? err.message : String(err);
   return /429|529/.test(message);
@@ -957,6 +1112,7 @@ async function runVisibilityProbes(input, engines, opts = {}) {
   const queries = buildQueries(input);
   const prospect = domainOf(input.url);
   const brand = resolveBusinessName(input.business, input.url).toLowerCase();
+  const nameIsDistinctive = isDistinctiveName(brand);
   const answers = [];
   const competitorCounts = /* @__PURE__ */ new Map();
   for (const engine of engines) {
@@ -978,7 +1134,7 @@ async function runVisibilityProbes(input, engines, opts = {}) {
         }
         const citedDomains = reply.citedDomains.map(domainOf);
         const domainCited = citedDomains.some((d) => isSameSite(d, prospect));
-        const brandMentioned = brand.length > 0 && reply.answer.toLowerCase().includes(brand);
+        const brandMentioned = mentionsBrand(reply.answer.toLowerCase(), brand);
         for (const d of citedDomains) {
           if (isSameSite(d, prospect)) continue;
           competitorCounts.set(d, (competitorCounts.get(d) ?? 0) + 1);
@@ -989,6 +1145,8 @@ async function runVisibilityProbes(input, engines, opts = {}) {
           kind,
           domainCited,
           brandMentioned,
+          // The same expression the score uses below — written once, read twice.
+          countedAsVisible: domainCited || brandMentioned && nameIsDistinctive,
           citedDomains,
           snippet: reply.answer.slice(0, SNIPPET_CHARS),
           truncated: reply.answer.length > SNIPPET_CHARS,
@@ -1002,7 +1160,7 @@ async function runVisibilityProbes(input, engines, opts = {}) {
     throw new Error("no visibility engine returned an answer");
   }
   const categoryAnswers = answers.filter((a) => a.kind === "category");
-  const visibleCategory = categoryAnswers.filter((a) => a.domainCited || a.brandMentioned).length;
+  const visibleCategory = categoryAnswers.filter((a) => a.countedAsVisible).length;
   const visibilityScore = categoryAnswers.length === 0 ? null : Math.round(visibleCategory / categoryAnswers.length * 100);
   const brandedRecognized = answers.some((a) => a.kind === "branded" && a.domainCited);
   return {
@@ -1050,7 +1208,7 @@ function claudeWebSearchEngine(createMessage) {
       const collected = [];
       for (let turn = 0; turn < MAX_CLAUDE_TURNS; turn++) {
         const res = await create({
-          model: "claude-opus-5",
+          model: PROBE_MODEL,
           max_tokens: 4e3,
           tools: [{ type: "web_search_20260209", name: "web_search", max_uses: 4 }],
           messages
@@ -1175,7 +1333,7 @@ async function runProspectAudit(url, opts, deps = {}) {
         {
           url,
           business: businessName ?? "",
-          buyerQuestions: analyze.ok ? analyze.data.buyerQuestions.map((q) => q.question) : [],
+          categoryQueries: analyze.ok ? analyze.data.categoryQueries : [],
           competitors: opts.competitors ?? []
         },
         deps.engines ?? defaultEngines(),
@@ -1202,8 +1360,9 @@ async function runProspectAudit(url, opts, deps = {}) {
 }
 
 export {
+  resolveBusinessName,
   PROBES_SKIPPED,
   ANALYZE_SKIPPED,
   runProspectAudit
 };
-//# sourceMappingURL=chunk-X3B723J4.js.map
+//# sourceMappingURL=chunk-7TMWBXX7.js.map