domma-cms 0.88.0 → 0.89.0

package/plugins/seo/admin/lib/analyse.js

@@ -0,0 +1,286 @@
+/**
+ * SEO - reading a rendered page and judging it. Pure: no DOM, no network, so
+ * the server's audit, the admin screen and the tests share it.
+ *
+ *   scanHtml(html)            -> facts (title, description, headings, images, links, words...)
+ *   analyse(facts, opts)      -> {score, checks: [{id, group, status, title, detail, fix}]}
+ *   siteIssues(results)       -> duplicates across pages (titles, descriptions)
+ *   snippet({title, ...})     -> what a search result would show, cut where Google cuts
+ *
+ * A status is 'pass' | 'warn' | 'fail' | 'info'. The score counts a pass as
+ * 1, a warn as 0.5, a fail as 0, and leaves 'info' out - as Security does.
+ *
+ * @module seo/admin/lib/analyse
+ */
+
+export const LIMITS = {titleMin: 30, titleMax: 60, descMin: 70, descMax: 160, minWords: 300};
+
+const ENTITIES = {amp: '&', lt: '<', gt: '>', quot: '"', apos: "'", nbsp: ' ', ndash: '–', mdash: '—', hellip: '…',
+    lsquo: '‘', rsquo: '’', ldquo: '“', rdquo: '”', pound: '£', euro: '€', copy: '©'};
+
+/** Undo HTML entities in text. */
+export function decode(s) {
+    return String(s ?? '').replace(/&(#x[0-9a-f]+|#\d+|[a-z]+);/gi, (m, e) => {
+        if (e[0] === '#') {
+            const n = e[1] === 'x' || e[1] === 'X' ? parseInt(e.slice(2), 16) : parseInt(e.slice(1), 10);
+            return Number.isFinite(n) && n > 0 && n < 0x110000 ? String.fromCodePoint(n) : m;
+        }
+        return ENTITIES[e.toLowerCase()] ?? m;
+    });
+}
+
+const squash = (s) => decode(String(s ?? '').replace(/<[^>]*>/g, ' ')).replace(/\s+/g, ' ').trim();
+
+/** The attributes of one start tag: `<meta name="x" content='y' async>` -> {name, content, async: ''}. */
+export function attrs(tag) {
+    const out = {};
+    const body = String(tag).replace(/^<\s*[a-z0-9-]+/i, '').replace(/\/?>$/, '');
+    const re = /([^\s"'=<>`/]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g;
+    let m;
+    while ((m = re.exec(body))) out[m[1].toLowerCase()] = decode(m[2] ?? m[3] ?? m[4] ?? '');
+    return out;
+}
+
+/**
+ * The facts of one page, from its HTML. Scripts, styles, templates and
+ * comments are removed first, so nothing inside them counts.
+ *
+ * @param {string} html
+ * @returns {object}
+ */
+export function scanHtml(html) {
+    const src = String(html ?? '');
+    const headEnd = src.search(/<\/head\s*>/i);
+    const head = headEnd >= 0 ? src.slice(0, headEnd) : src;
+
+    const jsonLdTypes = [];
+    for (const m of src.matchAll(/<script\b[^>]*type\s*=\s*["']?application\/ld\+json["']?[^>]*>([\s\S]*?)<\/script>/gi)) {
+        try {
+            const j = JSON.parse(m[1]);
+            for (const x of [j, ...(Array.isArray(j) ? j : []), ...(Array.isArray(j?.['@graph']) ? j['@graph'] : [])]) {
+                const t = x?.['@type'];
+                if (t) jsonLdTypes.push(...(Array.isArray(t) ? t : [t]).map(String));
+            }
+        } catch { jsonLdTypes.push('(invalid)'); }
+    }
+
+    const clean = src
+        .replace(/<!--[\s\S]*?-->/g, ' ')
+        .replace(/<(script|style|template|noscript|svg)\b[\s\S]*?<\/\1\s*>/gi, ' ');
+
+    const metas = [...head.matchAll(/<meta\b[^>]*>/gi)].map(m => attrs(m[0]));
+    const meta = (key, val) => metas.find(a => (a[key] || '').toLowerCase() === val)?.content;
+    const links = [...head.matchAll(/<link\b[^>]*>/gi)].map(m => attrs(m[0]));
+
+    const bodyStart = clean.search(/<body\b/i);
+    const body = bodyStart >= 0 ? clean.slice(bodyStart) : clean;
+
+    const headings = [...body.matchAll(/<h([1-6])\b[^>]*>([\s\S]*?)<\/h\1\s*>/gi)].map(m => ({level: Number(m[1]), text: squash(m[2])}));
+    const images = [...body.matchAll(/<img\b[^>]*>/gi)].map(m => {
+        const a = attrs(m[0]);
+        return {src: a.src || a['data-src'] || '', alt: 'alt' in a ? a.alt : null, role: a.role || ''};
+    });
+    const anchors = [...body.matchAll(/<a\b([^>]*)>([\s\S]*?)<\/a\s*>/gi)].map(m => {
+        const a = attrs(`<a ${m[1]}>`);
+        return {href: a.href || '', text: squash(m[2]), rel: a.rel || '', title: a.title || ''};
+    });
+    const text = squash(body);
+    const firstPara = squash(body.match(/<p\b[^>]*>([\s\S]*?)<\/p\s*>/i)?.[1] || '');
+
+    return {
+        title: squash(head.match(/<title\b[^>]*>([\s\S]*?)<\/title\s*>/i)?.[1] || ''),
+        description: meta('name', 'description') ?? null,
+        robots: meta('name', 'robots') || '',
+        viewport: Boolean(meta('name', 'viewport')),
+        canonical: links.find(l => (l.rel || '').toLowerCase() === 'canonical')?.href || '',
+        lang: attrs(src.match(/<html\b[^>]*>/i)?.[0] || '<html>').lang || '',
+        og: {
+            title: meta('property', 'og:title') || '',
+            description: meta('property', 'og:description') || '',
+            image: meta('property', 'og:image') || '',
+            type: meta('property', 'og:type') || ''
+        },
+        twitter: {card: meta('name', 'twitter:card') || '', image: meta('name', 'twitter:image') || ''},
+        headings,
+        images,
+        links: anchors,
+        words: text ? text.split(/\s+/).filter(w => /[\p{L}\p{N}]/u.test(w)).length : 0,
+        text: text.slice(0, 20000),
+        firstPara: firstPara.slice(0, 1000),
+        jsonLdTypes: [...new Set(jsonLdTypes)]
+    };
+}
+
+const plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+const has = (hay, needle) => Boolean(needle) && String(hay || '').toLowerCase().includes(needle);
+const slugWords = (s) => String(s || '').toLowerCase().normalize('NFKD').replace(/[̀-ͯ]/g, '').replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '');
+
+/**
+ * Judge one page.
+ *
+ * @param {object} f - scanHtml() facts
+ * @param {object} [opts]
+ * @param {string} [opts.urlPath]
+ * @param {string} [opts.focus] - the focus keyphrase, if one is set
+ * @param {object} [opts.limits] - LIMITS overrides
+ * @param {string} [opts.origin] - the site's own origin, to tell internal links
+ * @returns {{score: number, failing: number, checks: object[]}}
+ */
+export function analyse(f, {urlPath = '/', focus = '', limits = {}, origin = ''} = {}) {
+    const L = {...LIMITS, ...limits};
+    const checks = [];
+    const add = (id, group, status, title, detail, fix = '') => checks.push({id, group, status, title, detail, fix});
+    const noindex = /noindex/i.test(f.robots);
+
+    // --- Search result ---
+    const tl = f.title.length;
+    if (!tl) add('title', 'Search result', 'fail', 'Title', 'The page has no title.', 'Give it one: it is the blue link people click in the results.');
+    else if (tl < L.titleMin) add('title', 'Search result', 'warn', 'Title', `${tl} characters - short. Search engines may write their own.`, `Aim for ${L.titleMin}-${L.titleMax} characters that say what the page is about.`);
+    else if (tl > L.titleMax) add('title', 'Search result', 'warn', 'Title', `${tl} characters - it will be cut off after about ${L.titleMax}.`, 'Put the words that matter first, or shorten it.');
+    else add('title', 'Search result', 'pass', 'Title', `${tl} characters.`);
+
+    const d = f.description;
+    const dl = (d || '').length;
+    if (!dl) add('description', 'Search result', 'fail', 'Description', 'No description: search engines pick any sentence from the page.', 'Write one or two sentences that make someone want to click.');
+    else if (dl < L.descMin) add('description', 'Search result', 'warn', 'Description', `${dl} characters - short.`, `Aim for ${L.descMin}-${L.descMax} characters.`);
+    else if (dl > L.descMax) add('description', 'Search result', 'warn', 'Description', `${dl} characters - it will be cut off after about ${L.descMax}.`, 'Shorten it, keeping the point in the first half.');
+    else add('description', 'Search result', 'pass', 'Description', `${dl} characters.`);
+
+    const slug = urlPath.split('/').filter(Boolean).pop() || '';
+    if (urlPath !== '/' && (slug.length > 60 || /[A-Z_ %]/.test(slug) || /\d{5,}/.test(slug))) {
+        add('url', 'Search result', 'warn', 'Address', `"${slug}" is long or hard to read.`, 'Short, lower-case words joined by hyphens read best - rename the page (a redirect is added for you).');
+    } else {
+        add('url', 'Search result', 'pass', 'Address', urlPath === '/' ? 'The home page.' : `"${slug}" reads well.`);
+    }
+
+    // --- Content ---
+    const h1s = f.headings.filter(h => h.level === 1);
+    if (!h1s.length) add('h1', 'Content', 'fail', 'Main heading', 'There is no H1 heading.', 'Start the page with one main heading (# in Markdown) saying what it is about.');
+    else if (h1s.length > 1) add('h1', 'Content', 'warn', 'Main heading', `${h1s.length} H1 headings: "${h1s.slice(0, 3).map(h => h.text).join('", "')}".`, 'Keep one H1; make the others H2.');
+    else if (!h1s[0].text) add('h1', 'Content', 'warn', 'Main heading', 'The H1 heading is empty.', 'Give it words.');
+    else add('h1', 'Content', 'pass', 'Main heading', `"${h1s[0].text.slice(0, 80)}".`);
+
+    const skips = [];
+    for (let i = 1; i < f.headings.length; i++) {
+        if (f.headings[i].level > f.headings[i - 1].level + 1) skips.push(`H${f.headings[i - 1].level} → H${f.headings[i].level}`);
+    }
+    if (skips.length) add('headings', 'Content', 'warn', 'Heading order', `Levels are skipped: ${[...new Set(skips)].slice(0, 3).join(', ')}.`, 'Go down one level at a time (H2, then H3) - screen readers and search engines read them as an outline.');
+    else if (f.headings.length > 1) add('headings', 'Content', 'pass', 'Heading order', `${plural(f.headings.length, 'heading')}, in order.`);
+
+    if (f.words < Math.round(L.minWords / 3)) add('words', 'Content', 'warn', 'Length', `${plural(f.words, 'word')}. Very little for a search engine to go on.`, `Pages that rank usually have ${L.minWords}+ words - unless the page is a form or a contact page.`);
+    else if (f.words < L.minWords) add('words', 'Content', 'info', 'Length', `${plural(f.words, 'word')}.`, `Pages that rank usually have ${L.minWords}+ words.`);
+    else add('words', 'Content', 'pass', 'Length', `${f.words.toLocaleString('en-GB')} words.`);
+
+    const content = f.images.filter(i => i.role !== 'presentation');
+    const noAlt = content.filter(i => i.alt === null);
+    if (noAlt.length) add('alt', 'Content', 'fail', 'Image descriptions', `${plural(noAlt.length, 'image')} of ${content.length} ${noAlt.length === 1 ? 'has' : 'have'} no alt text.`, 'Describe each image in a few words (empty alt="" only for decoration). It is how search and screen readers see them.');
+    else if (content.length) add('alt', 'Content', 'pass', 'Image descriptions', `All ${plural(content.length, 'image')} described.`);
+
+    const internal = f.links.filter(l => isInternal(l.href, origin));
+    if (!internal.length && f.links.length < 50) add('links', 'Content', 'warn', 'Links to your other pages', 'None in the page itself.', 'Link to related pages: it helps visitors, and search engines find pages through links.');
+    else add('links', 'Content', 'pass', 'Links to your other pages', `${plural(internal.length, 'link')}.`);
+
+    // --- Focus keyphrase ---
+    const k = String(focus || '').trim().toLowerCase();
+    if (k) {
+        const where = [
+            ['title', has(f.title, k)],
+            ['description', has(d, k)],
+            ['main heading', h1s.some(h => has(h.text, k))],
+            ['address', slugWords(urlPath).includes(slugWords(k))],
+            ['first paragraph', has(f.firstPara, k)]
+        ];
+        const missing = where.filter(([, ok]) => !ok).map(([w]) => w);
+        const count = countPhrase(f.text, k);
+        const density = f.words ? (count * k.split(/\s+/).length * 100) / f.words : 0;
+        if (missing.length >= 3) add('focus', 'Keyphrase', 'fail', `"${focus}"`, `Missing from the ${missing.join(', ')}.`, 'Use the phrase people search for where they look first: the title, the heading and the opening.');
+        else if (missing.length) add('focus', 'Keyphrase', 'warn', `"${focus}"`, `Missing from the ${missing.join(', ')}.`, 'Work it in naturally - never at the cost of reading well.');
+        else add('focus', 'Keyphrase', 'pass', `"${focus}"`, 'In the title, description, heading, address and opening.');
+        if (f.words < 100) { /* too short for a share of the words to mean anything */ }
+        else if (density > 3) add('density', 'Keyphrase', 'warn', 'Repetition', `The phrase is ${density.toFixed(1)}% of the words (${plural(count, 'time')}).`, 'Over about 3% reads as stuffing - use other words for the same thing.');
+        else if (count) add('density', 'Keyphrase', 'pass', 'Repetition', `Used ${plural(count, 'time')} (${density.toFixed(1)}%).`);
+    } else {
+        add('focus', 'Keyphrase', 'info', 'Focus keyphrase', 'None set.', 'Say which search this page should be found for, and the checks will look for it.');
+    }
+
+    // --- Sharing and technical ---
+    if (noindex) add('index', 'Technical', 'info', 'Search engines', 'Hidden from search engines (noindex).', 'On purpose for thank-you pages and the like; otherwise switch it off.');
+    else add('index', 'Technical', 'pass', 'Search engines', 'May be indexed.');
+    if (!f.canonical) add('canonical', 'Technical', 'warn', 'Canonical address', 'No canonical link.', 'Set the site address in Settings so every page names its one true address.');
+    else if (!f.canonical.replace(/\/$/, '').endsWith(urlPath === '/' ? '' : urlPath)) add('canonical', 'Technical', 'info', 'Canonical address', `Points elsewhere: ${f.canonical}.`, 'Right when this page is a copy of that one; otherwise it hides this page.');
+    else add('canonical', 'Technical', 'pass', 'Canonical address', f.canonical);
+    if (!f.og.image) add('share-image', 'Sharing', 'warn', 'Share image', 'No image when the page is shared.', 'Choose an image (1200 × 630 is ideal), or set a default one for the site.');
+    else add('share-image', 'Sharing', 'pass', 'Share image', f.og.image);
+    if (f.jsonLdTypes.includes('(invalid)')) add('schema', 'Technical', 'fail', 'Structured data', 'A JSON-LD block is not valid JSON.', 'Fix or remove it - search engines ignore the lot.');
+    else if (f.jsonLdTypes.length) add('schema', 'Technical', 'pass', 'Structured data', f.jsonLdTypes.join(', '));
+    else add('schema', 'Technical', 'info', 'Structured data', 'None.', 'Structured data lets search engines show rich results.');
+    if (!f.lang) add('lang', 'Technical', 'warn', 'Language', 'The page does not say what language it is in.', 'The site template sets <html lang="…">.');
+
+    return {...score(checks), checks};
+}
+
+function isInternal(href, origin) {
+    const h = String(href || '').trim();
+    if (!h || h.startsWith('#') || /^(mailto|tel|javascript|data):/i.test(h)) return false;
+    if (h.startsWith('/') && !h.startsWith('//')) return true;
+    if (!origin) return false;
+    try { return new URL(h).origin === new URL(origin).origin; } catch { return false; }
+}
+
+function countPhrase(text, phrase) {
+    if (!phrase) return 0;
+    const esc = phrase.replace(/[.*+?^${}()|[\]\\]/g, '\\$&').replace(/\s+/g, '\\s+');
+    return (String(text).match(new RegExp(`(^|[^\\p{L}\\p{N}])${esc}(?=$|[^\\p{L}\\p{N}])`, 'giu')) || []).length;
+}
+
+/** Score and failing count of a list of checks. */
+export function score(checks) {
+    const counted = checks.filter(c => c.status !== 'info');
+    const got = counted.reduce((n, c) => n + (c.status === 'pass' ? 1 : c.status === 'warn' ? 0.5 : 0), 0);
+    return {
+        score: counted.length ? Math.round((got / counted.length) * 100) : 100,
+        failing: checks.filter(c => c.status === 'fail').length,
+        warnings: checks.filter(c => c.status === 'warn').length
+    };
+}
+
+/**
+ * Problems only visible across pages: the same title or description on more
+ * than one. `results` are audit rows `{urlPath, title, description, noindex}`.
+ *
+ * @returns {{duplicateTitles: Array<{text, paths}>, duplicateDescriptions: Array<{text, paths}>}}
+ */
+export function siteIssues(results) {
+    const dupes = (key) => {
+        const by = new Map();
+        for (const r of results) {
+            const v = String(r[key] || '').trim().toLowerCase();
+            if (!v || r.noindex || r.error) continue;
+            if (!by.has(v)) by.set(v, {text: r[key], paths: []});
+            by.get(v).paths.push(r.urlPath);
+        }
+        return [...by.values()].filter(x => x.paths.length > 1).sort((a, b) => b.paths.length - a.paths.length);
+    };
+    return {duplicateTitles: dupes('title'), duplicateDescriptions: dupes('description')};
+}
+
+/**
+ * A search result as Google would show it, cut where it cuts (roughly: it
+ * measures pixels; characters are close enough to show the problem).
+ */
+export function snippet({title = '', description = '', url = '', limits = {}} = {}) {
+    const L = {...LIMITS, ...limits};
+    const cut = (s, n) => (s.length > n ? `${s.slice(0, n - 1).replace(/\s+\S*$/, '')} …` : s);
+    let crumbs = url;
+    try {
+        const u = new URL(url);
+        crumbs = [u.hostname, ...u.pathname.split('/').filter(Boolean)].join(' › ');
+    } catch { /* a path */ }
+    return {
+        title: cut(String(title), L.titleMax),
+        description: cut(String(description), L.descMax),
+        crumbs,
+        titleCut: String(title).length > L.titleMax,
+        descriptionCut: String(description).length > L.descMax
+    };
+}

package/plugins/seo/admin/lib/redirects.js

@@ -0,0 +1,163 @@
+/**
+ * SEO - redirects, pure. Used by the server (matching every request) and the
+ * admin screen (checking a rule before it is sent).
+ *
+ * A rule: {id, from, to, code: 301|302|307|308|410, hits, lastHit, note, auto, at}
+ *   - `from` is a path: "/old-page", or a prefix ending in "/*": "/news/*".
+ *   - `to` is a path or a full http(s) URL; a "*" in it takes what the prefix
+ *     matched. 410 ("gone") has no `to`.
+ * Paths compare without a trailing slash and without case, and the query string
+ * travels with the visitor unless `to` has one of its own.
+ *
+ * @module seo/admin/lib/redirects
+ */
+
+export const CODES = [301, 302, 307, 308, 410];
+export const MAX_RULES = 5000;
+
+/** "/About/" -> "/about"; "" -> ""; keeps "/" as "/". */
+export function normalisePath(p) {
+    let s = String(p ?? '').trim();
+    if (!s) return '';
+    try { s = decodeURI(s); } catch { /* keep as typed */ }
+    s = s.split('#')[0].split('?')[0];
+    if (!s.startsWith('/')) s = `/${s}`;
+    s = s.replace(/\/{2,}/g, '/');
+    if (s.length > 1) s = s.replace(/\/+$/, '');
+    return s.toLowerCase();
+}
+
+const isWildcard = (from) => String(from).endsWith('/*');
+const isAbsolute = (to) => /^https?:\/\//i.test(String(to));
+
+/**
+ * Check one rule. `others` are the rules already there (minus this one, when
+ * editing), for duplicates and loops.
+ *
+ * @returns {{errors: Record<string, string>, rule: object}}
+ */
+export function checkRule(input = {}, others = []) {
+    const errors = {};
+    const code = Number(input.code ?? 301);
+    const fromRaw = String(input.from ?? '').trim();
+    const wildcard = isWildcard(fromRaw);
+    const from = wildcard ? `${normalisePath(fromRaw.slice(0, -2)) === '/' ? '' : normalisePath(fromRaw.slice(0, -2))}/*` : normalisePath(fromRaw);
+    let to = String(input.to ?? '').trim();
+
+    if (!CODES.includes(code)) errors.code = 'Choose 301, 302, 307, 308 or 410.';
+    if (!fromRaw) errors.from = 'Say which address to redirect.';
+    else if (/^https?:\/\//i.test(fromRaw)) errors.from = 'The address to redirect is a path on this site, like /old-page.';
+    else if (/^\/(admin|api)(\/|$)/.test(from)) errors.from = 'The admin and the API cannot be redirected.';
+    else if (from === '/*') errors.from = 'That would redirect the whole site.';
+
+    if (code === 410) {
+        to = '';
+    } else if (!to) {
+        errors.to = 'Say where it goes.';
+    } else if (isAbsolute(to)) {
+        try { new URL(to.replace('*', 'x')); } catch { errors.to = 'Not a web address.'; }
+    } else if (/^[a-z][a-z0-9+.-]*:/i.test(to) || to.startsWith('//')) {
+        errors.to = 'A path on this site (/new-page) or an http(s) address.';
+    } else {
+        const [p, q] = to.split('?');
+        to = normalisePath(p) + (q ? `?${q}` : '');
+        if (to.includes('*') && !wildcard) errors.to = 'A "*" in the target needs a "/*" rule to fill it.';
+    }
+
+    if (!errors.from && !errors.to && code !== 410 && !isAbsolute(to)) {
+        const target = normalisePath(to.split('?')[0]);
+        if (!wildcard && target === from) errors.to = 'It would redirect to itself.';
+        else if (!wildcard && loopsBack(from, target, others)) errors.to = 'That makes a loop with another redirect.';
+    }
+    if (!errors.from && others.some(r => r.from === from)) errors.from = `There is already a redirect from ${from}.`;
+
+    return {
+        errors,
+        rule: {
+            from,
+            to,
+            code,
+            note: String(input.note ?? '').trim().slice(0, 200),
+            ...(input.auto === true && {auto: true})
+        }
+    };
+}
+
+/** Would following `target` through `rules` come back to `from`? */
+function loopsBack(from, target, rules) {
+    const seen = new Set([from]);
+    let at = target;
+    for (let i = 0; i < 20; i++) {
+        if (seen.has(at)) return true;
+        seen.add(at);
+        const next = matchRedirect(rules, at);
+        if (!next || !next.location || isAbsolute(next.location)) return false;
+        at = normalisePath(next.location.split('?')[0]);
+    }
+    return true;
+}
+
+/**
+ * The rule for a request path, exact rules before prefixes (the longest
+ * prefix wins). Returns null when none applies.
+ *
+ * @param {object[]} rules
+ * @param {string} rawPath - the request path, query included or not
+ * @returns {{rule: object, location: string, code: number}|null}
+ */
+export function matchRedirect(rules, rawPath) {
+    const [pathPart, query] = String(rawPath ?? '').split('?');
+    const p = normalisePath(pathPart);
+    if (!p) return null;
+    let hit = null;
+    let rest = '';
+    for (const r of rules) {
+        if (r.from === p) { hit = r; rest = ''; break; }
+    }
+    if (!hit) {
+        let best = -1;
+        for (const r of rules) {
+            if (!isWildcard(r.from)) continue;
+            const prefix = r.from.slice(0, -2);
+            if ((p === prefix || p.startsWith(`${prefix}/`)) && prefix.length > best) {
+                best = prefix.length;
+                hit = r;
+                rest = p.slice(prefix.length + 1);
+            }
+        }
+    }
+    if (!hit) return null;
+    if (hit.code === 410) return {rule: hit, location: '', code: 410};
+    let location = hit.to.includes('*') ? hit.to.replace('*', rest) : hit.to;
+    if (!isAbsolute(location)) location = location.replace(/\/{2,}/g, '/').replace(/(.)\/$/, '$1');
+    if (query && !location.includes('?')) location += `?${query}`;
+    return {rule: hit, location, code: hit.code};
+}
+
+/**
+ * A page moved from `from` to `to`: the redirect to add, and every existing
+ * rule that pointed at `from` re-aimed at `to` (no chains). A rule FROM the
+ * new address is removed - the page lives there now. Pure: returns a new list.
+ */
+export function onMoved(rules, from, to, {now = new Date().toISOString(), id} = {}) {
+    const f = normalisePath(from);
+    const t = normalisePath(to);
+    if (!f || !t || f === t) return rules;
+    const out = rules
+        .filter(r => r.from !== t)
+        .map(r => (normalisePath(String(r.to).split('?')[0]) === f && !isAbsolute(r.to) ? {...r, to: t} : r));
+    const existing = out.find(r => r.from === f);
+    if (existing) return out.map(r => (r === existing ? {...r, to: t, code: 301} : r));
+    return [...out, {id: id || `r${Date.now().toString(36)}`, from: f, to: t, code: 301, note: 'The page moved', auto: true, hits: 0, lastHit: null, at: now}];
+}
+
+/** Redirects that lead to another redirect (A -> B -> C): [{rule, via}]. */
+export function chains(rules) {
+    const out = [];
+    for (const r of rules) {
+        if (r.code === 410 || isAbsolute(r.to) || isWildcard(r.from)) continue;
+        const next = matchRedirect(rules, r.to);
+        if (next && next.rule !== r) out.push({rule: r, via: next.rule});
+    }
+    return out;
+}

package/plugins/seo/admin/lib/schema.js

@@ -0,0 +1,113 @@
+/**
+ * SEO - structured data (JSON-LD) and the 'seo:meta' changes this plugin
+ * makes, pure: the server's transform calls applySeo() on every render.
+ *
+ * @module seo/admin/lib/schema
+ */
+
+const abs = (u, origin) => {
+    const s = String(u || '').trim();
+    if (!s || /^https?:\/\//i.test(s) || !origin) return s;
+    return `${origin}${s.startsWith('/') ? '' : '/'}${s}`;
+};
+
+/** Organization / LocalBusiness / Person for the home page, or null when off or unnamed. */
+export function organisationLd(org, {origin = '', siteTitle = ''} = {}) {
+    if (!org?.enabled) return null;
+    const name = org.name || siteTitle;
+    if (!name) return null;
+    const ld = {'@context': 'https://schema.org', '@type': org.type || 'Organization', name};
+    const url = org.url || origin;
+    if (url) ld.url = abs(url, origin);
+    if (org.logo) ld[org.type === 'Person' ? 'image' : 'logo'] = abs(org.logo, origin);
+    if (org.email) ld.email = org.email;
+    if (org.phone) ld.telephone = org.phone;
+    if (org.sameAs?.length) ld.sameAs = org.sameAs;
+    const a = org.address || {};
+    if (org.type !== 'Person' && (a.street || a.locality || a.postcode)) {
+        ld.address = {'@type': 'PostalAddress',
+            ...(a.street && {streetAddress: a.street}), ...(a.locality && {addressLocality: a.locality}),
+            ...(a.region && {addressRegion: a.region}), ...(a.postcode && {postalCode: a.postcode}),
+            ...(a.country && {addressCountry: a.country})};
+    }
+    return ld;
+}
+
+/** BlogPosting for a blog post (the render says `item.type === 'blog:post'`). */
+export function articleLd(meta, {origin = '', publisher = ''} = {}) {
+    const ld = {'@context': 'https://schema.org', '@type': 'BlogPosting', headline: String(meta.title || '').slice(0, 110)};
+    if (meta.description) ld.description = meta.description;
+    if (meta.image) ld.image = abs(meta.image, origin);
+    if (meta.canonical) {
+        ld.url = meta.canonical;
+        ld.mainEntityOfPage = meta.canonical;
+    }
+    if (publisher) ld.publisher = {'@type': 'Organization', name: publisher};
+    return ld;
+}
+
+/**
+ * The 'seo:meta' transform's work, on a copy of core's model.
+ *
+ * @param {object} meta - core's model (renderer.js buildSeoMeta)
+ * @param {object} ctx
+ * @param {object} ctx.page - {urlPath, item?}
+ * @param {'page'|'plugin'} ctx.kind
+ * @param {string} ctx.origin - the request's origin, no trailing slash
+ * @param {string} ctx.siteTitle
+ * @param {object} ctx.settings - SEO settings (mergeDefaults)
+ * @param {object|null} ctx.override - this URL's overrides {title, description, image, noindex}
+ * @returns {object}
+ */
+export function applySeo(meta, {page, kind, origin = '', siteTitle = '', settings, override = null}) {
+    const out = {...meta, jsonLd: [...(meta.jsonLd || [])], extra: [...(meta.extra || [])]};
+
+    // A URL's own overrides - for plugin pages (a blog post, a listing) whose
+    // fields this plugin cannot edit in place. Core pages are edited in place.
+    if (override) {
+        if (override.title) out.title = override.title;
+        if (override.description) out.description = override.description;
+        if (override.image) out.image = abs(override.image, origin);
+        if (override.noindex === true) out.noindex = true;
+        const webPage = out.jsonLd.find(x => x?.['@type'] === 'WebPage');
+        if (webPage) {
+            const i = out.jsonLd.indexOf(webPage);
+            out.jsonLd[i] = {...webPage, ...(override.description && {description: override.description}), ...(out.image && {image: out.image})};
+        }
+    }
+
+    const urlPath = page?.urlPath || '/';
+    if (urlPath === '/') {
+        const org = organisationLd(settings?.organisation, {origin, siteTitle});
+        if (org) out.jsonLd.push(org);
+    }
+    if (settings?.articles !== false && kind === 'plugin' && page?.item?.type === 'blog:post') {
+        out.ogType = 'article';
+        out.jsonLd.push(articleLd(out, {origin, publisher: settings?.organisation?.enabled ? settings.organisation.name : siteTitle}));
+    }
+    return out;
+}
+
+/**
+ * robots.txt lines, the settings applied: everything blocked (a site not yet
+ * live), or extra lines added before the Sitemap line.
+ */
+export function robotsLines(lines, {blockAll = false, extra = ''} = {}, sitemapUrl = '/sitemap.xml') {
+    if (blockAll) return ['# This site asks search engines to stay away (SEO settings).', 'User-agent: *', 'Disallow: /'];
+    const add = String(extra || '').split('\n').map(l => l.trimEnd()).filter((l, i, a) => l || (i > 0 && a[i - 1]));
+    if (!add.length) return lines;
+    let out;
+    if (add.some(l => /^user-agent\s*:/i.test(l))) {
+        // Groups of their own: after core's group, before the Sitemap line.
+        const at = lines.findIndex(l => /^sitemap:/i.test(l));
+        out = at >= 0 ? [...lines.slice(0, at), ...add, '', ...lines.slice(at)] : [...lines, '', ...add];
+    } else {
+        // Plain rules belong to the "User-agent: *" group: in it, before the blank line that ends it.
+        const ua = lines.findIndex(l => /^user-agent\s*:\s*\*/i.test(l));
+        const end = ua >= 0 ? lines.findIndex((l, i) => i > ua && !l.trim()) : -1;
+        const at = end >= 0 ? end : (ua >= 0 ? lines.length : -1);
+        out = at >= 0 ? [...lines.slice(0, at), ...add.filter(Boolean), ...lines.slice(at)] : ['User-agent: *', ...add.filter(Boolean), '', ...lines];
+    }
+    if (!out.some(l => /^sitemap:/i.test(l))) out.push('', `Sitemap: ${sitemapUrl}`);
+    return out;
+}