domma-cms 0.89.1 → 0.90.1

package/server/routes/api/seo.js

@@ -0,0 +1,201 @@
+/**
+ * SEO - the API (mounted at /api/seo behind toolGate('seo'); the `seo`
+ * permission: read / manage). The engine is services/seo/index.js.
+ *
+ *   GET /overview · GET /count · GET /audit · POST /audit · GET|PUT /item
+ *   GET|POST /redirects · PUT|DELETE /redirects/:id · POST /redirects/import
+ *   GET /redirects/test · GET /sitemap · GET|PUT /settings · GET /extensions
+ *
+ * Was /api/plugins/seo while SEO was a plugin (0.89.0).
+ */
+import {authenticate as defaultAuthenticate, requirePermission as defaultRequirePermission} from '../../middleware/auth.js';
+import {getConfig} from '../../config.js';
+import {getPage, updatePage} from '../../services/content.js';
+import {getSitemapSources} from '../../services/hooks.js';
+import {seoEngine} from '../../services/seo/index.js';
+import {excluded} from '../../../admin/js/lib/seo-settings.js';
+
+/**
+ * @param {import('fastify').FastifyInstance} fastify
+ * @param {object} [opts] - authenticate / requirePermission overrides (tests)
+ */
+export async function seoRoutes(fastify, opts = {}) {
+    const authenticate = opts.authenticate || defaultAuthenticate;
+    const requirePermission = opts.requirePermission || defaultRequirePermission;
+    const may = (action) => ({preHandler: [authenticate, requirePermission('seo', action)]});
+    const seo = () => seoEngine();
+    const site = () => { try { return getConfig('site') || {}; } catch { return {}; } };
+    const off = (reply) => reply.code(503).send({error: 'SEO is not running on this site.'});
+
+    fastify.addHook('preHandler', async (request, reply) => {
+        if (!seo()) return off(reply);
+    });
+
+    fastify.get('/overview', may('read'), async (request) => {
+        const s = seo().summary();
+        const rules = seo().store.rules();
+        return {...s, redirects: rules.length, chains: seo().chains(rules).length, hooks: true,
+            origin: s.origin || seo().originOf(request), siteSeo: site().seo || {}};
+    });
+
+    fastify.get('/count', may('read'), async () => {
+        const s = seo().summary();
+        if (!s.at) return {count: 0, label: 'Not checked yet'};
+        const bad = (seo().store.audit().results || []).filter(r => r.error || r.failing > 0);
+        return {
+            count: bad.length,
+            label: bad.length ? `${bad.length} ${bad.length === 1 ? 'page has' : 'pages have'} SEO problems` : 'No SEO problems found',
+            ...(s.broken && {tone: 'danger'}),
+            details: {title: 'SEO', rows: [{label: 'Score', value: s.score === null ? '—' : `${s.score}%`}, {label: 'Pages', value: String(s.pages)}],
+                items: bad.slice(0, 5).map(r => ({text: r.urlPath, meta: r.error ? 'broken' : `${r.failing} failing`})),
+                empty: 'Every page passes.'}
+        };
+    });
+
+    fastify.get('/audit', may('read'), async () => {
+        const a = seo().store.audit();
+        return {...seo().summary(a), results: (a.results || []).map(r => ({...r, checks: undefined,
+            problems: (r.checks || []).filter(c => c.status === 'fail' || c.status === 'warn').map(c => c.title)}))};
+    });
+
+    fastify.post('/audit', may('read'), async (request) => {
+        const p = seo().runAudit(seo().originOf(request));
+        if (request.body?.wait === true) await p;
+        return seo().summary();
+    });
+
+    fastify.get('/item', may('read'), async (request, reply) => {
+        const e = seo();
+        const urlPath = e.normalisePath(request.query?.path || '') || '/';
+        const origin = e.originOf(request);
+        const page = await getPage(urlPath).catch(() => null);
+        const override = e.store.override(urlPath) || {};
+        const fields = page
+            ? {title: page.seo?.title || '', description: page.seo?.description || '', image: page.seo?.image || '', noindex: page.seo?.noindex === true, focus: page.seo?.focus || ''}
+            : {title: override.title || '', description: override.description || '', image: override.image || '', noindex: override.noindex === true, focus: override.focus || ''};
+        const fetched = await e.fetchLocal(urlPath, origin).catch(err => ({status: 0, error: err.message}));
+        if (!page && fetched.status === 404) return reply.code(404).send({error: `Nothing is served at ${urlPath}.`});
+        // Only a page that is really served is judged - a draft answers with the 404 page.
+        const facts = fetched.status === 200 && fetched.html ? e.scanHtml(fetched.html) : null;
+        const limits = e.settings().audit;
+        const judged = facts ? e.analyse(facts, {urlPath, focus: fields.focus, limits, origin}) : null;
+        const s = site();
+        return {
+            urlPath, origin, kind: page ? 'page' : 'url',
+            page: page ? {title: page.title, status: page.status, description: page.description || ''} : null,
+            fields,
+            live: facts ? {title: facts.title, description: facts.description || '', image: facts.og.image, h1: facts.headings.find(h => h.level === 1)?.text || '', words: facts.words, canonical: facts.canonical} : null,
+            status: fetched.status || 0,
+            defaults: {separator: s.seo?.titleSeparator || ' | ', siteTitle: s.seo?.defaultTitle || s.title || '', description: s.seo?.defaultDescription || '', image: s.seo?.defaultImage || ''},
+            analysis: judged,
+            limits,
+            redirect: e.matchRedirect(e.store.rules(), urlPath)?.rule || null
+        };
+    });
+
+    fastify.put('/item', may('manage'), async (request, reply) => {
+        const e = seo();
+        const b = request.body ?? {};
+        const urlPath = e.normalisePath(b.path || '') || '/';
+        const clip = (v, n) => String(v ?? '').trim().slice(0, n);
+        const fields = {title: clip(b.title, 200), description: clip(b.description, 400), image: clip(b.image, 500), noindex: b.noindex === true, focus: clip(b.focus, 100)};
+        if (fields.image && !/^(https?:\/\/|\/)/i.test(fields.image)) return reply.code(400).send({error: 'The image: a path like /media/photo.jpg, or a full web address.'});
+        const page = await getPage(urlPath).catch(() => null);
+        if (page) {
+            // Empty means "use the default": sent as null, updatePage's merge removes the key.
+            const seoFields = Object.fromEntries(Object.entries(fields).map(([k, v]) => [k, v === '' || v === false ? null : v]));
+            await updatePage(urlPath, {seo: seoFields}, undefined, {author: request.user?.username || request.user?.email});
+        } else {
+            e.store.setOverride(urlPath, fields);
+        }
+        e.sitemapChanged();
+        await e.reaudit(urlPath, {origin: e.originOf(request), focus: fields.focus}).catch(() => {});
+        return {ok: true, kind: page ? 'page' : 'url'};
+    });
+
+    // Redirects
+    fastify.get('/redirects', may('read'), async () => {
+        const rules = seo().store.rulesWithHits();
+        return {rules, chains: seo().chains(rules).map(c => ({id: c.rule.id, via: c.via.id})), max: seo().maxRules, onRename: seo().settings().redirects.onRename};
+    });
+    fastify.post('/redirects', may('manage'), async (request, reply) => {
+        const r = seo().addRule(request.body ?? {});
+        if (r.errors) return reply.code(400).send({error: Object.values(r.errors).join(' '), errors: r.errors});
+        return r;
+    });
+    fastify.put('/redirects/:id', may('manage'), async (request, reply) => {
+        const r = seo().updateRule(request.params.id, request.body ?? {});
+        if (r.missing) return reply.code(404).send({error: 'No such redirect.'});
+        if (r.errors) return reply.code(400).send({error: Object.values(r.errors).join(' '), errors: r.errors});
+        return r;
+    });
+    fastify.delete('/redirects/:id', may('manage'), async (request) => {
+        seo().removeRules(String(request.params.id).split(','));
+        return {ok: true};
+    });
+    fastify.post('/redirects/import', may('manage'), async (request) => {
+        const text = String(request.body?.csv ?? '').slice(0, 1_000_000);
+        let added = 0;
+        const skipped = [];
+        for (const [i, line] of text.split(/\r?\n/).entries()) {
+            const cells = line.split(/[,\t]/).map(c => c.trim().replace(/^"|"$/g, ''));
+            if (!cells[0] || cells[0].startsWith('#') || /^(from|source|old)/i.test(cells[0])) continue;
+            const r = seo().addRule({from: cells[0], to: cells[1], code: cells[2] || 301, note: cells[3] || 'Imported'});
+            if (r.errors) skipped.push({line: i + 1, from: cells[0], why: Object.values(r.errors).join(' ')});
+            else added++;
+            if (added + skipped.length >= 2000) break;
+        }
+        return {added, skipped};
+    });
+    fastify.get('/redirects/test', may('read'), async (request) => {
+        const hops = [];
+        let at = String(request.query?.path || '');
+        const rules = seo().store.rules();
+        for (let i = 0; i < 10 && at; i++) {
+            const hit = seo().matchRedirect(rules, at);
+            if (!hit) break;
+            hops.push({from: at, to: hit.location, code: hit.code, id: hit.rule.id});
+            if (hit.code === 410 || /^https?:/i.test(hit.location)) break;
+            at = hit.location;
+        }
+        return {hops};
+    });
+
+    // Sitemap and robots
+    fastify.get('/sitemap', may('read'), async (request) => {
+        const e = seo();
+        const cfg = e.settings();
+        const origin = e.originOf(request);
+        const {listSitemapEntries, buildRobotsTxt} = await import('../../services/sitemap.js');
+        const entries = await listSitemapEntries(origin, {log: fastify.log});
+        const raw = await e.rawEntries(origin);
+        const kept = new Set(entries.map(x => x.urlPath));
+        const sources = {};
+        for (const x of raw) {
+            sources[x.source] ??= {id: x.source, count: 0, listed: 0, on: cfg.sitemap.sources[x.source] !== false};
+            sources[x.source].count++;
+            if (kept.has(x.urlPath)) sources[x.source].listed++;
+        }
+        const rules = e.store.rules();
+        const over = e.store.overrides();
+        const left = raw.filter(x => !kept.has(x.urlPath)).map(x => ({...x,
+            why: cfg.sitemap.sources[x.source] === false ? 'Its source is switched off'
+                : excluded(x.urlPath, cfg.sitemap.exclude) ? 'Excluded in the settings'
+                    : over[x.urlPath]?.noindex ? 'Hidden from search engines'
+                        : e.matchRedirect(rules, x.urlPath) ? 'Redirected' : 'Left out'}));
+        return {hooks: true, origin, entries, left, sources: Object.values(sources),
+            labels: {pages: 'Pages', ...Object.fromEntries(getSitemapSources().map(s => [s.id, s.label]))},
+            robots: buildRobotsTxt(origin)};
+    });
+
+    fastify.get('/settings', may('read'), async () => ({settings: seo().settings(), hooks: true}));
+    fastify.put('/settings', may('manage'), async (request, reply) => {
+        const r = seo().saveSettings(request.body ?? {});
+        if (r.errors) return reply.code(400).send({error: Object.values(r.errors).join(' '), errors: r.errors});
+        return {settings: r.settings, hooks: true};
+    });
+
+    fastify.get('/extensions', may('read'), async () => ({
+        tabs: seo().registry.list().flatMap(x => x.tabs.map(t => ({...t, owner: x.owner, ownerLabel: x.label})))
+    }));
+}

package/server/server.js

@@ -491,6 +491,7 @@ const { notesRoutes }              = await import('./routes/api/notes.js');
 const { todoRoutes }               = await import('./routes/api/todo.js');
 const { analyticsRoutes }          = await import('./routes/api/analytics.js');
 const { contactsRoutes }           = await import('./routes/api/contacts.js');
+const { seoRoutes }                = await import('./routes/api/seo.js');
 const { relatedRoutes }            = await import('./routes/api/related.js');
 const { pluginMarketplaceRoutes }  = await import('./routes/api/plugin-marketplace.js');
 const { collectionsRoutes } = await import('./routes/api/collections.js');
@@ -548,6 +549,15 @@ await app.register(toolGate('notes', notesRoutes), {prefix: '/api/notes'});
 await app.register(toolGate('todo', todoRoutes), {prefix: '/api/todo'});
 await app.register(toolGate('analytics', analyticsRoutes), {prefix: '/api/analytics'});
 await app.register(toolGate('contacts', contactsRoutes), {prefix: '/api/contacts'});
+// SEO (0.90.0; the `seo` plugin in 0.89.0): a global plugin - its redirect guard
+// sees every request - plus its API. Off, the engine does nothing at all.
+{
+    const {seoPlugin} = await import('./services/seo/index.js');
+    const {getBaseUrl} = await import('./routes/public.js');
+    const rolesService = await import('./services/roles.js');
+    await app.register(seoPlugin, {enabled: isToolEnabled('seo'), getBaseUrl, rolesService});
+}
+await app.register(toolGate('seo', seoRoutes), {prefix: '/api/seo'});
 await app.register(toolsRoutes, {prefix: '/api'});
 // What plugins show beside a contact or a note (Calendar's Events) - 0.79.
 await app.register(relatedRoutes, {prefix: '/api/related'});
@@ -576,7 +586,8 @@ const coreToolItems = [
     {text: 'Notes', url: '#/notes', icon: 'edit-3', permission: 'notes', countUrl: '/api/notes/count'},
     {text: 'Todo', url: '#/todo', icon: 'check-square', permission: 'todo', countUrl: '/api/todo/count'},
     {text: 'Analytics', url: '#/analytics', icon: 'chart-bar', permission: 'analytics', countUrl: '/api/analytics/active-count'},
-    {text: 'Contacts', url: '#/contacts', icon: 'users', permission: 'contacts'}
+    {text: 'Contacts', url: '#/contacts', icon: 'users', permission: 'contacts'},
+    {text: 'SEO', url: '#/seo', icon: 'search', permission: 'seo', countUrl: '/api/seo/count'}
 ];
 for (const item of coreToolItems) {
     if (isToolEnabled(item.permission)) registerSidebarItem({item: {source: 'Built in', ...item}});

package/server/services/permissionRegistry.js

@@ -226,6 +226,17 @@ export const REGISTRY = [
             {key: 'delete', label: 'Reset', description: 'Reset all counters'}
         ]
     },
+    {
+        key: 'seo',
+        label: 'SEO',
+        description: 'How the site looks to search engines: the audit, page titles and descriptions, redirects, the sitemap and robots.txt.',
+        icon: 'search',
+        group: 'Tools',
+        actions: [
+            {key: 'read', label: 'View', description: 'See the audit, redirects and sitemap; run the audit'},
+            {key: 'manage', label: 'Manage', description: 'Change page titles and descriptions, redirects and settings'}
+        ]
+    },
     {
         key: 'notes',
         label: 'Notes',

package/server/services/plugins.js

@@ -165,7 +165,7 @@ export function isCorePlugin(name) { return CORE_PLUGINS.has(name); }
  * same data - and, like supersession, nothing is written down: a lapsed
  * licence means the plugin does not load and the core Tool is simply back.
  */
-export const BUILT_IN_TOOLS = new Set(['notes', 'todo', 'analytics', 'contacts']);
+export const BUILT_IN_TOOLS = new Set(['notes', 'todo', 'analytics', 'contacts', 'seo']);
 
 /** Built-in Tool → {plugin, route}, for the plugins that loaded this boot. */
 const _toolTakeovers = {};
@@ -196,6 +196,16 @@ export function toolTakeoversOf(manifest, taken = {}) {
     return out;
 }
 
+/**
+ * Plugins that became part of the CMS. A site updated from an engine that
+ * shipped one still has its folder; it is never loaded again (it would run
+ * beside the built-in copy - two redirect guards, two sets of tags) and its
+ * data is carried over by the built-in feature.
+ */
+export const RETIRED_PLUGINS = Object.freeze({
+    seo: 'Built in since 0.90.0 (server/services/seo) - its data moves to content/seo and config/seo.json.'
+});
+
 /**
  * Scan the plugins/ directory and return all valid manifests.
  * Validates mandatory fields and required files (plugin.js, config.js).
@@ -212,7 +222,7 @@ export async function discoverPlugins() {
     }
 
     const plugins = [];
-    for (const entry of entries.filter(e => e.isDirectory() && !e.name.startsWith('_'))) {
+    for (const entry of entries.filter(e => e.isDirectory() && !e.name.startsWith('_') && !RETIRED_PLUGINS[e.name])) {
         const dir = entry.name;
         const pluginDir = path.join(PLUGINS_DIR, dir);
         const manifestPath = path.join(pluginDir, 'plugin.json');

package/{plugins/seo/server → server/services/seo}/audit.js

@@ -2,12 +2,12 @@
  * SEO - the audit: every URL in the sitemap (and every published page hidden
  * from search engines), fetched INSIDE the process with fastify.inject - no
  * network, no certificate, the same HTML a visitor gets - and judged by
- * admin/lib/analyse.js.
+ * admin/js/lib/seo-analyse.js.
  *
  * The requests carry `user-agent: DommaSEO/1 (audit)` and `x-domma-seo: audit`
  * so analytics and SEO Pro's 404 log can leave them out.
  */
-import {analyse, scanHtml} from '../admin/lib/analyse.js';
+import {analyse, scanHtml} from '../../../admin/js/lib/seo-analyse.js';
 
 export const AUDIT_UA = 'DommaSEO/1 (audit)';
 const CONCURRENCY = 3;

package/server/services/seo/index.js

@@ -0,0 +1,345 @@
+/**
+ * SEO - built in since 0.90.0 (it was the free `seo` plugin in 0.89.0).
+ *
+ *  - Redirects: a global onRequest guard (GET/HEAD, never /api or /admin);
+ *    rules in content/seo/redirects.json (admin/js/lib/seo-redirects.js).
+ *    A renamed page gets one (content:pageRenamed), older rules re-aimed.
+ *  - What search engines are given: the 'seo:meta', 'sitemap:entries' and
+ *    'robots:lines' transforms (hooks.js section 8) - a URL's overrides,
+ *    Organization / BlogPosting JSON-LD, sitemap exclusions, robots rules.
+ *  - The audit (./audit.js): every sitemap URL fetched in-process and judged.
+ *  - The registry (./registry.js) SEO Pro plugs into.
+ *
+ * A switchable built-in Tool (services/tools.js): when it is off, none of the
+ * above runs and /api/seo answers 404. The switch restarts the site, so the
+ * boot-time state is the state.
+ *
+ * `seoEngine()` is the one instance; routes/api/seo.js is its API.
+ *
+ * @module services/seo
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import fp from 'fastify-plugin';
+import {createStore} from './store.js';
+import {auditAll, auditOne, AUDIT_UA, fetchLocal, hostOf} from './audit.js';
+import {seoRegistry} from './registry.js';
+import {analyse, scanHtml, siteIssues} from '../../../admin/js/lib/seo-analyse.js';
+import {chains, checkRule, matchRedirect, MAX_RULES, normalisePath, onMoved} from '../../../admin/js/lib/seo-redirects.js';
+import {applySeo, robotsLines} from '../../../admin/js/lib/seo-schema.js';
+import {checkSettings, excluded, mergeDefaults} from '../../../admin/js/lib/seo-settings.js';
+import {getConfig, saveConfig} from '../../config.js';
+import {hooks as coreHooks, getSitemapSources, registerTransform} from '../hooks.js';
+import {listPages} from '../content.js';
+import {invalidateTags} from '../cache/index.js';
+
+const SKIP = /^\/(api|admin)(\/|$)/;
+
+let engine = null;
+
+/** The SEO engine, once `seoPlugin` has registered it (null before). */
+export const seoEngine = () => engine;
+
+/** Settings: config/seo.json over the defaults. */
+function readSettings() {
+    try { return mergeDefaults(getConfig('seo')); } catch { return mergeDefaults({}); }
+}
+
+/**
+ * The SEO plugin's data, once, when SEO became built in (0.89.0 -> 0.90.0):
+ * its settings from config/plugins.json, redirects (with their counters) and
+ * overrides from plugins/seo/data. Never over anything already here.
+ */
+export function migrateFromPlugin({root = process.cwd(), log = console} = {}) {
+    const moved = [];
+    const cfgFile = path.join(root, 'config', 'seo.json');
+    const pluginData = path.join(root, 'plugins', 'seo', 'data');
+    const dir = path.join(root, 'content', 'seo');
+    try {
+        if (!fs.existsSync(cfgFile)) {
+            const plugins = JSON.parse(fs.readFileSync(path.join(root, 'config', 'plugins.json'), 'utf8'));
+            const s = plugins?.seo?.settings;
+            if (s && typeof s === 'object' && Object.keys(s).length) {
+                fs.writeFileSync(cfgFile, JSON.stringify(mergeDefaults(s), null, 2) + '\n');
+                moved.push('settings');
+            }
+        }
+    } catch { /* no plugins.json, or no SEO settings in it */ }
+    const readJson = (f) => { try { return JSON.parse(fs.readFileSync(f, 'utf8')); } catch { return null; } };
+    const old = readJson(path.join(pluginData, 'redirects.json'));
+    if (Array.isArray(old?.rules) && old.rules.length && !fs.existsSync(path.join(dir, 'redirects.json'))) {
+        fs.mkdirSync(dir, {recursive: true});
+        const rules = old.rules.map(({hits: _h, lastHit: _l, ...r}) => r);
+        const hits = Object.fromEntries(old.rules.filter(r => r.hits).map(r => [r.id, {hits: r.hits, lastHit: r.lastHit || null}]));
+        fs.writeFileSync(path.join(dir, 'redirects.json'), JSON.stringify({rules}, null, 2) + '\n');
+        if (Object.keys(hits).length) fs.writeFileSync(path.join(dir, 'hits.json'), JSON.stringify(hits) + '\n');
+        moved.push(`${rules.length} redirect(s)`);
+    }
+    const over = readJson(path.join(pluginData, 'overrides.json'));
+    if (over && typeof over === 'object' && Object.keys(over).length && !fs.existsSync(path.join(dir, 'overrides.json'))) {
+        fs.mkdirSync(dir, {recursive: true});
+        fs.writeFileSync(path.join(dir, 'overrides.json'), JSON.stringify(over, null, 2) + '\n');
+        moved.push(`${Object.keys(over).length} override(s)`);
+    }
+    if (moved.length) log.info?.(`[seo] carried over from the SEO plugin: ${moved.join(', ')}.`);
+    return moved;
+}
+
+async function seo(fastify, {enabled = true, getBaseUrl = null, rolesService = null} = {}) {
+    const log = fastify.log;
+    const registry = seoRegistry();
+    if (!enabled) {
+        log.info('[seo] SEO is switched off on this site.');
+        return;
+    }
+    try { migrateFromPlugin({log}); } catch (err) { log.warn(`[seo] the SEO plugin's data was not carried over: ${err.message}`); }
+    // Admins may use it, once - removed by hand, it stays removed (roles.js grantPermissionOnce).
+    rolesService?.grantPermissionOnce?.('admin', 'seo', 'core')?.catch?.(() => {});
+
+    let cfg = readSettings();
+    const store = createStore();
+    const site = () => { try { return getConfig('site') || {}; } catch { return {}; } };
+    const originOf = (request) => {
+        try { return String(getBaseUrl?.(request) || site().baseUrl || '').replace(/\/+$/, ''); } catch { return ''; }
+    };
+    const sitemapChanged = () => { invalidateTags(['sitemap']).catch(() => {}); };
+
+    // ---- 1. Redirects, ahead of everything else ----
+    fastify.addHook('onRequest', async (request, reply) => {
+        try {
+            if (request.method !== 'GET' && request.method !== 'HEAD') return;
+            const url = String(request.url || '');
+            if (SKIP.test(url)) return;
+            const rules = store.rules();
+            if (!rules.length) return;
+            const hit = matchRedirect(rules, url);
+            if (!hit) return;
+            if (request.headers['x-domma-seo'] !== 'audit') store.countHit(hit.rule.id);
+            if (hit.code === 410) {
+                reply.code(410).header('content-type', 'text/plain; charset=utf-8').send('Gone');
+                return reply;
+            }
+            reply.code(hit.code).header('location', hit.location)
+                .header('cache-control', hit.code === 301 || hit.code === 308 ? 'public, max-age=3600' : 'no-store').send();
+            return reply;
+        } catch (err) {
+            log.warn(`[seo] redirect skipped: ${err.message}`);
+        }
+    });
+    const saveHits = setInterval(() => store.saveHits(), 60_000);
+    saveHits.unref?.();
+
+    const onRenamed = ({from, to} = {}) => {
+        if (!cfg.redirects.onRename || !from || !to) return;
+        try {
+            store.setRules(onMoved(store.rulesWithHits(), from, to, {id: newId()}));
+            log.info(`[seo] ${from} moved to ${to}: redirect added.`);
+        } catch (err) {
+            log.warn(`[seo] no redirect for the move of ${from}: ${err.message}`);
+        }
+    };
+    coreHooks.on('content:pageRenamed', onRenamed);
+
+    // ---- 2. What search engines are given ----
+    registerTransform('seo:meta', (meta, ctx) => {
+        try {
+            const origin = String(ctx?.baseUrl || '').replace(/\/+$/, '');
+            return applySeo(meta, {page: ctx?.page, kind: ctx?.kind, origin, siteTitle: ctx?.site?.title || '', settings: cfg,
+                override: store.override(normalisePath(ctx?.page?.urlPath || '/') || '/')});
+        } catch (err) {
+            log.warn(`[seo] page tags left as they were: ${err.message}`);
+            return meta;
+        }
+    });
+    registerTransform('sitemap:entries', (entries) => {
+        const rules = store.rules();
+        const over = store.overrides();
+        return entries.filter(e => !excluded(e.urlPath, cfg.sitemap.exclude)
+            && cfg.sitemap.sources[e.source] !== false
+            && over[normalisePath(e.urlPath)]?.noindex !== true
+            && !(rules.length && matchRedirect(rules, e.urlPath)));
+    });
+    registerTransform('robots:lines', (lines, ctx) => robotsLines(lines, cfg.robots, ctx?.sitemapUrl));
+
+    // ---- 3. The audit ----
+    const sitemap = await import('../sitemap.js');
+    let running = null;
+    let progress = {done: 0, total: 0};
+    const isPublic = (p) => p.status === 'published' && (p.visibility || 'public') === 'public' && p.urlPath !== '/404';
+
+    /** What to audit: the sitemap, plus published pages kept out of it (so they show as hidden). */
+    async function auditList(origin) {
+        const list = [];
+        const seen = new Set();
+        for (const e of await sitemap.listSitemapEntries(origin, {log})) {
+            seen.add(e.urlPath);
+            list.push({urlPath: e.urlPath, source: e.source, title: e.title});
+        }
+        for (const p of await listPages()) {
+            if (seen.has(p.urlPath) || !isPublic(p)) continue;
+            list.push({urlPath: p.urlPath, source: 'pages', title: p.title, noindex: p.seo?.noindex === true, unlisted: true});
+        }
+        return list;
+    }
+    async function focusMap() {
+        const map = {};
+        for (const p of await listPages()) if (p.seo?.focus) map[p.urlPath] = p.seo.focus;
+        for (const [p, o] of Object.entries(store.overrides())) if (o.focus) map[p] = o.focus;
+        return map;
+    }
+    async function runAudit(origin) {
+        if (running) return running;
+        running = (async () => {
+            const started = Date.now();
+            try {
+                const o = origin || store.audit().origin || String(site().baseUrl || '').replace(/\/+$/, '');
+                const [list, focus] = await Promise.all([auditList(o), focusMap()]);
+                progress = {done: 0, total: list.length};
+                const results = await auditAll(fastify, list, {origin: o, focusOf: (p) => focus[p] || '', limits: cfg.audit,
+                    onProgress: (done, total) => { progress = {done, total}; }});
+                store.setAudit({at: new Date().toISOString(), ms: Date.now() - started, origin: o, results});
+                registry.emit('audit', store.audit());
+                return store.audit();
+            } catch (err) {
+                log.warn(`[seo] audit failed: ${err.message}`);
+                return store.audit();
+            } finally {
+                running = null;
+            }
+        })();
+        return running;
+    }
+    function summary(a = store.audit()) {
+        const rows = a.results || [];
+        const judged = rows.filter(r => typeof r.score === 'number' && !r.noindex);
+        const issues = siteIssues(rows);
+        return {
+            at: a.at, ms: a.ms || 0, origin: a.origin || '', running: Boolean(running), progress,
+            pages: rows.length,
+            score: judged.length ? Math.round(judged.reduce((n, r) => n + r.score, 0) / judged.length) : null,
+            failing: rows.filter(r => r.error || r.failing > 0).length,
+            broken: rows.filter(r => r.error).length,
+            hidden: rows.filter(r => r.noindex).length,
+            duplicates: issues.duplicateTitles.length + issues.duplicateDescriptions.length,
+            issues
+        };
+    }
+    /** Audit one URL again (after its fields changed), in place. */
+    async function reaudit(urlPath, {origin, focus}) {
+        const a = store.audit();
+        const at = (a.results || []).findIndex(r => r.urlPath === urlPath);
+        if (at < 0) return;
+        const row = await auditOne(fastify, a.results[at], {origin: a.origin || origin, focus, limits: cfg.audit});
+        const results = [...a.results];
+        results[at] = row;
+        store.setAudit({...a, results});
+    }
+
+    // ---- 4. Redirect rules ----
+    function addRule(input) {
+        const rules = store.rules();
+        if (rules.length >= MAX_RULES) return {errors: {from: `There are ${MAX_RULES} redirects already.`}};
+        const {errors, rule} = checkRule(input, rules);
+        if (Object.keys(errors).length) return {errors};
+        const full = {id: newId(), ...rule, at: new Date().toISOString()};
+        store.setRules([...rules, full]);
+        sitemapChanged();
+        return {rule: {...full, hits: 0, lastHit: null}};
+    }
+    function updateRule(id, input) {
+        const rules = store.rules();
+        const old = rules.find(r => r.id === id);
+        if (!old) return {missing: true};
+        const {errors, rule} = checkRule({...old, ...input, auto: false}, rules.filter(r => r !== old));
+        if (Object.keys(errors).length) return {errors};
+        const next = {...old, ...rule};
+        delete next.auto;
+        store.setRules(rules.map(r => (r === old ? next : r)));
+        sitemapChanged();
+        return {rule: next};
+    }
+    function removeRules(ids) {
+        const drop = new Set(ids);
+        store.setRules(store.rules().filter(r => !drop.has(r.id)));
+        sitemapChanged();
+    }
+
+    /** The sitemap entries before SEO's filter (pages + every source), to show what it leaves out. */
+    async function rawEntries(origin) {
+        const out = (await listPages()).filter(p => isPublic(p) && !p.seo?.noindex).map(p => ({urlPath: p.urlPath, title: p.title, source: 'pages'}));
+        const seen = new Set(out.map(p => p.urlPath));
+        for (const s of getSitemapSources()) {
+            try {
+                for (const e of (await s.list({baseUrl: origin})) || []) {
+                    if (!e?.urlPath || seen.has(e.urlPath)) continue;
+                    seen.add(e.urlPath);
+                    out.push({urlPath: e.urlPath, title: e.title || '', source: s.id});
+                }
+            } catch { /* shown as nothing from that source */ }
+        }
+        return out;
+    }
+
+    function saveSettings(input) {
+        const {errors, settings} = checkSettings(input, cfg);
+        if (Object.keys(errors).length) return {errors};
+        saveConfig('seo', settings);
+        cfg = settings;
+        sitemapChanged();
+        schedule();
+        return {settings};
+    }
+
+    // ---- 5. The registry SEO Pro plugs into ----
+    Object.assign(registry.services, {
+        version: 1,
+        builtIn: true,
+        settings: () => cfg,
+        listEntries: (origin) => sitemap.listSitemapEntries(origin, {log}),
+        auditList,
+        fetchPage: (urlPath, origin) => fetchLocal(fastify, urlPath, hostOf(origin)),
+        scanHtml, analyse,
+        audit: {latest: () => store.audit(), summary: () => summary(), run: (origin) => runAudit(origin)},
+        redirects: {list: () => store.rulesWithHits(), match: (p) => matchRedirect(store.rules(), p), add: (input) => addRule(input)},
+        auditUserAgent: AUDIT_UA
+    });
+
+    // ---- 6. On a schedule ----
+    let timer = null;
+    function schedule() {
+        if (timer) clearInterval(timer);
+        timer = null;
+        if (!cfg.audit.everyHours) return;
+        timer = setInterval(() => { runAudit().catch(() => {}); }, cfg.audit.everyHours * 3_600_000);
+        timer.unref?.();
+    }
+    schedule();
+    // The first audit a few minutes after start, if the last is older than the interval.
+    const first = setTimeout(() => {
+        const at = Date.parse(store.audit().at || 0) || 0;
+        if (cfg.audit.everyHours && Date.now() - at > cfg.audit.everyHours * 3_600_000) runAudit().catch(() => {});
+    }, 3 * 60_000);
+    first.unref?.();
+
+    fastify.addHook('onClose', (_i, done) => {
+        clearInterval(timer); clearInterval(saveHits); clearTimeout(first);
+        coreHooks.off?.('content:pageRenamed', onRenamed);
+        store.close();
+        done();
+    });
+
+    engine = {
+        store, registry, originOf, summary, runAudit, reaudit, auditList, rawEntries,
+        addRule, updateRule, removeRules, saveSettings, sitemapChanged,
+        settings: () => cfg, chains, matchRedirect, normalisePath, scanHtml, analyse,
+        fetchLocal: (urlPath, origin) => fetchLocal(fastify, urlPath, hostOf(origin)),
+        isRunning: () => Boolean(running), maxRules: MAX_RULES
+    };
+}
+
+function newId() {
+    return `r${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`;
+}
+
+/** Global (fastify-plugin): the redirect guard must see every request. */
+export const seoPlugin = fp(seo, {name: 'core-seo'});