domma-cms 0.89.1 → 0.90.1

package/{plugins/seo/server → server/services/seo}/registry.js

@@ -1,9 +1,10 @@
 /**
- * SEO's door for extensions - how SEO Pro adds to the free SEO without
- * replacing it (the Shopping Cart's pattern, lib/extensions.js there).
+ * SEO's door for extensions - how SEO Pro adds to the built-in SEO without
+ * replacing it (the Shopping Cart's pattern). The same registry the SEO plugin
+ * had before SEO was built in (0.90.0), so SEO Pro works with either.
  *
  * It lives on `globalThis` under a registered symbol, so an extension reaches
- * it WITHOUT importing a file from this plugin. An extension registers from its
+ * it WITHOUT importing a core file. An extension registers from its
  * `onReady` hook, when every plugin has loaded:
  *
  *   const seo = globalThis[Symbol.for('domma.seo')];
@@ -16,6 +17,7 @@
  * and reads through `seo.services` (listEntries, auditList, fetchPage,
  * scanHtml, analyse, audit {latest, summary, run}, redirects {list, match, add}).
  * A lapsed licence means the extension never loads and SEO carries on alone.
+ * A tab's `module` is a `/plugins/<slug>/...` URL exporting mount(root, ctx).
  */
 export const KEY = Symbol.for('domma.seo');
 export const VERSION = 1;

package/server/services/seo/store.js

@@ -0,0 +1,110 @@
+/**
+ * SEO - its data. Held in memory (the redirect guard and the 'seo:meta'
+ * transform run on every request and must not touch the disk) and written back
+ * a moment after each change; a file changed on disk (a restore, a pull of the
+ * site's repo) is read again within a few seconds.
+ *
+ * In content/seo/ - authored, so tracked by the site's repo:
+ *   redirects.json  {rules: [{id, from, to, code, note, auto, at}]}   see admin/js/lib/seo-redirects.js
+ *   overrides.json  {"/path": {title, description, image, noindex, focus}}
+ * Runtime state, kept out of the repo (services/siteGitignore.js):
+ *   hits.json       {ruleId: {hits, lastHit}} - kept apart so a visit never dirties redirects.json
+ *   audit.json      {at, origin, results: [...]}
+ *
+ * @module services/seo/store
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+
+/** Where SEO keeps its files - resolved per call, as analyticsDir() is. */
+export const seoDir = () => path.resolve('content', 'seo');
+
+function jsonFile(file, empty, {pretty = true} = {}) {
+    let value = read();
+    let mtime = stat();
+    let timer = null;
+    let checked = Date.now();
+
+    function stat() { try { return fs.statSync(file).mtimeMs; } catch { return 0; } }
+    function read() {
+        try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return structuredClone(empty); }
+    }
+    function flush() {
+        timer = null;
+        try {
+            fs.mkdirSync(path.dirname(file), {recursive: true});
+            fs.writeFileSync(`${file}.tmp`, JSON.stringify(value, null, pretty ? 2 : 0) + '\n');
+            fs.renameSync(`${file}.tmp`, file);
+            mtime = stat();
+        } catch { /* tried again with the next change */ }
+    }
+    return {
+        get() {
+            const now = Date.now();
+            if (!timer && now - checked > 3000) {
+                checked = now;
+                const m = stat();
+                if (m && m !== mtime) { value = read(); mtime = m; }
+            }
+            return value;
+        },
+        set(next, {soon = 500} = {}) {
+            value = next;
+            if (timer) clearTimeout(timer);
+            timer = setTimeout(flush, soon);
+            timer.unref?.();
+            return value;
+        },
+        flush() { if (timer) { clearTimeout(timer); flush(); } }
+    };
+}
+
+/**
+ * @param {string} [dir] - defaults to content/seo
+ */
+export function createStore(dir = seoDir()) {
+    const redirects = jsonFile(path.join(dir, 'redirects.json'), {rules: []});
+    const hits = jsonFile(path.join(dir, 'hits.json'), {}, {pretty: false});
+    const overrides = jsonFile(path.join(dir, 'overrides.json'), {});
+    const audit = jsonFile(path.join(dir, 'audit.json'), {at: null, origin: '', results: []}, {pretty: false});
+    const rulesNow = () => (Array.isArray(redirects.get()?.rules) ? redirects.get().rules : []);
+    let hitsDirty = false;
+    return {
+        /** The rules as stored (no counters) - what matching uses. */
+        rules: rulesNow,
+        /** The rules with their counters, for the screen and SEO Pro. */
+        rulesWithHits() {
+            const h = hits.get() || {};
+            return rulesNow().map(r => ({...r, hits: h[r.id]?.hits || 0, lastHit: h[r.id]?.lastHit || null}));
+        },
+        setRules(rules) {
+            const clean = rules.map(({hits: _h, lastHit: _l, ...r}) => r);
+            redirects.set({rules: clean});
+            const ids = new Set(clean.map(r => r.id));
+            const h = hits.get() || {};
+            if (Object.keys(h).some(id => !ids.has(id))) hits.set(Object.fromEntries(Object.entries(h).filter(([id]) => ids.has(id))));
+        },
+        /** One use of a rule - in memory; saved by saveHits() once a minute. */
+        countHit(id) {
+            const h = hits.get() || {};
+            const e = h[id] ||= {hits: 0, lastHit: null};
+            e.hits++;
+            e.lastHit = new Date().toISOString();
+            hitsDirty = true;
+        },
+        saveHits() { if (hitsDirty) { hitsDirty = false; hits.set(hits.get(), {soon: 0}); } },
+        overrides: () => overrides.get() || {},
+        override: (urlPath) => overrides.get()?.[urlPath] || null,
+        setOverride(urlPath, fields) {
+            const all = {...overrides.get()};
+            const clean = Object.fromEntries(Object.entries(fields || {}).filter(([, v]) => v !== '' && v !== null && v !== undefined && v !== false));
+            if (Object.keys(clean).length) all[urlPath] = clean;
+            else delete all[urlPath];
+            overrides.set(all);
+            return all[urlPath] || null;
+        },
+        audit: () => audit.get(),
+        setAudit: (a) => audit.set(a, {soon: 100}),
+        close() { this.saveHits(); redirects.flush(); hits.flush(); overrides.flush(); audit.flush(); }
+    };
+}

package/server/services/siteGitignore.js

@@ -49,7 +49,7 @@ const SITE_ROOTS = ['content', 'config', 'plugins'];
  */
 export const RETIRED_PLUGINS = [
     'analytics', 'contacts', 'notes', 'todo', 'demo-viewer', 'theme-switcher', 'site-search',
-    'seo-pro', 'shopping-cart', 'form-builder'
+    'seo', 'seo-pro', 'shopping-cart', 'form-builder'
 ];
 
 /**
@@ -309,6 +309,9 @@ export function buildGitignore({sitePlugins = [], pluginContent = {}, sitePublic
         '/content/sessions/',
         '/content/versions/',
         '/content/analytics/',
+        // SEO's runtime state; its redirects and overrides beside them are authored, and tracked.
+        '/content/seo/audit.json',
+        '/content/seo/hits.json',
         '/content/instances_log.json',
         '/content/preview-links.json',
         '/config/connections.json*',

package/server/services/tools.js

@@ -46,7 +46,8 @@ export const CORE_TOOLS = Object.freeze([
     {name: 'contacts', displayName: 'Contacts', icon: 'users', description: 'An address book for each user, with groups.'},
     {name: 'notes', displayName: 'Notes', icon: 'edit-3', description: 'Private notes for each user.'},
     {name: 'todo', displayName: 'Todo', icon: 'check-square', description: 'To-do lists with due dates and reminders.'},
-    {name: 'analytics', displayName: 'Analytics', icon: 'chart-bar', description: 'Page views and visitors, counted on this server.'}
+    {name: 'analytics', displayName: 'Analytics', icon: 'chart-bar', description: 'Page views and visitors, counted on this server.'},
+    {name: 'seo', displayName: 'SEO', icon: 'search', description: 'How the site looks to search engines: an audit of every page, redirects, the sitemap and robots.txt.'}
 ]);
 
 const CORE_NAMES = new Set(CORE_TOOLS.map(t => t.name));

package/plugins/seo/CLAUDE.md

@@ -1,48 +0,0 @@
-# SEO (free) - AI Assistant Guide
-
-How the site looks to search engines, and what to fix. Free tier (`make sync-free-tier` ships it with the engine).
-SEO Pro (paid) is an ADD-ON (`requires: ["seo"]`, no supersedes) that plugs in through `server/registry.js`.
-Social (paid, planned) will be its own plugin, sold with SEO Pro.
-
-Needs core 0.89 for: `hooks.registerSitemapSource` / `sitemapChanged`, and the `seo:meta`, `sitemap:entries`,
-`robots:lines` transforms (core `renderer.js` buildSeoMeta/renderSeoTags, `sitemap.js`). On an older engine the plugin
-logs it, the screen says so, and the audit, editor and redirects still work (`hasCore` in plugin.js).
-
-## What it does
-- **Audit** (`server/audit.js`): every sitemap URL (`listSitemapEntries`) plus published pages kept out of it, fetched
-  IN-PROCESS with `fastify.inject` (UA `DommaSEO/1 (audit)`, header `x-domma-seo: audit` - analytics / SEO Pro skip
-  those), judged by `admin/lib/analyse.js` (pure: `scanHtml` regex scanner - no DOM, `analyse`, `siteIssues`, `snippet`).
-  Every `audit.everyHours` (first run 3 min after start if stale), or POST /audit. Kept in `data/audit.json`.
-- **Editor per URL** (GET/PUT /item): a core page is edited IN PLACE (`updatePage(path, {seo})`, empty -> null so core's
-  merge removes the key); anything else (a blog post) gets an override in `data/overrides.json`, applied by the
-  `seo:meta` transform (`admin/lib/schema.js applySeo`). Fields: title, description, image, noindex, focus.
-- **Redirects** (`admin/lib/redirects.js`, pure): exact and "/prefix/*" rules, 301/302/307/308/410, query kept, no
-  loops (checkRule follows the chain), `onMoved` on core's `content:pageRenamed` re-aims older rules (no chains) and
-  drops a rule FROM the new address. Guard = global `onRequest` (fastify-plugin), GET/HEAD, never /api or /admin.
-  Hits counted in memory, saved each minute.
-- **Sitemap/robots**: `sitemap:entries` drops excluded paths, switched-off sources, overridden noindex and redirected
-  addresses; `robots:lines` adds rules (plain rules into the `*` group; `User-agent:` blocks as their own groups) or
-  blocks everything. JSON-LD: Organization/LocalBusiness/Person on `/`, BlogPosting when `page.item.type === 'blog:post'`.
-
-## Data (plugins/seo/data - kept by updates, never bundled)
-`redirects.json`, `overrides.json`, `audit.json` - in memory (the guard and transform run on every request), debounced
-writes, re-read within ~3 s when changed on disk (`server/store.js`).
-
-## Permission
-`seo` (read / manage), granted to admin. Routes: /overview /count /audit (GET, POST) /item (GET, PUT) /redirects
-(GET, POST, PUT/:id, DELETE/:id - ids comma-separated) /redirects/import /redirects/test /sitemap /settings /extensions.
-
-## Extensions (SEO Pro)
-`globalThis[Symbol.for('domma.seo')]` (`server/registry.js`): `register(owner, {label, tabs})`, `on('audit', fn)`,
-`services` {settings, listEntries, auditList, fetchPage, scanHtml, analyse, audit {latest, summary, run},
-redirects {list, match, add}, auditUserAgent}. Tabs: `{key, label, icon, module, help}`; `module` is a
-`/plugins/<slug>/...` URL exporting `mount(root, ctx)` -> dispose; ctx = {kit, api, scope, here, openItem, reload, E, M, I}.
-
-## Admin
-`admin/views/seo.js` + `admin/templates/seo.html` (prefix `sox-`): Pages (the audit + "Across the site"), Redirects,
-Sitemap, extension tabs; page editor slideover (search result + share card previews, meters, checks); settings
-slideover. Rows by index, text through data-bind-text only.
-
-## Tests
-`tests/seo.test.js` (pure). Headless: throwaway CMS from a clean domma-cms worktree with plugins/seo + blog copied in;
-puppeteer-core + ~/.cache/ms-playwright chromium_headless_shell for screenshots.

package/plugins/seo/admin/lib/analyse.js

@@ -1,286 +0,0 @@
-/**
- * SEO - reading a rendered page and judging it. Pure: no DOM, no network, so
- * the server's audit, the admin screen and the tests share it.
- *
- *   scanHtml(html)            -> facts (title, description, headings, images, links, words...)
- *   analyse(facts, opts)      -> {score, checks: [{id, group, status, title, detail, fix}]}
- *   siteIssues(results)       -> duplicates across pages (titles, descriptions)
- *   snippet({title, ...})     -> what a search result would show, cut where Google cuts
- *
- * A status is 'pass' | 'warn' | 'fail' | 'info'. The score counts a pass as
- * 1, a warn as 0.5, a fail as 0, and leaves 'info' out - as Security does.
- *
- * @module seo/admin/lib/analyse
- */
-
-export const LIMITS = {titleMin: 30, titleMax: 60, descMin: 70, descMax: 160, minWords: 300};
-
-const ENTITIES = {amp: '&', lt: '<', gt: '>', quot: '"', apos: "'", nbsp: ' ', ndash: '–', mdash: '—', hellip: '…',
-    lsquo: '‘', rsquo: '’', ldquo: '“', rdquo: '”', pound: '£', euro: '€', copy: '©'};
-
-/** Undo HTML entities in text. */
-export function decode(s) {
-    return String(s ?? '').replace(/&(#x[0-9a-f]+|#\d+|[a-z]+);/gi, (m, e) => {
-        if (e[0] === '#') {
-            const n = e[1] === 'x' || e[1] === 'X' ? parseInt(e.slice(2), 16) : parseInt(e.slice(1), 10);
-            return Number.isFinite(n) && n > 0 && n < 0x110000 ? String.fromCodePoint(n) : m;
-        }
-        return ENTITIES[e.toLowerCase()] ?? m;
-    });
-}
-
-const squash = (s) => decode(String(s ?? '').replace(/<[^>]*>/g, ' ')).replace(/\s+/g, ' ').trim();
-
-/** The attributes of one start tag: `<meta name="x" content='y' async>` -> {name, content, async: ''}. */
-export function attrs(tag) {
-    const out = {};
-    const body = String(tag).replace(/^<\s*[a-z0-9-]+/i, '').replace(/\/?>$/, '');
-    const re = /([^\s"'=<>`/]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g;
-    let m;
-    while ((m = re.exec(body))) out[m[1].toLowerCase()] = decode(m[2] ?? m[3] ?? m[4] ?? '');
-    return out;
-}
-
-/**
- * The facts of one page, from its HTML. Scripts, styles, templates and
- * comments are removed first, so nothing inside them counts.
- *
- * @param {string} html
- * @returns {object}
- */
-export function scanHtml(html) {
-    const src = String(html ?? '');
-    const headEnd = src.search(/<\/head\s*>/i);
-    const head = headEnd >= 0 ? src.slice(0, headEnd) : src;
-
-    const jsonLdTypes = [];
-    for (const m of src.matchAll(/<script\b[^>]*type\s*=\s*["']?application\/ld\+json["']?[^>]*>([\s\S]*?)<\/script>/gi)) {
-        try {
-            const j = JSON.parse(m[1]);
-            for (const x of [j, ...(Array.isArray(j) ? j : []), ...(Array.isArray(j?.['@graph']) ? j['@graph'] : [])]) {
-                const t = x?.['@type'];
-                if (t) jsonLdTypes.push(...(Array.isArray(t) ? t : [t]).map(String));
-            }
-        } catch { jsonLdTypes.push('(invalid)'); }
-    }
-
-    const clean = src
-        .replace(/<!--[\s\S]*?-->/g, ' ')
-        .replace(/<(script|style|template|noscript|svg)\b[\s\S]*?<\/\1\s*>/gi, ' ');
-
-    const metas = [...head.matchAll(/<meta\b[^>]*>/gi)].map(m => attrs(m[0]));
-    const meta = (key, val) => metas.find(a => (a[key] || '').toLowerCase() === val)?.content;
-    const links = [...head.matchAll(/<link\b[^>]*>/gi)].map(m => attrs(m[0]));
-
-    const bodyStart = clean.search(/<body\b/i);
-    const body = bodyStart >= 0 ? clean.slice(bodyStart) : clean;
-
-    const headings = [...body.matchAll(/<h([1-6])\b[^>]*>([\s\S]*?)<\/h\1\s*>/gi)].map(m => ({level: Number(m[1]), text: squash(m[2])}));
-    const images = [...body.matchAll(/<img\b[^>]*>/gi)].map(m => {
-        const a = attrs(m[0]);
-        return {src: a.src || a['data-src'] || '', alt: 'alt' in a ? a.alt : null, role: a.role || ''};
-    });
-    const anchors = [...body.matchAll(/<a\b([^>]*)>([\s\S]*?)<\/a\s*>/gi)].map(m => {
-        const a = attrs(`<a ${m[1]}>`);
-        return {href: a.href || '', text: squash(m[2]), rel: a.rel || '', title: a.title || ''};
-    });
-    const text = squash(body);
-    const firstPara = squash(body.match(/<p\b[^>]*>([\s\S]*?)<\/p\s*>/i)?.[1] || '');
-
-    return {
-        title: squash(head.match(/<title\b[^>]*>([\s\S]*?)<\/title\s*>/i)?.[1] || ''),
-        description: meta('name', 'description') ?? null,
-        robots: meta('name', 'robots') || '',
-        viewport: Boolean(meta('name', 'viewport')),
-        canonical: links.find(l => (l.rel || '').toLowerCase() === 'canonical')?.href || '',
-        lang: attrs(src.match(/<html\b[^>]*>/i)?.[0] || '<html>').lang || '',
-        og: {
-            title: meta('property', 'og:title') || '',
-            description: meta('property', 'og:description') || '',
-            image: meta('property', 'og:image') || '',
-            type: meta('property', 'og:type') || ''
-        },
-        twitter: {card: meta('name', 'twitter:card') || '', image: meta('name', 'twitter:image') || ''},
-        headings,
-        images,
-        links: anchors,
-        words: text ? text.split(/\s+/).filter(w => /[\p{L}\p{N}]/u.test(w)).length : 0,
-        text: text.slice(0, 20000),
-        firstPara: firstPara.slice(0, 1000),
-        jsonLdTypes: [...new Set(jsonLdTypes)]
-    };
-}
-
-const plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
-const has = (hay, needle) => Boolean(needle) && String(hay || '').toLowerCase().includes(needle);
-const slugWords = (s) => String(s || '').toLowerCase().normalize('NFKD').replace(/[̀-ͯ]/g, '').replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '');
-
-/**
- * Judge one page.
- *
- * @param {object} f - scanHtml() facts
- * @param {object} [opts]
- * @param {string} [opts.urlPath]
- * @param {string} [opts.focus] - the focus keyphrase, if one is set
- * @param {object} [opts.limits] - LIMITS overrides
- * @param {string} [opts.origin] - the site's own origin, to tell internal links
- * @returns {{score: number, failing: number, checks: object[]}}
- */
-export function analyse(f, {urlPath = '/', focus = '', limits = {}, origin = ''} = {}) {
-    const L = {...LIMITS, ...limits};
-    const checks = [];
-    const add = (id, group, status, title, detail, fix = '') => checks.push({id, group, status, title, detail, fix});
-    const noindex = /noindex/i.test(f.robots);
-
-    // --- Search result ---
-    const tl = f.title.length;
-    if (!tl) add('title', 'Search result', 'fail', 'Title', 'The page has no title.', 'Give it one: it is the blue link people click in the results.');
-    else if (tl < L.titleMin) add('title', 'Search result', 'warn', 'Title', `${tl} characters - short. Search engines may write their own.`, `Aim for ${L.titleMin}-${L.titleMax} characters that say what the page is about.`);
-    else if (tl > L.titleMax) add('title', 'Search result', 'warn', 'Title', `${tl} characters - it will be cut off after about ${L.titleMax}.`, 'Put the words that matter first, or shorten it.');
-    else add('title', 'Search result', 'pass', 'Title', `${tl} characters.`);
-
-    const d = f.description;
-    const dl = (d || '').length;
-    if (!dl) add('description', 'Search result', 'fail', 'Description', 'No description: search engines pick any sentence from the page.', 'Write one or two sentences that make someone want to click.');
-    else if (dl < L.descMin) add('description', 'Search result', 'warn', 'Description', `${dl} characters - short.`, `Aim for ${L.descMin}-${L.descMax} characters.`);
-    else if (dl > L.descMax) add('description', 'Search result', 'warn', 'Description', `${dl} characters - it will be cut off after about ${L.descMax}.`, 'Shorten it, keeping the point in the first half.');
-    else add('description', 'Search result', 'pass', 'Description', `${dl} characters.`);
-
-    const slug = urlPath.split('/').filter(Boolean).pop() || '';
-    if (urlPath !== '/' && (slug.length > 60 || /[A-Z_ %]/.test(slug) || /\d{5,}/.test(slug))) {
-        add('url', 'Search result', 'warn', 'Address', `"${slug}" is long or hard to read.`, 'Short, lower-case words joined by hyphens read best - rename the page (a redirect is added for you).');
-    } else {
-        add('url', 'Search result', 'pass', 'Address', urlPath === '/' ? 'The home page.' : `"${slug}" reads well.`);
-    }
-
-    // --- Content ---
-    const h1s = f.headings.filter(h => h.level === 1);
-    if (!h1s.length) add('h1', 'Content', 'fail', 'Main heading', 'There is no H1 heading.', 'Start the page with one main heading (# in Markdown) saying what it is about.');
-    else if (h1s.length > 1) add('h1', 'Content', 'warn', 'Main heading', `${h1s.length} H1 headings: "${h1s.slice(0, 3).map(h => h.text).join('", "')}".`, 'Keep one H1; make the others H2.');
-    else if (!h1s[0].text) add('h1', 'Content', 'warn', 'Main heading', 'The H1 heading is empty.', 'Give it words.');
-    else add('h1', 'Content', 'pass', 'Main heading', `"${h1s[0].text.slice(0, 80)}".`);
-
-    const skips = [];
-    for (let i = 1; i < f.headings.length; i++) {
-        if (f.headings[i].level > f.headings[i - 1].level + 1) skips.push(`H${f.headings[i - 1].level} → H${f.headings[i].level}`);
-    }
-    if (skips.length) add('headings', 'Content', 'warn', 'Heading order', `Levels are skipped: ${[...new Set(skips)].slice(0, 3).join(', ')}.`, 'Go down one level at a time (H2, then H3) - screen readers and search engines read them as an outline.');
-    else if (f.headings.length > 1) add('headings', 'Content', 'pass', 'Heading order', `${plural(f.headings.length, 'heading')}, in order.`);
-
-    if (f.words < Math.round(L.minWords / 3)) add('words', 'Content', 'warn', 'Length', `${plural(f.words, 'word')}. Very little for a search engine to go on.`, `Pages that rank usually have ${L.minWords}+ words - unless the page is a form or a contact page.`);
-    else if (f.words < L.minWords) add('words', 'Content', 'info', 'Length', `${plural(f.words, 'word')}.`, `Pages that rank usually have ${L.minWords}+ words.`);
-    else add('words', 'Content', 'pass', 'Length', `${f.words.toLocaleString('en-GB')} words.`);
-
-    const content = f.images.filter(i => i.role !== 'presentation');
-    const noAlt = content.filter(i => i.alt === null);
-    if (noAlt.length) add('alt', 'Content', 'fail', 'Image descriptions', `${plural(noAlt.length, 'image')} of ${content.length} ${noAlt.length === 1 ? 'has' : 'have'} no alt text.`, 'Describe each image in a few words (empty alt="" only for decoration). It is how search and screen readers see them.');
-    else if (content.length) add('alt', 'Content', 'pass', 'Image descriptions', `All ${plural(content.length, 'image')} described.`);
-
-    const internal = f.links.filter(l => isInternal(l.href, origin));
-    if (!internal.length && f.links.length < 50) add('links', 'Content', 'warn', 'Links to your other pages', 'None in the page itself.', 'Link to related pages: it helps visitors, and search engines find pages through links.');
-    else add('links', 'Content', 'pass', 'Links to your other pages', `${plural(internal.length, 'link')}.`);
-
-    // --- Focus keyphrase ---
-    const k = String(focus || '').trim().toLowerCase();
-    if (k) {
-        const where = [
-            ['title', has(f.title, k)],
-            ['description', has(d, k)],
-            ['main heading', h1s.some(h => has(h.text, k))],
-            ['address', slugWords(urlPath).includes(slugWords(k))],
-            ['first paragraph', has(f.firstPara, k)]
-        ];
-        const missing = where.filter(([, ok]) => !ok).map(([w]) => w);
-        const count = countPhrase(f.text, k);
-        const density = f.words ? (count * k.split(/\s+/).length * 100) / f.words : 0;
-        if (missing.length >= 3) add('focus', 'Keyphrase', 'fail', `"${focus}"`, `Missing from the ${missing.join(', ')}.`, 'Use the phrase people search for where they look first: the title, the heading and the opening.');
-        else if (missing.length) add('focus', 'Keyphrase', 'warn', `"${focus}"`, `Missing from the ${missing.join(', ')}.`, 'Work it in naturally - never at the cost of reading well.');
-        else add('focus', 'Keyphrase', 'pass', `"${focus}"`, 'In the title, description, heading, address and opening.');
-        if (f.words < 100) { /* too short for a share of the words to mean anything */ }
-        else if (density > 3) add('density', 'Keyphrase', 'warn', 'Repetition', `The phrase is ${density.toFixed(1)}% of the words (${plural(count, 'time')}).`, 'Over about 3% reads as stuffing - use other words for the same thing.');
-        else if (count) add('density', 'Keyphrase', 'pass', 'Repetition', `Used ${plural(count, 'time')} (${density.toFixed(1)}%).`);
-    } else {
-        add('focus', 'Keyphrase', 'info', 'Focus keyphrase', 'None set.', 'Say which search this page should be found for, and the checks will look for it.');
-    }
-
-    // --- Sharing and technical ---
-    if (noindex) add('index', 'Technical', 'info', 'Search engines', 'Hidden from search engines (noindex).', 'On purpose for thank-you pages and the like; otherwise switch it off.');
-    else add('index', 'Technical', 'pass', 'Search engines', 'May be indexed.');
-    if (!f.canonical) add('canonical', 'Technical', 'warn', 'Canonical address', 'No canonical link.', 'Set the site address in Settings so every page names its one true address.');
-    else if (!f.canonical.replace(/\/$/, '').endsWith(urlPath === '/' ? '' : urlPath)) add('canonical', 'Technical', 'info', 'Canonical address', `Points elsewhere: ${f.canonical}.`, 'Right when this page is a copy of that one; otherwise it hides this page.');
-    else add('canonical', 'Technical', 'pass', 'Canonical address', f.canonical);
-    if (!f.og.image) add('share-image', 'Sharing', 'warn', 'Share image', 'No image when the page is shared.', 'Choose an image (1200 × 630 is ideal), or set a default one for the site.');
-    else add('share-image', 'Sharing', 'pass', 'Share image', f.og.image);
-    if (f.jsonLdTypes.includes('(invalid)')) add('schema', 'Technical', 'fail', 'Structured data', 'A JSON-LD block is not valid JSON.', 'Fix or remove it - search engines ignore the lot.');
-    else if (f.jsonLdTypes.length) add('schema', 'Technical', 'pass', 'Structured data', f.jsonLdTypes.join(', '));
-    else add('schema', 'Technical', 'info', 'Structured data', 'None.', 'Structured data lets search engines show rich results.');
-    if (!f.lang) add('lang', 'Technical', 'warn', 'Language', 'The page does not say what language it is in.', 'The site template sets <html lang="…">.');
-
-    return {...score(checks), checks};
-}
-
-function isInternal(href, origin) {
-    const h = String(href || '').trim();
-    if (!h || h.startsWith('#') || /^(mailto|tel|javascript|data):/i.test(h)) return false;
-    if (h.startsWith('/') && !h.startsWith('//')) return true;
-    if (!origin) return false;
-    try { return new URL(h).origin === new URL(origin).origin; } catch { return false; }
-}
-
-function countPhrase(text, phrase) {
-    if (!phrase) return 0;
-    const esc = phrase.replace(/[.*+?^${}()|[\]\\]/g, '\\$&').replace(/\s+/g, '\\s+');
-    return (String(text).match(new RegExp(`(^|[^\\p{L}\\p{N}])${esc}(?=$|[^\\p{L}\\p{N}])`, 'giu')) || []).length;
-}
-
-/** Score and failing count of a list of checks. */
-export function score(checks) {
-    const counted = checks.filter(c => c.status !== 'info');
-    const got = counted.reduce((n, c) => n + (c.status === 'pass' ? 1 : c.status === 'warn' ? 0.5 : 0), 0);
-    return {
-        score: counted.length ? Math.round((got / counted.length) * 100) : 100,
-        failing: checks.filter(c => c.status === 'fail').length,
-        warnings: checks.filter(c => c.status === 'warn').length
-    };
-}
-
-/**
- * Problems only visible across pages: the same title or description on more
- * than one. `results` are audit rows `{urlPath, title, description, noindex}`.
- *
- * @returns {{duplicateTitles: Array<{text, paths}>, duplicateDescriptions: Array<{text, paths}>}}
- */
-export function siteIssues(results) {
-    const dupes = (key) => {
-        const by = new Map();
-        for (const r of results) {
-            const v = String(r[key] || '').trim().toLowerCase();
-            if (!v || r.noindex || r.error) continue;
-            if (!by.has(v)) by.set(v, {text: r[key], paths: []});
-            by.get(v).paths.push(r.urlPath);
-        }
-        return [...by.values()].filter(x => x.paths.length > 1).sort((a, b) => b.paths.length - a.paths.length);
-    };
-    return {duplicateTitles: dupes('title'), duplicateDescriptions: dupes('description')};
-}
-
-/**
- * A search result as Google would show it, cut where it cuts (roughly: it
- * measures pixels; characters are close enough to show the problem).
- */
-export function snippet({title = '', description = '', url = '', limits = {}} = {}) {
-    const L = {...LIMITS, ...limits};
-    const cut = (s, n) => (s.length > n ? `${s.slice(0, n - 1).replace(/\s+\S*$/, '')} …` : s);
-    let crumbs = url;
-    try {
-        const u = new URL(url);
-        crumbs = [u.hostname, ...u.pathname.split('/').filter(Boolean)].join(' › ');
-    } catch { /* a path */ }
-    return {
-        title: cut(String(title), L.titleMax),
-        description: cut(String(description), L.descMax),
-        crumbs,
-        titleCut: String(title).length > L.titleMax,
-        descriptionCut: String(description).length > L.descMax
-    };
-}