katman-mcp 0.1.0 → 0.3.0

package/dist/tools/crawl/audit/report.js

@@ -21,7 +21,7 @@ export function auditMarkdown(ctx, result, findings, opts = {}) {
     // Gates
     L.push("## Gates");
     L.push(mdTable(["Gate", "Pass", "Main reasons"], ["read", "quote", "fit"].map((k) => [
-        k === "read" ? "Read (Okunmak)" : k === "quote" ? "Quote (Alıntılanmak)" : "Fit (Soruya uymak)",
+        k === "read" ? "Read" : k === "quote" ? "Quote" : "Fit",
         g[k].total ? `${g[k].pass}/${g[k].total}` : "–",
         g[k].notes.slice(1, 4).join("; ") || (g[k].total ? "all pass" : ""),
     ])));
@@ -171,7 +171,7 @@ function nineCommands(ctx) {
         "3",
         "Title, description, canonical, robots, og:image",
         h
-            ? `title ${h.title ? `${h.title.length} chars ${Y}` : N} · description ${h.description ? `${h.description.length} chars ${Y}` : N} · canonical ${canon === undefined ? N : canon ? `self ${Y}` : `→ ${h.canonical} ${N}`} · robots ${h.metaRobots ?? "none"} ${home.noindex ? N : Y} · og:image ${h.og.image ? Y : N}`
+            ? `title ${h.title ? `${h.title.length} chars ${Y}` : N} · description ${h.description ? `${h.description.length} chars ${h.description.length >= 70 && h.description.length <= 160 ? Y : `${N} (aim for 70–160)`}` : N} · canonical ${canon === undefined ? N : canon ? `self ${Y}` : `→ ${h.canonical} ${N}`} · robots ${h.metaRobots ?? "none"} ${home.noindex ? N : Y} · og:image ${h.og.image ? Y : N}`
             : "—",
         `curl -s ${o}/ | grep -oiE '<title>[^<]*|name="description" content="[^"]*|rel="canonical" href="[^"]*|name="robots" content="[^"]*|og:image" content="[^"]*'`,
     ]);

package/dist/tools/crawl/cli.js

@@ -2,7 +2,9 @@
 import path from "node:path";
 import { parseArgs } from "../../cli.js";
 import { loadConfig, loadResearch, logEvent, readJson, saveResearch } from "../../state.js";
-import { auditAndSave, scanAndSave } from "./index.js";
+import { EXIT_NEEDS_PLAN, defaultLicense, meterAudit, statusOf } from "../../license.js";
+import { auditCountLine, renderAuditRefusal } from "../account/upsell.js";
+import { AuditRefused, auditAndSave, scanAndSave } from "./index.js";
 import { indexNowMarkdown, runIndexNow } from "./indexnow.js";
 import { keywordsMarkdown, mergeKeywords, runKeywords, termsToSave } from "./keywords.js";
 const str = (v) => (typeof v === "string" ? v : undefined);
@@ -25,20 +27,25 @@ export const commands = {
             return fail(`scan failed: ${e instanceof Error ? e.message : String(e)}`);
         }
     },
-    async audit(args) {
+    async audit(args, deps) {
         const a = parseArgs(args);
         const root = path.resolve(str(a.flags.root) ?? process.cwd());
         const max = Number(str(a.flags.max) ?? NaN);
+        const provider = deps?.license ?? defaultLicense();
         try {
-            const { run, markdown } = await auditAndSave(root, {
+            // The plan check has passed (runCli); the audit is counted right before it runs.
+            const { run, markdown, use } = await auditAndSave(root, {
                 site_url: a._[0] ?? str(a.flags.site),
                 max_urls: Number.isFinite(max) ? max : undefined,
                 urls: list(a.flags.urls),
                 include_bot_test: a.flags["no-bots"] ? false : undefined,
                 preview_urls: list(a.flags.preview),
-            }, (done, total, message) => process.stderr.write(`\r[${done}/${total}] ${message}                    `), !a.flags["no-save"]);
+            }, (done, total, message) => process.stderr.write(`\r[${done}/${total}] ${message}                    `), !a.flags["no-save"], (domain) => meterAudit(provider, domain));
             process.stderr.write("\n");
             console.log(markdown);
+            const count = use ? auditCountLine(use) : undefined;
+            if (count)
+                console.error(count.replace(/^> /, "").replace(/\*\*/g, ""));
             // --strict: non-zero exit when critical findings exist (for CI / a pre-publish script, book P14)
             if (a.flags.strict && run.findings.some((f) => f.severity === "critical"))
                 return 2;
@@ -46,6 +53,11 @@ export const commands = {
         }
         catch (e) {
             process.stderr.write("\n");
+            if (e instanceof AuditRefused) {
+                const status = await statusOf(provider);
+                console.error(renderAuditRefusal({ use: e.use, status, domain: e.domain, surface: "cli", command: "katman-mcp audit", example: ["katman-mcp", "audit", ...args].join(" ") }));
+                return EXIT_NEEDS_PLAN;
+            }
             return fail(`audit failed: ${e instanceof Error ? e.message : String(e)}`);
         }
     },
@@ -98,7 +110,7 @@ export const commands = {
 export const help = [
     "  katman-mcp scan [path] [--no-save]          scan the codebase → .katman/scan.json",
     "  katman-mcp audit <url> [--max 50] [--root .] [--urls u1,u2] [--preview u1] [--no-bots] [--strict] [--no-save]",
-    "                                              audit the live site like AI crawlers see it (--strict: exit 2 on critical)",
+    "                                              audit the live site like AI crawlers see it (--strict: exit 2 on critical); counts as one audit of the month",
     "  katman-mcp indexnow [--root .] [--site url] [--urls u1,u2] [--submit]",
     "                                              IndexNow key check + new/changed URLs (dry run unless --submit)",
     '  katman-mcp keywords "<seed>" [--lang en] [--country us] [--no-expand] [--save]',

package/dist/tools/crawl/index.js

@@ -1,4 +1,5 @@
-// Crawl module: katman_scan_code, katman_audit_site, katman_indexnow, katman_keywords.
+// Crawl module: katman_scan_code, katman_audit_site, katman_keywords and katman_indexnow (Katman Pro). katman_audit_site is
+// counted: it asks katman.pro right before the audit runs (license.ts meterAudit); see auditAndSave().
 // Registration only; the engines live in scan/, audit/, indexnow.ts and keywords.ts (pure or fetcher-injected).
 import { stat } from "node:fs/promises";
 import os from "node:os";
@@ -6,8 +7,9 @@ import path from "node:path";
 import { z } from "zod";
 import { resolveRoot, rootWarning } from "../../context.js";
 import { loadConfig, loadResearch, logEvent, readJson, saveConfig, saveResearch, stamp, writeJson, writeText } from "../../state.js";
-import { fail, ok } from "../../util.js";
-import { PRO_NOTE, withPro } from "../../license.js";
+import { domainOf, fail, normalizeSiteUrl, ok } from "../../util.js";
+import { licenseOf, meterAudit, statusOf, tierNote, withPlan } from "../../license.js";
+import { auditCountLine, auditCountStructured, auditRefusalStructured, renderAuditRefusal } from "../account/upsell.js";
 import { topIssues, auditMarkdown } from "./audit/report.js";
 import { runAudit } from "./audit/index.js";
 import { countBySeverity } from "./common/findings.js";
@@ -35,7 +37,22 @@ export async function scanAndSave(root, maxFiles, save = true) {
     const markdown = scanMarkdown(run, { savedTo: save ? ".katman/scan.json" : undefined, warning });
     return { run, markdown };
 }
-export async function auditAndSave(root, a, onProgress, save = true) {
+/** The audit was not run: this month's audits or sites are used up, or the plan or key stopped being valid. */
+export class AuditRefused extends Error {
+    use;
+    domain;
+    constructor(use, domain) {
+        super(`audit refused for ${domain}: ${use.reason ?? "not allowed"}`);
+        this.use = use;
+        this.domain = domain;
+    }
+}
+/**
+ * Audit the live site and save the result. With a `meter` (the real tools and the CLI pass one) the audit is counted
+ * first, right before it runs and only once the URL is valid; a refusal throws AuditRefused and nothing is fetched.
+ * `use` in the result is the meter's answer (the count, or "couldn't be checked").
+ */
+export async function auditAndSave(root, a, onProgress, save = true, meter) {
     const writable = save && !unsafeRoot(root);
     const readable = !unsafeRoot(root);
     const config = readable ? await loadConfig(root) : {};
@@ -44,6 +61,14 @@ export async function auditAndSave(root, a, onProgress, save = true) {
     const siteUrl = a.site_url?.trim() || config.siteUrl || research?.site?.url;
     if (!siteUrl)
         throw new Error("No site URL: pass site_url (e.g. https://example.com), or save it first with katman_start { site_url }.");
+    let use;
+    if (meter) {
+        // An invalid URL throws here, before anything is counted.
+        const domain = domainOf(normalizeSiteUrl(siteUrl));
+        use = await meter(domain);
+        if (!use.allowed)
+            throw new AuditRefused(use, domain);
+    }
     const run = await runAudit({
         siteUrl,
         maxUrls: a.max_urls ?? config.maxUrls ?? 50,
@@ -70,7 +95,7 @@ export async function auditAndSave(root, a, onProgress, save = true) {
         await logEvent(root, `katman_audit_site ${run.ctx.origin}: ${run.ctx.pages.length} URLs · read ${g.read.pass}/${g.read.total} · quote ${g.quote.pass}/${g.quote.total} · fit ${g.fit.pass}/${g.fit.total} · ${run.findings.length} findings`);
     }
     const markdown = auditMarkdown(run.ctx, run.result, run.findings, { full: false, jsonPath, mdPath });
-    return { run, markdown, jsonPath, writable };
+    return { run, markdown, jsonPath, writable, use };
 }
 function auditSummary(result, top, jsonPath) {
     return {
@@ -87,13 +112,14 @@ function auditSummary(result, top, jsonPath) {
 export function registerCrawlTools(server, ctx) {
     server.registerTool("katman_scan_code", {
         title: "Scan the codebase (framework, rendering, SEO files)",
-        description: "Read-only scan of the project's code (no network). Detects framework and builder (Lovable/Bolt/v0/Replit), the rendering verdict (SSR/SSG/CSR + evidence), hosting and preview-URL patterns, public vs app/auth routes, robots/sitemap/llms.txt/404 (static or generated), head-tag source, JSON-LD, i18n, analytics/AI-channel tracking, onClick navigation, hash routing and images without alt. Never opens .env*, keys or secret files. Writes .katman/scan.json; returns findings with gate, P-code and acceptance criterion. Run it first, and after big code changes.",
+        description: "Read-only scan of the project's code (no network). Detects framework and builder (Lovable/Bolt/v0/Replit), the rendering verdict (SSR/SSG/CSR + evidence), hosting and preview-URL patterns, public vs app/auth routes, robots/sitemap/llms.txt/404 (static or generated), head-tag source, JSON-LD, i18n, analytics/AI-channel tracking, onClick navigation, hash routing and images without alt. Never opens .env*, keys or secret files. Writes .katman/scan.json; returns findings with gate, P-code and acceptance criterion. Run it first, and after big code changes." +
+            tierNote("scan"),
         inputSchema: {
             project_root: z.string().optional().describe("Absolute path of the website's codebase (default: KATMAN_PROJECT_ROOT, MCP roots, or cwd)."),
             max_files: z.number().int().min(50).max(50000).optional().describe("Max files to list (default 5000)."),
         },
         annotations: { readOnlyHint: true, openWorldHint: false, destructiveHint: false, idempotentHint: true },
-    }, async ({ project_root, max_files }) => {
+    }, withPlan(ctx, "scan", async ({ project_root, max_files }) => {
         try {
             const root = await resolveRoot(ctx, project_root);
             if (unsafeRoot(root))
@@ -115,10 +141,11 @@ export function registerCrawlTools(server, ctx) {
         catch (e) {
             return fail(`katman_scan_code failed: ${errText(e)}`);
         }
-    });
+    }));
     server.registerTool("katman_audit_site", {
         title: "Audit the live site like AI crawlers see it",
-        description: "Fetches the live site without JavaScript, like AI crawlers: robots.txt, sitemap, http→https, www/apex, HSTS, compression, soft 404, llms.txt, AI-bot access through the CDN/firewall (GPTBot, OAI-SearchBot, ClaudeBot, PerplexityBot…), and per page: status, noindex, title/description, canonical, H1, JS-off words and first paragraph, JSON-LD, og:image, hreflang, internal links. Returns gates, top-10 issues (P-codes + acceptance criteria) and the P14 table. Network: the site only, ≤4 requests at a time. Pass urls to re-verify a fix. Writes .katman/audits/<stamp>.json + .katman/audit.md.",
+        description: "Fetches the live site without JavaScript, like AI crawlers: robots.txt, sitemap, http→https, www/apex, HSTS, compression, soft 404, llms.txt, AI-bot access through the CDN/firewall (GPTBot, OAI-SearchBot, ClaudeBot, PerplexityBot…), and per page: status, noindex, title/description, canonical, H1, JS-off words and first paragraph, JSON-LD, og:image, hreflang, internal links. Returns gates, top-10 issues (P-codes + acceptance criteria) and the P14 table. Network: the site only, ≤4 requests at a time. Pass urls to re-verify a fix. Writes .katman/audits/<stamp>.json + .katman/audit.md. Each run counts as one of the plan's audits for the calendar month (Katman Pro, 1 site: 5 audits and 1 site; 3 sites: 30 audits and 3 sites; katman.pro counts them); re-reading .katman/audit.md and every other tool don't count, so don't re-run it without a reason." +
+            tierNote("audit"),
         inputSchema: {
             site_url: z.string().optional().describe("Site to audit, e.g. https://example.com (default: .katman/config.json siteUrl or research site.url)."),
             project_root: z.string().optional().describe("Absolute project path (where .katman/ lives)."),
@@ -128,7 +155,7 @@ export function registerCrawlTools(server, ctx) {
             preview_urls: z.array(z.string()).optional().describe("Preview/staging copies (e.g. https://proj.vercel.app) that must 301 to the main host or send noindex."),
         },
         annotations: { readOnlyHint: true, openWorldHint: true, destructiveHint: false, idempotentHint: true },
-    }, async (args, extra) => {
+    }, withPlan(ctx, "audit", async (args, extra) => {
         try {
             const root = await resolveRoot(ctx, args.project_root);
             const token = extra?._meta?.progressToken;
@@ -137,17 +164,23 @@ export function registerCrawlTools(server, ctx) {
                     void extra.sendNotification({ method: "notifications/progress", params: { progressToken: token, progress: done, total, message } }).catch(() => undefined);
                 }
                 : undefined;
-            const { run, markdown, jsonPath, writable } = await auditAndSave(root, args, onProgress);
+            const provider = licenseOf(ctx);
+            const { run, markdown, jsonPath, writable, use } = await auditAndSave(root, args, onProgress, true, (domain) => meterAudit(provider, domain));
             const note = writable ? "" : `\n\n> Not saved: ${root} is not a project folder (pass project_root to keep the audit in .katman/).`;
-            return ok(markdown + note, auditSummary(run.result, topIssues(run.ctx, run.findings), jsonPath));
+            const count = use ? auditCountLine(use) : undefined;
+            return ok(markdown + note + (count ? `\n\n${count}` : ""), { ...auditSummary(run.result, topIssues(run.ctx, run.findings), jsonPath), ...(use ? { auditCount: auditCountStructured(use) } : {}) });
         }
         catch (e) {
+            if (e instanceof AuditRefused) {
+                const input = { use: e.use, status: await statusOf(licenseOf(ctx)), domain: e.domain, surface: "mcp" };
+                return ok(renderAuditRefusal(input), auditRefusalStructured(input));
+            }
             return fail(`katman_audit_site failed: ${errText(e)}`);
         }
-    });
+    }));
     server.registerTool("katman_indexnow", {
         title: "Notify search engines of new/changed pages (IndexNow)",
-        description: "Tells Bing (→ Copilot, ChatGPT search, DuckDuckGo), Yandex, Seznam, Naver and Yep about new or changed URLs via IndexNow. Creates a 32-hex key (saved in .katman/config.json), checks https://<host>/<key>.txt serves it, and selects only new/changed URLs (sitemap lastmod, else a hash of the page text) against .katman/indexnow.json. dry_run (default true) sends nothing; dry_run:false POSTs to api.indexnow.org and records the URLs. Always returns the manual checklist for Google Search Console, Bing Webmaster Tools and Brave." + PRO_NOTE,
+        description: "Tells Bing (→ Copilot, ChatGPT search, DuckDuckGo), Yandex, Seznam, Naver and Yep about new or changed URLs via IndexNow. Creates a 32-hex key (saved in .katman/config.json), checks https://<host>/<key>.txt serves it, and selects only new/changed URLs (sitemap lastmod, else a hash of the page text) against .katman/indexnow.json. dry_run (default true) sends nothing; dry_run:false POSTs to api.indexnow.org and records the URLs. Always returns the manual checklist for Google Search Console, Bing Webmaster Tools and Brave." + tierNote("indexnow"),
         inputSchema: {
             project_root: z.string().optional().describe("Absolute project path (where .katman/ lives)."),
             site_url: z.string().optional().describe("Site, e.g. https://example.com (default: config siteUrl)."),
@@ -156,7 +189,7 @@ export function registerCrawlTools(server, ctx) {
             dry_run: z.boolean().optional().describe("Default true: plan only. false = submit to api.indexnow.org."),
         },
         annotations: { readOnlyHint: false, openWorldHint: true, destructiveHint: false, idempotentHint: false },
-    }, withPro(ctx, "indexnow", async ({ project_root, site_url, urls, key, dry_run }) => {
+    }, withPlan(ctx, "indexnow", async ({ project_root, site_url, urls, key, dry_run }) => {
         try {
             const root = await resolveRoot(ctx, project_root);
             if (unsafeRoot(root))
@@ -185,7 +218,8 @@ export function registerCrawlTools(server, ctx) {
     }));
     server.registerTool("katman_keywords", {
         title: "Google autocomplete keyword ideas",
-        description: "Expands a seed phrase with Google autocomplete (seed + a–z/0–9; ≤40 requests, 350 ms apart; network: suggestqueries.google.com only) into real search phrases, clustered, and marks single-question, situation and comparison page candidates (English and Turkish question words). Use during research to find the customer's own words. save:true merges them into .katman/research.json keywords (source \"autocomplete\"); otherwise nothing is written.",
+        description: "Expands a seed phrase with Google autocomplete (seed + a–z/0–9; ≤40 requests, 350 ms apart; network: suggestqueries.google.com only) into real search phrases, clustered, and marks single-question, situation and comparison page candidates (English and Turkish question words). Use during research to find the customer's own words. save:true merges them into .katman/research.json keywords (source \"autocomplete\"); otherwise nothing is written." +
+            tierNote("keywords"),
         inputSchema: {
             seed: z.string().min(2).describe("Seed phrase in the customer's words, e.g. \"import invoices into accounting\"."),
             lang: z.string().optional().describe("Interface language (hl), default en; tr uses the Turkish alphabet."),
@@ -195,7 +229,7 @@ export function registerCrawlTools(server, ctx) {
             project_root: z.string().optional().describe("Absolute project path (needed with save)."),
         },
         annotations: { readOnlyHint: false, openWorldHint: true, destructiveHint: false, idempotentHint: true },
-    }, async ({ seed, lang, country, expand, save, project_root }) => {
+    }, withPlan(ctx, "keywords", async ({ seed, lang, country, expand, save, project_root }) => {
         try {
             const r = await runKeywords({ seed, lang, country, expand });
             let saved;
@@ -222,5 +256,5 @@ export function registerCrawlTools(server, ctx) {
         catch (e) {
             return fail(`katman_keywords failed: ${errText(e)}`);
         }
-    });
+    }));
 }

package/dist/tools/crawl/scan/framework.js

@@ -593,7 +593,10 @@ function detectHosting(p, pkg, builder, wr, findings) {
 }
 function staticDirFor(framework, appDir, assetsDir, p) {
     const pre = appDir ? `${appDir}/` : "";
-    if (assetsDir)
+    // A Worker's assets directory is the folder that gets deployed. Without a build step it is the source folder; with a
+    // framework it is the build output (dist/, build/, Hugo's public/…), which the next build wipes, so files go to the
+    // framework's own static folder instead.
+    if (assetsDir && (framework === "custom-server" || framework === "static-html" || framework === "unknown"))
         return assetsDir;
     switch (framework) {
         case "sveltekit":

package/dist/tools/method/core/lint.js

@@ -19,6 +19,7 @@ const SOURCE_MARK_RE = /(source|according to|survey|study|report|data from|measu
 const CLAIM_NUM_RE = /(\d+(?:[.,]\d+)?\s?%|%\s?\d+|\b\d+(?:[.,]\d+)?\s?[x×]\b|\b\d{1,3}(?:[.,]\d{3})+\+?|\b\d+\+?\s+(?:users|customers|people|visitors|downloads|companies|teams|businesses|orders|sites|reviews|clients|installs|creators|members|kullanıcı|müşteri|kişi|ziyaretçi|şirket|indirme|yorum|site|üye))/i;
 const FREE_RE = /\b(free|for free|free of charge)\b|ücretsiz|bedava|\bgratis\b|kostenlos|gratuit/gi;
 const CURRENCY_NEAR = /[$€£₺]|\b(usd|eur|gbp|try|tl)\b/i;
+const OFFER_LIMIT_BEFORE = /(?:\b(?:first|next|up to|limited to|max(?:imum)?|only|at most)|\bilk|\ben fazla|\bsadece)\s*$/i;
 function stripQuotes(s) {
     return s.replace(/“[^”]*”|"[^"]*"|«[^»]*»|„[^“]*“/g, " ");
 }
@@ -227,6 +228,9 @@ export function lintPage(x, c) {
                     continue;
                 if (CURRENCY_NEAR.test(s.slice(Math.max(0, (m.index ?? 0) - 3), (m.index ?? 0) + m[0].length + 3)))
                     continue;
+                // An offer's limit ("the first 100 customers", "up to 3 sites") is a condition, not a claim that needs a source.
+                if (OFFER_LIMIT_BEFORE.test(s.slice(Math.max(0, (m.index ?? 0) - 20), m.index ?? 0)))
+                    continue;
                 if (SOURCE_MARK_RE.test(s) || (ss[i + 1] && SOURCE_MARK_RE.test(ss[i + 1])))
                     continue;
                 unsourced.push(`“${s.length > 140 ? s.slice(0, 137) + "…" : s}”`);
@@ -270,12 +274,22 @@ export function lintPage(x, c) {
             // "free" next to a tool/resource word (free VAT calculator, free checker, free guide, ücretsiz araç) is a
             // genuinely free side offer, which the method recommends (free tools are link magnets): not a violation.
             const FREE_SIDE_OFFER = /^\W{0,3}(?:\p{L}+[\s-]+){0,3}?(?:tool|tools|finder|checker|calculator|counter|generator|guide|book|ebook|pdf|template|templates|course|webinar|audit|test|trial|plan|tier|version|download|araç|araçlar|araci|aracı|bulucu|hesaplayıcı|sayacı|rehber|kitap|şablon|deneme|sürüm|plan)\b/iu;
+            // The same side offer named before the word ("the checker and the guides are free", "AI crawler checker — Free",
+            // "check your site first, free"), in the same clause and without a contrast ("our tools are paid, but setup is free").
+            const FREE_SIDE_OFFER_BEFORE = /\b(?:tool|tools|finder|checker|checkers|check|calculator|calculators|counter|generator|guide|guides|template|templates|resource|resources|araç|araçlar|araci|aracı|bulucu|hesaplayıcı|sayacı|rehber|rehberler|şablon|kontrol)\b(?:(?!\b(?:but|however|while|whereas|although|except|ama|fakat|ancak)\b)[^.!?;])*$/iu;
             const hits = [];
             for (const seg of [...segments, stripQuotes(x.description ?? "")]) {
                 for (const m of seg.matchAll(FREE_RE)) {
-                    const after = seg.slice((m.index ?? 0) + m[0].length, (m.index ?? 0) + m[0].length + 60);
+                    const at = m.index ?? 0;
+                    const after = seg.slice(at + m[0].length, at + m[0].length + 60);
                     if (FREE_SIDE_OFFER.test(after))
                         continue;
+                    if (FREE_SIDE_OFFER_BEFORE.test(seg.slice(Math.max(0, at - 50), at)))
+                        continue;
+                    // A question ("Is it free?") asks, it doesn't promise; the answer is checked on its own.
+                    const end = seg.slice(at).search(/[.!?](?:\s|$)/);
+                    if (end >= 0 && seg[at + end] === "?")
+                        continue;
                     if (hits.length < 4)
                         hits.push(snippet(seg, m.index ?? 0, m[0].length));
                 }

package/dist/tools/method/core/prompt.js

@@ -5,7 +5,8 @@ import { t } from "../lib/l10n.js";
 import { appPathsText, knownPublicPaths, pathKnown } from "../lib/routes.js";
 import { loadConfigSafe, loadLatestAudit, loadResearchSafe, loadScan, staticDirFor } from "../lib/state.js";
 import { brandSentence, codeBlock, fillTemplate, hasNotX, isFilled, slugify } from "../lib/text.js";
-import { PLACEHOLDERS, PROMPTS, getPrompt, promptPlaceholders } from "../data/prompts.js";
+import { PLACEHOLDERS, PROMPTS } from "../data/prompts.js";
+import { getPrompt, promptPlaceholders } from "../lib/prompt-lookup.js";
 import { detectLang } from "./questions.js";
 export function siteUrlOf(r, cfg) {
     if (r && isFilled(r.site.url) && /^https?:\/\//i.test(r.site.url))

package/dist/tools/method/core/start.js

@@ -17,7 +17,7 @@ export function firstRunText(root) {
         "**First run in this project. What happens next:**",
         `1. Katman keeps its notes in \`${root}/.katman/\` (safe to commit, never secrets). It writes nowhere else unless you call katman_generate or katman_setup_monitoring with write: true, and it never overwrites without overwrite: true.`,
         "2. It reads your code (skipping node_modules, .git and build output; never .env*, keys or secrets) and, when you run the audit tools, your own live site.",
-        "3. Network only when a tool needs it: your site, openrouter.ai with YOUR key after a cost estimate (dry run first), api.indexnow.org on request, and katman.pro only to check KATMAN_KEY (at most once a day, only when it is set) or when you call katman_sync. No telemetry.",
+        "3. Network only when a tool needs it: your site, openrouter.ai with YOUR key after a cost estimate (dry run first), api.indexnow.org on request, and katman.pro only to check KATMAN_KEY (at most once a day, and again when a plan ends) or when you call katman_sync. No telemetry.",
         "4. The order: research (who you are, your customers' own sentences) → plan → build with prompts P0–P14 → verify, then re-measure every 14 days.",
         "5. It never invents facts: unknowns stay [FILL] and you'll be asked.",
     ].join("\n");

package/dist/tools/method/data/_store.js

@@ -0,0 +1,17 @@
+// Where the method data comes from at run time.
+// In the source tree (tests, `npm run dev`) every data module holds the method inline and METHOD_INLINE is true.
+// The published package carries no method text: scripts/postbuild.mjs replaces each data module in dist/ with a stub
+// that exports the same names, empty until katman.pro sends the data for a paid key (POST /api/web/mcp/method, see
+// src/license.ts loadMethod), and sets METHOD_INLINE to false. ES module bindings are live, so every importer sees
+// the values once applyMethod has run.
+export const METHOD_INLINE = false;
+const setters = [];
+/** Called by each stub module to receive its exports. */
+export function onMethod(set) {
+    setters.push(set);
+}
+/** Fills every stub module from the data katman.pro sent. */
+export function applyMethod(data) {
+    for (const set of setters)
+        set(data);
+}

package/dist/tools/method/data/anatomy.js

@@ -1,141 +1,12 @@
-export const ANATOMY_INTRO = {
-    en: "A page is written for two readers at once: Google and the assistant. The invoice example below is invented; its structure is the same as the sample site's situation pages. Blocks tagged SEO are for the search engine, GEO blocks are for the assistant to quote you. Most serve both.",
-    tr: "Bir sayfa iki okuyucuya birden yazılır: Google’a ve asistana. Aşağıdaki fatura örneği uydurmadır; yapı, örnek sitenin durum sayfalarıyla aynı. SEO etiketli bloklar arama motoru için, GEO etiketliler asistanın sizi alıntılaması için. Çoğu ikisine birden yarıyor.",
-};
-export const ANATOMY = [
-    {
-        n: 1,
-        tags: ["SEO", "GEO"],
-        name: { en: "<title> · meta description · canonical · og:image", tr: "<title> · meta description · canonical · og:image" },
-        example: { en: "yoursite.com/import-pdf-invoices", tr: "siteniz.com/faturami-muhasebeye-aktar" },
-        rule: {
-            en: "Title: the situation first, then the brand, about 60 characters. Meta description: the sentence you want the assistant to say; Google mostly builds the snippet from the page text, so the same sentence must also be in block 3.",
-            tr: "Title önce durum, sonra marka, yaklaşık 60 karakter. Meta açıklama asistanın söylemesini istediğiniz cümle; Google snippet’i çoğunlukla sayfa metninden kurar, bu yüzden aynı cümle 3. blokta da olmalı.",
-        },
-    },
-    {
-        n: 2,
-        tags: ["SEO", "GEO"],
-        name: { en: "H1", tr: "H1" },
-        example: { en: "I type my invoices in by hand and it takes hours", tr: "Faturalarımı elle giriyorum, saatlerimi alıyor" },
-        rule: { en: "The H1 is the customer's own sentence. The URL uses the same words.", tr: "H1 müşterinin kendi cümlesi. Adres de aynı kelimelerle." },
-    },
-    {
-        n: 3,
-        tags: ["GEO"],
-        name: { en: "The first 1–3 sentences", tr: "İlk 1–3 cümle" },
-        example: {
-            en: "Upload your invoice. We move the line items into your accounting software in 30 seconds and flag the ones that don't match. Your document is never stored.",
-            tr: "Faturanı yükle. Kalemleri 30 saniyede muhasebe programına aktarırız, eşleşmeyenleri işaretleriz. Belgen saklanmaz.",
-        },
-        rule: {
-            en: "The most important block. The assistant takes a sentence for its answer from here: short, concrete, understandable on its own. ChatGPT repeated the sample site's sentence almost word for word. Keep the key claim within the H1 and the first ~200 characters.",
-            tr: "Sayfanın en önemli bloğu. Asistan cevabına buradan bir cümle alır: kısa, somut, tek başına anlaşılır. Örnek sitenin cümlesini ChatGPT neredeyse kelimesi kelimesine tekrar etti. Asıl iddiayı H1’de ve ilk ~200 karakterde tutun.",
-        },
-    },
-    {
-        n: 4,
-        tags: [],
-        name: { en: "Try it now / one clear action", tr: "Hemen deneme / tek net eylem" },
-        example: { en: "Drop your invoice · try it free", tr: "Faturanı bırak · ücretsiz dene" },
-        rule: {
-            en: "The visitor arrives with the situation they told ChatGPT. On the sample site we put a file drop box on the two pages ChatGPT sent people to; 52 of the first 68 generations in week one used the visitor's own file.",
-            tr: "Ziyaretçi ChatGPT’ye anlattığı durumla gelir. Örnek sitede ChatGPT’nin gönderdiği iki sayfaya dosya kutusu koyduk; ilk haftadaki 68 ilk üretimin 52’si ziyaretçinin kendi dosyasıyla yapıldı.",
-        },
-    },
-    {
-        n: 5,
-        tags: ["GEO"],
-        name: { en: "Proof: number + date", tr: "Kanıt: sayı + tarih" },
-        example: { en: "A verifiable number with its date", tr: "Doğrulanabilir sayı, tarihiyle" },
-        rule: {
-            en: "A verifiable number, with its date. Don't claim more than your proof: the assistant repeats it and a competitor refutes it.",
-            tr: "Doğrulanabilir sayı, tarihiyle. Kanıtından büyük iddia yazmayın; asistan tekrar eder, rakip çürütür.",
-        },
-    },
-    {
-        n: 6,
-        tags: ["SEO", "GEO"],
-        name: { en: "How it works: 3–5 steps", tr: "Nasıl çalışır: 3–5 adım" },
-        example: { en: "3–5 plain-text steps", tr: "3–5 düz metin adım" },
-        rule: {
-            en: "Plain HTML text; a demo drawn with JavaScript is an empty page to a bot.",
-            tr: "Düz HTML metin; JavaScript ile çizilen bir demo bot için boş sayfadır.",
-        },
-    },
-    {
-        n: 7,
-        tags: ["GEO"],
-        name: { en: "Who it's not for", tr: "Kimler için değil" },
-        example: { en: "2–3 bullets", tr: "2–3 madde" },
-        rule: {
-            en: "Saying who it's not for and naming competitors honestly builds trust; assistants quote one-sided pages less.",
-            tr: "“Kime uygun değil” ve rakipleri dürüstçe saymak güven verir; asistan tek taraflı sayfayı daha az alıntılar.",
-        },
-    },
-    {
-        n: 8,
-        tags: ["GEO"],
-        name: { en: "Alternatives, honestly", tr: "Alternatifler, dürüstçe" },
-        example: { en: "Competitor: who it fits", tr: "Rakip: kime uygun" },
-        rule: {
-            en: "Name the alternatives and say whom each one fits; take competitor facts only from their own pages, with a date.",
-            tr: "Alternatifleri sayın, hangisinin kime uygun olduğunu yazın; rakip bilgisini yalnızca kendi sayfasından, tarihiyle alın.",
-        },
-    },
-    {
-        n: 9,
-        tags: ["GEO"],
-        name: { en: "FAQ: 5–8 questions", tr: "SSS: 5–8 soru" },
-        example: { en: "Questions in the customer's words", tr: "Müşterinin ağzından sorular" },
-        rule: {
-            en: "Questions in the customer's words, answers whose first sentence is the answer. Google no longer shows an FAQ rich result; this block is for the assistant.",
-            tr: "Müşterinin ağzından sorular, ilk cümlesi cevap olan yanıtlar. Google’da SSS zengin sonucu yok; bu blok asistan için.",
-        },
-    },
-    {
-        n: 10,
-        tags: ["SEO"],
-        name: { en: "Related pages", tr: "İlgili sayfalar" },
-        example: { en: "3–5 text links", tr: "3–5 metinli link" },
-        rule: {
-            en: "Internal links with descriptive text; every page gets a link from somewhere.",
-            tr: "Metinli iç linkler; her sayfa en az bir yerden link alsın.",
-        },
-    },
-    {
-        n: 11,
-        tags: ["SEO", "GEO"],
-        name: { en: "Updated date · author · JSON-LD", tr: "Güncellendi · yazar · JSON-LD" },
-        example: { en: "Updated: 29 Sep 2026 · Author · JSON-LD", tr: "Güncellendi: 29.09.2026 · Yazar · JSON-LD" },
-        rule: {
-            en: "A real update date (changed only when the text changes), the author, valid JSON-LD. In the sample site's first version all 85 pages carried the launch date; we fixed it.",
-            tr: "Gerçek güncelleme tarihi (yalnızca metin değişince), yazar, geçerli JSON-LD. Örnek sitede ilk sürümde 85 sayfanın hepsi yayın tarihini taşıyordu; düzelttik.",
-        },
-    },
-];
-/** The page brief the book tells you to start P6 with. */
-export const PAGE_BRIEF_TEMPLATE = {
-    en: `Situation: [the customer's sentence]
-URL: /[words]                               Title: [situation] — [brand]
-First sentence: [brings] → [we do] → [they get]. [fear is unnecessary].
-Action: [file drop / trial / pricing]
-Proof: [number, source, date]
-Not for: [2–3 bullets]
-Alternatives: [competitor: who it fits]
-FAQ: [5–8 questions, in the customer's words]
-Related pages: [3–5 URLs]`,
-    tr: `Durum: [müşterinin cümlesi]
-Adres: /[kelimeler]                               Title: [durum] — [marka]
-İlk cümle: [getirir] → [yaparız] → [eline geçer]. [korku gereksiz].
-Eylem: [dosya kutusu / deneme / fiyat]
-Kanıt: [sayı, kaynak, tarih]
-Kimler için değil: [2-3 madde]
-Alternatifler: [rakip: kime uygun]
-SSS: [5-8 soru, müşterinin ağzından]
-İlgili sayfalar: [3-5 adres]`,
-};
-export const ANATOMY_EXERCISE = {
-    en: "Write your own four-part sentence (brings → we do → gets → fear is unnecessary). Put the same sentence in three places: the first paragraph of your most important page, that page's meta description, and llms.txt.",
-    tr: "Kendi dört parçalı cümlenizi yazın (getirir → yaparız → eline geçer → korku gereksiz). Aynı cümleyi üç yere koyun: en önemli sayfanın ilk paragrafı, o sayfanın meta açıklaması, llms.txt.",
-};
+// Filled from katman.pro at run time for a paid key (see _store.js); the package carries no method text.
+import { onMethod } from "./_store.js";
+export let ANATOMY = [];
+export let ANATOMY_EXERCISE = {};
+export let ANATOMY_INTRO = {};
+export let PAGE_BRIEF_TEMPLATE = {};
+onMethod((d) => {
+  if (d.ANATOMY !== undefined) ANATOMY = d.ANATOMY;
+  if (d.ANATOMY_EXERCISE !== undefined) ANATOMY_EXERCISE = d.ANATOMY_EXERCISE;
+  if (d.ANATOMY_INTRO !== undefined) ANATOMY_INTRO = d.ANATOMY_INTRO;
+  if (d.PAGE_BRIEF_TEMPLATE !== undefined) PAGE_BRIEF_TEMPLATE = d.PAGE_BRIEF_TEMPLATE;
+});