searvex-seo 0.7.0 → 1.0.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "searvex",
-  "version": "0.7.0",
+  "version": "1.0.0",
   "description": "Search intelligence & optimization engine: deterministic technical SEO + GEO audits with a sourced rule base, competitor research, and safe, verified code fixes with rollback.",
   "author": { "name": "Cihan Topaç", "url": "https://github.com/cihantopac" },
   "license": "Apache-2.0",

package/CHANGELOG.md

@@ -5,6 +5,59 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
+## [1.0.0] - 2026-11-01
+
+First stable release. Every capability advertised as supported has been verified end to end; Bing Webmaster
+is the one integration shipped as experimental. Evidence: [docs/release-checklist.md](docs/release-checklist.md)
+and [docs/quality.md](docs/quality.md).
+
+### Security and data integrity
+- `monitor` no longer attaches search data of another website: `--import`, `--site-url`, `SEARVEX_GSC_SITE`
+  and `--baseline` are checked against the monitored site; an export without a pages table needs `--property`.
+- Search Console exports whose pages span several subdomains are scoped as domain properties (their totals
+  include every subdomain); an explicit `--property` that does not contain every exported page is refused.
+- `--render`: a hard per-page deadline stops pages whose scripts never yield or allocate without bound; a
+  stuck browser is replaced. Local host names with a trailing dot are blocked.
+- Optimizer: backups and the manifest are written before the first file (an interrupted apply is recoverable
+  with `rollback`, and new applies are refused until then); a failed verification never overwrites files
+  edited meanwhile; CRLF line endings and file modes are preserved.
+- Credentials: opt-in OS keychain store (`SEARVEX_CREDENTIAL_STORE=keychain`: macOS Keychain, Secret Service,
+  Windows DPAPI) using the OS's own tools with secrets on stdin; entries are isolated per config directory.
+  Automated scans confirm that no token, key or client secret reaches output or run files.
+
+### Added
+- `searvex bing auth|status|sites|logout` and `searvex crux auth|status|logout`: keys are entered without echo,
+  checked against the API and kept in the credential store instead of environment variables.
+- `gsc auth` opens the browser for consent (`--no-browser` to only print the URL).
+- `THIRD_PARTY_NOTICES.md` with the licence texts of all bundled runtime packages.
+
+### Changed
+- Search Console API reports show property totals from the daily series (anonymised queries included), equal
+  to the CSV export of the same period. Bing reports use the daily site series for totals and explain empty
+  data. `bing report` requires a verified site of the account.
+- "Fix first" names the likely root cause of dependent findings (e.g. a client-side language switch that
+  changes titles, canonicals and hreflang for renderers) and ranks it first.
+- 3-letter hreflang codes without an ISO 639-1 equivalent (`ast`, `ceb`) are reported at low severity with an
+  explanation instead of as high-severity mistakes; a finding's severity is its most severe occurrence.
+- Status commands (`gsc|bing|crux status`) exit 0 only when the integration is usable.
+
+### Fixed
+- Repository mode: test/fixture/benchmark/example folders, HTML fragments and server template folders are not
+  treated as the site (a repository without a website now scores n/a); static sites in workspace folders and
+  locale sub-folders are found; clean URLs; sitemap URLs without a file (unless another app routes them); all
+  Laravel route files; Blade/PHP expressions no longer hide attributes; admin views and tests skipped; error
+  pages modelled as 404/500; Next.js fill images and aspect-ratio utility classes are sized; personal sites
+  are not asked for Organization markup.
+- Website mode: pages linked only through internal redirects are not orphans; orphans are not reported on
+  crawls stopped at the page limit; cannibalisation candidates must share a language and exclude legal pages;
+  Turkish soft-404 wording is detected (Unicode-aware boundaries).
+
+### Verified
+- Live: Search Console API (authorization, refresh, properties, pagination, reports), Search Console CSV
+  (real Turkish and English exports), CrUX (values identical to the raw API), Bing Webmaster (mechanics; no
+  site data yet). Real-world rounds on 13 public sites and 9 repositories; benchmarks to 50,000 pages;
+  reproducible package; clean installs on Linux, macOS and Windows.
+
 ## [0.7.0] - 2026-10-30
 
 ### Added

package/NOTICE

@@ -11,6 +11,8 @@ The bundled distribution (dist/searvex.mjs) includes the following third-party s
 - robots-parser (MIT)        https://github.com/samclarke/robots-parser
 - @babel/parser (MIT)        https://github.com/babel/babel
 
+Full licence texts of every bundled package: THIRD_PARTY_NOTICES.md.
+
 Rule descriptions summarise and link to official documentation from Google Search Central, Bing
 Webmaster, Yandex, schema.org, W3C, web.dev, MDN and crawler operators. Those documents remain the
 property of their respective owners.

package/README.md

@@ -5,9 +5,10 @@ repositories for technical SEO and GEO/AEO (AI search) issues against a **source
 base**, researches competitors, and applies **safe, verified code fixes with one-command rollback**.
 It ships as a standalone CLI and as a Claude Code plugin.
 
-> Status: **v0.7.0 (early)**. The engine, rule base, CLI and plugin are tested (automated tests incl. Playwright rendering, CI on Linux/macOS/Windows,
-> real-site and real-repository validation — see [docs/quality.md](docs/quality.md)). Expect rough
-> edges; read [Limitations](#limitations) before relying on it.
+> Status: **v1.0.0**. Tested with automated tests (incl. Playwright rendering and adversarial isolation tests),
+> CI on Linux, macOS and Windows, clean installs of the packed package, and real-world validation on 13 public
+> sites, 9 repositories and live Search Console / CrUX accounts — see [docs/quality.md](docs/quality.md) and
+> [docs/release-checklist.md](docs/release-checklist.md). Read [Limitations](#limitations) before relying on it.
 
 ## Why Searvex
 
@@ -37,8 +38,8 @@ Competitor research and differentiation notes: [docs/research/competitors-2026-1
   (`research`).
 - Fix a small set of problems in code automatically (9 rule types: e.g. missing `lang`, viewport, robots.txt
   sitemap line, invalid hreflang codes), always as a dry-run diff first, then apply → re-verify → rollback.
-- Read Search Console or Bing data when you connect them yourself, and keep measured data separate from
-  inference.
+- Read Search Console data from a CSV export you download (no account needed), or from the Search Console
+  API (your own OAuth client) and the Bing API (experimental) when you connect them yourself, and keep measured data separate from inference.
 
 **Searvex does not:**
 
@@ -114,7 +115,7 @@ searvex connect https://example.com
 searvex gsc import performance-export.zip --audit latest   # Search Console CSV export, no account access
 searvex gsc auth --client client_secret.json               # your own Google OAuth "Desktop app" client
 searvex gsc report sc-domain:example.com --audit latest
-SEARVEX_BING_API_KEY=… searvex bing report https://example.com/
+searvex bing auth && searvex bing report https://example.com/   # Bing API key, asked once (hidden input)
 
 # Inspect the rule base and re-verify its official sources
 searvex rules check-sources
@@ -129,13 +130,28 @@ Full reference: [docs/cli.md](docs/cli.md).
 
 ### Optional integrations (read-only, opt-in)
 
-| Variable | Enables |
-|---|---|
-| `SEARVEX_CRUX_API_KEY` | Real-user Core Web Vitals (Chrome UX Report API) |
-| `searvex gsc auth` (or `SEARVEX_GSC_TOKEN`) | Search Console query × page analysis, `monitor` performance |
-| `SEARVEX_BING_API_KEY` | Bing Webmaster Tools query × page analysis |
-| `searvex gsc import export.zip` | Search Console Performance CSV/ZIP exports (no account access; no query × page data) |
-| `npm i -D playwright` | `--render`: JavaScript rendering and raw-vs-rendered comparison |
+| Variable | Enables | Status |
+|---|---|---|
+| `npm i -D playwright` | `--render`: JavaScript rendering and raw-vs-rendered comparison | supported |
+| `searvex gsc import export.zip` | Search Console Performance CSV/ZIP exports (no account access; no query × page data) | supported² |
+| `searvex gsc auth` (or `SEARVEX_GSC_TOKEN`) | Search Console query × page analysis, `monitor` performance | supported³ |
+| `searvex bing auth` (or `SEARVEX_BING_API_KEY`) | Bing Webmaster Tools query × page analysis | experimental¹ |
+| `searvex crux auth` (or `SEARVEX_CRUX_API_KEY`) | Real-user Core Web Vitals (Chrome UX Report API) | supported⁴ |
+| `SEARVEX_CREDENTIAL_STORE=keychain` | Keep the Search Console refresh token in the OS keychain instead of a 0600 file | supported |
+
+¹ Experimental: implemented and tested against recorded API behaviour and synthetic exports, but not yet
+verified against the live service or real exports in every UI language. Interfaces may change; please report
+problems. See [docs/release-checklist.md](docs/release-checklist.md).
+
+² Verified with real exports downloaded in the Turkish and English Search Console UI (both give identical
+results); other UI languages are recognised from published UI terms.
+
+³ Verified against the live Search Console API (authorization, refresh, property discovery, pagination,
+reports; totals identical to the CSV export of the same period). Revocation on `gsc logout` is tested against a
+mock server only.
+
+⁴ Verified against the live CrUX API: values identical to the raw API response; origins without enough
+real-user traffic are reported as not measured.
 
 Without them, Searvex reports these metrics as **not measured** — it never estimates them.