seo 0.12.0 → 0.13.0

package/PRIVACY.md

@@ -13,7 +13,8 @@ keeps your Search Console or analytics data, your reports or a log of your
 requests. When you first sign up it also notes how you found it: the
 sign-in path, the agent or app, and the site that sent you there. The only
 thing kept about your use is an anonymous usage count (the event, report,
-agent, version and week).
+agent, version and week). Accounts in the weekly site audit beta also have
+their audited sites' crawl results kept, as described below.
 
 The command-line tool runs on your machine. It does not create an SEO
 account, upload reports to a hosted SEO service, or send reports or connected
@@ -38,6 +39,18 @@ Cloudflare D1 with only these things:
 - **Your linked Bing account, if you link one.** Its refresh and access
   tokens, with read-only access to Bing Webmaster Tools, and a name made
   from its sites.
+- **Search Console folders you add from the Sites tab.** "Create these in
+  Search Console" asks Google, at that moment, for permission to add and
+  manage your Search Console properties. The server uses it once, to add
+  the folders listed on the page, and does not keep that permission or its
+  token. It keeps which folders it added and whether Google verified them.
+- **Alerts, for accounts in the weekly-audit beta.** Which alerts you want
+  by email and by webhook, your webhook URL and its signing secret, and
+  each alert sent in the last 30 days: the site, the pages that changed
+  and whether it was delivered. Alert email goes to your first linked
+  Google account's address through PostShiba, our email provider, which
+  receives that address and the alert's text to send it. A webhook gets
+  the same alert at the URL you save.
 - **Your API keys, if you save them.** A DataForSEO login and password, an
   Ahrefs key and a TypeSafe key.
 - **Your Clicky sites, if you save them.** Each site's numeric site ID,
@@ -83,7 +96,47 @@ it. The token your MCP client keeps carries only your person id.
 
 The server keeps nothing else. It does not keep reports, Search Console
 or Google Analytics rows, lists of your sites, or the pages it checked.
-Request logs are turned off.
+Request logs are turned off. The one exception is the weekly site audit
+beta, below, and only for the sites you add to it.
+
+### Weekly site audit (beta)
+
+The maintainer turns this beta on for chosen accounts; no one else has it.
+For each Search Console property you add on the account page, the server
+crawls the site once a week, up to 5,000 pages, as `SEOSkillBot`, and
+follows the site's `robots.txt`. It keeps, per site:
+
+- the property name, when you added it and when the next crawl is due;
+- the latest crawl and the one before it: each page's URL, status,
+  redirect target, title, description, first heading, canonical, robots
+  settings, word count and the internal links on it with their link text;
+- the findings worked out from them (such as broken links or missing
+  titles), with when each was first seen and resolved; resolved findings
+  are removed after 90 days;
+- a one-line summary of each of the last 52 crawls (counts only);
+- Google's URL Inspection result for each known URL of the site (the
+  sitemap's, the crawl's and the Search Console pages with clicks or
+  impressions, up to 50,000 from the sitemap and crawl): its indexing
+  reason and Google's details, when it was checked and is due again, the
+  reason before it last changed, and when it last dropped out of or came
+  back to Google's index. The server checks these in the background each day, within
+  Google's 2,000 checks a day per property, and `seo_page` and `seo_index`
+  read and add to the same results;
+- for each of those Search Console pages, its clicks and impressions in the
+  last 28 days and its clicks in the 28 days before, replaced each day;
+- how many URL Inspection checks each property used today;
+- how many pages a day Google can check for the site, and the folders worth
+  adding as their own Search Console properties, with which of them you
+  added from the account page.
+
+If you click Create these in Search Console, Google asks you for
+permission to manage Search Console for that Google account. The server
+uses that permission once, to add the listed folders as properties and
+read back whether each is verified. It asks for no refresh token and
+keeps no token afterwards.
+
+Remove a site on the account page and all of this is deleted at once.
+Delete everything deletes it for every site.
 
 - **Your data.** Search Console, Google Analytics, Clicky and provider responses are
   fetched for each request, returned to your MCP client and not kept. Pages checked live are fetched for the request and not kept.
@@ -112,7 +165,8 @@ Request logs are turned off.
 
 Sign in at [seoskill.dev/account](https://seoskill.dev/account) and choose
 **Delete everything**. It deletes your person id, linked accounts, keys,
-Clicky sites, linked machines, beta features and how you signed up,
+Clicky sites, linked machines, beta features, audited sites with their
+crawl data and how you signed up,
 and revokes the Google sign-ins. Your agents will ask you to sign in again if
 you use the hosted server later. You can also revoke SEO Skill in your
 [Google Account connections](https://myaccount.google.com/connections), which

package/README.md

@@ -142,7 +142,7 @@ ends with the command to run next, so your agent always knows where to go.
 
 | Command | What it returns |
 | --- | --- |
-| [`seo report`](https://seoskill.dev/docs/report) | Your Search Console overview, then the top rows of each section |
+| [`seo report`](https://seoskill.dev/docs/report) | Your Search Console overview for `--site`, then the top rows of each section |
 | [`seo page`](https://seoskill.dev/docs/page) | One URL: the live page, its Google index status and its queries |
 | [`seo compare`](https://seoskill.dev/docs/compare) | Before and after a date, with Google updates |
 | [`seo index`](https://seoskill.dev/docs/indexing) | Google's indexing reasons for known URLs, labelled from live checks, and pages that lost their clicks |