ssrwire 0.2.0 → 0.3.0

package/CHANGELOG.md

@@ -5,6 +5,28 @@ All notable changes to SSRWire are documented here. The project follows
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-08-28
+
+### Added
+
+- Streamed capture for core Open Graph and Twitter Card metadata with arrival
+  time, observed byte position, document location, bounded repeated values, and
+  report redaction.
+- Opt-in `require.openGraph` and `require.twitterCard` target contracts with
+  missing-field, invalid-URL, duplicate/conflict, and head/body delivery
+  findings.
+- A terminal social-preview readiness table and public social metadata signal
+  types in JSON and the programmatic API.
+
+### Changed
+
+- Enabled social contracts now participate in required-signal timing,
+  cross-agent comparison, and repeated-sample stability analysis.
+- Twitter Card readiness prefers native Twitter metadata and falls back to the
+  corresponding Open Graph title, description, and image.
+- Multiple `og:image` values are retained in document order without being
+  treated as conflicting scalar metadata.
+
 ## [0.2.0] - 2026-08-24
 
 ### Added
@@ -36,6 +58,7 @@ All notable changes to SSRWire are documented here. The project follows
 - Terminal, JSON, and SARIF reports with CI-safe exit codes.
 - YAML configuration, one-off URL checks, Docker support, and GitHub Actions examples.
 
-[Unreleased]: https://github.com/lame13/ssrwire/compare/v0.2.0...HEAD
+[Unreleased]: https://github.com/lame13/ssrwire/compare/v0.3.0...HEAD
+[0.3.0]: https://github.com/lame13/ssrwire/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/lame13/ssrwire/compare/v0.1.0...v0.2.0
 [0.1.0]: https://github.com/lame13/ssrwire/releases/tag/v0.1.0

package/CONTRIBUTING.md

@@ -28,6 +28,7 @@ Keep each change narrow. Include tests for behavior changes, especially for:
 - response chunk boundaries and elements split across chunks;
 - redirects, timeouts, aborted bodies, and size limits;
 - malformed, duplicated, late, or body-located metadata;
+- Open Graph and Twitter Card requirements, fallbacks, arrays, and URL values;
 - user-agent differences and comparison findings;
 - repeated-sample ordering, aggregation, and instability classification;
 - redaction of configured header values;

package/PUBLISHING.md

@@ -1,4 +1,4 @@
-# Publish SSRWire 0.2.0 from a local machine
+# Publish SSRWire 0.3.0 from a local machine
 
 This repository intentionally includes no npm publishing workflow. Publish from
 a foreground local terminal only after the GitHub `CI` workflow passes. Do not
@@ -10,7 +10,7 @@ request, and do not use an administrator bypass or a direct push to `main`.
 
 ## 1. Update the existing repository
 
-Work from a clean clone of the existing public repository. Copy the 0.2.0
+Work from a clean clone of the existing public repository. Copy the 0.3.0
 source files into that clone while preserving its `.git` directory.
 
 ```bash
@@ -18,7 +18,7 @@ cd ssrwire
 git switch main
 git pull --ff-only origin main
 git status --short
-git switch -c release/0.2.0
+git switch -c release/0.3.0
 ```
 
 `git status --short` must be empty before creating the release branch and
@@ -36,7 +36,7 @@ npm pack --dry-run
 node dist/bin.js --version
 ```
 
-The final command must print `0.2.0`. Inspect the dry-run file list. It must not
+The final command must print `0.3.0`. Inspect the dry-run file list. It must not
 contain `.env`, `.github`, `node_modules`, `test`, ZIP files, or tarballs.
 
 Review the release diff and version references:
@@ -45,7 +45,7 @@ Review the release diff and version references:
 git diff --check
 git diff --stat
 git diff -- package.json package-lock.json CHANGELOG.md README.md PUBLISHING.md
-rg '0\.1\.0' README.md examples package.json package-lock.json src test
+rg '0\.2\.0' README.md examples package.json package-lock.json scripts src test
 ```
 
 The final search should return nothing. Historical entries in `CHANGELOG.md`
@@ -58,10 +58,10 @@ gh auth status -h github.com || gh auth login -h github.com --web
 git add --all
 git diff --cached --check
 git diff --cached --stat
-git commit -m "feat: release SSRWire 0.2.0"
-git push --set-upstream origin release/0.2.0
-gh pr create --base main --head release/0.2.0 --fill
-PR_NUMBER="$(gh pr view release/0.2.0 --json number --jq .number)"
+git commit -m "feat: release SSRWire 0.3.0"
+git push --set-upstream origin release/0.3.0
+gh pr create --base main --head release/0.3.0 --fill
+PR_NUMBER="$(gh pr view release/0.3.0 --json number --jq .number)"
 test -n "$PR_NUMBER"
 gh pr checks "$PR_NUMBER" --watch --fail-fast
 ```
@@ -102,8 +102,8 @@ npm config get registry
 npm config get provenance
 ```
 
-The published version and `latest` tag must still be `0.1.0`. If npm already
-reports `0.2.0`, stop: never reuse a version that npm accepted.
+The published version and `latest` tag must still be `0.2.0`. If npm already
+reports `0.3.0`, stop: never reuse a version that npm accepted.
 
 In the npm package settings, select **Require two-factor authentication and
 disallow tokens**. npm documents this as the strongest package publishing
@@ -132,7 +132,7 @@ or add an npm credential to the repository or GitHub Actions. The package-level
 "disallow tokens" setting ensures that publication remains interactive.
 
 If npm's publish-time scanning delays package visibility, wait. Do not publish
-`0.2.0` again or change the tag to work around propagation.
+`0.3.0` again or change the tag to work around propagation.
 
 ## 6. Tag the exact published commit
 
@@ -140,9 +140,9 @@ If npm's publish-time scanning delays package visibility, wait. Do not publish
 node scripts/clean.mjs
 rm -rf node_modules/.vite
 git status --short
-git tag -a v0.2.0 -m "SSRWire v0.2.0"
-git push origin v0.2.0
-gh release create v0.2.0 --generate-notes --title "SSRWire v0.2.0"
+git tag -a v0.3.0 -m "SSRWire v0.3.0"
+git push origin v0.3.0
+gh release create v0.3.0 --generate-notes --title "SSRWire v0.3.0"
 ```
 
 `git status --short` must print nothing before tagging.

package/README.md

@@ -4,14 +4,14 @@
 [![npm version](https://img.shields.io/npm/v/ssrwire.svg)](https://www.npmjs.com/package/ssrwire)
 [![MIT License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
-Inspect streamed SSR HTML, metadata timing, and crawler-specific delivery from
-the command line.
+Inspect streamed SSR HTML, SEO and social metadata timing, and crawler-specific
+delivery from the command line.
 
 SSRWire makes a real HTTP request for each selected user-agent profile, reads
-the response incrementally, and records when important SEO signals become
-observable to its parser. It reports their elapsed time, observed byte
-position, and document location without launching a browser or executing
-JavaScript.
+the response incrementally, and records when important SEO and social-preview
+signals become observable to its parser. It reports their elapsed time,
+observed byte position, and document location without launching a browser or
+executing JavaScript.
 
 ```bash
 npx ssrwire https://example.com/product
@@ -25,7 +25,8 @@ Modern SSR output is not always one complete HTML document delivered at once:
 - a framework may intentionally stream metadata into `<body>` for a capable
   crawler while blocking for an HTML-limited bot;
 - browser, search-crawler, and social-crawler user agents may receive different
-  titles, canonicals, robots directives, redirects, or statuses;
+  titles, canonicals, social-preview metadata, robots directives, redirects, or
+  statuses;
 - the same URL and user agent may receive inconsistent SSR output between requests;
 - an interrupted or oversized stream may never deliver the expected elements;
 - a working hydrated page can hide thin or incomplete source HTML.
@@ -91,8 +92,8 @@ For each target, agent, and configured sample, SSRWire captures:
 - response status, final URL, redirect chain, and an allowlisted response-header snapshot;
 - time to response headers, first response-body bytes, and completed body;
 - total bytes delivered to the stream parser and a body fingerprint;
-- title, meta description, canonical, meta robots, H1, first main-content
-  text, and JSON-LD blocks;
+- title, meta description, canonical, meta robots, Open Graph, Twitter Card,
+  H1, first main-content text, and JSON-LD blocks;
 - elapsed arrival time, observed byte position, and `head`/`body` location for
   each signal;
 - clean completion, timeout, network failure, invalid response, or configured
@@ -107,10 +108,12 @@ It then checks:
 | Missing title | Error |
 | Missing description, canonical, H1, or main text | Warning |
 | Duplicate or conflicting title, description, canonical, or robots values | Warning |
+| Missing an enabled Open Graph or Twitter Card contract | Warning |
+| Invalid social metadata URL or conflicting scalar social metadata | Warning |
 | Invalid JSON-LD | Warning |
 | JSON-LD block/count exceeds the bounded analysis budget | Warning |
-| Critical metadata in `<body>` for a profile that requires head metadata | Error |
-| Status, final URL, title, canonical, or robots drift between profiles | Warning |
+| Critical or enabled social metadata in `<body>` for a profile that requires head metadata | Error |
+| Status, final URL, title, canonical, robots, or enabled social metadata drift between profiles | Warning |
 | Completion, status, final URL, or redirect-chain drift between samples | Warning |
 | Metadata value or document-location drift between complete samples | Warning |
 | Exact body fingerprint drift without metadata drift | Information |
@@ -162,6 +165,41 @@ agents:
     requiresHeadMetadata: true
 ```
 
+## Social preview metadata
+
+Every probe captures these bounded, ordered metadata signals when they arrive
+before completion or termination:
+
+- Open Graph: `og:title`, `og:type`, `og:url`, `og:image`, and
+  `og:description`;
+- Twitter Card: `twitter:card`, `twitter:title`, `twitter:description`, and
+  `twitter:image`.
+
+SSRWire accepts either the conventional `property` attribute or a `name`
+attribute for those keys. Each captured value carries the same arrival time,
+observed byte position, and document location as the existing metadata
+signals. The terminal report shows a compact readiness table whenever social
+metadata is observed or required, while JSON retains every captured value.
+
+Social policy is opt-in per target. `openGraph: true` requires the four basic
+[Open Graph protocol](https://ogp.me/) properties: title, type, URL, and image.
+The `twitterCard: true` option requires `twitter:card` plus a usable title,
+description, and image; SSRWire prefers the corresponding `twitter:*` value
+and falls back to `og:title`, `og:description`, or `og:image`. These are
+explicit SSRWire audit contracts, not a claim that a social platform will
+render a particular preview.
+
+Enabled contracts also participate in critical-signal timing, head/body
+policy, cross-agent drift, and repeated-sample stability checks. URL-valued
+fields must be absolute HTTP or HTTPS URLs. Open Graph permits multiple images,
+so SSRWire retains them in order without treating the array as a scalar
+conflict; the first non-empty image satisfies readiness.
+
+When both options are false, SSRWire still records and reports raw social
+signals but emits no social-policy or social-drift findings. It does not fetch
+images, verify dimensions or media types, execute JavaScript, or simulate a
+platform's rendered preview.
+
 ## Configuration
 
 SSRWire automatically looks for `ssrwire.config.yml`,
@@ -179,6 +217,8 @@ targets:
       canonical: true
       h1: true
       mainText: true
+      openGraph: true
+      twitterCard: true
     maxFirstByteMs: 1200
     maxCriticalMs: 2500
 
@@ -190,6 +230,8 @@ targets:
       canonical: false
       h1: true
       mainText: true
+      openGraph: false
+      twitterCard: false
 
 agents:
   - browser
@@ -218,6 +260,7 @@ Defaults:
 
 - expected status: `200`;
 - title, description, canonical, H1, and main text: required;
+- Open Graph and Twitter Card contracts: disabled;
 - agents: `browser`, `googlebot`, `bingbot`, and `twitterbot`;
 - timeout: 15 seconds per probe;
 - response limit: 10 MiB;
@@ -262,11 +305,11 @@ The final response must declare `text/html` or `application/xhtml+xml` as its
 sniff headerless, JSON, text, or binary responses for HTML-looking fragments.
 
 To keep hostile or accidentally huge pages bounded, SSRWire retains at most
-256 signals of each repeated metadata kind, analyzes at most 64 JSON-LD blocks,
-and captures at most 1,048,576 characters from one JSON-LD block. Exceeding a
-JSON-LD analysis budget produces a dedicated warning rather than being
-mislabeled as invalid JSON. The configured response-byte limit remains the
-outer bound.
+256 signals of each repeated metadata kind, including each supported social
+property, analyzes at most 64 JSON-LD blocks, and captures at most 1,048,576
+characters from one JSON-LD block. Exceeding a JSON-LD analysis budget produces
+a dedicated warning rather than being mislabeled as invalid JSON. The
+configured response-byte limit remains the outer bound.
 
 ## Timing interpretation
 
@@ -311,9 +354,11 @@ the maximum.
 
 Timing spread alone is evidence, not a failure. Network and cache variation can
 change timings without changing the response contract. SSRWire warns when HTTP
-response evidence or streamed metadata changes across samples. Exact body-hash
-variation by itself is informational because timestamps, nonces, and other
-legitimate dynamic values commonly change source HTML.
+response evidence or streamed metadata changes across samples. Enabled social
+contracts are included in metadata stability; observed social tags remain
+evidence-only when their contracts are disabled. Exact body-hash variation by
+itself is informational because timestamps, nonces, and other legitimate
+dynamic values commonly change source HTML.
 
 ## CLI reference
 
@@ -344,7 +389,8 @@ removed.
 
 ## Reports and exit codes
 
-- `terminal`: compact sample, aggregate-timing, and finding tables for local use.
+- `terminal`: compact sample, social-readiness, aggregate-timing, and finding
+  tables for local use.
 - `json`: structured machine-readable evidence, including every probe and timing
   signal plus repeated-run stability summaries.
 - `sarif`: findings suitable for GitHub Code Scanning and other SARIF 2.1.0
@@ -420,9 +466,10 @@ versions.
 
 ## Scope
 
-SSRWire does not execute JavaScript, inspect a hydrated DOM, measure Core Web
-Vitals, discover URLs, validate indexing, bypass access controls, perform load
-testing, or emulate a crawler's rendering pipeline. Use
+SSRWire does not execute JavaScript, inspect a hydrated DOM, render social
+previews, fetch social images, measure Core Web Vitals, discover URLs, validate
+indexing, bypass access controls, perform load testing, or emulate a crawler's
+rendering pipeline. Use
 [RoutePlay](https://github.com/lame13/routeplay) for server HTML versus a cold
 browser versus real client-side navigation. Use
 [RouteLint](https://github.com/lame13/routelint) for route discovery,

package/dist/analyze.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyze.d.ts","sourceRoot":"","sources":["../src/analyze.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EAEX,OAAO,EACP,WAAW,EAIX,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAgepB,wBAAgB,aAAa,CAC3B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,SAAS,WAAW,EAAE,GAC7B,SAAS,OAAO,EAAE,CAuGpB;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,GAAG,YAAY,CA6BlF"}
+{"version":3,"file":"analyze.d.ts","sourceRoot":"","sources":["../src/analyze.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EAEX,OAAO,EACP,WAAW,EAMX,iBAAiB,EAClB,MAAM,YAAY,CAAC;AA2pBpB,wBAAgB,aAAa,CAC3B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,SAAS,WAAW,EAAE,GAC7B,SAAS,OAAO,EAAE,CAwGpB;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,GAAG,YAAY,CA6BlF"}

package/dist/analyze.js

@@ -1,3 +1,4 @@
+import { effectiveTwitterCardSignal, firstSocialSignal, isAbsoluteHttpSocialUrl, normalizeSocialValue, OPEN_GRAPH_PROPERTIES, OPEN_GRAPH_REQUIRED_PROPERTIES, socialSignals, TWITTER_CARD_REQUIRED_FIELDS, TWITTER_PROPERTIES, } from "./social.js";
 const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
 const ROBOTS_OPPOSITES = [
     ["index", "noindex"],
@@ -201,6 +202,120 @@ function checkRepeatedRobots(findings, targetUrl, probe) {
         });
     }
 }
+function auditedSocialProperties(target, probe) {
+    const properties = new Set();
+    if (target.expectations.requireOpenGraph === true) {
+        for (const property of OPEN_GRAPH_PROPERTIES)
+            properties.add(property);
+    }
+    if (target.expectations.requireTwitterCard === true) {
+        for (const property of TWITTER_PROPERTIES)
+            properties.add(property);
+        if (firstSocialSignal(probe.signals, "twitter:title") === undefined) {
+            properties.add("og:title");
+        }
+        if (firstSocialSignal(probe.signals, "twitter:description") === undefined) {
+            properties.add("og:description");
+        }
+        if (firstSocialSignal(probe.signals, "twitter:image") === undefined) {
+            properties.add("og:image");
+        }
+    }
+    return [...properties];
+}
+function normalizedSocialValues(property, signals, baseUrl) {
+    return signals
+        .map((signal) => normalizeSocialValue(property, signal.value, baseUrl))
+        .filter((value) => value.length > 0);
+}
+function checkRepeatedSocialMetadata(findings, target, probe) {
+    for (const property of auditedSocialProperties(target, probe)) {
+        // Open Graph explicitly permits multiple images and gives the first one precedence.
+        if (property === "og:image")
+            continue;
+        const values = normalizedSocialValues(property, socialSignals(probe.signals, property), probe.finalUrl);
+        if (values.length < 2)
+            continue;
+        const distinct = new Set(values);
+        const conflicting = distinct.size > 1;
+        addFinding(findings, target.url, {
+            code: conflicting ? "conflicting-social-metadata" : "duplicate-social-metadata",
+            severity: "warning",
+            message: conflicting
+                ? `${probe.agent.label} received conflicting ${property} values.`
+                : `${probe.agent.label} received duplicate ${property} values.`,
+            agent: probe.agent.key,
+            evidence: {
+                property,
+                count: values.length,
+                distinctValues: distinct.size,
+                values: [...distinct].join(" | "),
+            },
+        });
+    }
+}
+function checkSocialUrls(findings, target, probe) {
+    const candidates = new Set();
+    if (target.expectations.requireOpenGraph === true) {
+        for (const signal of socialSignals(probe.signals, "og:url"))
+            candidates.add(signal);
+        for (const signal of socialSignals(probe.signals, "og:image"))
+            candidates.add(signal);
+    }
+    if (target.expectations.requireTwitterCard === true) {
+        const image = effectiveTwitterCardSignal(probe.signals, "image");
+        if (image !== undefined)
+            candidates.add(image);
+    }
+    for (const signal of candidates) {
+        if (signal.value.trim().length === 0 || isAbsoluteHttpSocialUrl(signal.value))
+            continue;
+        addFinding(findings, target.url, {
+            code: "invalid-social-metadata-url",
+            severity: "warning",
+            message: `${probe.agent.label} received a non-absolute HTTP(S) ${signal.property} URL.`,
+            agent: probe.agent.key,
+            evidence: { property: signal.property, value: signal.value },
+        });
+    }
+}
+function checkRequiredSocialMetadata(findings, target, probe) {
+    if (probe.completion !== "complete")
+        return;
+    if (target.expectations.requireOpenGraph === true) {
+        const missing = OPEN_GRAPH_REQUIRED_PROPERTIES.filter((property) => firstSocialSignal(probe.signals, property) === undefined);
+        if (missing.length > 0) {
+            addFinding(findings, target.url, {
+                code: "missing-open-graph-metadata",
+                severity: "warning",
+                message: `${probe.agent.label} received an incomplete Open Graph metadata set.`,
+                agent: probe.agent.key,
+                evidence: { fields: missing.join(", ") },
+            });
+        }
+    }
+    if (target.expectations.requireTwitterCard === true) {
+        const missing = TWITTER_CARD_REQUIRED_FIELDS.filter((field) => effectiveTwitterCardSignal(probe.signals, field) === undefined);
+        if (missing.length > 0) {
+            addFinding(findings, target.url, {
+                code: "missing-twitter-card-metadata",
+                severity: "warning",
+                message: `${probe.agent.label} received an incomplete Twitter Card metadata set.`,
+                agent: probe.agent.key,
+                evidence: { fields: missing.join(", ") },
+            });
+        }
+    }
+}
+function checkSocialMetadata(findings, target, probe) {
+    if (target.expectations.requireOpenGraph !== true &&
+        target.expectations.requireTwitterCard !== true) {
+        return;
+    }
+    checkRequiredSocialMetadata(findings, target, probe);
+    checkRepeatedSocialMetadata(findings, target, probe);
+    checkSocialUrls(findings, target, probe);
+}
 function criticalArrivalMs(target, probe) {
     const marks = [];
     const { expectations } = target;
@@ -229,6 +344,18 @@ function criticalArrivalMs(target, probe) {
         normalizeText(probe.signals.firstMainText?.value ?? "").length > 0) {
         marks.push(probe.signals.firstMainText?.atMs ?? 0);
     }
+    if (expectations.requireOpenGraph === true) {
+        const signals = OPEN_GRAPH_REQUIRED_PROPERTIES.map((property) => firstSocialSignal(probe.signals, property));
+        if (!signals.every((signal) => signal !== undefined))
+            return undefined;
+        marks.push(...signals.map((signal) => signal.atMs));
+    }
+    if (expectations.requireTwitterCard === true) {
+        const signals = TWITTER_CARD_REQUIRED_FIELDS.map((field) => effectiveTwitterCardSignal(probe.signals, field));
+        if (!signals.every((signal) => signal !== undefined))
+            return undefined;
+        marks.push(...signals.map((signal) => signal.atMs));
+    }
     return marks.length === 0 ? undefined : Math.max(...marks);
 }
 function checkRequiredSignals(findings, target, probe) {
@@ -283,7 +410,7 @@ function checkRequiredSignals(findings, target, probe) {
         });
     }
 }
-function checkHeadRequirements(findings, targetUrl, probe) {
+function checkHeadRequirements(findings, target, probe) {
     if (!probe.agent.requiresHeadMetadata) {
         return;
     }
@@ -301,10 +428,15 @@ function checkHeadRequirements(findings, targetUrl, probe) {
     if (effectiveRobotsSignals(probe).some((signal) => signal.location === "body")) {
         bodyFields.add("robots");
     }
+    for (const property of auditedSocialProperties(target, probe)) {
+        if (socialSignals(probe.signals, property).some((signal) => signal.location === "body")) {
+            bodyFields.add(property);
+        }
+    }
     if (bodyFields.size === 0) {
         return;
     }
-    addFinding(findings, targetUrl, {
+    addFinding(findings, target.url, {
         code: "head-metadata-in-body",
         severity: "error",
         message: `${probe.agent.label} requires head metadata but received ${[...bodyFields].join(", ")} in the body.`,
@@ -342,7 +474,24 @@ function checkTimings(findings, target, probe) {
 function agentValueSummary(probes, valueFor) {
     return probes.map((probe) => `${probe.agent.key}=${valueFor(probe)}`).join("; ");
 }
-function checkAgentDrift(findings, targetUrl, probes) {
+function openGraphValue(probe) {
+    return OPEN_GRAPH_PROPERTIES.map((property) => {
+        const values = [
+            ...new Set(normalizedSocialValues(property, socialSignals(probe.signals, property), probe.finalUrl)),
+        ];
+        return `${property}=${values.join(" | ") || "<missing>"}`;
+    }).join(", ");
+}
+function twitterCardValue(probe) {
+    return TWITTER_CARD_REQUIRED_FIELDS.map((field) => {
+        const signal = effectiveTwitterCardSignal(probe.signals, field);
+        const value = signal === undefined
+            ? "<missing>"
+            : normalizeSocialValue(signal.property, signal.value, probe.finalUrl);
+        return `${field}=${value || "<missing>"}`;
+    }).join(", ");
+}
+function checkAgentDrift(findings, target, probes) {
     const complete = probes.filter((probe) => probe.completion === "complete");
     if (complete.length < 2) {
         return;
@@ -365,12 +514,18 @@ function checkAgentDrift(findings, targetUrl, probes) {
             valueFor: effectiveRobotsValue,
         },
     ];
+    if (target.expectations.requireOpenGraph === true) {
+        comparisons.push({ field: "open-graph", valueFor: openGraphValue });
+    }
+    if (target.expectations.requireTwitterCard === true) {
+        comparisons.push({ field: "twitter-card", valueFor: twitterCardValue });
+    }
     for (const comparison of comparisons) {
         const values = complete.map(comparison.valueFor);
         if (new Set(values).size < 2) {
             continue;
         }
-        addFinding(findings, targetUrl, {
+        addFinding(findings, target.url, {
             code: `agent-${comparison.field}-drift`,
             severity: "warning",
             message: `Crawler profiles received different ${comparison.field.replace("-", " ")} values.`,
@@ -429,6 +584,7 @@ export function analyzeTarget(target, probes) {
         checkRepeatedMetadata(findings, target.url, probe, "description", probe.signals.descriptions);
         checkRepeatedMetadata(findings, target.url, probe, "canonical", probe.signals.canonicals);
         checkRepeatedRobots(findings, target.url, probe);
+        checkSocialMetadata(findings, target, probe);
         const invalidJsonLd = probe.signals.jsonLd.filter((signal) => signal.valid === false);
         if (probe.completion === "complete" && invalidJsonLd.length > 0) {
             addFinding(findings, target.url, {
@@ -455,10 +611,10 @@ export function analyzeTarget(target, probes) {
                 },
             });
         }
-        checkHeadRequirements(findings, target.url, probe);
+        checkHeadRequirements(findings, target, probe);
         checkTimings(findings, target, probe);
     }
-    checkAgentDrift(findings, target.url, probes);
+    checkAgentDrift(findings, target, probes);
     return findings;
 }
 export function summarizeAudit(results) {